Respect for the privacy of individuals, including the protection of personal data of individuals, is of paramount importance to SŽ-Potniški promet, d. o. o. (hereinafter referred to as SŽ-PP). We fully respect our commitment to lawful, fair and transparent processing of personal data and take appropriate security measures to ensure that personal data are not accessed by unauthorised persons, to maintain their confidentiality and integrity and to prevent their loss or accidental destruction throughout the processing. Please find below detailed information on the processing of your personal data.

1  INFORMATION ABOUT THE DATA CONTROLLER

Company name:SŽ-Potniški promet, d. o. o.
Head office:Kolodvorska 11, Ljubljana
Tax ID number:SI89393686
Registration number:6017274000
Telephone number:+ 386 1 29 12 402
Website:www.slo-zeleznice.si
E-mail:[email protected]
Data Protection Officer’s e-mail:[email protected]

2  COLLECTION AND USE OF PERSONAL DATA

We collect and process your data in accordance with the regulations governing the protection of personal data or the processing of individual personal data.

SŽ-PP collects personal data it obtains from you when you:

  • Purchase a personal ticket of Slovenian Railways (hereinafter referred to as SŽ), or obtain a SŽ benefit;
  • Visit the SŽ-PP website;
  • Use our online shop or the SŽ-PP mobile app;
  • Ask us for information;
  • Need travel assistance for disabled persons and other persons with reduced mobility;
  • Give a compliment or make a complaint;
  • Break the rules on internal arrangements of the railway undertaking;
  • Get injured on a train;
  • Make a request for a ticket refund, reimbursement or compensation in case of daily or repeated train delays;
  • Participate in prize draws (co-)organised by SŽ-PP;
  • Register for an event organised by SŽ-PP;
  • Get on board and travel by train;
  • Enter a SŽ station area or station building;
  • Are in the vicinity of a SŽ self-service point of sale (hereafter: ticket machine) when the ticket machine door is open;
  • When other cases set out in this Privacy Policy arise.

 

2.1  Purchasing a SŽ personal ticket or obtaining a SŽ benefit

What we collect: We collect personal data from you when you decide to purchase a SŽ personal ticket or obtain a SŽ benefit. You submit your personal data at the ticket office via the form for obtaining a SŽ personal ticket and/or a SŽ benefit on a chip card (K-50 form), which is available on the SŽ-PP website: www.slo-zeleznice.si. 

You can also purchase a personal ticket at a ticket machine, where the purchase is made on the basis of your chip card.

When purchasing SŽ personal tickets and SŽ benefits, the following data are collected:

  • Name and surname;
  • Personal identification number;
  • CUID number of the chip card;
  • Information on permanent residence;
  • Signature;
  • The name and surname of the legal representative if the holder of the personal ticket/benefits card is a minor.

Why we collect the data: SŽ-PP processes the data obtained from the purchase of SŽ personal tickets/SŽ benefits in order to perform a transport contract.

How long we keep the data: Your personal data are kept for 3 years from the last use of the chip card.

Categories of personal data users[1]: External contractors of the ticketing system, payment service providers, IT service providers – SŽ, d. o. o.

Legal basis: The legal basis for the processing of personal data relating to SŽ personal tickets and SŽ benefits is a contract (Article 6/1(b) of the GDPR[2]).

Rights of the data subject[3]: Right to information, right to rectification, right to erasure, right to restriction, right to portability.

2.2  Visiting the SŽ-PP website or using the Grem z vlakom mobile app

The SŽ-PP website www.slo-zeleznice.si is publicly accessible and is intended for the use and information of the general public and for the purchase of tickets in the online shop (https://eshop.sz.si/), but it also allows the use of other functionalities.

The Grem z vlakom mobile app, which can be downloaded free of charge on smartphones, allows you to: view timetable and fare information on the selected route, information on delays and service disruptions (maintenance works, rail replacement services etc.), set your favourite travel routes, purchase tickets and other services in accordance with the terms and conditions of use of each service.

What we collect: When you visit the SŽ-PP website or mobile app, the server automatically retrieves the following device data and other log data:

  • IP address;
  • The URL of the website from which you accessed our website;
  • Browser settings and information about the operating system of your computer or mobile device;
  • The content you access on the SŽ-PP website or app;
  • The date of access and the duration of the visit to the SŽ-PP website or app.

