This Privacy Policy (hereinafter referred to as "Policy") applies to any individual whose personal data is processed by the company Postojnska jama d.d.

With a view to implementing the principle of fair and transparent processing of personal data, the company Postojnska jama d.d. has, as a controller of your personal data, prepared this Policy, which allows individuals to obtain all the relevant information pertaining to their personal data in a one place.

The company Postojnska jama d.d. respects your privacy and has undertaken to use your personal data solely for the purposes specified in this Policy. The company will exercise due diligence in protecting your personal data in compliance with the legislation governing the personal data protection (in particular Regulation (EU) 2016/679 (hereinafter referred to as "GDPR") and the Personal Data Protection Act (ZVOP-1) and other internal rules set out by the company Postojnska jama d.d., which govern the field of personal data protection.

1. Personal Data Controller 

Your personal data controller is the company Postojnska jama d.d., Jamska cesta 30, 6230 Postojna. For further information or additional questions regarding the protection of your personal data, contact us by emailing info@postojnska-jama.eu.

2. Types of Personal Data and the Purpose of Its Use

The company Postojnska jama d.d. collects and processes personal data based on the consent given by the data subjects and/or for the purposes of carrying out contracts and pre-contractual measures, as well as based on legitimate interest.

2.1. Consent-Based Data Processing

The processing of personal data can be based on a specific consent granted by an individual, who allows the company Postojnska jama d.d. to use the their personal data for the purposes specified in the consent, namely for the purposes of marketing activities, such as informing the individual about the available products and services, new products and services, benefits, for the distribution of magazines, brochures and other promotional materials related to the products and services offered by the company Postojnska jama d.d., affiliated companies and its business partners.

Based on the consent, the following personal data is collected and processed by the company Postojnska jama d.d.:

- from individuals who are consumers: first name, surname, email address, telephone number, country of residence. The country of residence data is needed so the communication to be sent to you in the most appropriate language version;

- from individuals other than consumers (company representatives): first name, surname, email address and telephone number.

You will receive information via the contact details provided by you.

The consent is given for the purposes specified in the consent and is valid until the consent is revoked. When an individual revokes their consent in whole or in part, their data will no longer be used for the purposes which the consent has been revoked for. If an individual wishes to cancel their consent, they can email us at info@postojnska-jama.eu. An individual can "unsubscribe" from receiving individual messages at any time using the communication channel through which a specific message has been received. The unsubscribe link or the information on how to unsubscribe is found in the message. The individual's unsubscribe request will be recorded in our system and will be implemented either immediately or no later than 15 days after receiving it.

In the event that an individual fails to give consent for the aforementioned personal data processing purposes, gives only a partial consent or revokes the consent (partially), the company Postojnska jama d.d. will be informing such an individual only in cases and within the scope of the granted consent or in the manner permitted by the applicable law.

Conclusion of the contract for the purchase of tickets for tours of the sights managed by the company Postojnska jama d.d. or other products and holiday arrangements and/or for reservations of rooms in Hotel Jama is not conditional on the consent for the performance of marketing activities. Giving consent is voluntary and if an individual decides they do not want to give it or decides to revoke it at a later time, this in no case reduces their rights pursuant to the contract and does not result in any additional costs or aggravating circumstances.

The company Postojnska jama d.d. will process personal data in accordance with the individual's consent received last, regardless of the communication channel through which the consent was given.

2.2. Contract-Based Data Processing 

The company Postojnska jama d.d. collects and processes individuals' personal data in accordance with a concluded contract for (i) the purchase of tickets for tours of sights managed by the company Postojnska jama d.d. or other products and holiday arrangements as defined in the General Terms and Conditions; and (ii) reservation of rooms in Hotel Jama and Apartments Proteus (Apartmaji Proteus).

(iii) Furthermore, the company Postojska jama d.d. collects and processes individuals' personal data in accordance with contracts concluded with their business partners. Pursuant to these contracts, the company collects the personal data of those individuals that are in some way necessary for the execution of the contract.

Personal data collected on these grounds are necessary for the purposes of executing the concluded contracts (for the purpose of providing the aforementioned services and/or products) and measures prior to the conclusion of the contract. If such personal data is not provided or if the data subject does not agree with the data being processed, it will not be possible to conclude the aforementioned contracts and we will withdraw from the previously concluded contracts.

