Last updated: 23 oktobra 2026
This privacy policy explains how personal data is processed on www.naluft.si (NaLuft), an online directory of sports activities and outdoor experiences in Slovenia. We process data in line with the General Data Protection Regulation (GDPR) and the Slovenian Personal Data Protection Act (ZVOP-2).
1. Data controller
Monika Jensterle s.p., [naslov], VAT/tax no. [davčna številka]
E-mail: info@nexa.si
2. What data we collect and why
Enquiries to activity providers. When you send an enquiry from an activity or provider page, we collect your name, e-mail address, phone number (optional), preferred date, number of people and your message. We use them to forward your enquiry to the provider you chose so they can reply to you. Legal basis: your consent and steps taken at your request before entering into a contract (Art. 6(1)(a) and (b) GDPR). The provider then processes your data as a separate controller.
Partner and provider applications. When you apply via the »Partner with us« page, we collect the company name, contact person, e-mail, phone, website, region, activities and your message, to reply to you and agree on a listing. Legal basis: steps prior to a contract (Art. 6(1)(b) GDPR).
Newsletter. If you subscribe, we keep your e-mail address, the language and the date of subscription and send you ideas for outdoor activities. Legal basis: your consent (Art. 6(1)(a) GDPR). You can unsubscribe at any time via the link in each newsletter or by writing to us.
Provider accounts (when this feature is enabled). For registered providers we process the company and contact details, login details (the password is stored only in encrypted form), the activities they submit and payment records. Payments are processed by Stripe Payments Europe Ltd.; we never see or store card details. Legal basis: contract (Art. 6(1)(b) GDPR) and legal obligations regarding invoices (Art. 6(1)(c) GDPR).
Published provider information. Activity listings show the business contact details of providers (name, address, phone, e-mail, website, social media), which the providers publish themselves or which are publicly available. Providers can ask us to correct or remove them at any time.
Technical data. When you visit the site, the hosting server automatically records technical data (IP address, browser, time of visit) for security and to ensure the site works. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
3. Cookies and data stored in your browser
The site does not use analytics, advertising or tracking cookies. We use only what is needed for the site to work:
pll_language— remembers the chosen language (1 year),- login cookies
wordpress_*— only for logged-in users (until logout or up to 14 days), - activities and providers you save with ❤ are stored only in your browser (local storage) and are never sent to us.
Links to Google Maps, Facebook and Instagram open those services only when you click them; their own privacy policies then apply.
4. Who receives your data
- the activity provider to whom you send an enquiry,
- our hosting and e-mail service providers (processors under a data processing agreement),
- Stripe (only for provider payments, when enabled),
- competent authorities, where required by law.
We do not sell your data or use it for profiling. Data is stored in the EU; if a processor transfers data outside the EU (e.g. Stripe), this is done on the basis of the European Commission’s standard contractual clauses.
5. How long we keep data
- enquiries and messages: up to 2 years after the last contact,
- partner applications: up to 2 years, or for the duration of cooperation,
- newsletter: until you unsubscribe,
- provider accounts: while the account is active; invoices and payment records for 10 years, as required by tax law,
- server logs: as set by the hosting provider, usually up to 30 days.
6. Your rights
You have the right to access, rectify and erase your data, to restrict processing, to data portability, to object to processing, and to withdraw your consent at any time (this does not affect processing before withdrawal). To exercise your rights, write to info@nexa.si. We will reply within one month.
If you believe we process your data unlawfully, you can lodge a complaint with the Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec), Dunajska cesta 22, 1000 Ljubljana, www.ip-rs.si.
7. Security
The site uses an encrypted connection (HTTPS). Access to the data is limited to persons who need it for the purposes described above.
8. Changes
We may update this privacy policy. The current version is always published on this page, with the date of the last update.