When purchasing personal tickets via the online shop on the SŽ-PP website or mobile app, the following personal data are processed:

  • Name and surname;
  • Personal identification number;
  • Information on permanent residence.

When visiting the SŽ-PP website and mobile app, we also store cookies, which most websites temporarily store on the users’ devices used to access the Internet in order to identify the individual devices used by the users when accessing the Internet. You can find out more about the types of cookies we store, about the purposes for which cookies are collected and the legal basis for collecting cookies in the Cookie Notice on the SŽ-PP website.

Why we collect the data: When you purchase a personal ticket via the online shop or the SŽ-PP mobile app, your personal data are processed by SŽ-PP for the performance of a transport contract.

How long we keep the data: The storage period of personal data for the purchase of SŽ personal tickets or SŽ benefits cards is 3 years from the last use of the chip card or from the expiry of its validity.

Categories of personal data users: Maintainers and developers of the SŽ-PP website, external contractors of the ticketing system (for the mobile application), IT service providers – SŽ, d. o. o.

Legal basis: The legal basis for the processing of personal data when purchasing SŽ personal tickets or SŽ benefits cards is the contract (Article 6(1)b of the GDPR). The General Terms and Conditions for the use of SŽ online shop and mobile app are available on the SŽ-PP website.

Rights of the data subject: Right to information, right to rectification, right to erasure, right to restriction, right to portability.

2.3  Request for information

You can ask for information:

  • By calling our toll-free number 080 81 11;
  • By calling 00 386 1 29 13 331 (the number can also be reached from abroad);
  • By sending an e-mail to [email protected];
  • By writing a message on the Grem z vlakom Facebook page.

What we collect:

  1. We record your phone number or e-mail address and the reason for the call, while phone conversations are not recorded.
  2. After the call/replied message, we may also ask you to provide feedback on your satisfaction with contact in the form of answers to a survey questionnaire.


Why we collect the data:

  1. When you make a request for information, you voluntarily decide which personal data you want to share with us. We need your telephone number so that we can call you for any further clarification or information. We will also call you automatically if you select the option to order a call-back in the initial answering machine.
  2. We process customer satisfaction with contact in order to improve our services and to offer you the best support in our call centre.

How long we keep the data: Your e-mails are kept for 1 year, while phone numbers and Facebook messages are deleted after one month. Customer contact satisfaction data are kept for 1 year.

Categories of personal data users: External call centre contractors, IT service providers – SŽ, d. o. o., provider of the Facebook page.

Legal basis: Personal data are processed for the purpose of information prior to the conclusion of a transport contract (Article 6(1)b of the GDPR). The processing of customer contact satisfaction data is based on the legal basis of legitimate interest (Article 6/1(f) of the GDPR).

Rights of the data subject: Right to information, right to rectification, right to erasure, right to restriction, right to portability, right to object.

2.4  Subscription to event notifications via My train (Moj vlak) portal

Users can subscribe to receive information about announced and exceptional changes in rail services on the selected route, such as rail replacement bus services, delays, closures and timetable changes. This is done by registering on the My train (Moj vlak) portal at https://potniski.sz.si/ and/or https://potnik.sz.si and accepting the General Terms and Conditions, using the contact channel of your choice, which can be:

  • E-mail;
  • SMS.

What we collect: We collect the following personal data: name and surname, e-mail address, telephone number, IP address, password in encrypted form, date of last login, date of account creation, confirmation of the General Terms and Conditions, confirmation of age over 15 and subscription to rail service change notifications, information on the routes, day of the week (all days, weekdays, weekends, any choice of day(s), notifications on the date selected) and period of the day.

Why we collect the data: We collect your data for the purpose of providing you with the notification service to which you have subscribed, in accordance with the terms and conditions you accepted when registering.

How long we keep the data: We keep your personal data for a maximum of 30 days from the date of cancellation of your registration or request to delete your profile, after which it will be irretrievably deleted.

Categories of personal data users: External contractors of the CRM system and the subscription portal, IT service providers – SŽ, d. o. o.

