2. RECORD OF PROCESSING ACTIVITIES

Article 3

In accordance with Article 30 of the GDPR, the company maintains a Record of Processing Activities, which is kept for all personal data records for which the company is the data controller or processor. Its purpose is to provide a complete overview of the flow of personal data.

The Record of Processing Activities contains the following information: the name of each personal data record; the name or the name and contact details of the controller and, where applicable, the joint controller, the controller’s representative, and the data protection officer; the purposes of the processing; the legal basis; a description of the categories of data subjects to whom the personal data relate, and the types of personal data; the categories of recipients to whom the personal data have been or will be disclosed, including recipients in third countries or international organizations; information on transfers of personal data to a third country or international organization, including identification of that third country or international organization; the envisaged retention periods; a general description of the technical and organizational security measures.

The Record of Processing Activities is regularly updated according to changes in the data concerning each personal data record contained in the Record. The responsible person for each personal data record has the duty to update the Record of Processing Activities with every change concerning the data of the respective personal data record. All employees who process personal data from any personal data record must be familiar with the respective record in the Record of Processing Activities, and access must be granted to supervisory authorities upon request.

Due to the absence of grounds under Articles 35 and 37 GDPR, the company does not prepare Data Protection Impact Assessments for other records. The company has appointed a Data Protection Officer, who is ______________.

4. Article

(Definitions of Individual Personal Data Records)

Personal data in the company are structured and processed electronically in the following records:

• Personnel records (kadrovska evidenca)

• Records of labor costs

• Records of working time utilization

• Records on forms of resolving collective labor disputes at the employer

• Records in the field of occupational health and safety

• Records of business partners

• Records of video surveillance data (records of entry and exit from premises)

Personal data in the ____ records are also processed in physical form in personal files.

3. PROCESSING OF PERSONAL DATA, NOTIFICATIONS AND RIGHTS OF INDIVIDUALS

Article 5
The company, potentially with the help of contractual data processors, collects and processes only those personal data for which there is a valid legal basis under GDPR or other applicable personal data protection legislation. Collection and processing can only take place for specific and lawful purposes and must not be incompatible with those purposes unless otherwise allowed by law.

If personal data are processed for a new purpose incompatible with the original, this must be verified for compatibility and documented in writing.

If no valid legal basis exists, personal data processing must stop immediately, access disabled, and the company director or direct superior informed to decide on further actions.

Accidentally collected personal data that are obviously unnecessary for the processing must be deleted without delay, irreversibly destroyed, or returned to the individual, controller, or processor who sent them.

Individuals must be informed about the collection and processing of their personal data per Articles 12, 13, and 14 of GDPR. The person responsible for notifications is ___________. ___________ must (for each personal data record) define and keep a written list of persons authorized to process or access those records (“authorized persons for data processing”). This list must be provided to the company director. Authorized persons must be familiar with ZVOP-2, GDPR, and this Policy and must sign a special data protection declaration.

Article 6
According to Article 15 GDPR, the individual has the right to obtain confirmation from the company about whether their personal data are being processed, access their data, and receive the information specified in Article 15(1) GDPR. They can request a copy of the data; the company may charge reasonable fees for additional copies after informing the individual in advance.

Individuals may withdraw their consent for data processing at any time, which does not affect the lawfulness of processing before withdrawal.

Individuals have all rights granted by GDPR and ZVOP-2 where legally applicable, including correction, deletion (right to be forgotten), restriction of processing, etc.

If data are processed for direct marketing, individuals may object at any time to such processing, including profiling related to direct marketing, and if they object, the data must no longer be processed for these purposes.

The data controller concludes that data processing does not pose a high risk to individuals’ rights and freedoms; therefore, a Data Protection Impact Assessment (DPIA) is not required.

Before any new processing, especially involving new technologies or changes to the nature, scope, circumstances, and purposes of processing or when risk changes, the data controller commits to reassessing risks and determining whether a DPIA is necessary.

4. PERSONAL DATA PROTECTION

Article 7

The protection of personal data includes all measures, both organizational and technical, aimed at preventing intentional or accidental unauthorized acquisition, access, alteration, loss, or destruction of data, information, and documents classified as personal data of natural persons.

The company ensures the protection of personal data through legal, organizational, and technical procedures and measures by:

• securing premises and equipment where personal data is collected and processed,

• securing system and application software used for processing personal data,

• ensuring the safe transmission and transfer of personal data, including via telecommunications means and networks,

• ensuring effective methods for blocking, destroying, and deleting personal data.

