When registering or making a purchase, the consumer authorizes Kridis, Kristjan Korošec s.p. (hereinafter “Kridis s.p.”) to collect, process, and store the personal data provided in accordance with the Personal Data Protection Act.

Kridis s.p. undertakes to protect user data diligently and in accordance with the law. Data is collected based on the individual’s personal consent and is retained for a period of 5 years, or, if the Personal Data Protection Act provides otherwise, for the period specified therein.

Personal data is collected for the purpose of smoothly processing orders or quotes, communicating with customers, statistical analysis aimed at improving the functionality of our websites and services, and, if the customer so chooses, to send notifications, news, and offers (via text message, email, or by mail).

In this context, the following data is collected: IP address, full name, permanent or temporary address, date of birth, gender, phone number, email address, time and date of registration, and a record of communications with the online store. In the case of a gift card, the first and last name of the recipient and their address are also collected.

Kridis s.p. respects the privacy of users of the ilo.si and undertakes to carefully protect the personal data it collects and not to disclose it to third parties without consent, nor to use it for any purpose other than those specified above, except in cases where such data is requested by a competent state authority acting on a legal basis, or in the event of suspected fraudulent activity on the part of a website user. Kridis s.p. may only disclose data to a contracted data processor.

Personal and payment information is entered via a secure online form protected by the same or similar encryption mechanisms used by banks and other trusted institutions.

Users are also responsible for protecting their personal data by ensuring the security of their username and password and by installing appropriate software (antivirus) protection on their computers. The personal data collection is registered on the Information Commissioner’s website (www.ip-rs.si). Users can view the data we store about them through their user account.

Cookies

What is a cookie?

A cookie is a small file that typically contains a string of letters and numbers and is stored on a user’s computer when they visit a particular website. Cookies are primarily intended to ensure that a website functions properly. In addition, they help us provide a better user experience.

Where are cookies used on our website?

We use two types of cookies on our website. The first type is strictly necessary for the website to function; without them, we cannot provide our services (this includes, for example, identifying individual browsing sessions). The second group of cookies is intended to improve the website’s performance. These cookies include web analytics, which allow us to compare new and returning visitors. We also use cookies to link our website to social media platforms, where users can share their experiences with us on these platforms and comment on articles.

Third-Party Cookies

In addition to our own cookies, we also use third-party cookies (e.g., Facebook, Najdi.si, etc.). For information on how third parties use cookies, please review the privacy policies on their websites.

Consent to the Use of Cookies

By clicking the “Accept and Close” button, you consent to the use of cookies as described in the information banner that appears when you visit the website.

Consent to the Processing of Personal Data for Marketing Purposes

I agree that the company Kridis, Kristjan Korošec s.p., with its registered office at Bevkova 31, 3000 Celje, Slovenia, Tax ID No.: SI12797898 (hereinafter referred to as the “controller”) is, in accordance with European legislation, Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, has processed the following personal data:

¤ First and last name

¤ Email address

¤ phone number

¤ place of residence

¤ Tax ID number

¤ VAT ID number

1. The administrator will process the above information for the purposes of registration on the website and for marketing purposes, specifically to send e-newsletters to the person who has given consent. This consent is granted for a fixed period of 5 years. The person giving this consent confirms that the administrator will process the above personal data for the duration of the consent.

2. Personal data will be processed only by the controller or by a person with whom the data controller has a properly executed data processing agreement.

3. You may revoke your consent at any time by sending an email to maja[afna]ilo.si to unsubscribe from the e-newsletter, or by sending us a written notice to the following address: Kridis, Kristjan Korošec s.p., Bevkova 31, 3000 Celje, Slovenia.

4. The administrator of the ilo.si website would like to inform you that, as an individual, you have the following rights under applicable regulations:

The Right to Withdraw Consent

If you, as an individual, have consented to the processing of your personal data (for one or more specific purposes), you have the right to withdraw that consent at any time, without this affecting the lawfulness of the data processing that was carried out on the basis of your consent prior to its withdrawal.

Withdrawing consent to the processing of personal data has no negative consequences or penalties for the individual. However, it is possible that, following the withdrawal of consent to the processing of personal data, the controller may no longer be able to provide the individual with one or more of its services if those services cannot be provided without personal data.

