POLITIKA ZASEBNOSTI/PRIVACY POLICY

1. UPRAVLJAVKA OSEBNIH PODATKOV

Upravljavka osebnih podatkov, zbranih prek spletnega mesta sarahrovatic.com, je:

Sara Hrovatič s.p., Lažiše 48, Lažiše, 3225 Planina pri Sevnici

Matična številka: 3188787000

Davčna številka: 50353284

E-pošta: sara@sarahrovatic.com

Telefon: +386 41 962 559

Storitve izvajam tudi pod blagovno znamko Witch. Obviously.

Za vsa vprašanja v zvezi z obdelavo osebnih podatkov mi lahko pišete na sara@sarahrovatic.com.

2. KATERE PODATKE ZBIRAM IN ZAKAJ

Pri vsaki vrsti obdelave navajam, katere podatke zbiram, čemu so namenjeni, na kateri pravni podlagi jih obdelujem in kako dolgo jih hranim.

2.1 Nakup digitalne vsebine, svetovanja ali udeležbe na dogodku

Podatki: ime in priimek, elektronski naslov, naslov, telefonska številka, pri podjetjih tudi naziv in davčna številka podjetja, ter podatki o naročilu in plačilu. Podatkov o plačilni kartici ne zbiram in ne shranjujem – obdeluje jih ponudnik plačilnih storitev.

Namen: izvedba nakupa, izdaja računa, vzpostavitev dostopa do vsebine, izvedba storitve in obveščanje o njej.

Pravna podlaga: izvajanje pogodbe in izpolnjevanje zakonskih obveznosti na davčnem in računovodskem področju.

Rok hrambe: podatki na računih se hranijo minimalno 10 let, skladno z davčno zakonodajo. Ostali podatki o naročilu se hranijo do izteka obdobja dostopa oziroma izvedbe storitve in še 2 leti po njem.

2.2 Uporabniški račun

Podatki: uporabniško ime, elektronski naslov, šifrirano geslo, podatki o kupljenih vsebinah in o njihovi uporabi.

Namen: omogočanje dostopa do kupljene vsebine in podpora uporabnikom.

Pravna podlaga: izvajanje pogodbe.

Rok hrambe: ves čas trajanja dostopa do kupljene vsebine in še 2 leti po njem. Račun lahko kadar koli zahtevate v izbris, s čimer pa preneha tudi dostop do kupljene vsebine.

2.3 Svetovanje in izobraževanje

Podatki: ime, s katerim se prijavite v spletno srečanje, elektronski naslov, dogovorjeni termini, ter vsebina, ki jo delite z mano v okviru svetovanja ali izobraževanja — podatki o vašem podjetju, znamki, ciljih in odločitvah.

Namen: izvedba svetovanja oziroma izobraževanja in priprava nanj.

Pravna podlaga: izvajanje pogodbe.

Rok hrambe: zapiske in gradiva, ki nastanejo pri svetovanju, hranim do zaključka sodelovanja in še 2 leti po njem, da lahko ob morebitnem nadaljevanju gradimo na že opravljenem delu. Na vašo zahtevo jih izbrišem prej.

Zaupnost. Vse, kar delite z mano v okviru svetovanja, obravnavam zaupno. Tega brez vašega soglasja ne razkrijem tretjim osebam in ne uporabim kot primer ali referenco.

Posebne vrste osebnih podatkov. Svetovanje ni namenjeno obravnavi podatkov o zdravju ali drugih posebnih vrst osebnih podatkov. Če jih v pogovoru delite sami, jih ne zapisujem in ne hranim.

Snemanje. Srečanj ne snemam brez predhodnega dogovora z vami. Če se za snemanje dogovoriva, posnetek uporabim izključno za namen, o katerem sva se dogovorila, in ga izbrišem po zaključku sodelovanja. Srečanje smete posneti tudi sami za lastno uporabo.

2.4 Udeležba na dogodkih

Podatki: ime in priimek, elektronski naslov, podatki o prijavi in izbranem terminu, pri spletnih dogodkih tudi ime, s katerim se prijavite v srečanje.

Namen: izvedba dogodka, obveščanje prijavljenih o poteku, morebitnih spremembah in odpovedi.

Pravna podlaga: izvajanje pogodbe.

Rok hrambe: seznam prijavljenih se hrani skupaj s podatki o naročilu.

Snemanje in fotografiranje. Dogodkov praviloma ne snemam in ne fotografiram. Če bi bil posamezen dogodek posnet ali fotografiran, boste o tem obveščeni pred začetkom. Pri spletnih dogodkih boste imeli možnost izklopiti kamero in mikrofon, pri dogodkih v živo pa se odmakniti iz kadra.

