Personal Data Protection Policy
The purpose of the personal data protection policy is to inform clients, partners, associates,
employees and other users (hereinafter: individuals) collaborating with the company SMART
AD d.o.o. (hereinafter: the Company) on the purposes and legal bases, security measuresand rights of individuals regarding the personal data processing performed by our Company.
We value your privacy, that's why we always take great care to protect your data.
This privacy policy may be modified or amended at any time without prior warning or notice.
By using the provider's website after any modifications or amendments have been made, theindividual confirms that he/she agrees with the modifications and amendments.

Your personal data are processed in accordance with European legislation (Regulation (EU)2016/697 on the protection of natural persons with regard to the processing of personal dataand on the free movement of such data (hereinafter: General Regulation)), applicablelegislation on the protection of personal data (Personal Data Protection Act (ZVOP-1, Official
Gazette of the Republic of Slovenia, no. 94/07)), and other legislation providing a legal basisfor the processing of personal data.
The personal data protection policy provides information to individuals on the manner inwhich our company, as the controller, processes personal data obtained from an individual
according to the legal bases described below.

Controller
The controller of personal data is the company:
SMART AD d.o.o.
Parmova ulica 14, 1000 Ljubljana

Data Protection Officer
In line with the provision of Article 37 of the General Regulation, we have not appointed adata protection officer. In case of any queries regarding the processing of your personaldata, feel free to contact us whenever necessary via e-mail: info@smart-ad.si.

Personal Data
Personal data means any information relating to an identified or identifiable individual(hereinafter: »data subject«); an identifiable individual is one who can be identified, directly
or indirectly, in particular by reference to an identifier, such as a name, identification number,
location data, an online identifier, or to one or more factors specific to the physical,
physiological, genetic, mental, economic, cultural or social identity of that individual.
In accordance with relevant legal bases, the following types of personal data can beprocessed:

–Data on other users or natural persons (name, surname, address, telephone number,e-mail, profiles on social networks, etc.).

Our company can create new personal data on an individual, such as records of interviews
and meetings held. The company does not collect or process an individual's personal data
unless this is enabled or allowed by the individual upon ordering products or services,
subscription to e-news, participation in a prize contest, etc., or when there are legal grounds
for the collection of personal data, or if the provider has a legitimate interest in theirprocessing.
The use of certain contents on the portal will require you to register via the Facebook pluginwith your username and password. By registering on the portal, you agree that the personal
data (demographic data – name, surname, gender, e-mail) which you submitted when
acquiring a username or when using the portal, or which the issuer has obtained from othersources and may be joined with your personal data processed by the issuer, may be used in
the manner and for the purposes described below.
The issuer shall use the data on the use of the portal that will be collected automatically anddo not enable insight into personal data, exclusively for the purpose of improving theoperation of the portal. Users who register on the portal via their Facebook account shallassume full responsibility for the account created. In the event that a user registers andcomments on the portal and maliciously uses it with a false Facebook profile, the issuer
reserves the right to exclude such user or block him/her from the portal.

Purposes of processing and bases for data processing
The company collects and processes your personal data on the following legitimate bases:– processing is necessary in order to meet the legal requirements applicable for thecontroller;– processing is necessary in order to implement the contract, whose contracting
party is the individual to whom the personal data relate, or to implement relevantmeasures at the request of such individual prior to concluding the contract;– processing is necessary because of legitimate interests;– the individual to whom the personal data relate has consented to the processing of
his/her personal data for one or more of the specified purposes.
We process personal data for the purposes of direct marketing by e-mail to the designatede-mail address. This may involve informing on novelties and marketing of goods andservices offered by the issuer, as well as goods and services offered by a third party
contractually linked with the issuer.
Data are also processed in cases of potential defence in litigations and other legal
proceedings, as well as for determining compliance, which includes compliance with therequirements of state authorities for personal data, compliance with tax procedures, forensuring safety-at-work, etc. These may be used for internal reporting, during audits, and inother legal matters within the scope of normal business objectives.

Data may also be used for improving services, which includes identifying difficulties inexisting services, planning improvements of existing services, and creating new services.
We may also make use of surveys.
The personal data provided by the user are included in the issuer's data base. This data isprocessed for the needs of informing about the portal, products, sampling, surveying andstatistical data processing, determining the use of the portal's services, adapting theproducts and their content offered by the issuer and their segmentation, market research,
informing on commercial (including classic banner advertising) and non-commercial offers,novelties, bargains, other marketing purposes of the issuer, and for sending the daily
electronic newspaper. The data obtained by the issuer from other sources may also be
joined with the data in the issuer's data base for the purpose of adapting the ad's message
for the user of other contents of the issuer. The data shall be used to determine the user's
interest in specific contents and advertisements of the issuer's products, and consequently
adapting the advertisements to a specific user.

