PRIVACY POLICY

Introduction

This Privacy Policy (hereinafter “Policy”) has been prepared in accordance with the General Data Protection Regulation (GDPR) and applicable Slovenian personal data protection legislation. It describes how the company Elenas d.o.o. (hereinafter “the company”) collects, uses, discloses, and protects your personal data when you use our website and services.

Collection of Personal Data

The company collects various types of personal data about you, depending on how you use our services. This data can be categorised as follows:

Data you provide directly:

Form data: First name, last name, email address, phone number, delivery address, etc.
Registration data: Data you provide when registering on our website, such as a username and password.
Purchase data: Data related to your purchases, such as products purchased, purchase amount, and payment method.
Contact data: Data you provide via email, phone, or other communication channels.

Usage data:

IP address: The address of your device connecting to the internet.
Browser and operating system: The type and version of the browser and operating system you use.
Date and time of visit: The date and time you visit our website or use our services.
Pages visited: Actions you performed on our website.

Cookies and other tracking technologies:

Data stored in your browser or device when you visit our website.
We use them to improve your experience and to analyse traffic.
You can read more about cookies in our Cookie Policy.

Purpose of Personal Data Processing

The company processes your personal data for the following purposes:

Fulfilling contractual obligations: Processing orders for therapy services, issuing invoices, etc.
Service improvement: Analysing the use of the website and services to develop new features and improve user experience.
Communication: Sending order confirmations, responding to your enquiries, etc.
Marketing: Displaying relevant advertisements and offers (with your consent).
Fraud prevention: Protection against fraud and misuse.
Legal obligations: Fulfilment of legal obligations, such as tax obligations or requirements of law enforcement authorities.

Legal Basis for Personal Data Processing

The company processes your personal data on the following legal bases:

Contract: For the fulfilment of contractual obligations entered into when booking our services.
Consent: For purposes requiring your consent, such as sending marketing materials and displaying personalised advertisements.
Legal obligation: For the fulfilment of legal obligations, such as retaining invoices for tax purposes.
Legitimate interest: To protect our legitimate interests, such as preventing fraud and ensuring the security of our services.

Retention Period of Personal Data

The company retains your personal data only for as long as necessary to fulfil the purpose of processing, or as required by law.

Customer data: Data of customers who have made a purchase is retained in accordance with the statutory retention periods for accounting documents (at least 10 years).
Registration data: Registration data is retained until your user account is cancelled.
Usage data: Website usage data is retained for a limited period in anonymised form for analytics purposes.
Marketing data: If you have given consent to receive marketing materials, your data will be retained until your consent is withdrawn.

Transfers of Personal Data

The company does not, as a rule, transfer your personal data to third parties. In exceptional cases, your personal data may be shared with third parties who require it to fulfil our services. We have data processing agreements in place with such third parties to ensure an appropriate level of data protection.

Among the external data processors who may access your data in connection with our services are:

Google LLC (Google Analytics, Google Ads) — analytics and advertising
Meta Platforms, Inc. (Facebook, Instagram) — advertising
PayPal Holdings, Inc. — payment processing
Hotjar Ltd. — user experience analysis
Microsoft Corporation (Bing Ads, Clarity) — advertising and analytics

Data Security

Although Elenas d.o.o. strives to protect your personal data, no data transmission over the internet or method of data storage is completely secure. We endeavour to use commercially acceptable means to protect your personal data; however, we cannot guarantee its absolute security.

Your Rights

In relation to your personal data, you have the following rights:

Right of access: You have the right to access your personal data that we hold.
Right to rectification: You have the right to request the correction of inaccurate or incomplete personal data.
Right to erasure: You have the right to request the deletion of your personal data where there is no longer a legal basis for retaining it.
Right to restriction of processing: You have the right to request the restriction of processing of your personal data.
Right to data portability: You have the right to request the transfer of your personal data to another controller.
Right to object: You have the right to object to the processing of your personal data for the purposes of direct marketing.

Exercising Your Rights

To exercise your rights, please contact us at:

Email: info@elenas-therapy.com
Phone: 051 452 964

We will respond to your requests within the legally prescribed timeframe.

Right to Lodge a Complaint

If you believe that the company is violating your personal data protection rights, you have the right to lodge a complaint with the supervisory authority:

Information Commissioner of the Republic of Slovenia
Dunajska cesta 5, 1000 Ljubljana, Slovenia
www.ip-rs.si

Changes to the Privacy Policy

The company reserves the right to amend this Privacy Policy. You will be notified of any changes via our website or other appropriate channels.

Contact

For any questions regarding this Privacy Policy, please contact us at:

Email: info@elenas-therapy.com
Phone: 051 452 964

Last updated: 28 May 2026