Legal basis: When subscribing to event notifications via the My train (Moj vlak) portal, personal data are processed in accordance with the contract (Article 6/1(b) of the GDPR).

Rights of the data subject: Right to information, right to rectification, right to erasure, right to portability.

2.5  Subscription to marketing notifications

Users have the possibility to subscribe to marketing notifications in two ways:

When doing so, you select the contact channel through which you would like to receive marketing notifications, i.e.:

  • E-mail;
  • SMS.

What we collect: We collect the following personal data: name and surname, e-mail address, telephone number, IP address, password in encrypted form, date of last registration, confirmation of age over 15, consent to receive marketing content, content areas of marketing notifications.

Why we collect the data: We collect your data for the purpose of sending you marketing notifications based on your consent.

How long we keep the data: Your personal data will be stored for a maximum of 30 days from the date of cancellation of your registration or your request to delete your profile or from your unsubscription by clicking on the link in each email you receive if you are not registered on the My train (Moj vlak) portal; after that they will be irreversibly deleted. If you only withdraw your consent to receive marketing notifications in the My train (Moj vlak) settings (leaving other notifications ticked) and do not provide it again in the meantime, your consent to receive marketing notifications and the content areas of the marketing notifications will be irrevocably deleted within the time limit set out above.

Categories of personal data users: External contractors of the CRM system and the subscription portal, IT service providers – SŽ, d. o. o.

Legal basis: We collect personal data on the basis of your consent when you sign up for marketing notifications.

Rights of the data subject: Right to information, right to rectification, right to erasure, right to restriction, right to portability, right to object (withdrawal of consent).

 

2.6  Travel assistance for disabled persons and other persons with reduced mobility

You can announce travel of disabled persons and persons with reduced mobility:

  • By calling 00 386 1 29 13 391 (the number can also be reached from abroad);
  • By sending an e-mail to [email protected].

What we collect:

  1. We collect your contact details, which you provide during the call or in the message, the route and the date and time of the journey, the type of assistance you need (access to the platform, boarding the train, etc.), what kind of aids you use, if you have extra luggage, if an accompanying person is travelling with you, and contact details of the accompanying person, if we are arranging assistance with them.
  2. After the call/replied message, we may also ask you to provide feedback on your satisfaction with contact in the form of answers to a survey questionnaire.

Calls to the above-mentioned phone number are recorded, so we also collect telephone conversation recordings.  

Why we collect the data: We collect your data to order and organise transport for wheelchair users and other people with reduced mobility. We may use your contact details for further information. We process your satisfaction with the contact in order to improve our services and to offer you the best support in our call centre.

How long we keep the data: Your personal data, details of your journey, and telephone conversation recordings are kept for 1 year. Customer contact satisfaction data are also kept for 1 year.

Categories of personal data users: External call centre contractors, IT service providers (SŽ, d. o. o.), SŽ-ŽIP, d. o. o., SŽ-Infrastruktura, d. o. o.

Legal basis: Personal data are processed for the purpose of information prior to the conclusion of a transport contract (Article 6/1(b) of the GDPR). Recordings of telephone conversations are processed in accordance with the provisions of the law governing electronic communications (Article 214/7, ZEKom-2). The processing of contact satisfaction data is based on the legal basis of legitimate interest (Article 6/1(f) of the GDPR). 

Rights of the data subject: Right to information, right to rectification, right to restriction, right to portability.

2.7  Compliments, complaints, comments and suggestions

You can submit a compliment, complaint, comment or suggestion:

  • By calling our toll-free number 080 19 10;
  • By sending an e-mail to: [email protected];
  • By using the online form on the SŽ-PP website;
  • By postal mail;
  • In the Guest Book available at station ticket offices.

What we collect:

  1. We collect your message and the contact details you provide in your message, as well as the telephone conversation recording.
  2. After the call/replied message, we may also ask you to provide feedback on your satisfaction with contact in the form of answers to a survey questionnaire.

Why we collect the data:

  1. We collect your complaints, compliments, comments and suggestions in order to monitor customer satisfaction with the transport service. We may use your telephone number for call-back purposes for further information.
  2. We process customer satisfaction with contact in order to improve our services and to offer you the best support in our call centre.

