Respect for the privacy of individuals, including the protection of personal data of individuals, is of paramount importance to SŽ-Potniški promet, d. o. o. (hereinafter referred to as SŽ-PP). We fully respect our commitment to lawful, fair and transparent processing of personal data and take appropriate security measures to ensure that personal data are not accessed by unauthorised persons, to maintain their confidentiality and integrity and to prevent their loss or accidental destruction throughout the processing. Please find below detailed information on the processing of your personal data.

1  INFORMATION ABOUT THE DATA CONTROLLER

Company name:SŽ-Potniški promet, d. o. o.
Head office:Kolodvorska 11, Ljubljana
Tax ID number:SI89393686
Registration number:6017274000
Telephone number:+ 386 1 29 12 402
Website:www.slo-zeleznice.si
E-mail:[email protected]
Data Protection Officer’s e-mail:[email protected]

2  COLLECTION AND USE OF PERSONAL DATA

We collect and process your data in accordance with the regulations governing the protection of personal data or the processing of individual personal data.

SŽ-PP collects personal data it obtains from you when you:

  • Purchase a personal ticket of Slovenian Railways (hereinafter referred to as SŽ), or obtain a SŽ benefit;
  • Want to obtain a free 6-month promotional subscription to VOYO;
  • Visit the SŽ-PP website;
  • Use our online shop or the SŽ-PP mobile app;
  • Ask us for information;
  • Need travel assistance for disabled persons and other persons with reduced mobility;
  • Give a compliment or make a complaint;
  • Make a request for a ticket refund, reimbursement or compensation in case of daily or repeated train delays;
  • Participate in prize draws (co-)organised by SŽ-PP;
  • Register for an event organised by SŽ-PP;
  • Get on board and travel by train;
  • Enter a SŽ station area or station building; or
  • When other cases set out in this Privacy Policy arise.

2.1  Purchasing a SŽ personal ticket or obtaining a SŽ benefit

What we collect: We collect personal data from you when you decide to purchase a SŽ personal ticket or obtain a SŽ benefit. You submit your personal data at the ticket office via the form for obtaining a SŽ personal ticket and/or a SŽ benefit on a chip card (K-50 form), which is available on the SŽ-PP website: www.slo-zeleznice.si

You can also purchase a personal ticket at a SŽ self-service point of sale (hereafter: ticket machine), where the purchase is made on the basis of your chip card.

When purchasing SŽ personal tickets and SŽ benefits, the following data are collected:

  • Name and surname;
  • Personal identification number;
  • CUID number of the chip card;
  • Information on permanent residence;
  • Signature;
  • The name and surname of the legal representative if the holder of the personal ticket/benefits card is a minor.

Why we collect the data: SŽ-PP processes the data obtained from the purchase of SŽ personal tickets/SŽ benefits in order to perform a transport contract.

How long we keep the data: Your personal data are kept for 3 years from the last use of the chip card.

Categories of personal data users[1]: External contractors of the ticketing system, payment service providers, IT service providers – SŽ, d. o. o.

Legal basis: The legal basis for the processing of personal data relating to SŽ personal tickets and SŽ benefits is a contract (Article 6/1(b) of the GDPR[2]).

Rights of the data subject[3]: Right to information, right to rectification, right to erasure, right to restriction, right to portability.

2.2  Obtaining a free 6-month promotional subscription to VOYO

What we collect: We obtain personal data from you when you wish to obtain a free 6-month promotional subscription to VOYO portal. The acquisition of a code is voluntary and applies to holders of valid SŽ annual tickets (SŽ season tickets for a selected route and SŽ flat-rate tickets) and does not apply to holders of IJPP tickets. To obtain a promotional 6-month subscription to VOYO, the applicant must fill in the online form.

When obtaining a free 6-month promotional subscription to VOYO, the following data are collected:

  • CUID number of the chip card on which a valid annual ticket is loaded;
  • E-mail address;
  • Signature;
  • The name and surname of the legal representative if the holder of the season ticket/benefit card is a minor;
  • The date on which the form was submitted to a SŽ ticket office.

