Respect for the privacy of individuals, including the protection of personal data of individuals, is of paramount importance to SŽ – Potniški promet, d. o. o. (hereinafter referred to as SŽ-PP). We fully respect our commitment to lawful, fair and transparent processing of personal data and take appropriate security measures to ensure that personal data are not accessed by unauthorised persons, to maintain their confidentiality and integrity and to prevent their loss or accidental destruction throughout the processing. Please find below detailed information on the processing of your personal data.
1. INFORMATION ABOUT THE DATA CONTROLLER
| Company name: | SŽ – Potniški promet, d. o. o. |
| Head office: | Kolodvorska 11, Ljubljana |
| Tax ID number: | SI89393686 |
| Registration number: | 6017274000 |
| Telephone number: | + 386 1 29 12 402 |
| Website: | www.slo-zeleznice.si |
| E-mail: | [email protected] |
| Data Protection Officer’s e-mail: | [email protected] |
2. COLLECTION AND USE OF PERSONAL DATA
We collect and process your data in accordance with the regulations governing the protection of personal data or the processing of individual personal data.
SŽ-PP collects personal data it obtains from you when you:
- Purchase a personal ticket of Slovenian Railways (hereinafter referred to as SŽ), or obtain a SŽ benefits card;
- Visit the SŽ website;
- Use our online shop or the SŽ mobile app;
- Ask us for information;
- Give a compliment or make a complaint;
- Make a request for a ticket refund, reimbursement or compensation in case of daily train delays;
- Participate in prize draws (co-)organised by SŽ-PP;
- Enter a SŽ station area or station building; or
- When other cases set out in this Policy arise.
2.1 Purchasing a SŽ personal ticket or a SŽ benefits card
What we collect: We collect personal data from you when you decide to purchase a SŽ personal ticket or a SŽ benefits card. You submit your personal data at the ticket office via the form for obtaining a SŽ personal ticket and/or an SŽ benefits card on a chip card (K-50 form), which is available on the SŽ website: www.slo-zeleznice.si.
You can also purchase a personal ticket at a SŽ self-service point of sale (hereafter: ticket machine), where the purchase is made on the basis of your chip card.
When purchasing SŽ personal tickets and SŽ benefits cards, the following data are collected:
- Name and surname;
- Personal identification number;
- CUID number of the chip card;
- Information on permanent residence;
- Signature;
- The name and surname of the legal representative if the holder of the personal ticket or benefits card is a minor.
Why we collect the data: SŽ-PP processes the data obtained from the purchase of SŽ personal tickets/SŽ benefits cards in order to perform a transport contract.
How long we keep the data: Your personal data are kept for 3 years from the last use of the chip card.
Categories of personal data users[1]: External contractors of the ticketing system, payment service providers, IT service providers – SŽ, d. o. o.
Legal basis: The legal basis for the processing of personal data relating to SŽ personal tickets and SŽ benefits cards is a contract (Article 6/1(b) of the GDPR[2]).
Rights of the data subject[3]: Right to information, right to rectification, right to erasure, right to restriction, right to portability.
2.2 Visiting the SŽ website or using the Grem z vlakom mobile app
The SŽ website www.slo-zeleznice.si is publicly accessible and is intended for the use and information of the general public and for the purchase of tickets in the online shop (https://eshop.sz.si/), but it also allows the use of other functionalities.
The Grem z vlakom mobile app, which can be downloaded free of charge on smartphones, allows you to: view timetable and fare information on the selected route, information on delays and service disruptions (maintenance works, rail replacement services etc.), set your favourite travel routes, purchase tickets and other services in accordance with the terms and conditions of use of each service.
What we collect: When you visit the SŽ website or the SŽ-PP mobile app, the server automatically retrieves the following device data and other log data:
- IP address;
- The URL of the website from which you accessed our website;
- Browser settings and information about the operating system of your computer or mobile device;
- The content you access on the SŽ-PP website or app;
- The date of access and the duration of the visit to the SŽ-PP website or app.
When purchasing personal tickets via the online shop on the SŽ website or the SŽ mobile app, the following personal data are processed:
- Name and surname;
- Personal identification number;
- Information on permanent residence.
When visiting the SŽ website and the SŽ mobile app, we also store cookies, which most websites temporarily store on the users’ devices used to access the Internet in order to identify the individual devices used by the users when accessing the Internet. You can find out more about the types of cookies we store in the Cookie Notice on the SŽ website.