If the caller chooses to receive a call-back, the caller’s phone number is stored and used for the call-back.

Phone call recordings are stored and processed for the purpose of providing evidence of business communication in the case of complaints, compliments and comments, and more specifically for the purpose of establishing the facts and circumstances of the cases dealt with and the information provided by customers, in accordance with the provisions of the law governing electronic communications, and have an impact on the change of the business relationship.

How long we keep the data:

  1. Compliments, complaints, comments and suggestions in electronic and written form are kept for 2 years. The telephone numbers and personal data you give us during the call are also kept for 2 years.
  2. Telephone conversation recordings and customer contact satisfaction data are kept for 1 year.

Categories of personal data users: External call centre contractors, IT service providers – SŽ, d. o. o.

Legal basis: Personal data is processed in accordance with the concluded transport contract (Article 6/1(b) of the GDPR). Telephone conversation recordings are processed in accordance with the provisions of the Electronic Communications Act (Article 214/7, ZEKom-2). The processing of contact satisfaction data is based on the legal basis of legitimate interest (Article 6/1(f) of the GDPR). 

Rights of the data subject: Right to information, right to rectification, right to restriction, right to portability, right to object.

2.8  Violation of rules on internal arrangements of the railway undertaking

Rules on internal arrangements in a railway undertaking (Official Gazette of the Republic of Slovenia, No. 88/08 and 30/18 – ZVZelP-1) was adopted on the basis of the Railway Safety Act (Official Gazette of the Republic of Slovenia, No. 30/18 and 54/21). It was adopted in order to ensure railway safety, and it establishes the rules on internal arrangements in the railway area and in trains, which must be observed by passengers and other persons, as well as the powers and measures of authorised railway workers of the public railway infrastructure manager and the railway undertaking for its maintenance.

In the event of a violation, the staff on board the train shall request a valid identity document of the offender, enter the personal data of the offender and the occurrence of the violation in the K-91 Irregularity Report Form.

In this case, we process the following personal data of the offender:

  • Name and surname;
  • Address of residence.

If the offender does not wish to be identified, the police in charge of the case will take over the case.

Why we collect the data: We collect your data for the purpose of issuing a fine in case of a violation of the provisions of Rules on internal arrangements in a railway undertaking.

How long we keep the data: We keep your personal data and details of the violation for 10 years.

Categories of personal data users: SŽ, d. o. o., the police and other users who have a legal basis for obtaining personal data.

Legal basis: Railway Safety Act (Official Gazette of the Republic of Slovenia, No. 30/18 and 54/21).

Rights of the data subject: Right to information and right to rectification.

2.9  Injuries to train passengers

If you are injured when getting on or off the train or on the train itself, the train staff will fill in an O-116 Accident report form. The form consists of four (4) parts. Part 1 – Accident Report is received by SŽ-PP, Part 2 – Accident Report is received by the competent insurance company, Part 3 – Accident Report and Part 4 – Notices regarding the processing of personal data are received by the injured party.

In this case, we process the following personal data of the injured party:

  • Name and surname;
  • Address of residence;
  • Date of birth;
  • Number of the person’s identity document;
  • Details of the injury;
  • Time and place of the injury;
  • Personal details of witnesses (name, address and ID card number).

Why we collect the data: We collect your data in order to investigate railway incidents in accordance with the safety management system or in the event of an accident investigation.

How long we keep the data: In the event of a railway incident, we keep your personal data permanently, while in the event of an accident on the train, we keep your personal data for 10 years.

Categories of personal data users: SŽ, d. o. o.  (Legal and Organisational Affairs and Human Resources Department), insurance company, the police.

Legal basis: Personal data is processed in accordance with the transport contract (Article 6/1(b) of the General Data Protection Regulation.

Rights of the data subject: Right to information, right to rectification, right to restriction, right to portability.

2.10  Claims for reimbursement, refund, damages or compensation in the event of daily of repeated train delays

Claims for reimbursement are requests from users for reimbursement of overcharged fares and supplements, and for reimbursement of fares paid for unused or partially used tickets, made in the prescribed manner.