Every employee who processes personal data from any of the company’s individual personal data records is authorized to process personal data for that specific record and thus becomes an authorized person for personal data processing. Authorized persons must process personal data in accordance with the provisions of ZVOP-2 and GDPR. Upon termination of employment or the termination of the legal basis granting access to personal data, revocation of authorization for data processing, or any other reason for the termination of the legal relationship, the obligation to protect personal data to which the authorized person had access or which were disclosed to them during processing does not cease.

Article 8
(Electronic Messages)

1. Electronic messages containing personal data must include the following message in both Slovenian and English:

2. SAMO NASLOVNIKU! / ONLY FOR THE INTENDED RECIPIENT!

3. NOTICE: This e-mail contains information that may be confidential. It is intended solely for the recipient. If this message was sent to you due to an error in addressing or transmission, please notify the sender immediately. If you are not the intended recipient, please delete it immediately (SHIFT+DEL). You are not permitted to use, disclose, distribute, copy, or print the contents of this message.

4. DISCLAIMER: This e-mail contains proprietary information which may be legally privileged. It is for the intended recipient only. If an addressing or transmission error has misdirected this e-mail, please notify the sender by immediately replying to this mail. If you are not the intended recipient you must not use, disclose, distribute, copy, print, or rely on this e-mail. In this case, please permanently delete this e-mail from your computer (SHIFT+DEL).

5. VIDEO SURVEILLANCE

Article 9

To ensure greater security of its property and personnel, and to protect classified data and trade secrets, the company may carry out video surveillance in accordance with the provisions of ZVOP-2, which regulate the conditions for conducting video surveillance.

The director of the company adopts a decision on the introduction of video surveillance, which must explain the reasons for its implementation.

The company publishes a notice about the implementation of video surveillance. The notice must be displayed clearly and visibly in a manner that allows individuals to be informed about the surveillance and to choose not to enter the monitored area.

The notice/sticker must include the following information:

• Information from the first paragraph of Article 13 of the GDPR;

• A written or unambiguous graphic depiction that video surveillance is being conducted;

• The purposes of processing, identification of the controller of the video surveillance system, telephone number or email address or website for exercising data subject rights;

• Information about specific processing impacts, particularly further processing;

• Contact details of the Data Protection Officer (telephone number or email address);

• Unusual further processing such as transfers to third countries, live monitoring, or sound intervention in the case of live monitoring.

The notice must be posted permanently while surveillance is in place. Information required under the first paragraph of Article 13 of the GDPR and points 4 to 6 above may also be published on the company’s website. In that case, the physical notice must include the website link where the information can be accessed.

The video surveillance system data set may include:

• A recording of the individual (image),

• Location data,

• Date and time of the recording,

• Exceptionally, if strictly necessary, also sound.

The video surveillance system must be secured as per Articles 24 and 32 of the GDPR.

Video recordings are automatically deleted on a rolling basis, no later than every 30 days, unless an incident has occurred, in which case they are retained until the conclusion of the related proceedings.

Video surveillance is not permitted in elevators, restrooms, changing rooms, hotel rooms, or other similar areas where a person can reasonably expect a higher level of privacy.

The video surveillance controller must ensure a traceable log for each viewing or use of the footage, showing which footage was processed, when and how it was used or to whom it was disclosed, who performed the processing, when, for what purpose, and based on what legal grounds. This log must be maintained for two years after the end of the year in which the data was created, in accordance with Article 22 of ZVOP-2.

Article 10
(Video surveillance of access to official business premises)

The company may conduct video surveillance of access to official business premises if necessary for the safety of people or property, for controlling entry and exit, or if the nature of the work presents a risk to employees.

Video surveillance must not record residential building areas that are not business premises, nor entrances to residential units.

All employees working in the monitored area must be informed in writing about the implementation of video surveillance and the content of the notice referred to in the previous article.

The personal data set under this article may, in addition to the data listed in the sixth paragraph of the previous article, include the date and time of entry and exit from the business premises, the recorded individual’s name, permanent or temporary residence, employment, personal ID number and type, and reason for entry, if such personal data is collected together with the video surveillance footage.

Article 11
(Video surveillance within the workplace)

Video surveillance within the workplace may only be conducted if strictly necessary for the safety of people or property or for the protection of classified data or trade secrets, and such purposes cannot be achieved by less intrusive means.

Surveillance may be conducted only in those parts and to the extent necessary to protect the interests mentioned above.

Recording of regular workstations is prohibited unless it is strictly necessary according to the first paragraph of this article.