Why we collect the data: When you purchase a personal ticket via the online shop or the SŽ-PP mobile app, your personal data are processed by SŽ-PP for the performance of the transport contract.
How long we keep the data: The retention period of personal data for the purchase of SŽ personal tickets or SŽ benefits cards is 3 years from the last use of the chip card or from the expiry of its validity.
Categories of personal data users: Maintainers and developers of the SŽ website, external contractors of the ticketing system (for the mobile application), IT service providers – SŽ, d. o. o.
Legal basis: The legal basis for the processing of personal data when purchasing SŽ personal tickets or SŽ benefits cards is the contract (Article 6(1)b GDPR). The General Terms and Conditions for the use of SŽ online shop and mobile app are available on the SŽ website.
Rights of the data subject: Right to information, right to rectification, right to erasure, right to restriction, right to portability.
2.3 Request for information
You can ask for information:
- By calling our toll-free number 080 81 11;
- By sending an e-mail to [email protected];
- By writing a message on the Grem z vlakom Facebook page.
What we collect: We record your phone number or e-mail address and the reason for the call, while phone conversations are not recorded.
Why we collect the data: When we process your personal data, you voluntarily decide which personal data you want to entrust to us. However, we may also use your telephone number for call-back purposes for further information.
How long we keep the data: We keep your e-mails for 1 year, while phone numbers and Facebook messages are deleted after one month.
Categories of personal data users: External call centre contractors, IT service providers – SŽ, d. o. o., provider of the Facebook page.
Legal basis: Personal data are processed for the purpose of information prior to the conclusion of a transport contract (Article 6(1)b GDPR).
Rights of the data subject: Right to information, right to rectification, right to erasure, right to restriction, right to portability.
2.4 Compliments, complaints, comments and suggestions
You can submit a compliment, complaint, comment or suggestion:
- By calling our toll-free number 080 19 10 (call or answering machine recording);
- By sending an e-mail to: [email protected];
- By using the online form on the SŽ website;
- By postal mail;
- In the Guest Book available at station ticket offices.
What we collect: When you submit a compliment, complaint, comment or suggestion, we collect your message and the contact details you provide with your message. Telephone conversations are not recorded.
Why we collect the data: We collect your complaints, compliments, comments and suggestions in order to monitor customer satisfaction with the transport service. You decide voluntarily which personal data you want to share with us. However, we may also use your telephone number for call-back purposes for further information.
The caller can voluntarily leave a message (which is recorded) on the 080 1910 answerphone. The caller’s phone number is also stored and used for the call-back. The answering machine recordings shall be stored and processed for the purpose of providing evidence of business communication in the case of complaints, compliments and comments, and more specifically for the purpose of establishing the facts and circumstances of the cases dealt with and the information provided by customers, in accordance with the provisions of the law governing electronic communications.
How long we keep the data: We keep compliments, complaints, comments and suggestions in electronic and written form for 5 years, while telephone numbers and a recording of the caller’s message on the 080 19 10 answering machine are deleted after one month.
Categories of personal data users: External call centre contractors, IT service providers – SŽ, d. o. o.
Legal basis: Personal data are processed on the basis of consent. Answering machine recordings are processed in accordance with the provisions of the Electronic Communications Act (Article 214/7, ZEKom-2).
Rights of the data subject: Right to information, right to rectification, right to restriction, right to portability.
2.5 Claims for reimbursement, refund, damages or compensation in the event of daily train delays
Claims for reimbursement are requests from users for reimbursement of overcharged fares and supplements, and for reimbursement of fares paid for unused or partially used tickets, made in the prescribed manner.
Claims for refund are requests made by users in the prescribed manner for reimbursement of fares paid for unused or partially used tickets because a passenger has cancelled a journey for personal reasons.
Claims for damages are claims made by users in the prescribed manner for compensation for loss, damage or delay in the delivery of luggage and accompanied cars and for compensation for damage caused by delay or cancellation of a train or loss of connection.
Claims for compensation in the event of daily train delays are requests by users for reimbursement of the fare or part of the fare and for compensation for damage caused by delay or cancellation of the train or loss of service, made in the prescribed manner and subject to certain conditions.
You can submit a claim for reimbursement, refund or damages, or a claim for compensation in the event of daily train delays by sending an e-mail to [email protected], by sending it by postal mail or by submitting the form at one of our sales outlets. Forms and procedures for submitting forms are available on the SŽ website.