(i) The following personal data is collected and processed by the company Postojnska jama d.d for the purposes of executing the contract for the purchase of tickets for tours of the sights managed by the company Postojnska jama d.d. or other products and holiday arrangements: first name, surname, email address, telephone number, country of residence, language settings.

(ii) The following individuals' personal data is collected and processed by the company Postojnska jama d.d for the purposes of executing the contract for reservations of rooms in Hotel Jama: first name, surname, email address, telephone number, address, country of residence, language settings.

(iii) As a general rule, the following personal data is collected by the company Postojnska jama d.d for the purposes of executing contracts with the company's business partners: first name, surname, email address, telephone number. Pursuant to these contracts, the company Postojnska jama d.d can also collect other personal data, which are specified in individual contracts and are necessary for a contract to be executed.

The company Postojnska jama d.d does not collect any payment card-related numbers or other data provided by buyers through the websites www.postojnska-jama.eu or tickets.postojnska-jama.eu. Such data is collected exclusively by credit card payment providers.

2.3. Data processing based on legitimate interest

Photography for the purpose of purchasing the photographs at a later time

Before touring Postojna Cave, visitors can voluntarily decide to be photographed for the purpose of purchasing the photographs at a later time – they are not entitled to any compensation for this. Visitors who do not wish to be photographed, shall validate their Postojna Cave tickets at the rightmost entrance, i.e. ticket validator marked 3 (three), where no photographs are taken. Being photographed is not a prerequisite for entry to Postojna Cave. The photographs are displayed on display stands at the exit. They can be purchased on a completely voluntary basis and a receipt is issued for each purchase. The photographs are kept until visitors have left Postojna Cave; unsold photographs are destroyed and removed from digital storage media.

The photographs are taken by Postojnska jama d.d., the company that is also the controller of the personal data – the photographs.

The purpose of taking photographs is to give visitors an opportunity to buy photographs as a memento of their cave tour.

The processing, i.e. the photography, takes place based on Article 6(1)(f) of the General Data Protection Regulation (GDPR) – it is necessary due to the legitimate interests pursued by the data controller, i.e. the pursuit of profit-making interests (generating revenue through the sale of photographs) and to make the tour experience more memorable for the visitors. The users of the photographs are employed by the data controller in the photo department, the commerce department and the marketing department. The photographs are not transferred to third countries. They are retained until they are destroyed: unsold photographs are cleared and destroyed after visitors who were part of a particular cave tour have left the photo display area. They are placed in a box that is stored and locked in the photo department. The company has a contract with a document destruction company that takes care of the removal and destruction of the photographs. Unsold photographs are immediately deleted from the digital storage media. No automated decision-making is used in relation to this type of personal data processing.

Video Surveillance

The company Postojnska jama d.d. carries out video surveillance of its business premises and its business units Hotel Cerkno Thermal Spa and Ski Resort (PE Terme in smučišče Hotel Cerkno) and Vila Planinka, the surroundings of the entire area used by the company and the company’s sports arenas and recreational areas.

Video surveillance (cameras installed in marked areas) is used to monitor people entering and exiting said premises and areas to ensure the safety of people or property and to control entry to or exit from those premises (pursuant to Article 77 of the Personal Data Protection Act – ZVOP-2). Video surveillance of car-park, sports and park areas is carried out for the purpose of controlling the appropriate use of sports areas and compliance with contractual obligations and compliance with the regulations based on which the activity is carried out.

Video surveillance is also carried out within certain work areas where CCTV is strictly necessary to ensure the safety of people and property or to protect classified information and business secrets. Video surveillance assists the company in detecting, handling or resolving incidents, crimes, claims for damages or other claims. The CCTV recordings are kept for up to 70 days. Video surveillance is not carried out in a way that would have a particular processing impact. Nor does video surveillance allow for unusual further processing, such as transfers to third country entities, the possibility of audio intervention in the event of real-time monitoring. Video surveillance allows an authorised person to monitor events in real time. All the information regarding the video surveillance can be obtained by calling +386 (0)5 700 01 00 or emailing info@postojnska-jama.eu. The rights of individuals are described in this Legal Notice.

3. Personal Data Users 

Personal data users are employees of the company Postojnska jama d.d. from the sales, marketing, IT departments and Hotel Jama, as well as contractual data processors, who are obliged to protect individuals' personal data in accordance with the legislation, the labour law, personal data processing contracts, sensitive data protection contracts, and the like.

