Privacy policy

The personal data protection policy, or privacy policy, governs the collection, keeping and processing of personal data that SITIK d.o.o., Cistercian Abbey of Stična collects and processes in connection with visits to the website of the Father Simon Ašič Herbal Pharmacy (www.pater-simon-asic.si), with enquiries, with orders for products and with visits to the shop.

Controller

The controller of personal data, in the sense laid down by the EU General Data Protection Regulation and the applicable law governing the protection of personal data, GDPR, is:

SITIK d.o.o., Cistercian Abbey of Stična

Stična 17

1295 Ivančna Gorica, Slovenia

Telephone: +386 (0)1 787 70 65

Email: info@sitik.si

Personal data and the purpose of processing

In its work, Sitik d.o.o., Cistercian Abbey of Stična collects, processes and keeps the personal data of several groups of individuals. These are people who buy in the online shop, people who create a user account in the online shop, people who present a white prescription with their purchase, people who sign up to receive the newsletter, and people who take part in prize draws. For each group, the personal data collected, the purpose of collection and the period of keeping are set out below.

• Record of buyers in the online shop. Name and surname, address, telephone, email address, details of the purchase. Purpose: delivery of the products ordered and notice of the status of the order. Kept for at most 10 years from the purchase.
• Record of registered users of the online shop. User name, name and surname, address, telephone, email address, details of past purchases. Purpose: delivery of the products ordered, notice of the status of the order, and the possibility of viewing past orders and of buying more quickly. Kept for at most 10 years from the buyer's last activity (login).
• Record of buyers in the physical shop who buy on a white prescription. Name and surname, the herbal blend prescribed. The purpose of processing is the making up and sale of the herbal blend on a white prescription and the later provision of the same service. White prescriptions are kept so that the customer can order the same blend again more easily. Kept for at most 3 years.
• Record of newsletter subscribers. Name and surname, email address. Purpose: informing potential and existing customers who have consented to it about news, offers and the rest of the company's range, and about the company. Kept until consent is withdrawn.
• Record of participants in prize draws. Name and surname, user name on the Facebook social network, address (where a prize is sent by post). The data are obtained for the purpose of running the prize draw itself, of gaining followers on social networks and for the promotion of the company and its products. An address is collected and processed only where a prize is sent by post. Kept for the duration of the prize draw and the handing over of the prize.

Sitik d.o.o., Cistercian Abbey of Stična respects your privacy and is committed to acting carefully and in accordance with the applicable rules on the protection of personal data when collecting, keeping and processing personal data.

To prevent unauthorised access to the data obtained or their disclosure, to keep personal data accurate and to ensure their proper use, we have put in place suitable technical and organisational procedures for securing the data.

Contractual processing and passing to third parties

Your personal data are passed to third parties and to contractual processors only where this is strictly necessary for the successful carrying out of the purpose of processing. These cases are:

• to providers of payment services for the purpose of processing payments, and to banks on the basis of the individual's order for the purposes of performing the contract of sale,
• to carriers or providers of postal services for the purposes of delivering the products ordered, and
• to contractual processors of personal data for the purposes of maintaining the information system and the online shop.

Transfer of data to third countries

In no case do we transfer your data to third countries.

Legal basis

The personal data you give us when placing an order in our online shop are processed with your clear and unambiguous consent, founded on Article 6(1)(a) of the EU General Data Protection Regulation (GDPR), on legitimate interest, or on the basis of performing the contract when products are ordered.

You may withdraw your consent at any time by a message to: info@sitik.si. Any withdrawal of consent does not affect the lawfulness of the processing of your personal data in the time before the withdrawal was given. The withdrawal of consent will be carried out within at most 14 days of receipt of the written request at the email address, in so far as the purpose of processing and the legal basis allow it.

Your rights

Under the provisions of the EU General Data Protection Regulation (GDPR) you have the following rights.

The right to withdraw consent: if, as a user, you have consented to the processing of your personal data (for one or more particular purposes), you have the right to withdraw that consent at any time, without this affecting the lawfulness of the processing carried out on the basis of the consent up to its withdrawal.

The right of access to personal data: as a user you have the right to obtain from the provider (the controller of personal data) confirmation as to whether personal data concerning you are being processed and, where that is so, access to the personal data and to certain information.

The right to rectification of personal data: as a user you have the right to obtain from the provider, without undue delay, the rectification of inaccurate personal data concerning you. Taking into account the purposes of processing, you have the right to have incomplete data completed.

The right to erasure of personal data (the right to be forgotten): as a user you have the right to obtain the erasure of your personal data where there is no longer a justified reason for further processing. Preventing processing is possible in particular circumstances.

The right to restriction of processing: as a user you have the right to obtain from the provider a restriction of processing where you contest the accuracy of the personal data; where the processing is unlawful and you oppose erasure and request a restriction of use instead; and where the data are no longer needed for the purpose of processing but you need them to establish legal claims.

The right to data portability: as a user you have the right to receive the personal data concerning you which you have given to the provider, in a structured, commonly used and machine-readable form.

The right to object to processing: as a user you may object to processing where it is carried out for the performance of tasks in the public interest or in the exercise of official authority, and in the case of direct marketing (including profiling).

Period for which personal data are kept

Sitik d.o.o., Cistercian Abbey of Stična keeps your personal data for as long as is needed for the purpose of processing them. The individual collections of personal data have different periods of keeping. The data of people who make a purchase in the online shop are kept for at most 10 years, but only the data that appear on the invoice (name, surname and address). The data of people with a user account are kept for at most 10 years from their last activity in the online shop. The data of a buyer with a white prescription are kept for at most 3 years from the presentation of the prescription. The data of newsletter recipients are kept until the individual withdraws consent. The data of participants in prize draws are kept only for the period of the prize draw, the drawing of the winner and the handing over or sending of the prize.

Further information and exercising your rights

To exercise any of your rights or to obtain further information, contact our appointed data protection officer, who is available at the email address: info@sitik.si. We will consider your application and answer it in accordance with the EU General Data Protection Regulation, GDPR.

Stična, 1 February 2023

Sitik d. o. o., Cistercian Abbey of Stična