Personal Data Protection Notification

The controller of the personal data processed in accordance with this Notification is Eligma Ltd. (“Eligma”), company registration number 8106452000, with business address at Letaliska cesta 33F, 1000 Ljubljana, Slovenia. If you have any questions or requirements regarding the processing of your personal data, please send them to e-mail address [email protected].

Data protection officer (DPO) at Eligma is Luka Planinc, who is available at [email protected]. You can contact him for further explanations and information regarding personal data protection.

We only collect your personal data when this is absolutely necessary or when you have given your consent. We will not process your personal data if the purpose of or basis for their processing is not supported by the applicable regulations in the field of personal data protection (the Personal Data Protection Act, the Official Gazette of the Republic of Slovenia No. 94/07 – official consolidated version and 177/20 (ZVOP-1) and Regulation (EU)  2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR)) and our internal policies.

Eligma’s processing of your personal data will be based on the following legal basis:

1. By visiting our website https://elly.com/pos/en, you accept and agree with the General Terms of Use of this website and enter into an agreement with Eligma and/or you entered or you are in the process of entering into an agreement for the use of Elly POS service, which constitutes a contractual basis for processing your personal data. The data is coded and transferred to the server in a protected format. Such system prevents your personal data to be intercepted.

2. Eligma also processes your data for compliance with a legal obligation to which the controller is subject:

• the national legislation, i.a. the Prevention of Money Laundering and Terrorist Financing Act (the Official Gazette of the Republic of Slovenia, No. 68/16, 81/19, 91/20 in 2/21 – popr; ZPPDFT-1), the Personal Data Protection Act (the Official Gazette of the Republic of Slovenia No. 94/07 – official consolidated version and 177/20 (ZVOP-1), the Copyright and Related Rights Act (the Official Gazette of the Republic of Slovenia No. 16/07 – official consolidated version, 68/08, 110/13, 56/15 in 63/16 – ZKUASP and 59/19; ZASP), etc.,
• other international agreements and EU regulations that oblige Eligma to provide personal data of individuals to state authorities and other controllers in certain cases to comply with its own or their legal obligations or competences.

3. Eligma can process personal data for the purposes of the legitimate interests pursued by the controller regarding the implementation of the agreement laid down in Item 1 of this chapter, e.g.:

• for statistical purposes,
• for identifying server problems and for website editing,
• for business analyses,
• for offer development,
• for information system safety,
• for improving or adapting the services to the individual,
• for measuring the efficiency of its promotional activities and advertising,
• on the basis of other legitimate interests.

4. In certain cases, Eligma can process your personal data on the basis of your personal consent to perform marketing activities like sending newsletters and general notifications on the offer, novelties, advantages and events. The personal consent is completely voluntary and is not a prerequisite for entering the agreement. In such cases, the processing takes places on the basis of a declaration of intent and the agreed ways of notification until the withdrawal of consent.

5. During one’s visit, Eligma also collects one’s personal data through cookies, based on the legitimate interests for the purpose of improving the functionalities, user experience, safety, for smooth website functioning and for counting its website visitors. All further information on the use of cookies is accessible at the following link.

We acquire personal data from various sources. In most cases, they are supplied by you directly through visiting our website, filling out online forms for a customer identification and verification and / or subscribing to our newsletter. We can also use other information and data accessible through or provided by public sources (public registers, databases, internet applications, social media).

Eligma processes the following types of personal data:

a) contact information

This includes all the personal data you provide when filling in online forms or communicating with us by phone, e-mail or in any other way. It also includes all the data you provide when you fill out the form for entering into an agreement for the use of Elly POS system on the website, subscribe to our newsletter, or report any kind of problem that arises during your visits to our website. In such cases, we collect and save data which can include your name, company name, e-mail address, phone number, address and other provided data.

b) server data

When you use this website, we collect various data in the server log, i.a.: the dates and times of the visits; the visited subpages; your IP address; time zone settings; the time you have spent on our website: the websites you visit immediately before or immediately after visiting our website; screenshots of clicks on this website; the information you viewed or sought; webpage response time; downloading errors; the lengths of the visits to individual webpages and data on webpage interactions.

c) device data

We collect data on the computer or mobile device which you use to access this website, including its model, the operating system and version of your software, the internet browser used and other identifiers of your device.

d) data on the use of our services

To target our services, we use data on which of our services you already use, for how long, under what conditions and whether you have kept or cancelled them. We know how frequently and for what purposes you use our individual services.

e) data on contacts with us

We keep records of your contacts with us, especially of the dates (sometimes also times) of the contacts and the reasons for them. This holds for all kinds of contacts (phone, SMS, regular mail, e-mail, live).

f) data from social networks

In our marketing campaigns, we also use social media (e.g. Facebook) and, although we do not keep the data published on your profile, we use it for targeted marketing activities, but only if you consent to this during your use of the aforementioned media. In the scope of third-party cookies, we also offer user service improvements, content dissemination through various social media and personalisation of our offer according to your wishes and requirements which are evident from your previous web browsing. Despite all of our efforts, we can not guarantee for the security of the content of the connected external websites or check such content. You therefore click external links at your own risk. We are not liable for any damages or implications resulting from visiting any aforementioned external link. If you follow a link to another website, you thereby leave our website and this Personal Data Protection Notification does not apply to your use of other websites or your activities on them.

g) geolocation data

Geolocation data or GPS coordinates (longitude, latitude) is acquired at your visit to our website in order to be able to help you find the most suitable end product and / or service. Eligma processes location data in a form that can not be connected to a specific or identifiable person, or on the basis of prior user consent.