Why we collect the data: The data is collected by SŽ-PP for the purpose of verifying eligibility for a code. SŽ-PP sends a code for a free 6-month promotional subscription to VOYO portal to the e-mail address of the eligible applicant within 30 days of receipt of the complete form.

How long we keep the data: The above-mentioned personal data will be stored by SŽ-PP until all codes have been distributed, i.e. up to and including 31 December 2024. After that time, the personal data will be permanently deleted.

Categories of personal data users[4]: Personal data is used only by SŽ-PP.

Legal basis: The personal data controller SŽ-PP processes personal data on the basis of Article 6/1 (b) of the GDPR, namely for the implementation of measures prior to the conclusion of a contract (verification of eligibility and issuance of a code), which the individual will then conclude with another controller, i.e. PRO PLUS, d. o. o.

Rights of the data subject[5]: Right to information, right to rectification, right to erasure, right to restriction, right to portability.

2.3  Visiting the SŽ-PP website or using the Grem z vlakom mobile app

The SŽ-PP website www.slo-zeleznice.si is publicly accessible and is intended for the use and information of the general public and for the purchase of tickets in the online shop (https://eshop.sz.si/), but it also allows the use of other functionalities.

The Grem z vlakom mobile app, which can be downloaded free of charge on smartphones, allows you to: view timetable and fare information on the selected route, information on delays and service disruptions (maintenance works, rail replacement services etc.), set your favourite travel routes, purchase tickets and other services in accordance with the terms and conditions of use of each service.

What we collect: When you visit the SŽ-PP website or mobile app, the server automatically retrieves the following device data and other log data:

  • IP address;
  • The URL of the website from which you accessed our website;
  • Browser settings and information about the operating system of your computer or mobile device;
  • The content you access on the SŽ-PP website or app;
  • The date of access and the duration of the visit to the SŽ-PP website or app.

When purchasing personal tickets via the online shop on the SŽ-PP website or mobile app, the following personal data are processed:

  • Name and surname;
  • Personal identification number;
  • Information on permanent residence.

When visiting the SŽ-PP website and mobile app, we also store cookies, which most websites temporarily store on the users’ devices used to access the Internet in order to identify the individual devices used by the users when accessing the Internet. You can find out more about the types of cookies we store in the Cookie Notice on the SŽ-PP website.

Why we collect the data: When you purchase a personal ticket via the online shop or the SŽ-PP mobile app, your personal data are processed by SŽ-PP for the performance of a transport contract.

How long we keep the data: The storage period of personal data for the purchase of SŽ personal tickets or SŽ benefits cards is 3 years from the last use of the chip card or from the expiry of its validity.

Categories of personal data users: Maintainers and developers of the SŽ-PP website, external contractors of the ticketing system (for the mobile application), IT service providers – SŽ, d. o. o.

Legal basis: The legal basis for the processing of personal data when purchasing SŽ personal tickets or SŽ benefits cards is the contract (Article 6(1)b of the GDPR). The General Terms and Conditions for the use of SŽ online shop and mobile app are available on the SŽ-PP website.

Rights of the data subject: Right to information, right to rectification, right to erasure, right to restriction, right to portability.

2.4  Request for information

You can ask for information:

  • By calling our toll-free number 080 81 11;
  • By calling 00 386 1 29 13 331 (the number can also be reached from abroad);
  • By sending an e-mail to [email protected];
  • By writing a message on the Grem z vlakom Facebook page.

What we collect:

  1. We record your phone number or e-mail address and the reason for the call, while phone conversations are not recorded.
  2. After the call/replied message, we may also ask you to provide feedback on your satisfaction with contact in the form of answers to a survey questionnaire.

Why we collect the data:

  1. When you make a request for information, you voluntarily decide which personal data you want to share with us. We need your telephone number so that we can call you for any further clarification or information. We will also call you automatically if you select the option to order a call-back in the initial answering machine.
  2. We process customer satisfaction with contact in order to improve our services and to offer you the best support in our call centre.

How long we keep the data: Your e-mails are kept for 1 year, while phone numbers and Facebook messages are deleted after one month. Customer contact satisfaction data are kept for 1 year.