Detailed information concerning the categories of users and contractual processors are available on request by emailing info@postojnska-jama.eu.

4. Contractual Processing of Personal Data 

Individual tasks related to individuals' personal data may be entrusted to other persons (contractual data processors). Contractual data processors may process the data provided to them solely on behalf of the company Postojnska jama d.d., within the limits of the company’s authorisation (in a written contract or some other legal act) and in accordance with the purposes defined in this Policy. 

5. Transmission of Personal Data to Third Countries 

The company Postojnska jama d.d. does not forward the collected personal data to third countries, except when electronic messages are sent through MailChimp. This online marketing automation platform keeps personal data for sending messages intended to facilitate the execution of the contract (first name, surname, email address, telephone number, country), sending emails about special offers and news for business users (first name, telephone number, company) and sending emails about special offers and new products/services for individuals (first name, surname, email address, telephone number, country).

The company Postojnska jama d.d. will temporarily suspend sending messages via the aforementioned online platform. It will resume sending messages in accordance with Paragraph 1 after it has received confirmation from the online platform that an adequate level of privacy is ensured for the data transferred from the EU in accordance with the new framework based on the decision of the European Commission. The company’s Privacy Policy will be updated accordingly.

6. Personal Data Protection 

To ensure the protection of personal data, the company Postojnska jama d.d. carries out all the necessary legal, organisational and adequate logistical and technical procedures and measures, either on its own in accordance with the internal rules, or through the company's contractual partners, by:

• protecting the premises, equipment and system software, including input/output units;
• protecting the application software used for personal data processing;
• preventing unauthorised access to personal data during data transmission, including the transmission using telecommunication means and networks;
• guaranteeing an effective method of blocking, disposing of, erasing and anonymising personal data;
• allowing to subsequently find out when individual items of personal data were used and entered into the database and who this was done by; this can be done for the period during which individual items of data are stored.

7. Personal Data Retention Period 

The personal data retention period depends on the processing basis and the purpose of processing a particular category of personal data. Personal data is stored only for the period required to achieve the purpose for which it was collected or processed further. Unless there is another lawful basis or if this is necessary for the enforcement, execution or defence of legal claims, personal data shall, after the purpose of processing has been accomplished, be erased, disposed of, blocked or anonymised.

Unless this Legal Notice contains other explicit provisions, the personal data retention period is as described below. 

Personal data processed under the contract will be retained for the duration of the period necessary to execute the contract and for a further 5 years after its termination, except in cases when a contract-related dispute arises between us and the individual the personal data relates to (the data subject); in such a case, the data is retained for another 5 years after the finality of a judicial or arbitration decision or settlement, or if there was no judicial dispute, for 5 years from the date of consensual dispute resolution. Invoices are archived for 10 years after the end of the year an invoice relates to in compliance with the act governing value added tax.

Personal data acquired by consent to carry out marketing activities are kept until the consent has been revoked.

8. Individuals' Rights 

If individuals wish to obtain information about all the purposes for which the company Postojnska jama d.d. uses their personal data, they may request this by exercising the right of access. Postojnska jama d.d. will provide them with a detailed list of all the processing of their personal data and related lawful bases.

Postojnska jama d.d. provides individuals whose personal data it processed with the option of exercising their rights, in particular the right of access to personal data, the right to rectification, the right to erasure and the right to object. An individual can file a request in a way that allows their identification (for instance, an oral request with the accompanying minutes, made at the seat of the company Postojnska jama d.d., a written request addressed to Postojnska jama d.d., Jamska cesta 30, 6230 Postojna). A copy of the personal data processed and the requested data shall be provided to an individual free of charge. A reasonable fee can be charged for additional copies requested by an individual, taking into account administrative costs. However, where an individual's requests are clearly unfounded or excessive, in particular because they are repetitive, the following may be done: (1) charge a reasonable fee taking into account the administrative costs of providing the requested data or communication or the implementation of the requested measure, or (2) refuse to act on the request.

The individual has the right of access to the personal data collected in relation to them, and to exercise this right in a simple manner and at reasonable intervals in order to be informed with the data processing and to check its legality (the right to be informed).