Your personal data will only be revealed to those third parties that will process your personal data on our behalf. The third parties are our contract partners performing use analysis, e-mailing, consulting, direct marketing as well as data collecting and storing services on our behalf. Your personal data constitutes a business secret of Eligma. Eligma’s employees process your personal data in accordance with their authorisations and our internal policies. The contracted data processors are obliged to protect confidential data and respect the rights of individuals in the same manner as Eligma’s employees, therefore, your data is safe.

Where we transfer your personal data outside the European Economic Area, we will ensure that it is protected and transferred in a manner consistent with the legal requirements applicable to personal data. This can be done in a number of different ways, for instance:

1. the country to which we send your personal data was approved by the European Commission;
2. the recipient of your personal data signed a contract based on “model contractual clauses” approved by the European Commission, obliging them to protect your personal data.

In all other circumstances, the law may permit us to otherwise transfer your personal data outside the European Economic Area. In all cases, however, any transfer of your personal data will be compliant with the applicable data protection legislation.

In the scope of our legal obligations, we may communicate your personal data to the regulatory authorities for the purposes of discovery and prevention of money laundering and terrorist financing as well as for prevention and investigation of abuse or fraud in connection with the use of the Elly POS service.

In order to protect personal data, Eligma will use all the organisational, technical and other suitable procedures and measures necessary to prevent unauthorised data destruction, modification, loss or any unauthorised processing. Among others, these measures can include internal rules on personal data protection, additional employee training, internal controls of processing activities, etc. Other possible measures can include minimalization of personal data collection, pseudonymisation, transparency, enabling individuals to monitor the processing, as well as continuous safety measure upgrades.

The period of keeping your personal data depends on the basis and purposes of processing an individual personal data category. Personal data is only kept for as long as this is legally required or allowed and absolutely necessary to achieve the purpose for which the data has been collected or processed. After achieving the purpose, we will only keep the personal data we are legally obliged to keep, or we might need for evidence or defence purposes in case of a possibility of legal claims. The rest of the data is erased, blocked or anonymised unless otherwise legally required for certain types of data.

The personal data that we process to send offers and notifications on novelties is kept until your consent withdrawal or, in any case, for a maximum period of five years from your consent. After that period, we will again ask you for your consent.

You can always request to view or access your personal data, or request its correction or erasure, or restrict or object to its processing. We will notify you if your request affects the possibility of further operation of the website or our business cooperation. In certain cases, you also have the right to port your personal data to a different controller. This depends on the technical capacities and internal policies of individual controllers.

Your consent to the processing of personal data for the purpose of sending offers and novelty notifications may be withdrawn at any time; however, the withdrawal of your consent does not affect the lawfulness of the processing of your personal data on the basis of your consent for the period prior to the withdrawal.

Eligma does not take responsibility for the credibility, accuracy and currency of the personal data you provide. The user themselves is obliged to ensure the accuracy and currency of all the data they provide.

In the event of a violation of protection of your personal data, we will notify you in accordance with the conditions laid down by the applicable legislation.

Your requests will be fulfilled without undue delay, but in any case, within one month of the receipt of your request unless otherwise provided by the applicable legislation. In the event of complexity and a large number of requests, this time limit may be extended by up to two months. We will notify you of any such extension within one month of receiving your request, together with the reasons for the delay.

If you believe that we do not process your personal data in accordance with the applicable legislation, you can file a complaint with the Slovenian Information Commissioner at the e-mail address [email protected] or by regular mail to Information Commissioner of the Republic of Slovenia, Dunajska cesta 22, 1000 Ljubljana, Slovenia. Nevertheless, we will greatly appreciate it if you communicate your misgivings, comments or suggestions to us prior to contacting the Information Commissioner.

This Notification is published on the website https://elly.com/pos/en and enters into force on 15 March 2021.  

In addition to this Notification, we also advise you to read the General Terms of Use of this website, which are published on our website and form a binding agreement between you and Eligma together with this Notification and potentially the Contract for the rental and use of Elly POS terminals.

This notification may be changed at any time if this is necessary due to a change of personal data processing or due to a new interpretation, decision or opinion in connection with the personal data processing legislation. Any notification changes will be communicated to you in advance.