Notice to individuals under Article 13 of the General Data Protection Regulation (GDPR) regarding the processing of personal data

The controller of personal data relating to the https://arao.si/ is:

ARAO - Agencija za radioaktivne odpadke, Javni gospodarski zavod

Litostrojska 58/a, 1000 Ljubljana

organisation reg. no.: 5526329000

VAT ID no.: SI 32495854

email address: gp.arao@arao.si

website: https://arao.si/

(hereinafter:ARAO« oz. »zavod«)

V zavodu je imenovana pooblaščena oseba za varstvo osebnih podatkov, ki je dosegljiva na naslovu gp.arao@arao.si, in telefonski številki +386 1 236 32 00. 

Introduction

• Basic information about the organisation and its mission

ARAO je specializirana strokovna organizacija na področju ravnanja z radioaktivnimi odpadki. Izvaja naloge in projekte, za katere jo pooblasti država. Naše poslanstvo  je vzpostavitev celostnega sistema ravnanja z radioaktivnimi odpadki in izrabljenim jedrskim gorivom v Republiki Sloveniji skladno z najvišjimi standardi, ki jih narekuje in razvija stroka.

Taking into account domestic and foreign knowledge, ARAO ensures a system of radioactive waste and spent fuel management that is permanently protective of human health and the environment within and outside the borders of Slovenia, technologically up-to-date on a global scale and economically efficient from a national perspective.

 

For this purpose, ARAO collects, stores and otherwise processes certain information and data, which includes personal data, as provided for by the Personal Data Protection Act (ZVOP-2) and/or Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the "General Data Protection Regulation" or "GDPR").

 

You can find out more about us, our services and other activities  .

 

• Purpose and use of this notice

This notice describes how ARAO processes the personal data of individuals who have provided their personal data directly to us as the controller of their personal data in connection with the https://arao.si/en/ website (e.g. when loading cookies while visiting the website, when filling in and submitting a contact form, etc.).

 

• Use of terms and amendments to this notice

The organisation has appointed a Data Protection Officer, who can be contacted at gp.arao@arao.si.

 

The term website shall mean https://arao.si/en/ and its various sub-domains or related websites, sub-sites and/or related servers and systems (hereinafter: the website).

 

The terms defined in this notice, which are used in the singular form shall be deemed to include the plural form and vice versa, whereby the terms relating to the masculine gender shall be deemed to include all genders.

 

We may update or change the information and references in this notice from time to time, whereby news of major changes shall be posted on our website.

In the event of substantial changes (e.g. to the legal basis and purposes of the processing of data already collected), we shall inform individuals of the proposed changes by email or by other appropriate means.

Overview of the types of personal data, the categories of data subjects, data retention timescales, the legal bases for processing and the purposes and types of processing

** V zvezi z zgoraj navedenimi nameni (npr. hramba podatkov) so podatki lahko posredovani v obdelavo pogodbenim partnerjem zavoda (podobdelovalcem), ki so navedeni v poglavju 3.3. tega obvestila.  Podobdelovalci lahko podatke obdelujejo zgolj v povezavi z izvajanjem nalog, ki so jim bile dodeljene in so v direktni povezavi z zasledovanimi nameni.

Pravna podlaga za obdelavo osebnih podatkov

• Pravna podlaga za obdelavo osebnih podatkov lahko leži v izpolnjevanju sklenjene pogodbe oziroma pogajanjih za sklenitev pogodbe

We may process personal data of individuals on the basis of a contract or placed order (e.g. placing an order for the collection of radioactive waste) or contract negotiations (e.g. when an individual contacts the organisation through our official communication channels and wishes to obtain more information about our services).

In the cases described above, you provide us with personal data as part of a contractual obligation or as part of contract negotiations, and we consequently do not need your explicit consent for the above processing of your personal data.

In principle, you will not suffer any serious negative consequences in situations where we would otherwise need your personal data to perform our services and you do not provide us with such data. However, such situations may make it significantly more difficult or even impossible for us to perform the services you have requested or for us to cooperate with you, in which case you will be informed in advance or subsequently.

• Pravna podlaga za obdelavo vaših podatkov je lahko tudi zakon

The organisation also processes personal data for the purposes of complying with legal and regulatory provisions, in particular those governing the receipt and storage of radioactive waste, as further specified in the subject section of the table under point 1 of this notice.