2.5 Poslovno sodelovanje s podjetji

Podatki: ime, priimek, delovno mesto in kontaktni podatki kontaktnih oseb pri naročniku.

Namen: priprava ponudbe, izvedba in obračun dogovorjenega dela.

Pravna podlaga: izvajanje pogodbe z naročnikom oziroma moj zakoniti interes za komunikacijo s kontaktnimi osebami naročnika.

Rok hrambe: do zaključka sodelovanja in še 2 leti po njem, podatki na računih pa 10 let.

2.6 Kontaktni obrazec in povpraševanja

Podatki: ime in priimek, elektronski naslov in vsebina sporočila.

Namen: odgovor na vaše sporočilo in morebitna priprava ponudbe.

Pravna podlaga: izvajanje ukrepov pred sklenitvijo pogodbe na vašo zahtevo oziroma moj zakoniti interes, da odgovorim na prejeto sporočilo.

Rok hrambe: 2 leti od zadnje komunikacije, razen če iz povpraševanja nastane pogodbeno razmerje.

2.7 Prijava na e-novice

Podatki: ime in elektronski naslov.

Namen: obveščanje o vsebinah, dogodkih in storitvah.

Pravna podlaga: vaša privolitev. Privolitev lahko kadar koli prekličete – v vsakem sporočilu je povezava za odjavo ali pa mi pišete na sara@sarahrovatic.com. Preklic ne vpliva na zakonitost obdelave pred preklicem.

Rok hrambe: do preklica privolitve.

2.8 Obisk spletnega mesta

Podatki: naslov IP, vrsta brskalnika, čas obiska, ogledane strani.

Namen: delovanje in varnost spletnega mesta ter statistika obiska.

Pravna podlaga: zakoniti interes za varno delovanje spletnega mesta oziroma privolitev pri piškotkih, ki niso nujni.

Podrobnosti o piškotkih so v Politiki piškotkov.

2.9 Merjenje obiska in oglaševanje

Na spletnem mestu lahko uporabljam orodja za merjenje obiska in merjenje učinkovitosti oglaševanja. Ta orodja lahko zbirajo podatke o vaši napravi, obisku in dejanjih na spletnem mestu ter jih posredujejo svojim ponudnikom.

Pravna podlaga: vaša privolitev, ki jo podate ob prvem obisku prek obvestila o piškotkih. Orodja se naložijo šele po podani privolitvi. Privolitev lahko kadar koli spremenite ali prekličete v nastavitvah piškotkov.

3. OBDELAVA PODATKOV OTROK

Spletno mesto in storitve so namenjeni polnoletnim osebam. Zavestno ne zbiram osebnih podatkov oseb, mlajših od 15 let.

Če ugotovim, da sem podatke take osebe prejela brez ustrezne podlage, jih izbrišem.

4. KOMU PODATKE POSREDUJEM

Osebnih podatkov ne prodajam in jih ne posredujem tretjim osebam za njihove lastne namene.

Podatke posredujem le obdelovalcem, ki so nujni za izvedbo storitve, in sicer:

Obdelovalec	Namen
Hitrost.com	gostovanje spletnega mesta
Stripe Payments Europe, Ltd.	obdelava plačil s kartico
Čebelca BIZ	izdaja in hramba računov
Zoom	izvedba spletnih srečanj in dogodkov
Mailchimp (Intuit Inc.)	pošiljanje e-novic
Google Ireland Ltd. (Google Analytics)	statistika obiska
Meta Platforms Ireland Ltd.	merjenje učinkovitosti oglaševanja
Računovodski servis	vodenje poslovnih knjig

Z vsemi obdelovalci imam urejena ustrezna pogodbena razmerja o obdelavi osebnih podatkov.

Podatke lahko posredujem tudi pristojnim organom, kadar to od mene zahteva zakon.

Prenos v tretje države. Nekateri obdelovalci lahko podatke obdelujejo zunaj Evropskega gospodarskega prostora. V takih primerih je prenos zavarovan s standardnimi pogodbenimi klavzulami Evropske komisije ali drugim ustreznim mehanizmom po V. poglavju GDPR.

5. VAŠE PRAVICE

Kot posameznik, na katerega se nanašajo osebni podatki, imate pravico:

do dostopa – izvedeti, katere podatke o vas obdelujem, in prejeti njihovo kopijo,
do popravka – zahtevati popravek netočnih ali dopolnitev nepopolnih podatkov,
do izbrisa – zahtevati izbris podatkov, kadar za obdelavo ni več podlage,
do omejitve obdelave – v primerih, določenih z GDPR,
do prenosljivosti – prejeti podatke v strukturirani, splošno uporabljani obliki,
do ugovora – ugovarjati obdelavi, ki temelji na zakonitem interesu,
do preklica privolitve – kadar obdelava temelji na privolitvi.

