1.  Who we are (data controller)

The data controller responsible for your personal data is Solve by Heart, turistične storitve, d.o.o., trading as "Slovenia By Heart", Kersnikova ulica 4, 1000 Ljubljana, Slovenia (registration number 7449577000). For any privacy matter, contact us at hello@sloveniabyheart.com.

2.  Scope of this policy

This policy applies to personal data we process about enquirers, clients and travellers, website visitors, suppliers and business contacts. Our website is hosted on Squarespace and may link to third-party sites; this policy does not cover those external sites, which have their own policies.

3.  The personal data we collect

• Identity and contact data  name, email address, telephone number, postal or billing address, and country of residence.

• Booking and travel data  the details needed to arrange your trip, including travel dates, party details, preferences, and — where you provide them — passport or identity details required by certain suppliers.

• Special-category data  health, mobility, fitness, allergy or dietary information that you choose to share so that activities and dining can be arranged safely and appropriately. We only process this with your explicit consent or where necessary to arrange your requested services, and we share it with suppliers only to the extent needed to deliver your trip.

• Payment data  the information needed to process your payment. Card payments are handled by our payment providers; we do not store full card numbers.

• Communications  the content of your emails, messages and enquiry forms with us.

• Website and technical data  information collected automatically when you use our website, such as IP address, device and browser type, pages viewed and cookie data (see Section 8).

4.  How we collect your data

We collect data directly from you — when you enquire, correspond, complete a form on our website, or make a booking. We also collect technical and usage data automatically through Squarespace and cookies when you visit our website, and occasionally we receive data from third parties, such as a person booking on your behalf.

5.  Why we use your data and our legal bases

We process your personal data on the following legal bases under Article 6 GDPR:

• Performance of a contract  to prepare a proposal, take a booking, arrange your trip with suppliers, process payment and provide support before, during and after travel.

• Legitimate interests  to respond to enquiries, run and improve our website and services, keep business records, and protect against fraud — balanced against your rights.

• Consent  to send marketing communications where you have opted in, to use non-essential cookies, and to process special-category (for example health or dietary) data. For special-category data we rely on your explicit consent under Article 9 GDPR, or on another lawful basis where one applies.

• Legal obligation  to meet accounting, tax, consumer-protection and other legal duties that apply to us.

6.  Special-category (sensitive) data

Some information you share — such as health conditions, reduced mobility, or food allergies and dietary needs — is treated as special-category data and handled with particular care. We use it solely to arrange your trip safely and to inform the relevant suppliers (for example an activity provider or restaurant). Please share only what is necessary for us to help you.

7.  Who we share your data with

We share personal data only as needed to run our business and deliver your trip:

• Suppliers and partners — accommodation, activity, transport, guiding, dining and experience providers — to fulfil your booking.

• Service providers who support us, including Squarespace (website hosting), our email and productivity provider (Google Workspace), our payment providers, and our accountant.

• Insurers, professional advisers and authorities, where necessary to meet a legal obligation, establish or defend legal claims, or comply with a lawful request.

We do not sell your personal data, and we require our suppliers and providers to protect it and use it only for the agreed purposes.

8.  Cookies and website analytics

Our website uses cookies and similar technologies. Some are essential to make the site work; others help us understand how the site is used so we can improve it. You can control non-essential cookies through the cookie banner on our website and through your browser settings. Squarespace, which hosts our site, sets certain cookies as part of providing and securing the service.

9.  International transfers

We are based in the EU, and we prefer to keep data within the European Economic Area (EEA). However, some of our service providers — for example Squarespace and Google — may process data outside the EEA, including in the United States. Where that happens, we rely on appropriate safeguards recognised under GDPR, such as the European Commission’s Standard Contractual Clauses or an applicable adequacy decision. If you are a client in the United Kingdom, equivalent UK transfer safeguards apply.

10.  How long we keep your data

We keep personal data only for as long as necessary for the purposes described above. Booking and correspondence records are kept for the duration of our relationship and for a reasonable period afterwards to handle any follow-up or dispute. Accounting and tax records are kept for the retention periods required by Slovenian law. When data is no longer needed, we delete or anonymise it.

11.  Your rights

Under GDPR you have the right to: access your personal data; have inaccurate data corrected; have data erased in certain circumstances; restrict or object to processing; data portability; and, where we rely on consent, to withdraw that consent at any time (without affecting processing already carried out). To exercise any of these rights, email us at hello@sloveniabyheart.com. We will respond within the time limits set by law.

12.  Marketing

We will only send you marketing communications, such as travel ideas or offers, where you have asked to receive them or where the law otherwise allows. You can opt out at any time by using the unsubscribe link in our emails or by contacting us.

13.  How we keep your data secure

We take appropriate technical and organisational measures to protect your personal data against loss, misuse and unauthorised access, and we work with reputable providers who do the same. No transmission over the internet can be guaranteed completely secure, but we take reasonable steps to safeguard your information.

14.  Children

Our services are aimed at adults. Where a booking includes children, we process their data only as provided by the responsible adult and only as needed to arrange the trip.

15.  Changes to this policy

We may update this policy from time to time. The current version is always available on our website, and we will indicate the effective date at the top.

16.  Contact and your right to complain

For any question about this policy or your personal data, contact us at hello@sloveniabyheart.com. If you believe we have not handled your data properly, you have the right to lodge a complaint with the Slovenian supervisory authority:

Informacijski pooblaščenec (Information Commissioner of the Republic of Slovenia), Dunajska cesta 22, 1000 Ljubljana, Slovenia. Email: gp.ip@ip-rs.si. Tel: +386 1 230 97 30. Web: www.ip-rs.si.

If you are resident in another EU country or the United Kingdom, you may also contact your local data protection authority.