• Na podlagi zakonitih interesov

We may also process certain personal data for the purposes of protecting our own legitimate interests. This would be the case, for example, where the processing of your data would be necessary for administrative, criminal or civil proceedings (e.g. where our organisation would need to submit the database as evidence in the proceedings, otherwise our organisation would suffer a penalty or serious and irreparable damage), in which case we will always process only the data that is strictly necessary for the pursuit of such legitimate aims

Zavod sme obdelovati osebne podatke posameznika tudi v primerih, ko je obdelava potrebna za zaščito življenjskih interesov posameznika (e.g. access to the address of an individual facing imminent and serious danger to his/her life).

• Na podlagi pridobljenega soglasja

Sodelovanje z nami in koriščenje storitev zavoda načeloma ne pogojujemo s tem, da soglašate z  obdelavo osebnih podatkov.

Kljub temu lahko v zavodu vaše osebne podatke obdelujemo tudi na podlagi vaše izrecne privolitve (tj. soglasja). Kot izrecna privolitev posameznika se šteje njegova prostovoljna izjava volje s katero ta soglaša k obdelavi določenih osebnih podatkov za določen namen (npr. vaše soglašanje k prejemanju naših informativnih sporočil), pri čemer v tovrstnih primerih obdelujemo tiste podatke, ki so navedeni v razdelku tabele iz točke 1, kjer je označeno, da obdelava temelji na soglasju.

Such communications may be revoked at any time by following the link contained in each such email or by contacting us at  gp.arao@arao.si.

However, our online advertising may also be carried out on the basis of your consent if, when you visit our website, you have consented to the placement of optional (advertising) cookies and tracking pixels from our advertising partners (a detailed description of the optional cookies of our advertising partners, the data we process with them and the retention periods for this data is set out on our "Cookies" sub-page, that can be found in the footer of our website).

We guarantee each individual the right to withdraw his or her explicit consent at any time in a simple way, i.e. by contacting us at gp.arao@arao.si.

The withdrawal of consent shall not affect the lawfulness of the processing carried out on the basis of the consent up to the moment of withdrawal.

In the event that you do not consent to the processing of your personal data, give your consent partially or withdraw your consent (partially), we will, as far as possible, only cooperate with you to the extent of the consent given or in the ways permitted by applicable law.

Consent is voluntary and if you decide not to give consent or subsequently withdraw consent, this will in no way prejudice your other rights or constitute an additional cost or aggravating circumstance for you.

How long do we store or process your personal data?

The period of retention of personal data depends on the basis and purpose of the processing of each category of personal data. As a general rule, personal data are kept for as long as necessary to fulfil the purpose for which the data were collected or as long as a regulation requires us to keep them, at which point they are deleted.

Obdobje hrambe posameznih podatkov je natančneje opredeljeno v zgornji tabeli.

Documents and other evidence, if any, that the individual has appended to his emails or has provided to the organisation as proof of eligibility for visiting our center will be returned to the individual by the organisation at the end of procedure for issuing the permit or permanently deleted by our organisation.

Zavod sme podatke hraniti še petnajst dni po poteku navedenih rokov hrambe z namenom, da lahko v tem obdobju izvede uničevanje shranjenih podatkov z vseh nosilcev podatkov in strežnikov.

The deletion of the data may always be requested by the data subject by sending a request to the official e-mail address of our organisation at: gp.arao@arao.si.

Kdo v ARAO in izven njega obdeluje vaše osebne podatke (uporabniki osebnih podatkov)?

• Določeni zaposleni v zavodu

Your personal data is processed by individual employees of our organisation. Employees of the organisation process only those personal data that they need for their work, but they can also share them with each other if their work tasks and internal rules of the organisation allow them to do so. All employees are committed to confidentiality and the protection of personal data.

• Državni organi

In certain cases prescribed by applicable law, the organisation must provide or report your personal data to the competent state authorities as well as to the authorities responsible for financial, tax or other control (e.g. the Slovenian Labour Inspectorate, the Financial Administration of the Republic of Slovenia, courts, the Office of the Information Commissioner of the Republic of Slovenia, the Market Inspectorate of the Republic of Slovenia, etc.). In certain cases, the organisation is compelled to provide data to third parties if such an obligation to provide or disclose the data is imposed on the organisation by law or on the basis of a valid legal right of a third party.