Performance of Contract
In cases when you enter into a contract with the company, the contract shall represent alegal basis for the processing of personal data. Your personal data have to be processed inorder to conclude and implement the contract. If an individual fails to provide his/her
personal data, the company will not be able to conclude the contract, or perform a service ordeliver goods or other products in accordance with the concluded contract, as it does notpossess the data required for its implementation. We are also allowed to inform contractual
parties on contents, services and products under the Electronic Communications Act. An
individual may at any time request termination of this type of communication and processingof personal data, and revoke the receipt of messages via the link for cancellation in themessage received, or by sending a request by e-mail to info@smart-ad.si or by ordinary post
to the company's address.
Legitimate Interests
The company may process personal data on the basis of the legitimate interests it pursues.
This shall not be admissible when such interests are overridden by the interests orfundamental rights and freedoms of the individual requiring the protection of personal data.
When exercising its legitimate interests, the company always conducts an assessment incompliance with the General Regulation.
Processing on the Basis of Consent
The company may, in the absence of any legal basis established under applicable law,
contractual obligations or legitimate interests, request the individual's consent. This will allow
the company to process specific personal data of the individual also for the following
purposes, subject to the individual's consent:– E-mail address for the purposes of informing and communication (news, bargains,prize contests, etc.),– additional information about a customer for specific, previously determined purposes,– other purposes to which the individual agrees by consent.

If the individual has given consent to the processing of his/her personal data and now nolonger wishes to do so, he/she may request the cessation of processing of his/her personal
data by sending a request to that effect by e-mail to info@smart-ad.si or by ordinary post to
the organisation's address.

Storage and erasure of personal data
The company shall store personal data for only as long as this is necessary to achieve thepurpose for which the personal data were collected and processed. If the company
processes data pursuant to the law, such data shall be stored for the period prescribed bylaw. In such cases some data are stored for the period of training in the organisation, whileother data have to be stored permanently.
The personal data processed by the company on the basis of a contractual relationship with
the individual shall be stored by the company for the period needed to implement thecontract and for an additional 6 years after its termination, except in the event of a dispute
between the individual and the organisation relating to the contract. In this case the company
shall store the data for an additional 5 years after the issue of a final court decree, arbitration
award or court settlement, or, in the absence of litigation, 5 years from the date of anamicable settlement of the dispute.
The company shall store the personal data processed on the basis of the personal consent
of an individual, or legitimate interests, until such consent is revoked or a request is received
for erasure of the data. After receipt of a revocation or a request for erasure, the data shallbe erased not later than within 15 days. The company may erase the data even before
revocation in cases when the purpose of processing the personal data has been achieved,or if so required by law.
The company may, in exceptional cases, reject a request for erasure for reasons specified in
the General Regulation, namely: exercising the right of freedom of expression andinformation, compliance with a legal obligation which requires processing, reasons of publicinterest in the area of public health, archiving purposes in the public interest, scientific or
historical research purposes or statistical purposes, and the exercise or defence of legalclaims.
After expiry of the storage period, the controller shall effectively and permanently erase oranonymise the personal data so that they can no longer be linked to a specific individual.

Contractual Processing of Personal Data and Transfer of
Data
The company may entrust individual tasks related to the processing of personal data to acontractual processor on the basis of a contract on contractual processing. Contractualprocessors may process the entrusted data exclusively on behalf of the controller within thescope of his/her authorisations as specified in a written contract or other legal act and incompliance with the purposes defined in this document.
The contractual processors with whom the provider collaborates are in particular:––––accounting services and other providers of legal and business consulting services;
information system maintainers,
providers of e-mail services and providers of software, cloud services (e.g., Arnes,Microsoft, Google);
providers of social networks and online advertising (Google, Facebook, Instagram,etc.).

The company shall not, under any circumstances, supply the personal data of an individual
to unauthorised third parties.
Contractual processors may process personal data only within the scope of the company's
instructions, and shall not utilise personal data for any other purposes.

The company, as the controller and employees of the company, does not export personal data
to third countries (outside the Member States of the European Economic Area - EU member
states and Iceland, Norway and Liechtenstein) and to international organizations except theUSA. Relationships with USA contract processors are governed by standard contractual
clauses (standard contracts adopted by the European Commission) and / or binding businessrules (adopted by the organization and approved by EU supervisors).

