M SORA D.D. PRIVACY AND PERSONAL DATA PROTECTION POLICY (Version 3.0)
Date of last update: 21 October 2026 Effective from: 21 October 2026
At M Sora d.d. (hereinafter: the “company” or the “controller”), we respect your privacy. This policy explains how we collect, process and protect your personal data in accordance with the General Data Protection Regulation (GDPR) and the Personal Data Protection Act (ZVOP-2).
- PERSONAL DATA CONTROLLER AND CONTACT DETAILS
The controller of personal data is: M Sora d.d., Trg svobode 2, 4226 Žiri, Slovenia. Registration number: 2235102000
For all questions relating to personal data protection, we have established the following dedicated contact address: gdpr@m-sora.si
Data Protection Officer (DPO): Considering the scope of processing and the use of advanced tracking technologies, the company has appointed a DPO, who can be contacted at the email address stated above.
- PURPOSES OF PROCESSING AND LEGAL BASIS
We process your data on the following legal bases (Article 6 GDPR and Article 6 ZVOP-2):
- Performance of a contract or steps prior to entering into a contract: preparation of quotations (windows, doors and architectural solutions), installation, servicing, handling complaints and performing other contractual obligations.
- Legal obligation: maintaining accounting records, invoicing and complying with tax and other statutory obligations.
- Consent: sending newsletters, targeted advertising on social media, use of optional cookies, and participation in podcasts, interviews, presentations and other audiovisual content.
- Legitimate interest: ensuring website security, preventing fraud, statistical analysis of website visits, optimising the user experience and informing the public about the company’s activities, including the publication of photographs and recordings of events in accordance with applicable legislation.
- Processing of job applicant data: conducting recruitment and selection procedures on the basis of pre-contractual measures, the applicant’s consent or another appropriate legal basis.
- TYPES OF DATA AND RETENTION PERIODS
- Enquiries and contracts: first name, surname, address, email address, telephone number and information about the property or project. Retention period: five years after performance of the contract or until the expiry of the relevant limitation periods; in the event of a dispute, until the proceedings have been finally concluded.
- Website analytics (Google Analytics 4): anonymised IP address, device data and website behaviour. Retention period: 14 months.
- Marketing data: email address and click data. Retention period: until consent is withdrawn.
- Job applicants: until the end of the selection procedure or until consent is withdrawn.
3. a. PHOTOGRAPHY, AUDIO AND VIDEO RECORDING, AND PUBLICATION
M Sora d.d. organises and co-organises various business, professional, promotional, educational and social events at which photographs and audio and video recordings may be made.
The company may publish photographs and recordings from events on its websites, social media and in other promotional materials for the purpose of informing the public about its activities.
The legal basis for the publication of event photographs and recordings is the legitimate interest of the controller pursuant to point (f) of Article 6(1) GDPR and Article 93 ZVOP-2, provided that the publication does not constitute a significant interference with the reasonable expectations of privacy of the persons concerned.
Participants are informed in advance or at the beginning of the event about photography and recording and about the possibility of objecting. A person who does not wish to be photographed or recorded may inform the organiser at the event or subsequently contact gdpr@m-sora.si.
Where an individual is the main subject of a photograph or recording, or participates in a podcast, interview, presentation or other audiovisual content, the company will obtain that individual’s consent before publication.
Photographs and recordings are retained for as long as necessary for the purpose of informing the public and documenting the company’s activities, or until the individual objects or withdraws consent.
- COOKIES AND TRACKING TECHNOLOGIES
The website uses an advanced consent management platform (CMP), which allows you to choose between:
- Necessary cookies: required for the operation of the website; always active.
- Analytics cookies: Google Analytics 4, with IP anonymisation enabled.
- Marketing cookies and pixels: Meta Pixel, LinkedIn Insight Tag and TikTok Pixel for remarketing and segmentation.
Tracking is carried out only if you give your explicit consent through the cookie banner. We do not activate non-essential cookies before your consent. You may change or withdraw your consent at any time via the cookie settings available on the website.
- TRANSFERS TO THIRD COUNTRIES
When using services such as Google Analytics, Meta and LinkedIn, data may be transferred to the United States. M Sora d.d. ensures the lawfulness of transfers by using the EU-US Data Privacy Framework, where the recipient is certified, or the European Commission’s Standard Contractual Clauses together with a Transfer Impact Assessment and additional safeguards where necessary.
- 6. M SORA GROUP AND DATA DISCLOSURE
M Sora d.d. may transfer certain personal data to affiliated companies within the M Sora Group, such as M Sora Finestre and M Sora Fenster, where this is necessary for carrying out business processes, providing shared services, performing contractual obligations towards customers or pursuing legitimate interests for internal administrative purposes.
Within the M Sora Group, companies may act as independent controllers, joint controllers or processors, depending on the nature and purpose of the processing. The relationships between the companies are governed by appropriate agreements in accordance with Articles 26 and 28 GDPR.
Personal data may also be disclosed to contractual processors, such as providers of IT infrastructure, hosting, accounting and marketing services, with whom appropriate agreements have been concluded in accordance with Article 28 GDPR. Personal data are disclosed to competent public authorities only where required or permitted by law.
For all questions relating to the processing of personal data and the exercise of your rights, the following single point of contact is available: dpo@m-sora.si.
- YOUR RIGHTS AND THE PROCEDURE FOR EXERCISING THEM
YOUR RIGHTS AND THE PROCEDURE FOR EXERCISING THEM
Under the GDPR and ZVOP-2, you have the following rights:
- right of access,
- right to rectification,
- right to erasure,
- right to restriction of processing,
- right to data portability,
- right to object to processing.
Procedure for exercising your rights
Send your request by email to gdpr@m-sora.si or by registered post to the company’s registered office.
We will decide on your request without undue delay and no later than one month after receiving the complete request.
In justified cases, this period may be extended by a maximum of two additional months, of which you will be informed in due time.
If we are unable to grant your request, we will inform you of the reasons and of your right to lodge a complaint with: Information Commissioner of the Republic of Slovenia, Dunajska cesta 22, 1000 Ljubljana.
CONSENT TO PHOTOGRAPHY, RECORDING AND PUBLICATION OF MATERIALS
I, the undersigned, _________________________________, hereby declare that I voluntarily consent to M Sora d.d., Trg svobode 2, 4226 Žiri, processing my personal data in the form of photographs, audio recordings, video recordings, first name, surname, job title or function, voice and other data that I provide or present as part of my participation.
I consent to the above personal data being used for the preparation and publication of:
- podcasts,
- interviews,
- presentation videos,
- professional and promotional content,
- publications on the company’s websites,
- publications on the company’s social media,
- the company’s internal and external communication materials.
I understand that the materials may be published in full or in part and will be accessible to the public through the company’s communication channels.
I give my consent voluntarily and may withdraw it at any time by sending notice to gdpr@m-sora.si. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal was received.
Date: ______________________
First name and surname: ______________________
Signature: _______________________________
