Personal data protection and privacy policy
At Šeherezada we value your trust. We process your personal data in line with Regulation (EU) 2016/679 (the General Data Protection Regulation — GDPR), the Slovenian Personal Data Protection Act (ZVOP-2) and applicable Slovenian law.
1. Data controller
The controller of the personal data collected through this website or in the course of our hospitality services is:
ADL d.o.o.
- Brand:Šeherezada
- Registered office:Trubarjeva cesta 31, 1000 Ljubljana, Slovenija
- Company registration number:3999521000
- Locations:Trubarjeva cesta 31 and Slovenska cesta 55, Ljubljana
Privacy contact point
- Email:info@seherezada.net
- Phone:+386 69 314 316
- Privacy questions:please use the email address or phone number above
2. What personal data we collect and why
We collect and process personal data only to the extent strictly necessary for each specific purpose:
Contact form and enquiries
When you send us a message through the web form, we collect your name, email address, phone number and the content of your message. We use this data solely to prepare a reply or to confirm your enquiry.
Job applications
When you apply for a job, we process your contact details, CV and work experience. We keep this data only for the duration of the selection process, or with your consent for future opportunities.
Technical server logs
When you visit the website, the web server automatically records technical data (IP address, browser type, date and time of access). This data serves to keep the network secure and running smoothly.
Student meals (vouchers)
When a student voucher is used, validation is carried out through the official state ŠOS terminal. Šeherezada does not store your personal student data in its own systems.
QR codes on printed materials and in our restaurants
Some of our QR codes (e.g. on flyers or tables) first take you to a short link seherezada.net/q/… and immediately redirect you onward (e.g. to our Google reviews). When this happens we record the date and time of the scan, an approximate location (country, region, city) that our hosting provider derives from the IP address, the type and model of the device, the operating system, the browser and the device language. We do not store the IP address; to count distinct visitors we only use a pseudonymous identifier that changes every day, so you cannot be tracked across days. We do not set any cookies. The same applies to our link pages (seherezada.net/links/…): when you press a button there, the link goes through the same short link and is recorded in the same way. We use this data only for aggregate statistics on how often and where our QR codes and buttons are used. After the redirect, the privacy policy of the destination site applies.
3. Legal bases for processing
We process your personal data on the following legal bases under Article 6 of the GDPR:
• Performance of a contract or pre-contractual steps (Article 6(1)(b) GDPR): Processing food orders and replies to enquiries.
• Explicit consent (Article 6(1)(a) GDPR): For optional cookies and for keeping a CV for future positions. We do not send email newsletters.
• Legitimate interests (Article 6(1)(f) GDPR): To keep IT systems secure, prevent misuse, improve how the website performs and measure the use of our QR codes (aggregate scan statistics).
4. Your rights regarding your personal data
Under the GDPR you have the following rights at any time:
Right of access
You have the right to obtain confirmation of whether we process your data, and to request free access to it.
Right to rectification
You may request that inaccurate personal data be corrected without delay, or that incomplete data be completed.
Right to erasure
You may request that your data be erased (the “right to be forgotten”) where there is no longer a legal reason to keep it.
Restriction of processing
You have the right to request that processing be temporarily restricted, in the event of an objection or while accuracy is being verified.
Data portability
You may receive the data you provided to us in a structured, commonly used and machine-readable format.
Right to object
You may object at any time to processing based on legitimate interest, or withdraw consent you have given.
You can exercise all of the rights above with a simple written message to info@seherezada.net. We will respond to your request without undue delay, and within 30 days at the latest.
5. Data security and retention
To protect your data we use up-to-date technical and organisational measures, including encrypted connections (SSL/TLS certificate), secure server protocols and limited access for authorised staff only.
We keep data only for as long as is necessary for the purpose for which it was collected, or until you withdraw your consent, or until the statutory retention periods for business records expire.
Records of QR code scans are kept for 24 months and are then deleted automatically. For attempts to sign in to the protected part of the website, we keep only a hashed (irreversibly transformed) form of the IP address, for no longer than 24 hours, to prevent password guessing.
6. Who we share data with
We do not sell your personal data and we do not pass it on for advertising. To run this website, however, we work with providers that process data on our instructions:
• Vercel (Vercel Inc.) — our hosting provider; the servers that handle requests are in Frankfurt (EU). With every visit it records the technical data needed to deliver the page (IP address, browser type, time of request), and when a QR code is scanned it derives an approximate location from the IP address. We do not use this data to analyse visits to the website. Any transfer to the USA is safeguarded by the EU Standard Contractual Clauses.
• Google Maps — the Contact and Locations pages have a Google map embedded in them. It loads only after you consent, or when you click the button in its place. Google Ireland Ltd. then displays the map, receives your IP address in the process and sets its own cookies. We do not use the map to analyse visits.
• Google Analytics — loads only if you choose “Accept all” in the banner. We use it to count visits and clicks (e.g. on the phone number or on directions to a location), so we know what guests find useful on the site. In the process Google Ireland Ltd. receives your IP address, which it does not store, along with information about your browser, device and the pages you visit. We do not use Google signals or advertising features. Data is kept for 14 months. Any transfer to the US is covered by the EU-US Data Privacy Framework. You can withdraw your consent at any time on the Cookies page.
• Zoho Mail — a message you send us through the contact form travels via the e-mail provider Zoho, where our mailbox is hosted. The account is in Zoho's European data centre, so the data does not leave the European Union. In doing so Zoho processes your name, e-mail address, phone number and the content of your message.
• Supabase (Supabase Inc.) — the records of QR code scans described in section 2 are stored in a database with this provider, in its data centre in Frankfurt (EU). Any access from the USA is safeguarded by the EU Standard Contractual Clauses.
Beyond that, we disclose data only where required to do so by law or by a competent public authority.
7. Supervisory authority in the Republic of Slovenia
If you believe that the processing of your personal data breaches applicable law, you have the right to lodge a complaint with the competent supervisory authority:
Information Commissioner of the Republic of Slovenia
Address: Dunajska cesta 22, 1000 Ljubljana
Email: gp.ip@ip-rs.si | Phone: +386 1 230 97 30
Website: www.ip-rs.si