Categories of personal data users: External call centre contractors, IT service providers – SŽ, d. o. o., provider of the Facebook page.

Legal basis: Personal data are processed for the purpose of information prior to the conclusion of a transport contract (Article 6(1)b of the GDPR). The processing of customer contact satisfaction data is based on the legal basis of legitimate interest (Article 6/1(f) of the GDPR).

Rights of the data subject: Right to information, right to rectification, right to erasure, right to restriction, right to portability, right to object.

2.5  Travel assistance for disabled persons and other persons with reduced mobility

You can announce travel of disabled persons and persons with reduced mobility:

  • By calling 00 386 1 29 13 391 (the number can also be reached from abroad);
  • By sending an e-mail to [email protected].

What we collect:

  1. We collect your contact details, which you provide during the call or in the message, the route and the date and time of the journey, the type of assistance you need (access to the platform, boarding the train, etc.), what kind of aids you use, if you have extra luggage, if an accompanying person is travelling with you, and contact details of the accompanying person, if we are arranging assistance with them.
  2. After the call/replied message, we may also ask you to provide feedback on your satisfaction with contact in the form of answers to a survey questionnaire.

Calls to the above-mentioned phone number are recorded, so we also collect telephone conversation recordings.

Why we collect the data: We collect your data to order and organise transport for wheelchair users and other people with reduced mobility. We may use your contact details for further information. We process your satisfaction with the contact in order to improve our services and to offer you the best support in our call centre.

How long we keep the data: Your personal data, details of your journey, and telephone conversation recordings are kept for 1 year. Customer contact satisfaction data are also kept for 1 year.

Categories of personal data users: External call centre contractors, IT service providers (SŽ, d. o. o.), SŽ-ŽIP, d. o. o., SŽ-Infrastruktura, d. o. o.

Legal basis: Personal data are processed for the purpose of information prior to the conclusion of a transport contract (Article 6/1(b) of the GDPR). Recordings of telephone conversations are processed in accordance with the provisions of the law governing electronic communications (Article 214/7, ZEKom-2). The processing of contact satisfaction data is based on the legal basis of legitimate interest (Article 6/1(f) of the GDPR).

Rights of the data subject: Right to information, right to rectification, right to restriction, right to portability.

2.6  Compliments, complaints, comments and suggestions

You can submit a compliment, complaint, comment or suggestion:

  • By calling our toll-free number 080 19 10;
  • By sending an e-mail to: [email protected];
  • By using the online form on the SŽ-PP website;
  • By postal mail;
  • In the Guest Book available at station ticket offices.

What we collect:

  1. We collect your message and the contact details you provide in your message, as well as the telephone conversation recording.
  2. After the call/replied message, we may also ask you to provide feedback on your satisfaction with contact in the form of answers to a survey questionnaire.

Why we collect the data:

  1. We collect your complaints, compliments, comments and suggestions in order to monitor customer satisfaction with the transport service. We may use your telephone number for call-back purposes for further information.
  2. We process customer satisfaction with contact in order to improve our services and to offer you the best support in our call centre.

If the caller chooses to receive a call-back, the caller’s phone number is stored and used for the call-back.

Phone call recordings are stored and processed for the purpose of providing evidence of business communication in the case of complaints, compliments and comments, and more specifically for the purpose of establishing the facts and circumstances of the cases dealt with and the information provided by customers, in accordance with the provisions of the law governing electronic communications, and have an impact on the change of the business relationship.

How long we keep the data:

  1. Compliments, complaints, comments and suggestions in electronic and written form are kept for 2 years. The telephone numbers and personal data you give us during the call are also kept for 2 years.
  2. Telephone conversation recordings and customer contact satisfaction data are kept for 1 year.

Categories of personal data users: External call centre contractors, IT service providers – SŽ, d. o. o.

Legal basis: Personal data is processed in accordance with the concluded transport contract (Article 6/1(b) of the GDPR). Telephone conversation recordings are processed in accordance with the provisions of the Electronic Communications Act (Article 214/7, ZEKom-2). The processing of contact satisfaction data is based on the legal basis of legitimate interest (Article 6/1(f) of the GDPR).