Live monitoring may only be carried out by explicitly authorized personnel of the controller and under the conditions set out in paragraphs one and two of this article.

Employees must be notified in writing in advance of the start of surveillance under this article.

6. PROTECTION OF PREMISES AND COMPUTER EQUIPMENT

Article 12

Access to protected premises is allowed only during regular working hours; outside working hours, only with permission from the organizational unit manager or the director. Persons not employed in protected areas may enter only in the presence of an employee working there or in emergencies (e.g., fire, water leakage, urgent maintenance) in the presence of a security guard.

Employees in protected areas must diligently monitor the premises and lock them during any absence. Personal data carriers must not be exposed to the risk of unauthorized access or removal. Personal data stored outside protected areas must be kept in a locked fireproof cabinet. Computers containing personal data must be physically or digitally locked whenever the responsible employee is absent.

Computer equipment protection is further governed by the Information Security Policy.

7. STORAGE AND RETENTION PERIOD OF PERSONAL DATA

Article 13

Personal data may only be kept in data records as long as necessary to achieve the purpose for which they were collected.

Once the need for data retention ends, the data must be deleted, destroyed, anonymized, or otherwise processed to prevent the identification of the individual (e.g., by restricting access, blocking, or archiving).

The Record of Processing Activities defines the retention periods for each personal data record.

Article 14

Company employees must not take personal data carriers out of the company.

Only the director may exceptionally permit the removal of data carriers. In such cases, the purpose and reason must be recorded in the logbook of personal data carrier removals, including the date and signature upon return.

8. RECEIPT AND TRANSMISSION OF PERSONAL DATA

Article 15

The employee responsible for receiving and recording mail opens and inspects all incoming mail and packages unless otherwise specified in paragraph two of this article.

They must not open:

• Shipments addressed to another authority or organization and delivered by mistake;

• Shipments marked as personal data or labeled “do not open,” or those related to competitions or tenders;

• Shipments addressed to an employee with instructions to be delivered personally;

• Shipments where the employee’s name is listed before the company’s name.

Article 16

Personal data may only be transmitted via information, telecommunications, or other means if measures are in place to prevent unauthorized access, destruction, or disclosure.

When transmitted electronically or via telecom channels, personal data must be specially secured using cryptographic methods or electronic signatures to ensure they are unreadable during transmission.

Article 17

When transmitting personal data by post, the envelope must prevent visibility of contents under normal light or illumination. It must also prevent opening and reading without visible tampering.

Data may only be shared with users listed in the Record of Processing Activities. If shared with a recipient not under contract, a complete and legitimate request must be submitted, and the data transmission must be logged in the Record of Extraordinary Data Transfers.

Article 18

Personal data may be disclosed only to individuals who submit a written request citing the legal provision authorizing the access or accompanied by a data subject’s written consent.

Each transfer must be recorded in the personal data processing log, showing:

• Which personal data was transferred;

• The full name/company name and address of the recipient;

• The date of transfer;

• The legal basis for the transfer.

The original document must be retained, and only copies may be shared.

Article 19
(Contractual data processing)

For each external legal or natural person performing tasks related to personal data (data processor), a written agreement must be concluded in line with Article 28 of the GDPR. This contract must include conditions and measures to ensure data protection and security.

Before signing, the company’s legal representative must verify that the processor complies with data protection laws, including disclosure of all subprocessors with their names and locations.

Contractual Processors

Contractual processors may process personal data only within the scope of the authorizations they receive, and they may not process or otherwise use the data for any other purpose, to which they are contractually bound. The contractual processor must implement at least the same level of personal data protection as prescribed by this Policy.

In addition to other requirements, the company must ensure, through contracts concluded with contractual processors, the right to carry out an inspection or audit regarding personal data protection at least once per year. An inspection or audit must also be conducted in case of any suspicion or indication that the contractual processor is breaching the contract or failing to provide an adequate level of personal data protection.

9. HANDLING OF PERSONAL DATA RECORDS

Article 20

Employees or persons whose personal data is recorded in the company’s personal data records, as well as their legal representatives or proxies, have the right to access the personal data kept about them or their representatives, and to transcribe or copy such data.

Access and transcription of personal data from the records must be granted within 15 days from the date the company receives a written request.

Costs related to the request and access as referred to in this article are covered in accordance with Article 6 of this Policy.