• Pogodbena obdelava osebnih podatkov

In addition to employees of our organisation, employees of contractual processors of the organisation can also act as users of your personal data are, whereby they may only process personal data as confidential information on behalf of our organisation and within the scope and purposes that are laid down by the data processing agreement, which our organisation has entered into with any such processor. Contractual processors may only process personal data in the context of the organisation's instructions since our organisation is acting as the controller of personal data, and may not use the data to pursue any other self-interest.

Our organisation cooperates with the following types of data processors:

• persons/legal entities who cooperate with our organisation on the basis of business or work agreements (legal advice, advertising, IT services, etc.),
• the data hosting provider (see point 3.4.)

Our organisation shall not pass on your personal data to unauthorised third parties.

To obtain an accurate list of all contractual processors of our organisation, please send your request to gp.arao@arao.si.

• Ponudnik gostovanja

The hosting of our website and the storage of the related data is provided by a contractual processor from the Republic of Slovenia, with servers also located in the Republic of Slovenia.

• Iznos osebnih podatkov v tretje države in mednarodne organizacije in ukrepi za zaščito prenesenih podatkov

As a general rule, the organisation does not transfer personal data to third countries (i.e. outside the European Union, Iceland, Norway and Liechtenstein, i.e. the EEA) and to international organisations.

Exceptions to the above-stated are the occasional transfers of certain technical and personal data to the servers of various providers of cookies or plug-ins in relation to the website and our online tools, whose headquarters or servers may be located in the USA (e.g. automatic transfer of certain data collected by cookies and tracking pixels of Alphabet Inc. and Meta Platforms Inc. respectively, entry of email addresses in our tool for sending commercial email messages, etc.).

Under the General Data Protection Regulation (GDPR), the above-mentioned transatlantic transfers may be subject to data protection by implementing so-called Standard Contractual Clauses (SCCs) - which have been "pre-approved" by the European Commission. Our organisation therefore engages the above-mentioned sub-processors to the best of its knowledge and ability on the basis of such Standard Contractual Clauses (SCCs), which have been prepared and publicly disclosed by each of the above-mentioned providers and reviewed by our organisation. These sub-processors are also, for the most part, former members of the Privacy Shield program (https://www.privacyshield.gov/) and have other substantive data protection measures in place.

More detailed information about the categories of users and the contractual data processors can be obtained by sending a request in this respect to the following email address: gp.arao@arao.si.

If you, as an individual, have concerns about the security of your data in the context of such transatlantic transfers, please enquire with our organisation at the above-stated email address before engaging with our organisation.

Processing and protection of special categories of personal data

We do not direct individuals to provide specific personal data (i.e. data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, genetic data or biometric data, data concerning health or data concerning an individual's sex life or sexual orientation) in connection with our website or services.

If our organisation should become aware of a situation in which such data may be disclosed to it, the data received will be protected or otherwise dealt with as appropriate.

What rights do you have in connection with your personal data and how can you exercise them?

In connection with this notice or regarding the processing of your personal data by our organisation and our contractual processors, you can contact us at any time and without hesitation via gp.arao@arao.si.

You can also contact us via the email mentioned above in order to send us your specific requests and requirements and for exercising your other rights, which relate to your personal data and applicable local legislation or the GDPR.

As a data subject, the GDPR grants you the following rights:

• Pravica do dostopa do osebnih podatkov (15. člen uredbe GDPR)

You have the right to obtain from the organisation as the controller of personal data confirmation, whether personal data are processed in relation to you and, where applicable, request access to the personal data concerned together with the information referred to in Article 15 (1) of the GDPR:

When personal data is transferred to a third country or international organisation, you, as the data subject, have the right to be informed of appropriate safeguards in accordance with Article 46 of the GDPR Regulation in respect of such a transfer.

As a controller of personal data, the organisation can also provide you with a copy of the personal data that are processed. For any further copies requested by you, the organisation may charge a reasonable fee based on administrative costs.

Where the data subject submits the request by electronic means, and unless the data subject requests otherwise, the information shall be provided in a commonly used electronic form (i.e. excel spread sheet or other such form).