Rights of the data subject: Right to information, right to rectification, right to restriction, right to portability, right to object.

2.7  Claims for reimbursement, refund, damages or compensation in the event of daily of repeated train delays

Claims for reimbursement are requests from users for reimbursement of overcharged fares and supplements, and for reimbursement of fares paid for unused or partially used tickets, made in the prescribed manner.

Claims for refund are requests made by users in the prescribed manner for reimbursement of fares paid for unused or partially used tickets because a passenger has cancelled a journey for personal reasons.

Claims for damages are claims made by users in the prescribed manner for compensation for loss, damage or delay in the delivery of luggage and accompanied cars and for compensation for damage caused by delay or cancellation of a train or loss of connection.

Claims for compensation in the event of daily or repeated train delays are requests by users for reimbursement of the fare or part of the fare and for compensation for damage caused by delay or cancellation of the train or loss of service, made in the prescribed manner and subject to certain conditions.

You can submit a claim for reimbursement, refund or damages, or a claim for compensation in the event of daily train delays by sending an e-mail to [email protected], by sending it by postal mail or by submitting the form at one of our sales outlets. Forms and procedures for submitting forms are available on the SŽ-PP website.

What we collect: When you submit a claim for reimbursement, refund, damages or compensation in the event of daily train delays, we collect:

Type of claim:Types of personal data:
ReimbursementName and surname, address, e-mail address, telephone, bank account number
RefundName and surname, address, e-mail address, telephone, bank account number
DamagesName and surname, address, e-mail address, telephone, bank account number
Compensation in the event of daily train delaysName and surname, address, date of birth, e-mail address, telephone, bank account number

Why we collect the data: Providing the above personal data is a contractual obligation in case you wish to claim a refund of the fare, reimbursement, damages, or compensation in the event of daily or repeated delays under the transport contract.

How long we keep the data: We keep claims for reimbursement, refund, damages, and compensation in the event of daily train delays for 5 years.

Categories of personal data users: Other carriers or other railway administrations, if the claim is for an international ticket or a ticket involving another carrier.

Legal basis: Personal data are processed in accordance with the concluded transport contract (Article 6/1(b) of the GDPR).

Rights of the data subject: Right to information, right to rectification, right to erasure, right to restriction, right to portability.

2.8  Participation in prize draws

What we collect: When you participate in a prize draw organised or participated in by SŽ-PP and you have provided your personal data as part of your registration to participate in the prize draw or event, SŽ-PP may process your data as an independent controller of personal data collections or as a joint controller of a personal data collection with the organiser or other persons with whom it cooperates in the implementation of the prize draw or event.

The personal data we collect in the context of prize draws are: name and surname, address, e-mail address and, in the case of prize winners, their tax ID number. In the case of a minor, the name and surname of the legal representative are also needed.

The prize draws are usually held on Facebook and Instagram or published on the SŽ-PP website. The general terms and conditions of participation in prize draws are published on www.slo-zeleznice.si.

When participating in prize draws on Facebook and Instagram, participants’ personal data may be transferred to third countries, subject to the general terms and conditions of use of those social networks.

Why we collect the data: We process your personal data for the purpose of conducting the prize draw or event and for the awarding of prizes.

How long we keep the data: We keep the personal data of the participants in the prize draw until the end of the prize draw or for 10 years in the case of a prize.

Categories of personal data users: Maintainers and developers of the SŽ-PP website, co-organisers of prize draws, FURS[6].

Legal basis: SŽ-PP processes your data on the basis of your consent and the Personal Income Tax Act (tax ID number).

Rights of the data subject: Right to information, right to rectification, right to erasure, right to restriction.

2.9  Registration for promotional events organised by SŽ-PP

There are several ways to register for promotional events organised by SŽ-PP. You can reply to an invitation sent by email by SŽ-PP, or register via a registration link generated by SŽ-PP through web applications, such as:

1ka (https://www.1ka.si/), EUsurvey https://ec.europa.eu/eusurvey/home/welcome, Google forms https://www.google.com/forms/about/ etc.

