Privacy Policy

Controller

The controller of personal data is EKO TOK Julijana Andrejčič s.p.; the business address is not published yet.

Contact details for the controller are not published yet. You can reach the controller through the enquiry form on the booking page.

What data is processed

When you submit the booking form we process: first name, surname, town of residence, email address, phone number, message, the selected rental dates, chosen language, submission time and your acceptance of the rental terms. The name, surname and town of residence are compared against a photo ID at pickup (see the identity-verification section).

In addition, the following technical data is processed:

• a hashed (HMAC) IP address, used solely to limit abuse of the form,
• server error logs, which contain no form content,
• a log of sent emails — only the recipient, message type and delivery success are recorded, never the content.

If we issue you an invoice or proforma for the rental, your name, surname and town of residence are recorded on the document; this data forms part of the tax and accounting records.

Identification at pickup

At pickup, we verify your identity by viewing a valid identity document. We never copy, photograph or scan your document, and we never withhold it. Only the following goes into the rental contract or the handover record: your first and last name, address, and the type and number of the document.

For this data:

• the legal bases are performance of the rental contract (Article 6(1)(b) GDPR) and our legitimate interest in pursuing any claims arising from the rental (Article 6(1)(f) GDPR),
• it is kept until the equipment is returned and all obligations are settled, and then deleted within 30 days,
• in the event of a dispute, it is kept until the proceedings end or the limitation periods expire (3–5 years under the Slovenian Obligations Code),
• it is not passed on to third parties and is never used for marketing.

Purposes and legal bases

Data is processed for the following purposes:

• performance of the rental contract (Article 6(1)(b) GDPR): receiving your booking, confirming the dates and communicating about the rental,
• legitimate interest (Article 6(1)(f) GDPR): preventing abuse of the form (limiting the number of attempts, a hidden honeypot field that catches automated submissions) and keeping the site secure,
• compliance with legal obligations (Article 6(1)(c) GDPR): issuing and retaining invoices and other tax and accounting records.

Data retention

Data is kept only as long as necessary:

• confirmed and completed bookings are anonymised 24 months after the end of the rental,
• enquiries that were never confirmed are deleted after 3 months; if an invoice or proforma was issued for one, it is anonymised instead of deleted, because the document must be kept for 10 years,
• hashed IP addresses used for rate limiting are deleted within about 7 days,
• server logs are rotated and contain no personal data from the forms,
• issued invoices and proformas (which contain your name, surname and place of residence) are kept for 10 years as required by tax and accounting law (Article 86 of the Slovenian VAT Act); these documents are not anonymised early.

On your request, data is anonymised sooner (right to erasure). An exception is the data on already-issued invoices and proformas, which we are legally required to keep for 10 years and therefore cannot delete until that period lapses (Article 17(3)(b) GDPR).

Processors and recipients

Server and email hosting is provided by Hostinger International Ltd., acting as a processor. Data is not passed on to other recipients and is never sold.

Your rights

You have the right to access your data, and to rectification, erasure (anonymisation), restriction of processing, objection and data portability. No contact email is published for the controller yet, so send your request through the enquiry form on the booking page and quote your booking reference in the message.

You can lodge a complaint with the Information Commissioner of the Republic of Slovenia (ip-rs.si).

The right to erasure does not apply to data on already-issued invoices and proformas for as long as the legal obligation to retain them lasts (10 years).

Cookies

Public pages set no cookies and use no external services, so no cookie banner is required.

The only cookie on the entire site is the strictly necessary session cookie of the admin login, which is available only to the owner. Your language choice is not stored in cookies.

Profiling and automated decision-making

No profiling or automated decision-making takes place.

Governing text

This policy is published in Slovenian and English. In case of any discrepancy between the versions, the Slovenian text prevails.