Personal data protection and privacy policy
At Šeherezada we value your trust. We process your personal data in line with Regulation (EU) 2016/679 (the General Data Protection Regulation — GDPR), the Slovenian Personal Data Protection Act (ZVOP-2) and applicable Slovenian law.
1. Data controller
The controller of the personal data collected through this website or in the course of our hospitality services is:
ADL d.o.o.
- Brand:Šeherezada
- Registered office:Trubarjeva cesta 31, 1000 Ljubljana, Slovenija
- Company registration number:3999521000
- Locations:Trubarjeva cesta 31 and Slovenska cesta 55, Ljubljana
Privacy contact point
- Email:info@seherezada.net
- Phone:+386 69 314 316
- Privacy questions:please use the email address or phone number above
2. What personal data we collect and why
We collect and process personal data only to the extent strictly necessary for each specific purpose:
Contact form and enquiries
When you send us a message through the web form, we collect your name, email address, phone number and the content of your message. We use this data solely to prepare a reply or to confirm your enquiry.
Job applications
When you apply for a job, we process your contact details, CV and work experience. We keep this data only for the duration of the selection process, or with your consent for future opportunities.
Technical server logs
When you visit the website, the web server automatically records technical data (IP address, browser type, date and time of access). This data serves to keep the network secure and running smoothly.
Student meals (vouchers)
When a student voucher is used, validation is carried out through the official state ŠOS terminal. Šeherezada does not store your personal student data in its own systems.
3. Legal bases for processing
We process your personal data on the following legal bases under Article 6 of the GDPR:
• Performance of a contract or pre-contractual steps (Article 6(1)(b) GDPR): Processing food orders and replies to enquiries.
• Explicit consent (Article 6(1)(a) GDPR): For optional cookies and for keeping a CV for future positions. We do not send email newsletters.
• Legitimate interests (Article 6(1)(f) GDPR): To keep IT systems secure, prevent misuse and improve how the website performs.
4. Your rights regarding your personal data
Under the GDPR you have the following rights at any time:
Right of access
You have the right to obtain confirmation of whether we process your data, and to request free access to it.
Right to rectification
You may request that inaccurate personal data be corrected without delay, or that incomplete data be completed.
Right to erasure
You may request that your data be erased (the “right to be forgotten”) where there is no longer a legal reason to keep it.
Restriction of processing
You have the right to request that processing be temporarily restricted, in the event of an objection or while accuracy is being verified.
Data portability
You may receive the data you provided to us in a structured, commonly used and machine-readable format.
Right to object
You may object at any time to processing based on legitimate interest, or withdraw consent you have given.
You can exercise all of the rights above with a simple written message to info@seherezada.net. We will respond to your request without undue delay, and within 30 days at the latest.
5. Data security and retention
To protect your data we use up-to-date technical and organisational measures, including encrypted connections (SSL/TLS certificate), secure server protocols and limited access for authorised staff only.
We keep data only for as long as is necessary for the purpose for which it was collected, or until you withdraw your consent, or until the statutory retention periods for business records expire.
6. Who we share data with
We do not sell your personal data and we do not pass it on for advertising. To run this website, however, we work with a provider that processes data on our instructions:
• Hosting provider — with every visit the server records the technical data needed to deliver the page (IP address, browser type, time of request). We do not use this data to analyse visits.
• Google Maps — the Contact and Locations pages have a Google map embedded in them. It loads only after you consent, or when you click the button in its place. Google Ireland Ltd. then displays the map, receives your IP address in the process and sets its own cookies. We do not use the map to analyse visits.
Beyond that, we disclose data only where required to do so by law or by a competent public authority.
7. Supervisory authority in the Republic of Slovenia
If you believe that the processing of your personal data breaches applicable law, you have the right to lodge a complaint with the competent supervisory authority:
Information Commissioner of the Republic of Slovenia
Address: Dunajska cesta 22, 1000 Ljubljana
Email: gp.ip@ip-rs.si | Phone: +386 1 230 97 30
Website: www.ip-rs.si