What we collect: When you register for an event organised by SŽ-PP, we collect the following personal data: name and surname, name of the organisation, job title of the applicant, contact details (e-mail address, telephone number).

If you register via registration links, personal data of applicants may be transferred to third countries, subject to the general terms and conditions of use of those online systems.

Why we collect the data: We process your personal data for the purpose of organising promotional events.

How long we keep the data: Personal data of applicants to a promotional event are kept until the end of the promotional event.

Categories of personal data users: Co-organisers of events, owners of the web applications through which registration links are created.

Legal basis: SŽ-PP processes your data on the basis of a contract (Article 6/1(b) of the GDPR).

Rights of the data subject: Right to information, right to rectification, right to erasure, right to restriction, right to portability.

2.10  Filming at public events

What we collect: Any individual attending a major or public event (as a performer or spectator) should be aware that there is a higher likelihood of being filmed at such an event. At such events, we may therefore record and publish footage of the event itself, or reportage that includes images of the individual, taking care to ensure that the individual is not the central motif of the footage. Before we hold an event of this kind, we always announce that it will be filmed.

Why we collect the data: The photos or videos are processed by SŽ-PP for the purpose of publishing a photo gallery of the event or video contribution and for subsequent promotion.

How long we keep the data: SŽ-PP keeps the personal data created when events are filmed for 5 years from the date of creation. If you wish to have a published photograph of you as the subject of the video removed, or if you do not wish to appear in the frame, or if you do not wish to be featured in the video, please let us know in advance or as soon as possible by sending an e-mail to [email protected].

Legal basis: The data are processed on the basis of legitimate interest (Article 6/1(f) of the GDPR).

Categories of personal data users: Event organisers.

Rights of the data subject: Right to information, right to erasure, right to restriction, right to object.

2.11  Video surveillance on premises, the immediate surroundings and on trains

What we collect: We collect the recordings made through video surveillance systems:

  • When entering and leaving SŽ-PP business premises (Article 77 ZVOP-2[7]);
  • On the work premises of SŽ-PP, where this is necessary for the protection of trade secrets or classified information, people and property, and this purpose cannot be fulfilled by other means which are less intrusive (Article 78 ZVOP-2);
  • On-board public transport vehicles to ensure the safety of people and property (Article 79 ZVOP-2).

Why we collect the data: The purpose of the recording is to protect and safeguard property and people, including employees, against threats and violence and in similar cases where, without processing the personal data of individuals, we would not be able to protect and enforce our own legitimate interests and the rights we enjoy under the law, which includes carrying out video surveillance to clarify the circumstances of criminal offences against the company’s employees and property on trains, station facilities and infrastructure, and monitoring access to the company’s business premises to prevent unauthorised persons from entering the business premises and to ensure the maintenance of order on the business premises.

How long we keep the data: Recordings of entries and exits to and from business premises and recordings of work areas are stored for up to 90 days, after which they are automatically deleted. Video surveillance recordings in public passenger transport vehicles shall be kept for up to 7 days, after which they shall be deleted or destroyed.

Categories of personal data users: Contract processor SŽ-ŽIP, d. o. o., competent state authorities (e.g. police, court), other users who have a basis for obtaining personal data by law, personal consent of the individual or contractual relationship.

Legal basis: The data are processed on the basis of legitimate interest (Article 6/1(f) of the GDPR). Legitimate interest under Article 6/1(f) of the GDPR in conjunction with Article 77 of the Personal Data Protection Act ZVOP-2 (video surveillance of entries to and exits from business premises), Article 78 of the ZVOP-2 (video surveillance in workplaces) and Article 79 of the ZVOP-2 (video surveillance in means of transport intended for public passenger transport).

Rights of the data subject: Right to information, right to erasure, right to restriction, right to object, taking into account their nature.

You can find out more about the processing of personal data in video surveillance in the Video Surveillance Notice.

2.12  Analysis of pseudonymised data for business decision-making purposes

Why we collect the data: We analyse personal data in pseudonymised form for the purpose of reporting and business decision-making[8].

