Privacy Policy
Version 2026-10-28
1. Who is the controller
The controller of your personal data is Kulturni centar Sretenje, Zagrebška cesta 20, 2000 Maribor, MŠ: 2949903000, DŠ: 41959787 (the organiser). Privacy enquiries: info@kcsretenje.si.
This policy applies to the Sretenjski bal website and complies with Regulation (EU) 2016/679 (GDPR) and the Slovenian Personal Data Protection Act (ZVOP-2).
2. What data we process and why
| Purpose | Data | Legal basis |
|---|---|---|
| Ticket reservations | Full name, email, phone, ticket type and number, note, how you heard about the ball, invoice details (if requested) | Performance of a contract / steps at your request before a contract (Art. 6(1)(b) GDPR) |
| Diet and allergies (optional) | Free text you enter yourself; it may reveal health information | Your explicit consent (Art. 9(2)(a) GDPR); you can withdraw it at any time |
| Messages via the contact form | Name, email, message text | Consent (Art. 6(1)(a)); replying to your enquiry (Art. 6(1)(b)) |
| Invoices and accounting | Invoice data | Legal obligation (Art. 6(1)(c)) |
| Spam and abuse protection | Technical data about form submission, no cookies | Legitimate interest (Art. 6(1)(f)) — site security |
3. How long we keep data
- Reservation data: up to 6 months after the ball, except data we are legally required to keep (invoices).
- Diet and allergy information: up to 30 days after the ball, or sooner if you withdraw consent.
- Contact form messages: up to 12 months.
- Invoices and accounting records: as required by law.
4. Who has access
Only members of the organising team can access the data. We use the following processors, which act only on our instructions:
- Website hosting: Cloudflare, Inc. (Cloudflare Workers)
- Email delivery: Google Ireland Ltd. (Google Workspace / Gmail)
- Google Ireland Ltd. (Google Sheets / Apps Script) — reservation records. Any transfer outside the EU relies on the EU–US Data Privacy Framework or standard contractual clauses.
5. Your rights
You have the right to access, rectification, erasure, restriction, data portability and to object. You may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
Send requests to info@kcsretenje.si; we reply within one month.
You may lodge a complaint with the supervisory authority: Informacijski pooblaščenec, Dunajska cesta 22, 1000 Ljubljana, gp.ip@ip-rs.si, https://www.ip-rs.si/.
6. Mandatory data and automated decisions
Name, email, phone and number of tickets are needed to process a reservation; without them we cannot accept it. Diet information is voluntary. We do not use automated decision-making or profiling.
The site is intended for people aged 15 and over; younger visitors cannot give consent on their own.
7. Cookies and tracking
The site does not set cookies or write data to your browser’s local storage (localStorage), and we use no analytics, advertising, social plug-ins or third-party services that track visitors. Fonts are served from our own server. That is why there is no consent banner; if we later introduce analytics, we will ask for your consent first.
8. Photography at the ball
Photos and video may be taken at the ball. A notice will be displayed at the entrance; if you do not wish to be photographed, tell our staff.
9. Changes
We may update this policy; the current version is always on this page, with the version label at the top.