Personal data protection policy

Personal data controller

The personal data controller is the Public Institute Museum Vrbovec Museum of Forestry and Woodworking, Savinjska cesta 4, 3331 Nazarje (hereinafter referred to as the public institute).

Purpose of collecting personal data

The public institute processes the personal data of individuals to fulfill its tasks,
as determined by the Institutes Act and the statute of the public institute, to fulfill and implement
a contractual relationship, to perform tasks in the public interest, or processes personal data based on the consent of the individual.

Given the purpose for which it was established, the Institute, as a public service in the field of culture, performs the following tasks:

• collects, stores, conserves and restores, documents, protects and scientifically studies movable cultural heritage from the field of forestry and woodworking,
• prepares and presents thematic exhibitions and other forms of presenting heritage at home and abroad and organizes hosting of foreign exhibitions,
• determines and proposes the declaration of heritage as a monument or landmark and prepares the professional basis necessary for the declaration,
• prepares national and international professional and scientific meetings, seminars and other forms of professional cooperation,
• organizes and carries out scientific and research tasks in its field of work,
• provides explanations, advice and other professional assistance to natural and legal persons in the knowledge, protection and preservation of heritage; cooperates with the holders or bodies that keep it,
• lends museum material for exhibition activities and special needs,
• develops awareness of the importance of heritage,
• regularly and systematically cooperates with educational organizations and ensures the popularization of its activities,
• publishes, exchanges and sells professional publications of material from its collections, catalogues and other written and printed words, image and sound carriers and other products related to the activities of the museum,
• publishes and sells replicas and souvenirs related to the activities of the museum,
• issues copies of documents, certificates based on documents and gives expert opinions,
• provides services in the field of its activities for the needs of natural and legal persons,
• provides other services that complement the basic activity and are determined by the statute of the museum,
• performs other tasks in accordance with the law.

In order to fulfill its tasks and to promote the services of the Institute, the Institute may organize various public events that are recorded in audio or video, and the recordings of these events are publicly published on the web portals managed by the Institute.

Legal basis for the processing of personal data

The Public Institute processes personal data in the following cases:

• if the individual's consent has been given to the processing of personal data for one or more specific purposes,
• if the processing is necessary for the performance of a contract to which the individual to whom the personal data relate is a party,
• if the processing is necessary for the fulfillment of a legal obligation applicable to the Public Institute,
• if the processing is necessary for the performance of a task in the public interest or in the exercise of public authority vested in the Public Institute.

Types of personal data processed and source of personal data acquisition

The Public Institute may acquire and process the following personal data about individuals:

• unique identification number;
• personal name;
• address of permanent or temporary residence;
• date and place of birth;
• employment,
• e-mail address,
• telephone number.

The public institution may obtain personal data from the previous paragraph directly from
the individual to whom the data relate. The public institution may also obtain personal data from the administrator of the central population register, civil registry, land cadastre or other administrator, if so provided by law.

Categories of individuals whose personal data are processed

The public institution processes personal data of individuals who are involved in procedures and
tasks carried out by the institution, which include in particular:

• employees of the public institution,
• contractual employees of the public institution,
• individuals who have a contract with the public institution,
• visitors and users of the services of the public institution,
• other individuals who come into contact with the public institution where personal data processing is carried out.

In more detail, the categories of individuals for each personal data collection are defined in the record of personal data processing activities, which is accessible on the public institution's website.

Users of personal data

The public institution will enable the processing or transmission of personal data exclusively to the following authorized users:

• authorized employees of the public institution,
• authorized persons who process personal data with an authorized contractual processor of the public institution,
• persons who demonstrate authorization to access personal data within the framework of the law or implementing regulations,
• persons to whom the individual to whom personal data has granted authorization for access.

Storage of personal data

The public institution appropriately stores and protects personal data in both physical and electronic form. Data processed for the purpose of The data are stored until all obligations under the contractual relationship are fulfilled. The data are stored for as long as they are defined by the regulations that determine the retention periods for each type of material in accordance with written professional instructions for selecting archival from documentary material based on the Act on the Protection of Archival and Documentary Material and Archives. After the purpose of the processing has been fulfilled or the statutory retention period has expired, the personal data are deleted, destroyed, blocked or anonymized. The public institution stores data processed on the basis of the individual's consent until his or her consent is revoked. The user may submit a written request to the official address of the public institution at any time to revoke the consent and the processing of personal data.