Claims for refund are requests made by users in the prescribed manner for reimbursement of fares paid for unused or partially used tickets because a passenger has cancelled a journey for personal reasons.

Claims for damages are claims made by users in the prescribed manner for compensation for loss, damage or delay in the delivery of luggage and accompanied cars and for compensation for damage caused by delay or cancellation of a train or loss of connection.

Claims for compensation in the event of daily or repeated train delays are requests by users for reimbursement of the fare or part of the fare and for compensation for damage caused by delay or cancellation of the train or loss of service, made in the prescribed manner and subject to certain conditions.

You can submit a claim for reimbursement, refund or damages, or a claim for compensation in the event of daily train delays by sending an e-mail to [email protected], by sending it by postal mail or by submitting the form at one of our sales outlets. Forms and procedures for submitting forms are available on the SŽ-PP website.

What we collect: When you submit a claim for reimbursement, refund, damages or compensation in the event of daily train delays, we collect:

Type of claim:Types of personal data:
ReimbursementName and surname, address, e-mail address, telephone, bank account number
RefundName and surname, address, e-mail address, telephone, bank account number
DamagesName and surname, address, e-mail address, telephone, bank account number
Compensation in the event of daily train delaysName and surname, address, date of birth, e-mail address, telephone, bank account number

Why we collect the data: Providing the above personal data is a contractual obligation in case you wish to claim a refund of the fare, reimbursement, damages, or compensation in the event of daily or repeated delays under the transport contract.

How long we keep the data: We keep claims for reimbursement, refund, damages, and compensation in the event of daily train delays for 5 years.

Categories of personal data users: Other carriers or other railway administrations, if the claim is for an international ticket or a ticket involving another carrier.

Legal basis: Personal data are processed in accordance with the concluded transport contract (Article 6/1(b) of the GDPR).

Rights of the data subject: Right to information, right to rectification, right to erasure, right to restriction, right to portability.

2.11  Participation in prize draws

What we collect: When you participate in a prize draw organised or participated in by SŽ-PP and you have provided your personal data as part of your registration to participate in the prize draw or event, SŽ-PP may process your data as an independent controller of personal data collections or as a joint controller of a personal data collection with the organiser or other persons with whom it cooperates in the implementation of the prize draw or event.

The personal data we collect in the context of prize draws are: name and surname, address, e-mail address and, in the case of prize winners, their tax ID number. In the case of a minor, the name and surname of the legal representative are also needed.

The prize draws are usually held on Facebook and Instagram or published on the SŽ-PP website. The general terms and conditions of participation in prize draws are published on www.slo-zeleznice.si.

When participating in prize draws on Facebook and Instagram, participants’ personal data may be transferred to third countries, subject to the general terms and conditions of use of those social networks.

Why we collect the data: We process your personal data for the purpose of conducting the prize draw or event and for the awarding of prizes.

How long we keep the data: We keep the personal data of the participants in the prize draw until the end of the prize draw or for 10 years in the case of a prize.

Categories of personal data users: Maintainers and developers of the SŽ-PP website, co-organisers of prize draws, FURS[4].

Legal basis: SŽ-PP processes your data on the basis of your consent and the Personal Income Tax Act (tax ID number).

Rights of the data subject: Right to information, right to rectification, right to erasure, right to restriction.

2.12  Registration for promotional events organised by SŽ-PP

There are several ways to register for promotional events organised by SŽ-PP. You can reply to an invitation sent by email by SŽ-PP, or register via a registration link generated by SŽ-PP through web applications, such as:

1ka (https://www.1ka.si/), EUsurvey https://ec.europa.eu/eusurvey/home/welcome, Google forms https://www.google.com/forms/about/ etc.

What we collect: When you register for an event organised by SŽ-PP, we collect the following personal data: name and surname, name of the organisation, job title of the applicant, contact details (e-mail address, telephone number).

If you register via registration links, personal data of applicants may be transferred to third countries, subject to the general terms and conditions of use of those online systems.

Why we collect the data: We process your personal data for the purpose of organising promotional events.

How long we keep the data: Personal data of applicants to a promotional event are kept until the end of the promotional event.