What we collect: When you submit a claim for reimbursement, refund, damages or compensation in the event of daily train delays, we collect:
| Type of claim: | Types of personal data: |
| Reimbursement | Name and surname, address, e-mail address, telephone, bank account number |
| Refund | Name and surname, address, e-mail address, telephone, bank account number |
| Damages | Name and surname, address, e-mail address, telephone, bank account number |
| Compensation in the event of daily train delays | Name and surname, address, date of birth, e-mail address, telephone, bank account number |
Why we collect the data: Providing the above personal data is a contractual obligation in case you wish to claim a refund of the fare, reimbursement, damages, or compensation in the event of daily delays under the transport contract.
How long we keep the data: We keep claims for reimbursement, refund, damages, and compensation in the event of daily train delays for 5 years.
Categories of personal data users: Other carriers or other railway administrations, if the claim is for an international ticket or a ticket involving another carrier.
Legal basis: Personal data are processed in accordance with the concluded transport contract (Article 6/1(b) of the GDPR).
Rights of the data subject: Right to information, right to rectification, right to erasure, right to restriction, right to portability.
2.6 Participation in prize draws
What we collect: When you participate in a prize draw organised or participated in by SŽ-PP and you have provided your personal data as part of your registration to participate in the prize draw or event, SŽ-PP may process your data as an independent controller of personal data collections or as a joint controller of a personal data collection with the organiser or other persons with whom it cooperates in the implementation of the prize draw or event.
The personal data we collect in the context of prize draws are: name and surname, address, e-mail address and, in the case of prize winners, their tax ID number. In the case of a minor, the name and surname of the legal representative are also needed.
The prize draws are usually held on Facebook and Instagram or published on the SŽ website. The general terms and conditions of participation in prize draws are published on www.slo-zeleznice.si.
When participating in prize draws on Facebook and Instagram, participants’ personal data may be transferred to third countries, subject to the general terms and conditions of use of those social networks.
Why we collect the data: We process your personal data for the purpose of conducting the prize draw or event and for the awarding of prizes.
How long we keep the data: We keep the personal data of the participants in the prize draw until the end of the prize draw or for 10 years in the case of a prize.
Categories of personal data users: Maintainers and developers of the SŽ website, co-organisers of prize draws, FURS[4].
Legal basis: SŽ-PP processes your data on the basis of your consent and the Personal Income Tax Act (tax ID number).
Rights of the data subject: Right to information, right to rectification, right to erasure, right to restriction.
2.7. Filming at public events
What we collect: Any individual attending a major or public event (as a performer or spectator) should be aware that there is a higher likelihood of being filmed at such an event. At such events, we may therefore record and publish footage of the event itself, or reportage that includes images of the individual, taking care to ensure that the individual is not the central motif of the footage. Before we hold an event of this kind, we always announce that it will be filmed.
Why we collect the data: The photos or videos are processed by SŽ-PP for the purpose of publishing a photo gallery of the event or video contribution and for subsequent promotion.
How long we keep the data: The SŽ-PP keeps the personal data created when events are filmed for 5 years from the date of creation. If you wish to have a published photograph of you as the subject of the video removed, or if you do not wish to appear in the frame, or if you do not wish to be featured in the video, please let us know in advance or as soon as possible by sending an e-mail to [email protected].
Legal basis: The data are processed on the basis of legitimate interest (Article 6/1(f) of the GDPR).
Categories of personal data users: Event organisers.
Rights of the data subject: Right to information, right to erasure, right to restriction, right to object.
2.8. Video surveillance on premises, the immediate surroundings and on trains
What we collect: We collect the recordings made through video surveillance systems:
- When entering and leaving SŽ-PP business premises (Article 77 ZVOP-2[5]);
- On the work premises of SŽ-PP, where this is necessary for the protection of trade secrets or classified information, people and property, and this purpose cannot be fulfilled by other means which are less intrusive (Article 78 ZVOP-2);
- On-board public transport vehicles to ensure the safety of people and property (Article 79 ZVOP-2).
Why we collect the data: The purpose of the recording is to protect and safeguard property and people, including employees, against threats and violence and in similar cases where, without processing the personal data of individuals, we would not be able to protect and enforce our own legitimate interests and the rights we enjoy under the law, which includes carrying out video surveillance to clarify the circumstances of criminal offences against the company’s employees and property on trains, station facilities and infrastructure, and monitoring access to the company’s business premises to prevent unauthorised persons from entering the business premises and to ensure the maintenance of order on the business premises.
