Privacy Policy

Personal Data Protection Policy and User Rights

In accordance with the applicable Personal Data Protection Act, the Electronic Communications Act and the General Data Protection Regulation (“GDPR”), Libona d. o. o.so.p., (HempLight online store) provides the following rights regarding the protection of personal data, which are explained in more detail below:

• data controller;
• purpose of data processing and types of personal data;
• visit and use of the website;
• storage period;
• right of access to data;
• right to rectification;
• right to erasure (“right to be forgotten”);
• right to restriction of processing;
• right to data portability;
• right to object.

Data controller

The controller of your personal data is Libona d. o. o.so.p., Radgonska c. 2, 2235 Sv. Trinity.

Purpose of data processing and types of personal data

We will treat all personal data provided confidentially and use it only for the purposes for which you provided it. If there is a need to further process your data for any other purpose, we will inform you in advance and ask for your consent.

Visit and use of the website

With each visit to the website www.hemplight.net, a web server log file is automatically stored on the web server (e.g. IP number – a number that identifies an individual computer or other device connected to the Internet; browser version, time of visit, etc.). We process this data for the purposes of maintaining website visit statistics. Libona d.o.o.so.p. processes the data collected in this way separately and does not link it to other data.

Storage period

We assure you that we only store your data for as long as is necessary to fulfill the purpose for which it was collected and used, namely:

• Web server log files are stored for three months;
• Your contact details for communication purposes are processed until the transaction or communication is completed;
• If there is a different statutory storage period for individual data processed for the implementation of contracts (e.g. accounting or tax data), the storage period is ten years. During this time, data processing is limited.

After the need for data management ceases, i.e. after the purpose for which it was collected has been fulfilled, the data will be immediately, irreversibly and permanently deleted.

Right of access to data

You have the right to obtain from the company confirmation as to whether or not the company is processing your personal data and, where that is the case, access to your personal data and the following information regarding the processing of your personal data:

• purposes of the processing;
• types of personal data;
• users or categories of users to whom your personal data have been or will be disclosed, in particular users in third countries or international organisations;
• where possible, the period for which the personal data will be stored shall be provided or, where that is not possible, the criteria used to determine that period;
• the existence of the right to obtain from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject, or the existence of the right to object to such processing;
• the right to lodge a complaint with a supervisory authority;
• where the personal data are not collected from the data subject, all available information regarding their source;
• the existence of automated decision-making, including profiling, and meaningful information about the reasons for it, as well as the significance and envisaged consequences of such processing for the user.

Upon your request, the Company will provide you with one free copy of your personal data that is being processed. For additional copies of the data that you request, the Company will charge you a reasonable fee, taking into account administrative costs.

Right to rectification

You have the right to request from the Company to rectify inaccurate personal data concerning you without undue delay. Taking into account the purposes of the processing, you have the right to have incomplete personal data completed in writing.

Right to erasure (“right to be forgotten”)

You have the right to request that the company erases personal data concerning you without undue delay, and the company must erase your personal data without undue delay in the following cases:

• when the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
• when you withdraw your consent to the processing of your personal data and there is no other legal basis for the processing;
• when you object to the processing based on the legitimate interest of the controller and there are no overriding legitimate grounds for the processing;
• when you object to the processing for direct marketing purposes;
• when the personal data must be erased for compliance with a legal obligation under European Union law or Slovenian law.

When the company publishes your personal data in accordance with the policy, it takes reasonable steps to measures, including technical measures, to inform controllers processing your personal data that the data subject has requested them to erase any links to or copies of that personal data.

Right to restriction of processing

You have the right to request that the company restrict the processing of your personal data where one of the following applies:

• you contest the accuracy of the data, for a period enabling the controller to verify the accuracy of your personal data;
• the processing is unlawful and you oppose the erasure of the personal data and request the restriction of their use instead;
• the company no longer needs the personal data for the purposes of the processing, but you require them for the establishment, exercise or defence of legal claims;
• you have objected to the processing, pending verification of whether the legitimate grounds of the controller override your grounds.

Right to data portability

You have the right to receive the personal data concerning you held by the company in a structured, commonly used and machine-readable format, and the right to transmit those data to another controller, not that the company to which the personal data have been provided would hinder you in doing so when:

• the processing is based on your consent or a contract;
• the processing is carried out by automated means.

Right to object

On grounds relating to your particular situation, you have the right to object at any time to the processing of your personal data, if it is based on the legitimate interests pursued by the company or a third party. The company will cease processing the personal data unless it demonstrates compelling reasons for the processing which override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims. Where personal data are processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for such marketing purposes, including profiling, if it is related to such direct marketing. If direct marketing is based on consent, the right to object can be exercised by withdrawing the personal consent given.

Procedure for exercising rights

You can address all of the above requests concerning the exercise of rights in relation to your personal data in writing to the controller, namely to the e-mail address info@hemplight.net, or by post to the address Libona d.o.o.so.p., Radgonska c. 2, 2235 Sv. Trojica.

If you submit your request in accordance with the above paragraph by electronic means, the information will be provided to you, if possible, by electronic means, unless you request otherwise.

For the purposes of reliable identification in the event of exercising your rights in relation to personal data, the Controller may request additional information from you that is necessary to confirm your identity, and may refuse to take action in accordance with this Chapter only if it proves that it cannot reliably identify you.

The Controller will respond to a request by which you exercise your rights in relation to your personal data without undue delay and at the latest within one month of receiving the request. The Company may extend the deadline for exercising the rights by a maximum of two additional months, taking into account the complexity and number of requests. If the Company extends the deadline, it will notify you of any such extension within one month of receiving the request, together with the reasons for the delay.

If your requests under this section are manifestly unfounded or excessive, in particular because they are repetitive, the company may:

• charge a reasonable fee, taking into account the administrative costs of providing the information or communication or implementing the requested action;
• refuse to act on the request.

Right to lodge a complaint regarding the processing of personal data

You can address any complaint regarding the processing of your personal data in writing to the controller, namely to the e-mail address info@hemplight.net or by post to the address
Libona d.o.o.so.p., Radgonska c. 2, 2235 Sv. Trojica.

You also have the right to file a complaint directly with the Information Commissioner if you believe that the processing of personal data concerning you violates Slovenian or European Union regulations in the field of personal data protection.

Validity

This is valid from 22 April 2020 and may be amended or supplemented at any time. Therefore, we ask you to check the current version before each submission of personal data so that you are aware of any amendments and supplements.