Zahtevo pošljite na sara@sarahrovatic.com. Odgovorila vam bom najpozneje v enem mesecu od prejema zahteve. Ta rok lahko podaljšam za dva meseca, če je zahteva zapletena; v tem primeru vas o podaljšanju obvestim.

Za obravnavo zahteve bom morda potrebovala dodatne podatke za preveritev vaše identitete.

Podatkov, ki jih moram hraniti zaradi davčnih in računovodskih predpisov, ne morem izbrisati pred iztekom zakonskega roka.

Pritožba nadzornemu organu. Če menite, da vaše podatke obdelujem v nasprotju s predpisi, imate pravico vložiti pritožbo pri:

Informacijski pooblaščenec Republike Slovenije, Dunajska cesta 22, 1000 Ljubljana, gp.ip@ip-rs.si

6. VARNOST PODATKOV

Osebne podatke varujem z ustreznimi tehničnimi in organizacijskimi ukrepi. Spletno mesto uporablja šifrirano povezavo (SSL), gesla se hranijo v šifrirani obliki, dostop do podatkov pa je omejen.

Kljub temu popolne varnosti prenosa podatkov po internetu ni mogoče zagotoviti.

Če bi prišlo do kršitve varstva osebnih podatkov, ki bi verjetno povzročila veliko tveganje za vaše pravice in svoboščine, vas bom o tem obvestila skladno z 34. členom GDPR.

7. SPREMEMBE POLITIKE ZASEBNOSTI

To politiko lahko občasno posodobim. Veljavna različica je vedno objavljena na tem spletnem mestu. Ob bistvenih spremembah vas bom obvestila na primeren način.

Zadnja sprememba: 22.09.2026

This is an English translation of the Slovenian original. In the event of any discrepancy between the two versions, the Slovenian version shall prevail.

1. DATA CONTROLLER

The controller of personal data collected through the website sarahrovatic.com is:

Sara Hrovatič s.p., Lažiše 48, Lažiše, 3225 Planina pri Sevnici, Slovenia

Registration number: 3188787000

Tax number: 50353284

Email: sara@sarahrovatic.com

Phone: +386 41 962 559

I also deliver my services under the brand Witch. Obviously.

For any questions about the processing of personal data, please write to me at sara@sarahrovatic.com.

2. WHAT DATA I COLLECT AND WHY

For each type of processing, I state what data I collect, what it is used for, the legal basis on which I process it, and how long I keep it.

2.1 Purchase of digital content, consulting or event participation

Data: first and last name, email address, postal address, phone number, for companies also the company name and tax number, and order and payment details. I do not collect or store payment card details — these are processed by the payment service provider.

Purpose: completing the purchase, issuing the invoice, granting access to content, delivering the service and communicating about it.

Legal basis: performance of a contract and compliance with legal obligations in the areas of tax and accounting.

Retention: data on invoices is kept for a minimum of 10 years, in accordance with tax legislation. Other order data is kept until the end of the access period or service delivery, and for 2 years thereafter.

2.2 User account

Data: username, email address, encrypted password, details of purchased content and its use.

Purpose: providing access to purchased content and user support.

Legal basis: performance of a contract.

Retention: for the duration of access to the purchased content and for 2 years thereafter. You may request deletion of your account at any time; this also ends access to the purchased content.

2.3 Consulting and education

Data: the name you use to join an online session, email address, agreed session dates, and what you share with me in the course of consulting or education — information about your business, brand, goals and decisions.

Purpose: delivering consulting or education and preparing for it.

Legal basis: performance of a contract.

Retention: I keep notes and materials created during consulting until our work together ends and for 2 years thereafter, so that we can build on the work already done should we continue. At your request, I will delete them sooner.

Confidentiality. Everything you share with me in the course of consulting is treated as confidential. I do not disclose it to third parties without your consent and do not use it as an example or reference.

Special categories of personal data. Consulting is not intended for handling health data or other special categories of personal data. If you share such data during a conversation, I do not record or store it.

Recording. I do not record sessions without prior agreement with you. If we agree to record, I use the recording solely for the agreed purpose and delete it when our work together ends. You may also record a session yourself for your own use.

2.4 Event participation

Data: first and last name, email address, registration and selected date details, and for online events also the name you use to join the session.

Purpose: holding the event and informing registered participants about its schedule, any changes and cancellation.