How long we keep the data: Recordings of entries and exits to and from business premises and recordings of work areas are stored for up to 90 days, after which they are automatically deleted. Video surveillance recordings in public passenger transport vehicles shall be kept for up to 7 days, after which they shall be deleted or destroyed.
Categories of personal data users: Contract processor SŽ-ŽIP, d. o. o., competent state authorities (e.g. police, court), other users who have a basis for obtaining personal data by law, personal consent of the individual or contractual relationship.
Legal basis: The data are processed on the basis of legitimate interest (Article 6/1(f) of the GDPR).
Rights of the data subject: Right to information, right to erasure, right to restriction, right to object, taking into account their nature.
You can find out more about the processing of personal data in video surveillance in the Video Surveillance Notice.
2.9. Analysis of personal data of legitimate interest for the purpose of business decision-making
Why we collect the data: We analyse personal data in pseudonymised form for the purpose of reporting and business decision-making[6].
What we collect: For these purposes, we process the following data of legitimate interest:
- Data on purchases and use of personal tickets: CUID number, ticket type, route of travel, train type, ticket price, date of purchase, method of payment, station of purchase, method of purchase (sales channel), date of travel.
- Data on calls and e-mails: number of calls received, answered, unanswered, time and date of the call, duration of the call, time of the call and code of the agent who answered the call, content of the call, number of e-mails received, when the e-mail was received and answered, content of the e-mail.
- Data on complaints, compliments, suggestions and comments, and claims for reimbursement, refund, damages, and compensation in the event of daily train delays: the number of complaints, compliments, suggestions and comments, and claims for reimbursement, refund, damages, and compensation, the content of each claim, when the claim was received.
How long we keep the data: We keep the data in pseudonymised form for 5 years.
Legal basis: The data are processed on the basis of legitimate interest (Article 6/1(f) of the GDPR).
3. CATEGORIES OF PERSONAL DATA USERS
We do not pass on your personal data to third parties. However, from time to time, we may need to share your personal data with certain external parties if they demonstrate an appropriate legal basis for obtaining your data. Such users are usually various government authorities who need your personal data in the context of official procedures they are conducting, and other users who have a basis for obtaining your personal data in law or in the individual’s personal consent or contractual relationship.
We always check any request to obtain your personal data from third parties to determine whether it is from a legitimate requester and whether the requester has an adequate legal basis for obtaining it. In the event that a request for data is incomplete, we will refuse to provide any of your data.
Like most companies, SŽ-PP engages various contract processors to perform parts of the processing of personal data on its behalf, and we enter into appropriate statutory personal data processing contracts with such contract processors, committing them to the same standard of personal data protection as if we had performed the excluded parts of the processing of personal data ourselves. Contract processors shall process the data only for the purpose of providing the contractually defined services to SŽ-PP and for no other purpose, nor shall they use the data for their own purposes or for the purposes of third parties.
A list of the categories of processors of your personal data is set out below:
| Personal data processor category | Subject of contractual processing |
| External contractors of the ticketing system | Setting up, maintaining, upgrading and supporting the ticketing system |
| Payment service providers | Payment implementation |
| External call centre contractors | Setting up, maintaining, upgrading and supporting a call centre |
| IT service providers – Slovenske železnice, d.o.o. | Providing system maintenance, administration and development services for systems and applications |
| Contractual partner for an event | Carrying out activities related to the event |
| Printing works | Providing document printing services |
| Event organisers | Organization of events |
| External video surveillance providers | Protecting and securing property and employees against threats and violence |
4. PRIVACY PROTECTION
SŽ-PP takes physical, organisational and technical measures to protect data against loss, theft, inaccessibility and unauthorised use. We protect your data in accordance with the legislation in force and with the internal acts governing the protection and safeguarding of personal data at SŽ-PP and the field of information security.
5. EXERCISING YOUR RIGHTS IN RELATION TO PERSONAL DATA
In accordance with the provisions of the General Data Protection Regulation (EU Regulation 2016/679), the Company shall ensure that the data subject exercises the rights set out in the provisions of Articles 12 to 23, as well as the other rights guaranteed by the General Data Protection Regulation (EU Regulation 2016/679) and the applicable data protection law.