Article 21

Records of employees’ personal data (e.g., employee records) are stored in locked and fireproof cabinets in the director’s office. Payroll data for the current period is stored in locked and fireproof cabinets in the accounting office, and for other periods in separate fireproof cabinets in the archive. Other personal data records maintained by the company are stored for the current period in locked cabinets in the director’s office, and for other periods in the archive.

Access to archived data is limited to the responsible person for each personal data record. Other employees may access the data only with prior approval from the responsible person, and only if needed for the performance of their duties.

Personal data in electronic form is stored on a server within the computer system. Access to the system is only possible via individual computer units and with the user’s personal password.

Article 22

Employee personal data records are established upon the conclusion of the employment relationship or updated with each change reported by the employee. The personal data in employee records is created or updated by the director.

Records of personal data for volunteers, trainees, and contractual partners are created upon the conclusion of a contract.

11. DELETION OR DESTRUCTION OF DATA CARRIERS, BLOCKING OR ANONYMIZATION OF PERSONAL DATA

Article 23

Personal data may only be kept in a record for as long as necessary to achieve the purpose for which it was collected and maintained. After the retention period expires or the purpose is fulfilled, the personal data must be deleted, destroyed, blocked, anonymized, or pseudonymized—unless otherwise stipulated by law for certain categories of personal data. The retention period for personal data is defined for each record in the Record of Processing Activities.

After the need or retention period for keeping personal data has ended, the data or its carriers must be deleted or destroyed.

Article 24

Deletion of personal data on computer media must be carried out in a manner, following a procedure and using a method that prevents restoration of the deleted data.

Personal data stored on traditional media (documents, files, registers, lists) is deleted by destroying the media. The media is physically destroyed (burned, shredded) on the company’s premises or under the supervision of an authorized person responsible for the destruction of confidential documentation.

Article 25

With the diligence and care specified by this Policy for the destruction of personal data maintained in records or on individual data carriers, any auxiliary documentation or computer outputs/templates containing personal data must also be deleted or destroyed accordingly.

12. ACTION IN CASE OF SUSPECTED UNAUTHORIZED ACCESS OR PERSONAL DATA MISUSE

Article 26

Employees must report any detected breach of personal data protection to the appropriate person responsible for the personal data record. If the breach is likely to pose a risk to the rights and freedoms of individuals, the responsible person must notify the Information Commissioner without undue delay, within 72 hours of discovering the breach, as well as the affected individuals.

The controller must record every personal data breach in the security incidents register, including the facts related to the breach, its effects, and the corrective measures taken.

All security incidents must be recorded chronologically in the register, regardless of the level and type of risk to the rights and freedoms of individuals. The controller especially records breaches of confidentiality (e.g., unauthorized disclosure of data), breaches concerning access to data, and breaches of data integrity (e.g., unauthorized alteration of data).

13. RESPONSIBILITY FOR IMPLEMENTATION OF SECURITY MEASURES AND PROCEDURES

Article 27

The persons authorized to implement procedures and measures for personal data protection are appointed by the director.

Article 28

Before starting work in a position where personal data or data carriers are collected, processed, modified, stored, transmitted, or used, the employee must sign a declaration obliging them to protect personal data as a professional secret and informing them of the consequences of a breach. The signed declaration must show that the signer has been informed about the provisions of the ZVOP-2, GDPR, and the contents of this Policy. The obligation to protect personal data does not cease with the termination of employment or cooperation with the company (students, contractors, etc.).

Article 29

All employees are required to comply with the provisions set out in this Policy and to implement the security measures and procedures described herein.

14. VIOLATIONS, MISUSE, AND ACTIONS

Article 30

All employees must implement measures to prevent misuse of personal data and must handle any personal data they encounter during their work with due care and responsibility, in accordance with the procedures established in this Policy.

Article 31

Employees are subject to disciplinary liability for violations of this Policy, while other persons are liable for damages based on their contractual obligations.

In case of misuse or suspicion of misuse of personal data contained in the company’s records by persons who are not company employees, the competent authorities for prosecution must be informed.

15. FINAL PROVISIONS

Article 32

Employees working in positions involving the collection, processing, modification, storage, transmission, or use of personal data or data carriers must sign the declaration from Annex 1 of this Policy within 60 days of its adoption. Signatories of the declaration are also bound by all future amendments to this Policy without needing to sign a new declaration upon each amendment.

Article 33

In the event of a conflict between any provision of this Policy and current or future laws, collective agreements binding on the company, or other regulations, the validity of this Policy as a whole remains unaffected. The relevant provisions of the applicable law, collective agreement, or regulations shall apply directly in place of the conflicting provision.