Privacy Policy

About the Privacy Policy

The purpose of the Privacy Policy of Mystery Things (hereinafter: "Privacy Policy") is to inform users of the services of Mystery Things and other persons (hereinafter also referred to as "individuals") about the purposes and basis for the processing of personal data by Mystery Things, Nova pot 127h, 1351 Brezovica (hereinafter: "Company") and the rights of individuals in this field. The Company pays special attention to the security of your personal data. All personal data provided is treated confidentially and is used only for the purpose for which it was provided. We manage your personal data with the utmost care, considering applicable legislation and the highest standards of their handling. Among other things, we ensure the security of your personal data through appropriate organizational measures, work procedures, advanced technological solutions, and external experts with the aim of the most effective protection of your personal data. We use an appropriate level of protection and reasonable physical, electronic, and administrative measures to protect collected data from accidental or unlawful destruction, loss, alteration, unauthorized disclosure of personal data, or unauthorized access to personal data that has been transmitted, stored, or otherwise processed.

At the same time, this Privacy Policy further explains the consent you have given for the processing of your personal data.

In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: "General Data Protection Regulation"), the Privacy Policy includes the following information:

contact information of the company,
purposes, bases, and types of processing of different types of personal data of individuals,
retention period of individual types of personal data,
rights of individuals in relation to the processing of personal data,
the right to file a complaint regarding the processing of personal data,
validity of the Privacy Policy.

Personal Data Collected by the Company

If you are just a visitor to the website, we collect data about you only through the use of cookies. If you are a user of the services or a subscriber to the services provided by the company, we also collect other personal data necessary for the execution of the services you have ordered or are using. These personal data include:

name and surname
contact email address
contact phone number
IP address
data for issuing an offer based on your inquiry (your address, tax number).

Data Controller

The data controller of personal data processed in accordance with this Privacy Policy is Mystery Things, Nova pot 127h, 1351 Brezovica.

Categories of Individuals Whose Personal Data are Processed

This Privacy Policy is intended for everyone who has ordered and/or uses our services or submitted an inquiry, as well as those who visit our website.

Purposes of Data Processing and Bases for Data Processing

5.1. Processing Based on Contract:

In the context of exercising contractual rights and fulfilling contractual obligations, the company processes your personal data for the following purposes: identification of the individual, preparation of an offer, conclusion of a contract, provision of ordered services, informing about any changes, additional details and instructions for using the services, resolving any technical problems, objections, or complaints, billing services, and other purposes necessary for executing or concluding a contractual relationship between the company and the individual.

When billing services, based on tax regulations, we obtain and process your address for the correct issuance of an invoice.

5.2. Processing Based on Law:

Based on legitimate interest, we use your personal data to detect and prevent fraudulent use and abuse of services, to ensure the stable and secure operation of our systems and services, for purposes of implementing information security measures, meeting quality service requirements, and detecting technical failures of systems and services.

Based on legitimate interest, we also use your personal data for potential enforcement, judicial and extrajudicial recovery.

In accordance with the General Data Protection Regulation, the company, in case of suspected abuse, to a reasonable and proportional extent, processes data about individuals for the purpose of identification and prevention of potential fraud or abuse and may, if appropriate, transmit this data to other providers of such services, business partners, police, prosecutor's office, or other competent authorities. To prevent future abuse or fraud, data on the history of identified abuses or frauds related to an individual, including data on the subscription relationship and, for example, the IP address, may be kept for five years after the termination of the business relationship.

5.3. Processing Based on Consent for the Processing of Personal Data:

Data processing can also be based on your consent, which you have provided to the company. Consent may, for example, refer to informing about offers, benefits, and improvements of services provided by the company. The purpose of such information is to bring the services as close as possible to your needs and desires and thereby increase their utility value for you. Information is provided through the channels you have chosen in the consent. You can withdraw the notification at any time in the manner defined by the Privacy Policy.

You can withdraw or change your consent at any time in the same way as you gave it or in another way defined by the Privacy Policy, whereby the company reserves the right to identify the customer. Consent changes can also be arranged via email at info@mystery.si or by written request sent to the company's headquarters.

The withdrawal or change of consent applies only to data processed based on your consent. Your last given consent that we received is valid. The possibility of withdrawing consent does not constitute a right to withdraw from the business relationship with the company.

Data for which consent has been given are processed in the absence of withdrawal for up to two years after the termination of the business relationship with the company.

Limitations on the Provision of Personal Data

If necessary, we will authorize other companies and individuals to perform certain tasks contributing to our services. In such cases, the company may transmit personal data to such carefully selected external processors who will enter into a personal data processing contract with the company or a substantially equivalent agreement or another binding document (hereinafter: "Processing Agreement"). External processors will be provided with or given access to such data only to the extent required by the specific purpose. These data may not be used by the external processor for any other purpose, and they must meet at least all personal data processing standards prescribed by applicable law. External processors are contractually bound to respect the confidentiality of your personal data.

Based on a substantiated request, the company also transmits personal data to competent state authorities that have a legal basis for this. For example, Mystery Things will respond to requests from courts, law enforcement agencies, and other state authorities, which may also include state authorities of another EU member state.

Retention Period of Personal Data

The retention period of data is determined by the category of individual data. We store data for as long as necessary to achieve the purpose for which they were collected or further processed or until the expiration of the statutory limitation periods for fulfilling obligations or the statutory retention period.

Billing data and related contact data about individuals may be stored to fulfill contractual obligations until full payment for the service or at the latest until the expiration of the statutory limitation periods related to the individual claim, which may range from one to five years under the law. Invoices are kept for another 10 years after the end of the year to which the invoice relates, in accordance with the law regulating value-added tax.