Cookies
The website of the organisation operates with the help of so-called cookies. A cookie is a filethat stores website settings. Websites store cookies in users' devices which they use toaccess the internet for the purpose of recognising individual devices and settings used byusers during access. Cookies enable websites to recognise whether the user has alreadyvisited them, while in advanced applications they can help to adequately adjust individualsettings.
Cookies are fundamental to ensuring friendly online services to users. They are used tostore data on the state of a particular website, help to collect statistics on users and website
traffic, etc. Cookies also help us to assess the effectiveness of our website design.
The storage and management of cookies is under the complete supervision of the user's
browser. The browser may restrict or disable the storage of cookies at will. The cookies
stored by the browser can be deleted – instructions can be found on the websites ofindividual browsers.

Protection and accuracy of data
The company ensures information security and safety of infrastructure (premises andapplication/system software). Our information systems are protected, among others, withanti-virus programmes and firewalls. We have implemented appropriate organisational,
technical security measures aimed at protecting your personal data against accidental or
illegal destruction, loss, modification, unauthorised disclosure or access, as well as against
other illegal and unauthorised forms of processing. In case of special types of personal data,
these are sent in encrypted form and protected by password.

It is your responsibility to deliver your personal data to us safely, and to ensure that the data
sent are accurate and credible. We shall devote our best efforts to ensuring that yourpersonal data being processed by us are accurate and updated whenever necessary.
Occasionally, we may request that you confirm the accuracy of your personal data.

Rights of individuals regarding data processing
In line with the General Regulation, you as an individual have the following rights related topersonal data security:– You may request information about whether we keep any personal data about you
and, where that is the case, which data we have and on what grounds we have suchdata and why we are using them.
– You may request access to your personal data, which will allow you to receive a copyof the personal data we keep about you and to verify whether we are processing
them lawfully.
– You may request corrections of personal data, such as the correction of incomplete
or inaccurate personal data.
– You may request the erasure of your personal data when there is no reason for theirfurther processing or when you are exercising your right of objection against its
further processing.
– You may object to the further processing of your personal data whenever we rely on
legitimate business interests (also in the case of legitimate interests of third parties),when there are reasons linked to your special position; irrespective of the provision of
the previous sentence, you have the right to object at any time if we are processing
your personal information for the purposes of direct marketing.
– You may request the restriction of processing of your personal data, which means thecessation of processing of your personal data, e.g., if you would like us to ascertain
their accuracy or check the reasons for their further processing.
– You may request the transfer of your personal data to another controller in structured
electronic form, if this is possible and realisable.
– You may revoke your agreement or consent given for the collection, processing andtransfer of your personal data for a specific purpose. After receiving notification thatyou have revoked your consent, we shall cease to process your personal data for thepurposes initially accepted by you, unless we have another legitimate legal basis fordoing so lawfully.
If you wish to exercise any of the above-mentioned rights, please send your request by email to info@smart-ad.si or by ordinary post to the address of the organisation: Smart AD
d.o.o.
Access to your personal data and exercise of your rights are free of charge. However, wemay charge a reasonable payment in the event that the individual's request relating topersonal data is evidently unfounded or excessive, particularly if it is repetitive. In suchcases a request may be rejected.
In case of the exercise of rights in this respect, we may have to request that you provide us
with specific information that will assist us in confirming your identity. This is merely a safetymeasure designed to ensure that personal data are not disclosed to unauthorised persons.

In exercising rights in this respect, you may also use the Information Commissioner's form,
whichisaccessibleontheirwebsite.
Link:
https://www.iprs.si/fileadmin/user_upload/doc/obrazci/ZVOP/Zahteva_za_seznanitev_z_lastnimi_osebnimi_podatki__Obrazec_SLOP_.doc
If you feel that your rights are being violated, you may contact the supervisory authority or
the Information Commissioner for protection or assistance. Link: https://www.iprs.si/zakonodaja/reforma-evropskega-zakonodajnega-okvira-za-varstvo-osebnihpodatkov/kljucna-podrocja-uredbe/prijava-krsitev/
If you have any queries regarding the processing of your personal data, feel free to contact
us by e-mail at info@smart-ad.si or by ordinary post sent to the address of the organisation:
Smart AD d.o.o.

Posting of modifications
All modifications of our personal data protection policy will be posted on our website. By
using our website, the individual confirms that he/she accepts and agrees with the entire
contents of our personal data protection policy.
Ljubljana: 1 September 2020