Legal basis: performance of a contract.

Retention: the list of registered participants is kept together with the order data.

Recording and photography. As a rule, I do not record or photograph events. If a particular event is recorded or photographed, you will be informed before it begins. At online events you will be able to turn off your camera and microphone; at in-person events you will be able to step out of frame.

2.5 Business collaboration with companies

Data: name, surname, job title and contact details of contact persons at the client.

Purpose: preparing quotations, delivering and invoicing the agreed work.

Legal basis: performance of a contract with the client, or my legitimate interest in communicating with the client’s contact persons.

Retention: until the end of the collaboration and for 2 years thereafter; invoice data for 10 years.

2.6 Contact form and enquiries

Data: first and last name, email address and message content.

Purpose: replying to your message and, where relevant, preparing a quotation.

Legal basis: steps taken at your request prior to entering into a contract, or my legitimate interest in replying to messages received.

Retention: 2 years from the last communication, unless the enquiry leads to a contractual relationship.

2.7 Newsletter subscription

Data: name and email address.

Purpose: keeping you informed about content, events and services.

Legal basis: your consent. You may withdraw consent at any time — every message contains an unsubscribe link, or you can write to me at sara@sarahrovatic.com. Withdrawal does not affect the lawfulness of processing before withdrawal.

Retention: until consent is withdrawn.

2.8 Website visits

Data: IP address, browser type, time of visit, pages viewed.

Purpose: operation and security of the website and visitor statistics.

Legal basis: legitimate interest in the secure operation of the website, or consent for non-essential cookies.

Details about cookies are set out in the Cookie Policy.

2.9 Analytics and advertising

The website may use tools for measuring traffic and advertising effectiveness. These tools may collect data about your device, visit and actions on the website and transmit it to their providers.

Legal basis: your consent, given on your first visit through the cookie notice. These tools load only after consent has been given. You may change or withdraw your consent at any time in the cookie settings.

3. CHILDREN’S DATA

The website and services are intended for adults. I do not knowingly collect personal data from persons under 15.

If I discover that I have received data from such a person without an appropriate legal basis, I will delete it.

4. WHO I SHARE DATA WITH

I do not sell personal data and do not share it with third parties for their own purposes.

I share data only with processors necessary for delivering the service, namely:

Processor	Purpose
Hitrost.com	website hosting
Stripe Payments Europe, Ltd.	card payment processing
Čebelca BIZ	issuing and storing invoices
Zoom	holding online sessions and events
Mailchimp (Intuit Inc.)	sending newsletters
Google Ireland Ltd. (Google Analytics)	visitor statistics
Meta Platforms Ireland Ltd.	measuring advertising effectiveness
Accounting service	bookkeeping

I have appropriate data processing agreements in place with all processors.

I may also disclose data to competent authorities where required by law.

Transfers to third countries. Some processors may process data outside the European Economic Area. In such cases, the transfer is safeguarded by the European Commission’s Standard Contractual Clauses or another appropriate mechanism under Chapter V of the GDPR.

5. YOUR RIGHTS

As a data subject, you have the right:

of access — to find out what data I process about you and receive a copy,
to rectification — to request correction of inaccurate or completion of incomplete data,
to erasure — to request deletion of data where there is no longer a basis for processing,
to restriction of processing — in cases defined by the GDPR,
to data portability — to receive your data in a structured, commonly used format,
to object — to processing based on legitimate interest,
to withdraw consent — where processing is based on consent.

Send your request to sara@sarahrovatic.com. I will respond within one month of receiving it at the latest. This period may be extended by two months if the request is complex; in that case I will inform you of the extension.

To process your request, I may need additional information to verify your identity.

Data I am required to keep under tax and accounting regulations cannot be deleted before the statutory period expires.

Complaint to the supervisory authority. If you believe that I process your data in breach of the regulations, you have the right to lodge a complaint with:

Information Commissioner of the Republic of Slovenia, Dunajska cesta 22, 1000 Ljubljana, Slovenia, gp.ip@ip-rs.si

6. DATA SECURITY

I protect personal data with appropriate technical and organisational measures. The website uses an encrypted connection (SSL), passwords are stored in encrypted form, and access to data is restricted.

Nevertheless, complete security of data transmission over the internet cannot be guaranteed.

In the event of a personal data breach likely to result in a high risk to your rights and freedoms, I will notify you in accordance with Article 34 of the GDPR.

7. CHANGES TO THIS PRIVACY POLICY

I may update this policy from time to time. The current version is always published on this website. In the event of material changes, I will inform you in an appropriate manner.

Last updated: 22.09.2026