Privacy protection

The public institution ensures the protection of privacy by complying with all applicable legal regulations. The public institution also provides all necessary technological and organizational support for the protection and security of personal data against loss, alteration, theft and access by unauthorized third parties:

• internal acts on personal data security have been adopted,
• internal acts on information protection have been adopted,
• management of personal data databases,
• procedures for exercising the rights of individuals have been established,
• appropriate procedures and appropriate action in the event of identified violations of personal data protection have been established,
• an authorized person for personal data protection has been provided,
• appropriate contracts have been concluded with contractual personal data processors,
• measures for physical and communication data security have been applied.

Transfer of personal data to third parties

All personal data processed by the public institution are stored on information systems, which are located on the territory of the Republic of Slovenia and the European Union and are not transferred to third countries outside the EU.

Existence of automated decision-making

The Public Institution as the responsible organization does not use automated decision-making, including profiling.

User rights

The individual may at any time request from the personal data controller:

• confirmation as to whether personal data concerning him or her are being processed, and, where that is the case, access to the personal data and the following information:
  • the purposes of the processing;
  • the types of personal data concerned;
  • the users or categories of users to whom the personal data have been or will be disclosed, in particular users in third countries or international organizations;
  • the retention period for which the personal data will be stored or, if that is not possible, the criteria used to determine this period;
  • the existence of automated decision-making, including profiling;
• the reasons for the processing as well as the significance and envisaged consequences of such processing for the individual;
• one copy of the personal data in electronic form (free of charge);
• in the event that the individual requests additional copies, the controller may charge a reasonable fee, taking into account the costs;
• restriction of processing where:
  • the data subject contests the accuracy of the data, for a period enabling the controller to verify the accuracy of the personal data;
  • the processing is unlawful and the data subject opposes the erasure of the personal data and instead requests the restriction of their use;
  • the controller no longer needs the personal data for the purposes of the processing, but the data subject needs them for the establishment, exercise or defence of legal claims;
• rectification of inaccurate or incorrect personal data;
• erasure of all personal data on the basis of the conditions of Article 17 of the General Regulation, more specifically if the data subject withdraws the consent on the basis of which the personal data are processed;
• the data subject has the right to receive the personal data concerning him or her, which he or she has held from a controller, in a structured, commonly used and machine-readable format and the right to transmit those data to another controller without hindrance from the controller to whom the personal data have been provided;
• the right to object to the use of personal data for direct marketing purposes, including profiling;
• the data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her in accordance with Article 22 of the General Data Protection Regulation.

An individual has the right to file a complaint against the controller with the Information Commissioner if he or she believes that the processing of personal data violates the General Data Protection Regulation (address: Dunajska 22, 1000 Ljubljana, e-mail: gp.ip@iprs.si, telephone: 012309730, website: www.ip-rs.si).

An individual can submit an application for exercising rights to the address of the public institution. Additional information can also be obtained from the person authorized for personal data protection. ov dpo@virtuo.si .

Persons under 15 years of age

Persons under 15 years of age may submit their data via the website or in any other relationship with the public institution only with the express permission of their parents, foster parents or guardians.

Authorized person for personal data protection

The authorized person for personal data protection in the public institution is Virtuo d.o.o.; e-mail address: dpo@virtuo.si .

Records of processing activities

The public institution keeps records of processing activities in electronic form, which are accessible on the Institution's website:

Final provisions

The public institution reserves the right to amend and supplement this personal data protection policy. Individuals whose personal data are processed by the public institution and users of the public institution's website will be informed of any changes to this personal data protection policy on the public institution's website.

Current Museum opening hours

• Tuesday - Friday:
  9.00 - 16.00
• Saturday, Sunday, national days:
  9.00 - 17.00
• Mondays:
  closed

muzej.vrbovec@siol.net

+386 (0)3 839 16 13
+386 (0)40 345 630