• Pravica do popravka osebnih podatkov (16. člen uredbe GDPR)

The data subject has the right to obtain that the organisation, as the controller of personal data, corrects inaccurate personal data concerning him without undue delay.

The data subject has the right to supplement incomplete personal data, including the submission of a supplementary statement, taking into account the purposes of the processing. Regarding the above-mentioned, an individual can contact our organisation via email at gp.arao@arao.si.

• Pravica do izbrisa osebnih podatkov (»pravica do pozabe«) (17. člen uredbe GDPR)

The data subject has the right to request that the organisation, as the controller of personal data, correct inaccurate personal data concerning him without undue delay. However, the organisation shall delete personal data without undue delay even when one of the following reasons apply:

a)	personal data will no longer be required for the purposes for which they were collected or otherwise processed;

b)	if the processing of personal data was based on your consent, which you revoked;

c)	if you have objected to the processing of personal data, and there are no overriding legal reasons for the processing,

d)	if the personal data was processed illegally;

e)	if it is necessary to delete personal data in order to fulfill a legal obligation in accordance with the law of the Union or the law of the Republic of Slovenia,

f)	če so bili osebni podatki zbrani v zvezi s ponudbo storitev informacijske družbe (ki je bila ponujena osebi, ki je mlajša od petnajst let in glede tega ni soglašal skrbnik take osebe).

• Pravica do preklica privolitve oziroma delnega preklica privolitve

If, as an individual, you have consented to the processing of your personal data for one or more specific purposesv (see point 1.3 of this general information on the processing of personal data), you have the right to revoke your consent , without prejudice to the lawfulness of the processing of data carried out on the basis of consent until its revocation. In the event of revocation of consent or partial consent, the organisation reserves the right, as far as possible, to cooperate with you only to the extent of the given consent or in the ways permitted by applicable law. Your consent to the processing of personal data is always voluntary and if you choose not to provide it or cancel it later, this in no way interferes with your other rights, arising from the business relationship with the organisation or the GDPR regulation. In these cases you not incur any additional costs or expenses.

Your consent to the processing of personal data for the purposes described in this information is voluntary. Consent to data processing can be restricted or revoked at any time by contacting us at gp.arao@arao.si.

• Pravica do omejitve obdelave (18. člen uredbe GDPR)

As a data subject, you have the right to have the organisation, as the controller, restrict the processing of your personal data when one of the following cases applies:

a)	when, as a data subject, you dispute the accuracy of the data, for a period that allows the organisation to verify the accuracy of the personal data;

b)	where the processing is unlawful and you as a data subject oppose the erasure of personal data and instead request a restriction on their processing;

c)	when the organisation no longer needs personal data for the purposes of processing, but you, as the data subject, need said data to assert, enforce or defend legal claims;

d)	kadar kot posameznik, na katerega se nanašajo osebni podatki, vložite ugovor v zvezi z obdelavo  in dokler se ne preveri, ali zakoniti interesi upravljavca prevladajo nad vašimi razlogi (t.j. razlogi posameznika, na katerega se nanašajo osebni podatki).

Where the processing of personal data has been restricted, such personal data, with the exception of their storage, shall be processed only with the consent of the data subject or to assert, enforce or defend legal claims or to protect the rights of another natural or legal person due to important interests of the European Union or the Republic of Slovenia.

Where the organisation, as the controller, achieves a processing restriction, it shall inform the data subject before lifting the processing restriction.

• Pravica do prenosljivosti podatkov

As an individual, you have the right to receive personal information about you that you have provided to the organisation in a structured, commonly used and machine-readable form, and you have the right to pass this information on to other controllers, without being hindered by the organisation, and precisely:

a) when processing is based on consent or a contract and

b) processing is carried out with automated means.

As a data subject, in exercising the right of portability, you have the right to have personal data transferred directly from one controller (e.g. the organisation) to another where technically feasible.