Categories of personal data users: Co-organisers of events, owners of the web applications through which registration links are created.

Legal basis: SŽ-PP processes your data on the basis of a contract (Article 6/1(b) of the GDPR).

Rights of the data subject: Right to information, right to rectification, right to erasure, right to restriction, right to portability.

2.13  Filming at public events

What we collect: Any individual attending a major or public event (as a performer or spectator) should be aware that there is a higher likelihood of being filmed at such an event. At such events, we may therefore record and publish footage of the event itself, or reportage that includes images of the individual, taking care to ensure that the individual is not the central motif of the footage. Before we hold an event of this kind, we always announce that it will be filmed.

Why we collect the data: The photos or videos are processed by SŽ-PP for the purpose of publishing a photo gallery of the event or video contribution and for subsequent promotion.

How long we keep the data: SŽ-PP keeps the personal data created when events are filmed for 5 years from the date of creation. If you wish to have a published photograph of you as the subject of the video removed, or if you do not wish to appear in the frame, or if you do not wish to be featured in the video, please let us know in advance or as soon as possible by sending an e-mail to [email protected].

Legal basis: The data are processed on the basis of legitimate interest (Article 6/1(f) of the GDPR).

Categories of personal data users: Event organisers.

Rights of the data subject: Right to information, right to erasure, right to restriction, right to object.

2.14  Video surveillance on premises, the immediate surroundings, on trains and in the vicinity of SŽ ticket machines

What we collect: We collect the recordings made through video surveillance systems:

  • When entering and leaving SŽ-PP business premises (Article 77 ZVOP-2[5]);
  • On the work premises of SŽ-PP, where this is necessary for the protection of trade secrets or classified information, people and property, and this purpose cannot be fulfilled by other means which are less intrusive (Article 78 ZVOP-2);
  • On-board public transport vehicles to ensure the safety of people and property (Article 79 ZVOP-2).
  • When being in the vicinity of a SŽ ticket machine, when the front door of the machine is open (Articles 78 and 80 of ZVOP-2).

Why we collect the data: The purpose of the recording is to protect and safeguard property and people, including employees, against threats and violence and in similar cases where, without processing the personal data of individuals, we would not be able to protect and enforce our own legitimate interests and the rights we enjoy under the law, which includes carrying out video surveillance to clarify the circumstances of criminal offences against the company’s employees and property on trains, station facilities and infrastructure, and monitoring access to the company’s business premises to prevent unauthorised persons from entering the business premises and to ensure the maintenance of order on the business premises.

How long we keep the data: Recordings of entries and exits to and from business premises and recordings of work areas are stored for up to 90 days, after which they are automatically deleted. Video surveillance recordings in public passenger transport vehicles shall be kept for up to 7 days, after which they shall be deleted or destroyed. Recordings made when being in the vicinity of a SŽ ticket machine are kept for up to 7 days, after which they are deleted or destroyed. If a particular video recording is necessary for the exercise of a protected interest, it shall be removed from the collection, kept separately and kept for as long as it is necessary for the exercise, pursuit or defence of that interest.

Categories of personal data users: Contract processor SŽ-ŽIP, d. o. o., for video surveillance in buildings, on associated land and trains, contract processor Lastinski, d. o. o., for video surveillance of the surroundings of the SŽ ticket machines, competent state authorities (e.g. the police, court), and other users who have a basis for obtaining personal data by law, by personal consent of the individual or by contractual relationship.

Legal basis: The data are processed on the basis of legitimate interest (Article 6/1(f) of the GDPR). Legitimate interest under Article 6/1(f) of the GDPR in conjunction with Article 77 of the Personal Data Protection Act ZVOP-2 (video surveillance of entries to and exits from business premises), Article 78 of the ZVOP-2 (video surveillance in workplaces), Article 79 of the ZVOP-2 (video surveillance in means of transport intended for public passenger transport) and Articles 78 (video surveillance inside work areas) and 80 of the ZVOP-2 (video surveillance of public areas).

Rights of the data subject: Right to information, right to erasure, right to restriction, right to object, taking into account their nature.

You can find out more about the processing of personal data in video surveillance in the Video Surveillance Notice.