Right to information: You have the right at all times to be informed whether personal data relating to you is being processed and, if so, to have access to the personal data and to be provided with the following information: (a) the purposes of the processing; (b) the types of personal data concerned; (c) the users or categories of user to whom the personal data have been or will be disclosed; (d) the envisaged period of retention of the personal data or, failing that, the criteria used to determine that period; (e) where the personal data are not collected from you, any available information regarding their source.
Right to rectification: You have the right to have inaccurate personal data relating to you rectified and, taking into account the purposes of the processing, the right to have incomplete personal data completed.
Right to erasure: You have the right to have your personal data erased where one of the following grounds applies: (a) the personal data are no longer necessary for the purposes for which they were collected or otherwise processed; (b) where you withdraw the consent on which the processing is based and where there is no other legal basis for the processing; (c) where you object to the processing and there are no overriding legitimate grounds for the processing; (d) the personal data have been unlawfully processed.
Right to restriction of processing: You have the right to have us restrict the processing of your personal data where one of the following applies: (a) where you contest the accuracy of the data, for a period of time that allows us to verify the accuracy of the personal data; (b) the processing is unlawful and you object to the erasure of the personal data and instead request the restriction of their use; (c) we no longer need your personal data for the purposes of the processing, but you need them to assert, exercise or defend legal claims; (d) where you have raised an objection to the processing based on legitimate interests, pending verification that our legitimate grounds outweigh yours.
Right to data portability: You have the right to receive your personal data that you have provided to us in a structured, commonly used and machine-readable format, and the right to transfer that data to another controller where the processing is based on your consent or the processing is carried out by automated means. At your request, where technically feasible, personal data may be directly transferred to another controller.
Right to object: Where we process your data on the basis of legitimate interest, you have the right to object to such processing of your personal data. We will stop processing your personal data unless we can demonstrate compelling reasons for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.
Right of revocation: If you, as an individual, have consented to the processing of personal data for one or more of the purposes for which we process your personal data, you have the right to withdraw your consent at any time. Upon receipt of your withdrawal of consent for one or more of the processing purposes, the controller will immediately stop processing your personal data for that purpose. Withdrawal of consent to the processing of personal data shall not affect the lawfulness of the processing of personal data relating to you until your withdrawal.
An individual who has provided personal data at the time of ordering a personal ticket or a benefits card may exercise his/her rights to rectification and erasure or to restriction of the processing and portability of personal data by filling in the forms published on the SŽ website or obtained by the cardholder at all SŽ-PP sales outlets. The completed and signed form is to be handed in at the SŽ-PP ticket office equipped with a stationary terminal. The individual may exercise his/her rights to rectification and erasure or restriction of processing, objection, revocation and portability with regard to other personal data by submitting a written request at the SŽ-PP ticket office equipped with a stationary terminal. The company shall decide on your request within one month of receipt of a complete request, which may be extended by up to two additional months if necessary.
If the Company does not decide on the data subject’s request or if you consider that your personal data are being stored or otherwise processed in breach of the applicable regulations, you have the right to lodge a complaint with the Information Commissioner of the Republic of Slovenia.
6. OTHER INFORMATION
Any questions regarding this Policy, comments, remarks and requests for assistance in exercising your rights related to the processing of your personal data may be addressed to the Data Protection Officer of the Slovenian Railways Group, who can be contacted by sending an e-mail to [email protected] or by postal mail under the address: Slovenske železnice d. o. o., Kolodvorska 11, 1506 Ljubljana, att. “Data Protection Officer”.
We will do our best to reply to you as soon as possible.
7. UPDATING OUR PRIVACY POLICY
SŽ-PP reserves the right to update this Privacy Policy. Any changes to this Privacy Policy will take effect the day after it is published on www.slo-zeleznice.si.
Your continued use of the SŽ-PP websites, mobile applications or services after the changes to the Privacy Policy have been published means that you are aware of the changes.
Ljubljana, 26 July 2023
[1] The processing carried out by each category of personal data users is listed in section 3.
[2] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)
[3] The content of the rights and how to exercise them are described in section 5.
[4] FURS: Financial Administration of the Republic of Slovenia
[5] Personal Data Protection Act (Official Gazette of the Republic of Slovenia, No 163/22)
[6] Pseudonymisation means the processing of personal data in such a way that the personal data can no longer be attributed to a specific individual without further information, provided that such further information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to a specific or identifiable individual.