• Pravica do ugovora obdelavi (21. člen uredbe GDPR) 

Kot  posameznik, na katerega se nanašajo osebni podatki, imate na podlagi razlogov, ki so povezani z vašim posebnim položajem pravico, da ugovarjate obdelavi osebnih podatkov v zvezi z vami, kadar je obdelava potrebna za opravljanje naloge v javnem interesu ali pri izvajanju javne oblasti, dodeljene zavodu, oziroma kadar je obdelava potrebna zaradi zakonitih interesov, za katere si prizadeva zavod ali tretja oseba, razen kadar nad takimi interesi prevladajo interesi ali temeljne pravice in svoboščine posameznika, na katerega se nanašajo osebni podatki, ki zahtevajo varstvo osebnih podatkov, zlasti kadar je posameznik, na katerega se nanašajo osebni podatki, otrok. Navedeno prav tako velja za oblikovanje profilov v takih primerih obdelav.

In the event that you object, the organisation shall stop processing personal data unless it can prove that the legitimate interests for processing outweigh the interests, rights and freedoms of you as a data subject, or that the processing is necessary for the enforcement, implementation or defence of legal claims.

When personal data are processed for direct marketing purposes, the data subject has the right to object at any time to the processing of personal data relating to them for the purposes of such marketing, including the creation of profiles insofar as such direct marketing is concerned.

When the data subject objects to the processing for direct marketing purposes, the personal data is no longer processed for these purposes.

Where the data subject objects to the processing for direct marketing purposes, the personal data shall no longer be processed for those purposes. As part of using information society services, you, as a data subject, can exercise your right to object to processing by automated means technical specifications.

Where data are processed for scientific or historical-research purposes or for statistical purposes, you as the data subject have the right to object to the processing of data relating to you for reasons related to your particular situation, unless the processing is necessary for the performance of a task carried out by reasons of public interest.

• Pravica do vložitve pritožbe pri nadzornem organu

If you believe that the processing of personal data carried out by the organisation in relation to you violates the rules on personal data protection, you, without prejudice to any other (administrative or other) remedy, have the right to lodge a complaint with the supervisory authority in the country in which you have your habitual residence, in which your place of work is located, or in which the violation allegedly occurred (in Slovenia the supervisory authority is the Office of the Information Commissioner of the Republic of Slovenia):

– Informacijski pooblaščenec, Dunajska 22, 1000 Ljubljana, E-mail: gp.ip@ip-rs.com, phone N.: 012309730, webssite: www.ip-rs.com.

Obstoj avtomatiziranega sprejemanja odločitev in oblikovanja profilov

The processing carried out by our organisation does not involve automated decision-making and profiling based on your personal data.

Obdelava osebnih podatkov oseb, ki so mlajše od petnajst let

Zavod je razvoj in delovanje svojih storitev usmeril v zbiranje osebnih podatkov oseb, ki so starejše od petnajst let. V primerih, ko bi se storitev zavoda posluževala mlajša oseba, bo zavod pridobil soglasje starša oz. skrbnika takšne osebe.

V kolikor bo zavod sam naknadno ugotovil, da se v povezavi s storitvijo obdelujejo osebni podatki osebe, ki je mlajša od petnajst let pa njen starš oz. skrbnik s tem ni soglašal, bo naredil vse, kar je potrebno, da se vsi zajeti osebni podatki zbrišejo.

The data subject, or his/her parent or guardian, may at any time submit a request to gp.arao@arao.si  for the deletion of the data concerned.

Na koga se lahko obrnete v zvezi z dodatnimi pojasnili glede obdelovanja osebnih podatkov in glede vaših pravic?

You can contact us at any time regarding the processing of your personal data at gp.arao@arao.si.

Varovanje vaših osebnih podatkov

The organisation carefully stores and protects personal data through organisational, technical and logical technical procedures and measures to protect data from accidental or intentional unauthorised access, destruction, alteration or loss, and unauthorised disclosure or other form of processing to which you have not expressly consented.

To this end, the organisation has also adopted appropriate internal processes and set up various measures (e.g. assigning, using and changing passwords, locking premises, offices, server and workstation locations, regularly updating software and upgrading security-critical components, physically protection of material containing personal data in specially designated places, training of employees, etc.). The organisation also demands these security commitments from its contractual processors.

Verzija in datum objave oziroma zadnje posodobitve tega obvestla

Besedilo tega obvestilo predstavlja verzijo 1.1. tega dokumenta. To obvestilo je bilo nazadnje posodobljeno dne 31. 07. 2024.

ARAO - Agencija za radioaktivne odpadke