The individual has the right to obtain confirmation from the company Postojnska jama d.d. whether any of their personal data is processed and, if this is the case, access to personal data and the following information: the purpose of data processing, the type of personal data in question, users or the categories of users to whom personal data has been or will be disclosed , the personal data retention period, the existence of the right to request the controller to rectify the data or erase it, or restrict the processing of individual's personal data, or the existence of the right to object to such processing, the right to lodge a complaint with a supervisory authority when personal data has not been collected from the individual they relate to, all available information regarding their source and the existence of automated decision-making.

The individual the personal data relates to (the data subject) has the right to have their inaccurate personal data rectified without undue delay (the right to rectification).The individual has the right to have their incomplete personal data completed, taking into account the purposes of the data processing. The data subject has the right to receive their personal data provided to the controller in a structured and commonly used standard electronic format (the right to data portability). The data subject has the right to have their personal data erased without undue delay in the following cases: (1) the personal data is no longer needed for the purposes for which it has been collected or otherwise processed, (2) the data subject has revoked the consent for the processing and there is no other lawful basis for data processing, (3) the data subject opposes the data processing and there are no overriding legal grounds for it, (4) the personal data has been processed unlawfully, (5) when this is stipulated by the law (the right to erasure).

The individual the personal data relates to (the data subject) has the right to restrict the processing of their personal data when one of the following cases applies: (1) the individual consents the accuracy of the data, specifically for a period that allows the data accuracy to be verified, (2) the data processing is unlawful and the individual opposes the erasure of personal data, requesting a restriction of its use instead, (3) personal data is no longer needed for processing purposes, however, the individual needs them to enforce, execute or defend legal claims, (4) the individual has lodged an objection concerning the data processing, until it is verified whether the controller's legal reasons override the individual's reasons (the right to restriction of processing). Where the processing of personal data has been restricted in accordance with the above, such personal data, with the exception of their storage, shall be processed only with the data subject's consent, or for the enforcement, execution or defence of legal claims, or for the protection of rights of another natural or legal person. The individual will be notified before a processing restriction is revoked.

Without prejudice to any other judicial remedy, the individual the personal data relates to has the right, (i) to lodge a complaint with the company Postojnska jama d.d. regarding the processing of their personal data by emailing info@postojnska-jama.eu; and (ii) to lodge a complaint with a supervisory authority (in the Republic of Slovenia, this is the Information Commissioner), if they believe the processing of their personal data is in violation of the personal data protection rules (the right to lodge a complaint with a supervisory authority).

9. Additional Information When Data Has Not Been Obtained from the Individual 

Personal data that was not obtained directly from the individual is available from the company Postojnska jama d.d. upon the individual's request. The individual has the right to obtain all the available information regarding their source.

.

10. Cookie Policy

The cookies placed in your browser collect certain anonymous data about your visit to the site. They allow us to ensure that all the functions of the website are available, to adapt contents to match your preferences and track your visit in order to improve the website and the user experience.

• Strictly Necessary Cookies
  Strictly necessary cookies enable a functional website and its basic operations, such as website navigation and access to specific website areas. Without these cookies, the website is unable to function properly. This category also includes cookies designed to customise how the website behaves or looks like at the time of the user's subsequent visits, such as the preferred language.
• Statistics Cookies
  Statistics cookies collect and report information to website owners anonymously. This helps website owners understand how visitors use and interact with the website, thus improving user experience.
• Advertising and User Profiling Cookies
  Advertising cookies are used for tracking users on the websites. They are used by advertisers to display ads that are more relevant and interesting for individual users. They are also used to prevent showing ads already seen by the user.

Exact descriptions of each cookie and the expiry times are provided in the table below.

Security, full functionality, and content customization

I consent to the website use of tools, including cookies, which ensure full functionality and an appropriate level of security. I understand that without this, the website cannot offer proper functioning, such as website navigation, customization of appearance, and access to specific parts of the website.

Website traffic analysis

I consent to the website use of tools, including cookies, which collect anonymized data about website visitors. I understand that without this, website administrators cannot analyze site traffic and usage patterns to improve the user experience on the website.

Social networks

I consent to the website use of tools, including cookies, which transmit anonymized data about website visitors to social networks. I understand that without this consent, website operators cannot offer functionalities that rely on social networks.

The Cookie Policy of the company Postojnska jama d.d. will be updated if necessary, in which case users will be informed about it accordingly.

The Policy is published on the website www.postojnska-jama.eu and came into effect on 5 June 2018. The policy was updated on 29 January 2024.

Change settings