2.15  Analysis of pseudonymised data for business decision-making purposes

Why we collect the data: We analyse personal data in pseudonymised form for the purpose of reporting and business decision-making[6].

What we collect:  For these purposes, we process the following data:

a. Data on purchases and use of personal tickets: CUID number, ticket type, route of travel, train type, ticket price, date of purchase, method of payment, station of purchase, method of purchase (sales channel), date of travel.

b. Data on calls and e-mails: the number of calls received, outgoing, answered, unanswered and returned, the number of call-back requests, the time and date of the call, the duration of the call, the time of the call and the name and surname of the agent who answered the call, the content of the call, the number of e-mails received and processed, when the e-mail was received and answered, the content of the e-mail, the feedback on the caller’s or sender’s satisfaction with the information provided.

c. Data on complaints, compliments, suggestions and comments, and claims for reimbursement, refund, damages, and compensation in the event of daily train delays: the number of complaints, compliments, suggestions and comments, and claims for reimbursement, refund, damages, and compensation, the content of each claim, when the claim was received.

How long we keep the data: We keep the data in pseudonymised form for 5 years.

Legal basis: The data are processed on the basis of legitimate interest (Article 6/1(f) of the GDPR).

3  CATEGORIES OF PERSONAL DATA USERS

We do not pass on your personal data to third parties. However, from time to time, we may need to share your personal data with certain external parties if they demonstrate an appropriate legal basis for obtaining your data. Such users are usually various government authorities who need your personal data in the context of official procedures they are conducting, and other users who have a basis for obtaining your personal data in law or in the individual’s personal consent or contractual relationship.

We always check any request to obtain your personal data from third parties to determine whether it is from a legitimate requester and whether the requester has an adequate legal basis for obtaining it. In the event that a request for data is incomplete, we will refuse to provide any of your data.

Like most companies, SŽ-PP engages various contract processors to perform parts of the processing of personal data on its behalf, and we enter into appropriate statutory personal data processing contracts with such contract processors, committing them to the same standard of personal data protection as if we had performed the excluded parts of the processing of personal data ourselves. Contract processors shall process the data only for the purpose of providing the contractually defined services to SŽ-PP and for no other purpose, nor shall they use the data for their own purposes or for the purposes of third parties.

A list of the categories of processors of your personal data is set out below:

Personal data processor categorySubject of contractual processing (or other legal basis)
External contractors of the ticketing systemSetting up, maintenance, upgrade and support of the ticketing system
Payment service providersPayment implementation
External call centre contractorsSetting up, maintenance, upgrade and application support of the call centre
IT service providers – Slovenske železnice, d.o.o.Providing system maintenance, administration and development services for systems and applications
Contractual partner for an eventCarrying out activities related to the event
Maintainers and developers of the SŽ-PP websiteWebsite maintenance, upgrade and editing support
Printing worksProviding document printing services
Organisers and co-organisers of (promotional) eventsOrganisation and co-organisation of (promotional) events
External video surveillance providersProtecting and securing property and employees against threats and violence
Providers of transport assistance for wheelchair users and other people with reduced mobilityAssistance for wheelchair users and other persons with reduced mobility when travelling by train

4  PRIVACY PROTECTION

SŽ-PP takes physical, organisational and technical measures to protect data against loss, theft, inaccessibility and unauthorised use. We protect your data in accordance with the legislation in force and with the internal acts governing the protection and safeguarding of personal data at SŽ-PP and the field of information security.

5  EXERCISING YOUR RIGHTS IN RELATION TO PERSONAL DATA

In accordance with the provisions of the General Data Protection Regulation (EU Regulation 2016/679), the Company shall ensure that the data subject exercises the rights set out in the provisions of Articles 12 to 23, as well as the other rights guaranteed by the General Data Protection Regulation (EU Regulation 2016/679) and the applicable data protection law.

Right to information: You have the right at all times to be informed whether personal data relating to you is being processed and, if so, to have access to the personal data and to be provided with the following information: (a) the purposes of the processing; (b) the types of personal data concerned; (c) the users or categories of user to whom the personal data have been or will be disclosed; (d) the envisaged period of retention of the personal data or, failing that, the criteria used to determine that period; (e) where the personal data are not collected from you, any available information regarding their source.

