Privacy policy for the implementation of data collection projects

This Privacy Policy sets out how Valicon, trženjsko svetovanje in raziskave d.o.o., Kopitarjeva ulica 2, 1000 Ljubljana (hereinafter: Valicon) collects, stores and uses personal data obtained within the scope of research activities that it conducts as part of its operations, except for research conducted within the scope of the Opinia.Club online panel where surveys and data processing are carried out in a different manner. For a description of the latter, please visit the website: www.opinia.club.

We cordially request that you read this Privacy Policy carefully.

1. About Us

The data controller is VALICON d.o.o., with its registered office at Kopitarjeva ulica 2, 1000 Ljubljana, Slovenia.

Should you have any questions, please contact us by sending an email to: [email protected] or by calling us on +386 1 420 49 08.

The Data Protection Officer (DPO) for VALICON d.o.o. Ljubljana is “Info hiša”, Likozarjeva ul. 14, 1000 Ljubljana, reachable at: [email protected] or by telephone on +386 1 23 55 036.

2. How We Collect Your Personal Data

We collect your personal data as part of various data collection projects (e.g., field, telephone, qualitative, online and other research). Your personal data may be collected and processed on the basis of: (i) your explicit written or electronic consent (Article 6(1)(a) of the General Data Protection Regulation (GDPR)); or (ii) in the case of field and telephone surveys, on the basis of the performance of a contract, specifically your voluntary participation in the survey (Article 6(1)(b) GDPR).

3. Purposes of Processing and Legal Basis
   a) Conducting Surveys and Research

In connection with your participation in data collection projects for our clients or for use in our own research, we process your personal data including your name and surname, contact details (telephone number, email address and postal address), survey responses obtained during the research, including special categories of personal data, as well as any audio, video or other electronic recordings necessary for qualitative research purposes. Personal data is processed for the purpose of conducting research, including sample creation, the recruitment of respondents, survey execution and analysis of results. In cases where participants are rewarded for their participation by means of a remittance, data necessary to carry out such a remittance (such as bank account number, bank details, etc.) are also processed.

The legal basis for processing is your consent to participate in the survey.

Special Categories of Personal Data

In certain research projects, we may also process special categories of personal data. These include data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, as well as genetic data, biometric data, data concerning health, or data relating to an individual’s sex life or sexual orientation. Such data is processed solely for the purposes of sample formation, recruitment of respondents, survey execution and processing the results. All the processing of these special categories of personal data is carried out exclusively on the basis of the individual’s consent (Article 6(1)(a) of the General Data Protection Regulation).

If we process your personal data on the basis of your consent (Article 6(1)(a) GDPR), you have the right to withdraw your consent at any time by sending an email to: [email protected]. Please note that this email address is protected against spam. To view it, please enable JavaScript. The effective date of such a withdrawal shall be 30 working days from the date on which we receive your request.

b) Prevention of Abuse

In order to protect our business and legitimate interests, including the prevention of fraud and data falsification, we also process data relating to your online identifier and your web browser properties. This processing is necessary to safeguard our legitimate interests of preventing fraud and protecting our business. The legal basis for this processing is the legitimate interest of the controller (Article 6(1)(f) GDPR).

c) Statistical and Research Purposes

When it is not possible to use anonymised data from research results, we will use pseudonymised data for research purposes, such as studying response rates to survey invitations, depending on the research methodology and the channel through which the participants were recruited. The legal basis for this type of processing is our legitimate interest (Article 6(1)(f) of the General Data Protection Regulation).

d) Cookies

When you visit our website, cookies and similar tracking technologies are installed in your browser. For detailed information about such processing, please refer to our Cookie Policy.

4. Processing the Personal Data of Children

We will not collect or process the personal data of children under the age of 15 unless we have obtained parental consent in accordance with applicable law. If we become aware that we have inadvertently collected data relating to a child, we will delete such data immediately.

5. Retention of Personal Data and the Period of Processing

Your personal data is stored by Valicon on its own servers. We retain your personal data for a period of up to 90 days following the conclusion of the data collection project. After this period, all personal data is anonymised.

If you require further information regarding where and for how long your personal data is stored, or about your rights to erasure and data portability, please contact us at: [email protected].

6. Transmission of Personal Data

In the course of processing personal data, certain processing activities or parts thereof may be entrusted to contractual processors with whom we have concluded a contractual processing agreement. These processors may process the entrusted data exclusively on our behalf, within the scope of authorisations set out in a written contract or other legal act, and in accordance with the purposes defined in this Privacy Policy. We cooperate with contractual processors from the following areas: email service providers, web hosting providers and providers of various IT services. Your personal data is stored by VALICON on its own servers.

For certain services, we may also disclose your personal data to potential project partners, supervisory authorities or pursuant to a request from the judiciary. Under no circumstances will we disclose your personal data to unauthorised third parties.

If we transfer your personal data outside the European Economic Area (EEA), we will only do so after a careful review of the appropriate legal bases and safeguards, such as:

• Standard Contractual Clauses adopted by the European Commission or by the Information Commissioner and approved by the European Commission in accordance with the applicable law;
• code or codes of conduct prepared by an association or other body approved by the Information Commissioner;
• other legal bases as provided for by the General Data Protection Regulation.

7. How We Protect Your Personal Data

We have implemented appropriate technical and organisational measures to safeguard your personal data and protect it against unauthorised or unlawful use or processing, accidental loss, destruction or damage, including but not limited to:

– the principle of data minimisation and processing on a pseudonymised basis wherever possible;
– training our employees on the importance of confidentiality and maintaining the privacy and security of your data;
– commitment to applying appropriate disciplinary measures to enforce employee accountability regarding privacy;
– continuous and comprehensive updating and testing of our security technologies;
– careful and responsible selection of our subprocessors;
– use of secure servers for storing your personal data;
– appointment of a Data Protection Officer;
– requiring proof of identity from any individual requesting access to personal data.

7. You are hereby informed of the following rights concerning your personal data, which you may exercise by sending an email to [email protected] and

• request access to your personal data and information regarding our use and processing of your personal data;
• request the correction or deletion of your personal data;
• request the restriction of the processing of your personal data;
• request to receive from us your personal data that you have provided to us in a structured and machine-readable format (for example, an Excel spreadsheet), and the right to transmit this data to another data controller;
• object to the processing of your personal data for certain purposes;
• withdraw your consent to our use of your personal data when processing is based on your consent. If you withdraw your consent, this will not affect the lawfulness of our use and processing of your personal data based on your consent before the day you withdrew your consent. Due to technical limitations, the withdrawal of consent will be reflected in our systems within a maximum of 5 working days from receipt of the request.

You also have the right to lodge a complaint with the supervisory authority, which is the Information Commissioner for the Republic of Slovenia and whose contact details are available here.

Please inform us of any changes to your personal data that we hold about you, so that the data we hold about you can be kept accurate and up-to-date.

8. Amendments to Our Privacy Policy

From time to time, we may update our Privacy Policy. Any amendments to this Privacy Policy shall become effective on the date of their publication on the website www.valicon.net.

Last updated: 10 June 2025.