What we collect:  For these purposes, we process the following data:

  1. Data on purchases and use of personal tickets: CUID number, ticket type, route of travel, train type, ticket price, date of purchase, method of payment, station of purchase, method of purchase (sales channel), date of travel.
  2. Data on calls and e-mails: the number of calls received, outgoing, answered, unanswered and returned, the number of call-back requests, the time and date of the call, the duration of the call, the time of the call and the name and surname of the agent who answered the call, the content of the call, the number of e-mails received and processed, when the e-mail was received and answered, the content of the e-mail, the feedback on the caller’s or sender’s satisfaction with the information provided.
  3. Data on complaints, compliments, suggestions and comments, and claims for reimbursement, refund, damages, and compensation in the event of daily train delays: the number of complaints, compliments, suggestions and comments, and claims for reimbursement, refund, damages, and compensation, the content of each claim, when the claim was received.

How long we keep the data: We keep the data in pseudonymised form for 5 years.

Legal basis: The data are processed on the basis of legitimate interest (Article 6/1(f) of the GDPR).

3  CATEGORIES OF PERSONAL DATA USERS

We do not pass on your personal data to third parties. However, from time to time, we may need to share your personal data with certain external parties if they demonstrate an appropriate legal basis for obtaining your data. Such users are usually various government authorities who need your personal data in the context of official procedures they are conducting, and other users who have a basis for obtaining your personal data in law or in the individual’s personal consent or contractual relationship.

We always check any request to obtain your personal data from third parties to determine whether it is from a legitimate requester and whether the requester has an adequate legal basis for obtaining it. In the event that a request for data is incomplete, we will refuse to provide any of your data.

Like most companies, SŽ-PP engages various contract processors to perform parts of the processing of personal data on its behalf, and we enter into appropriate statutory personal data processing contracts with such contract processors, committing them to the same standard of personal data protection as if we had performed the excluded parts of the processing of personal data ourselves. Contract processors shall process the data only for the purpose of providing the contractually defined services to SŽ-PP and for no other purpose, nor shall they use the data for their own purposes or for the purposes of third parties.

A list of the categories of processors of your personal data is set out below:

Personal data processor categorySubject of contractual processing (or other legal basis)
External contractors of the ticketing systemSetting up, maintenance, upgrade and support of the ticketing system
Payment service providersPayment implementation
External call centre contractorsSetting up, maintenance, upgrade and application support of the call centre
IT service providers – Slovenske železnice, d.o.o.Providing system maintenance, administration and development services for systems and applications
Contractual partner for an eventCarrying out activities related to the event
Maintainers and developers of the SŽ-PP websiteWebsite maintenance, upgrade and editing support
Printing worksProviding document printing services
Organisers and co-organisers of (promotional) eventsOrganisation and co-organisation of (promotional) events
External video surveillance providersProtecting and securing property and employees against threats and violence
Providers of transport assistance for wheelchair users and other people with reduced mobilityAssistance for wheelchair users and other persons with reduced mobility when travelling by train

4  PRIVACY PROTECTION

SŽ-PP takes physical, organisational and technical measures to protect data against loss, theft, inaccessibility and unauthorised use. We protect your data in accordance with the legislation in force and with the internal acts governing the protection and safeguarding of personal data at SŽ-PP and the field of information security.

5  EXERCISING YOUR RIGHTS IN RELATION TO PERSONAL DATA

In accordance with the provisions of the General Data Protection Regulation (EU Regulation 2016/679), the Company shall ensure that the data subject exercises the rights set out in the provisions of Articles 12 to 23, as well as the other rights guaranteed by the General Data Protection Regulation (EU Regulation 2016/679) and the applicable data protection law.

Right to information: You have the right at all times to be informed whether personal data relating to you is being processed and, if so, to have access to the personal data and to be provided with the following information: (a) the purposes of the processing; (b) the types of personal data concerned; (c) the users or categories of user to whom the personal data have been or will be disclosed; (d) the envisaged period of retention of the personal data or, failing that, the criteria used to determine that period; (e) where the personal data are not collected from you, any available information regarding their source.

Right to rectification: You have the right to have inaccurate personal data relating to you rectified and, taking into account the purposes of the processing, the right to have incomplete personal data completed.