Right of Access to Personal Data

As an individual, you have the right to obtain confirmation from the provider (the personal data controller) as to whether personal data concerning you is being processed and, if so, to access that personal data and certain information (regarding the purposes of processing, the categories of personal data, the recipients, the retention periods or criteria for determining such periods, regarding the existence of the right to rectification or erasure of data, the right to restrict processing and to object to processing, and the right to lodge a complaint with a supervisory authority; regarding the source of the data if it was not collected directly from you; the existence of automated decision-making, including profiling, the reasons for it, and the significance and consequences of such processing for you, as well as other information in accordance with Article 15 of the GDPR).

Right to Rectification of Personal Data

As an individual, you have the right to have the provider correct inaccurate personal data concerning you without undue delay. As an individual, you have the right, taking into account the purposes of the processing, to have incomplete data completed, including by providing a supplementary statement.

The Right to Erasure of Personal Data (“Right to Be Forgotten”)

As an individual, you have the right to have the provider erase personal data concerning you without undue delay, and the provider must erase the data without undue delay when one of the following grounds applies:

(a) the data are no longer necessary for the purposes for which they were collected or otherwise processed,
(b) if you withdraw your consent and there is no other legal basis for the processing,
(c) if you object to the processing and there are no overriding legitimate grounds for the processing,
(d) the data were processed unlawfully,
(e) The data must be erased to comply with legal obligations under EU law or the law of a Member State applicable to the provider.

Right to Restrict Processing

As an individual, you have the right to have the provider restrict processing when one of the following applies:

(a) if you dispute the accuracy of the data within a period that allows the provider to verify the accuracy of the data,
(b) the processing is unlawful, and you object to the erasure of the data but instead request that its use be restricted,
(c) the data provider no longer needs the data for processing purposes, but you need it to assert, exercise, or defend legal claims,
(d) you have objected to the processing, pending verification of whether the provider’s legitimate grounds override your grounds.

Right to Data Portability

As an individual, you have the right to receive the personal data concerning you that you have provided to the provider in a structured, commonly used, and machine-readable format, and you have the right to transmit that data to another controller without hindrance from the provider to whom the personal data was provided, namely when:

(a) the processing is based on consent or a contract, and
(b) the processing is carried out by automated means.

As an individual, when exercising the aforementioned right to data portability, you have the right to have your personal data transferred directly from one controller (service provider) to another, where technically feasible.

Right to Object to Processing

As an individual, based on grounds related to your particular situation, you have the right to object at any time to the processing of personal data that is necessary for the performance of tasks carried out in the public interest or in the exercise of official authority vested in the provider (Article 6(e) (1) of the GDPR) or is necessary for the legitimate interests pursued by the provider or a third party (Article 6(1)(f) of the GDPR), including profiling based on such processing; the provider shall cease processing personal data unless it demonstrates compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or for the establishment, exercise, or defense of legal claims.

When personal data is processed for marketing purposes, the individual has the right to object at any time to the processing of data concerning him or her for such marketing purposes, including profiling, insofar as it is related to such direct marketing; where the individual objects to processing for direct marketing purposes, the data shall no longer be processed for those purposes.

The right to file a complaint with the supervisory authority

Without prejudice to any other (administrative or other) legal remedy, you, as an individual, have the right to file a complaint with a supervisory authority, particularly in the country where you have your habitual residence, where you work, or where the alleged violation occurred (in Slovenia, this is the Information Commissioner), if you believe that the processing of your personal data violates data protection regulations.

Without prejudice to any other (administrative or extrajudicial) remedy, you, as an individual, have the right to an effective legal remedy against a legally binding decision by the supervisory authority regarding your complaint, as well as in cases where the supervisory authority fails to address your complaint or fails to inform you within three months of the status of the matter or of a decision on the complaint. Proceedings against a supervisory authority fall within the jurisdiction of the courts of the Member State in which the supervisory authority is established.

Individuals may submit all requests regarding the exercise of their rights in connection with personal data in writing to Kridis, Kristjan Korošec s.p., Bevkova 31, 3000 Celje, Slovenia.

For the purposes of reliable identification when exercising rights related to personal data, the controller may request additional information from the individual, but may refuse to take action only if it can demonstrate that it cannot reliably identify the individual.

Upon request by an individual exercising his or her rights regarding personal data, the controller must respond without undue delay and no later than one month after receiving the request.

Last updated: July 16, 2026