Right to rectification: You have the right to have inaccurate personal data relating to you rectified and, taking into account the purposes of the processing, the right to have incomplete personal data completed.

Right to erasure: You have the right to have your personal data erased where one of the following grounds applies: (a) the personal data are no longer necessary for the purposes for which they were collected or otherwise processed; (b) where you withdraw the consent on which the processing is based and where there is no other legal basis for the processing; (c) where you object to the processing and there are no overriding legitimate grounds for the processing; (d) the personal data have been unlawfully processed.

Right to restriction of processing: You have the right to have us restrict the processing of your personal data where one of the following applies: (a) where you contest the accuracy of the data, for a period of time that allows us to verify the accuracy of the personal data; (b) the processing is unlawful and you object to the erasure of the personal data and instead request the restriction of their use; (c) we no longer need your personal data for the purposes of the processing, but you need them to assert, exercise or defend legal claims; (d) where you have raised an objection to the processing based on legitimate interests, pending verification that our legitimate grounds outweigh yours.

Right to data portability: You have the right to receive your personal data that you have provided to us in a structured, commonly used and machine-readable format, and the right to transfer that data to another controller where the processing is based on your consent or the processing is carried out by automated means. At your request, where technically feasible, personal data may be directly transferred to another controller.

Right to object: Where we process your data on the basis of legitimate interest, you have the right to object to such processing of your personal data. We will stop processing your personal data unless we can demonstrate compelling reasons for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

Right of revocation: If you, as an individual, have consented to the processing of personal data for one or more of the purposes for which we process your personal data, you have the right to withdraw your consent at any time. Upon receipt of your withdrawal of consent for one or more of the processing purposes, the controller will immediately stop processing your personal data for that purpose. Withdrawal of consent to the processing of personal data shall not affect the lawfulness of the processing of personal data relating to you until your withdrawal.

An individual who has provided personal data at the time of ordering a personal ticket or a benefits card may exercise his/her rights to rectification and erasure or to restriction of the processing and portability of personal data by filling in the forms published on the SŽ-PP website or obtained by the cardholder at all SŽ-PP sales outlets. The completed and signed form is to be handed in at the SŽ-PP ticket office equipped with a stationary terminal. The individual may exercise his/her rights to rectification and erasure or restriction of processing, objection, revocation and portability with regard to other personal data by submitting a written request at the SŽ-PP ticket office equipped with a stationary terminal. The company shall decide on your request within one month of receipt of a complete request, which may be extended by up to two additional months if necessary.

If the Company does not decide on the data subject’s request or if you consider that your personal data are being stored or otherwise processed in breach of the applicable regulations, you have the right to lodge a complaint with the Information Commissioner of the Republic of Slovenia.

6  OTHER INFORMATION

Any questions regarding this Policy, comments, remarks and requests for assistance in exercising your rights related to the processing of your personal data may be addressed to the Data Protection Officer of the Slovenian Railways Group, who can be contacted by sending an e-mail to [email protected] or by postal mail under the address: Slovenske železnice d. o. o., Kolodvorska 11, 1506 Ljubljana, att. “Data Protection Officer”.

We will do our best to reply to you as soon as possible.

 

7  UPDATING OUR PRIVACY POLICY

SŽ-PP reserves the right to update this Privacy Policy. Any changes to this Privacy Policy will take effect the day after it is published on www.slo-zeleznice.si.

Your continued use of the SŽ-PP websites, mobile applications or services after the changes to the Privacy Policy have been published means that you are aware of the changes.

Ljubljana, 25 April 2025

[1] The processing carried out by each category of personal data users is listed in section 3.

[2] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

[3] The content of the rights and how to exercise them are described in section 5.

[4] FURS: Financial Administration of the Republic of Slovenia

[5] Personal Data Protection Act (Official Gazette of the Republic of Slovenia, No 163/22)

[6] Pseudonymisation means the processing of personal data in such a way that the personal data can no longer be attributed to a specific individual without further information, provided that such further information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to a specific or identifiable individual.

Files for download

Privacy Policy of SŽ-Potniški promet d. o. o. (25 April 2025)