Other data obtained based on your consent are kept for the duration of the business relationship and another 2 years after its termination unless the law prescribes a longer retention period. If an individual who has given consent for the processing of personal data does not enter into a business relationship with us, their consent is valid for 2 years from its submission or until its withdrawal.

After the retention period, the data is deleted, destroyed, blocked, or anonymized, unless the law provides otherwise for a specific type of data.

Rights of Individuals Regarding the Processing of Personal Data

We ensure the exercise of your rights regarding the processing of your personal data without unnecessary delay. We will decide on your request within one month of receiving your request. In the case of complexity and a large number of requests, we may extend the deadline by a maximum of two additional months. If we extend the deadline, we will notify you of such an extension within one month of receiving the request, along with the reasons for the delay.

We accept requests regarding the exercise of your rights at the email address info@mystery.si or by mail at the address Mystery Things, Nova pot 127h, 1351 Brezovica.

When you submit a request by electronic means, we provide information, whenever possible, by electronic means, unless you request otherwise.

When there is a justified doubt regarding the identity of the individual submitting a request related to any of their rights, we may request the provision of additional information necessary to confirm the identity of the individual to whom the personal data relates.

If the requests of an individual to whom the personal data relates are manifestly unfounded or excessive, particularly because they are repetitive, the company may:

charge a reasonable fee, taking into account the administrative costs of providing the information or communication or executing the requested measure, or
refuse to act on the request.

We enable you to exercise the following rights regarding the processing of your personal data: (i) the right of access to data

(ii) the right to rectification

(iii) the right to erasure ("right to be forgotten")

(iv) the right to restriction of processing

(v) the right to data portability

(vi) the right to object

(i) The Right of Access to Data

You always have the right to be informed whether personal data about you is being processed and, if so, access to personal data and the following information:

the purposes of processing,
the types of personal data being processed,
users or categories of users to whom personal data has been or will be disclosed,
the intended period of retention of personal data or, if this is not possible, the criteria used to determine this period,
the existence of the right to request from the controller the rectification or erasure of personal data or restriction of processing of your personal data, or the existence of the right to object to such processing,
the right to file a complaint with a supervisory authority,
where personal data is not collected from you, all available information regarding its source.

(ii) The Right to Rectification

You have the right to achieve, without undue delay, the rectification of inaccurate personal data concerning you and, considering the purposes of processing, the right to have incomplete personal data completed, including by means of providing a supplementary statement.

(iii) The Right to Erasure ("Right to be Forgotten")

You have the right to achieve, without undue delay, the erasure of your personal data where one of the following reasons applies:

the personal data is no longer necessary for the purposes for which it was collected or otherwise processed,
you withdraw the consent on which the processing is based, and there is no other legal basis for the processing,
you object to the processing of data, and there are no overriding legitimate grounds for the processing,
the personal data has been unlawfully processed,
the personal data must be erased to comply with a legal obligation under EU or Slovenian law.

(iv) The Right to Restriction of Processing

You have the right to achieve the restriction of processing of your personal data where one of the following cases applies:

you contest the accuracy of the data, for a period enabling us to verify the accuracy of the personal data,
the processing is unlawful, and you oppose the erasure of personal data and request the restriction of its use instead,
we no longer need your personal data for processing purposes, but you need it for the establishment, exercise, or defense of legal claims,
if you have objected to processing based on the company's legitimate interests, pending verification of whether our legitimate grounds override your reasons.

Where the processing of your personal data has been restricted under the previous paragraph, such personal data, with the exception of storage, shall be processed only with your consent, or for the establishment, exercise, or defense of legal claims, or for the protection of the rights of another natural or legal person.

Before lifting the restriction on processing your personal data, we are obliged to inform you.

(v) The Right to Data Portability

You have the right to receive your personal data, which you have provided to us, in a structured, commonly used, and machine-readable format, and the right to transmit those data to another controller without hindrance from the company, where the processing is based on your consent and the processing is carried out by automated means. Upon your request, where technically feasible, the personal data may be transmitted directly to another controller.

(vi) The Right to Object

Where we process your data based on legitimate interest for marketing purposes, you may object to such processing at any time.

We will stop processing your personal data unless we demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or for the establishment, exercise, or defense of legal claims.

Right to File a Complaint Regarding the Processing of Personal Data

You may file a complaint regarding the processing of your personal data by sending it to the email address info@mystery.si or by mail to Mystery Things, Nova pot 127h, 1351 Brezovica.

If we do not decide on your request within the statutory period or if we reject your request, you have the possibility to file a complaint with the Information Commissioner.

You also have the right to file a complaint directly with the Information Commissioner if you believe that the processing of your personal data violates Slovenian or EU regulations on personal data protection.

If you have exercised the right of access to data and, after receiving the decision, you believe that the personal data you received are not the personal data you requested or that you have not received all the requested personal data, you may file a reasoned complaint with the company within 15 days before filing a complaint with the Information Commissioner. We must decide on your complaint as a new request within five working days.

Final Provisions

For everything not regulated by this Privacy Policy, applicable legislation applies.

The company reserves the right to change this Privacy Policy. We will inform you of any changes by posting them on the official website of Mystery Things 30 days before they take effect.

If you have any questions about the Privacy Policy or the data we hold about you, please write to us at info@mystery.si.

Validity of the Privacy Policy

This Privacy Policy is published on the www,mysterycups.com website and takes effect on 25.7.2024.

Mystery Things d.o.o.