Right to erasure: You have the right to have your personal data erased where one of the following grounds applies: (a) the personal data are no longer necessary for the purposes for which they were collected or otherwise processed; (b) where you withdraw the consent on which the processing is based and where there is no other legal basis for the processing; (c) where you object to the processing and there are no overriding legitimate grounds for the processing; (d) the personal data have been unlawfully processed.

Right to restriction of processing: You have the right to have us restrict the processing of your personal data where one of the following applies: (a) where you contest the accuracy of the data, for a period of time that allows us to verify the accuracy of the personal data; (b) the processing is unlawful and you object to the erasure of the personal data and instead request the restriction of their use; (c) we no longer need your personal data for the purposes of the processing, but you need them to assert, exercise or defend legal claims; (d) where you have raised an objection to the processing based on legitimate interests, pending verification that our legitimate grounds outweigh yours.

Right to data portability: You have the right to receive your personal data that you have provided to us in a structured, commonly used and machine-readable format, and the right to transfer that data to another controller where the processing is based on your consent or the processing is carried out by automated means. At your request, where technically feasible, personal data may be directly transferred to another controller.

Right to object: Where we process your data on the basis of legitimate interest, you have the right to object to such processing of your personal data. We will stop processing your personal data unless we can demonstrate compelling reasons for the processing which override your interests, rights and freedoms or for the establishment, exercise or defence of legal claims.

Right of revocation: If you, as an individual, have consented to the processing of personal data for one or more of the purposes for which we process your personal data, you have the right to withdraw your consent at any time. Upon receipt of your withdrawal of consent for one or more of the processing purposes, the controller will immediately stop processing your personal data for that purpose. Withdrawal of consent to the processing of personal data shall not affect the lawfulness of the processing of personal data relating to you until your withdrawal.

An individual who has provided personal data at the time of ordering a personal ticket or a benefits card may exercise his/her rights to rectification and erasure or to restriction of the processing and portability of personal data by filling in the forms published on the SŽ-PP website or obtained by the cardholder at all SŽ-PP sales outlets. The completed and signed form is to be handed in at the SŽ-PP ticket office equipped with a stationary terminal. The individual may exercise his/her rights to rectification and erasure or restriction of processing, objection, revocation and portability with regard to other personal data by submitting a written request at the SŽ-PP ticket office equipped with a stationary terminal. The company shall decide on your request within one month of receipt of a complete request, which may be extended by up to two additional months if necessary.

If the Company does not decide on the data subject’s request or if you consider that your personal data are being stored or otherwise processed in breach of the applicable regulations, you have the right to lodge a complaint with the Information Commissioner of the Republic of Slovenia.

6  OTHER INFORMATION

Any questions regarding this Policy, comments, remarks and requests for assistance in exercising your rights related to the processing of your personal data may be addressed to the Data Protection Officer of the Slovenian Railways Group, who can be contacted by sending an e-mail to [email protected] or by postal mail under the address: Slovenske železnice d. o. o., Kolodvorska 11, 1506 Ljubljana, att. “Data Protection Officer”.

We will do our best to reply to you as soon as possible.

7  UPDATING OUR PRIVACY POLICY

SŽ-PP reserves the right to update this Privacy Policy. Any changes to this Privacy Policy will take effect the day after it is published on www.slo-zeleznice.si.

Your continued use of the SŽ-PP websites, mobile applications or services after the changes to the Privacy Policy have been published means that you are aware of the changes.

Ljubljana, 20 May 2024

[1] The processing carried out by each category of personal data users is listed in section 3.

[2] Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

[3] The content of the rights and how to exercise them are described in section 5.

[4] The processing carried out by each category of personal data users is listed in section 3.  

[5] The content of the rights and how to exercise them are described in section 5.

[6] FURS: Financial Administration of the Republic of Slovenia

[7] Personal Data Protection Act (Official Gazette of the Republic of Slovenia, No 163/22)

[8] Pseudonymisation means the processing of personal data in such a way that the personal data can no longer be attributed to a specific individual without further information, provided that such further information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to a specific or identifiable individual.

Files for download