Privacy Policy

The website manager of Xsport is the company KinetiQ d.o.o. (Xsport™ is a trademark of KinetiQ d.o.o.), which is committed to the protection of the personal data of its users in accordance with the Personal Data Protection Act (ZVOP-2) and acts as a data controller in relation to the Xsport offer. We pay special attention to the protection of personal data. We are aware of and respect the privacy of our users and business partners, therefore we handle their personal data responsibly, carefully, and in accordance with the applicable Slovenian regulations and the internal acts of the company KinetiQ, d.o.o. Below is information about which personal data we process, on what basis we process them, for what specific purposes we use them, to whom we may disclose them, and what your rights are in connection with the processing of your personal data.

Data Controller Information

KinetiQ d.o.o.
Glavni trg 2
SI-2000 Maribor
Slovenia

Company number: 6190448000
VAT number: SI45860963

Personal Data (which personal data we process)

In the context of using our services, we collect various types of your personal data. We collect them when you provide them to us, for example, through your use of the website and its functions, when you contact us directly by email, phone, in writing, or through social media, in sweepstakes, when registering, when ordering and activating (redeeming) products (experiences) and gift vouchers, or in any other way in which you provide us with your personal data. We collect and manage the following personal data that you provide to us or that are part of our digital or other systems:

• identification data, primarily name and surname, address of residence, username and password, for legal entities ID for VAT;
• contact data, primarily email address, telephone number, delivery address, billing address, social network profiles;
• user account settings, primarily delivery addresses, profiles, newsletter subscriptions, loyalty program membership, shopping lists, searched products, compared products, reviews and comments on products or experiences and services;
• order data, primarily data about ordered products and payment method, including bank account number, data on complaints, exchanges, extensions;
• data on online habits, primarily data on searched products and other services, link clicks, search methods, devices used to access the internet, IP address and location, technical parameters (e.g., operating system, screen resolution, browser), other data obtained from cookies and similar technologies for device recognition;
• data on behavior in connection with reading received messages (e.g., mainly the time until the message is opened), devices used to access the internet, IP address and location, technical parameters (e.g., operating system, screen resolution, browser);
• derived data, such as personal data obtained from settings, primarily data on gender, age, financial circumstances, consumer habits, and attitude towards various products and services;
• data related to the use of application support from the ticketing system;
• any other data provided in accordance with the purpose of collection.
• data from certain publicly accessible sources such as online databases (e.g., company credit ratings), business directories, media publications, social media, websites, and others.

Based on the mentioned data, we create additional data in order to be able to send you offers tailored to your wishes and also with the aim of improving the offer and services in our online solution. In all current sweepstakes organized by the controller, the tax number as a very sensitive personal data is subsequently requested only from the winners and only in cases where the legislation requires it. Participants in the sweepstakes have the option to refuse to provide their data and still participate in the prize draw. The necessary data for receiving the prize must be provided by the winner, including the tax number if required. The winner who refuses to provide the data loses the right to the prize.

Purpose of Processing Personal Data

We process your personal data in various situations and primarily for the following purposes:

• Visiting the website (online store), which includes the use of cookies and other technologies primarily for transmitting data to advertising and social networks; determining the number of visitors, behavior on the website, and improving our offer and related services;
• Registered users – primarily for managing the user account and providing related functionalities.
• Completed purchase – primarily for processing the order, protecting our legal claims, and fulfilling our legal obligations.
• Contact and other data – for displaying and sending our tailored offers and the offers of our partner companies.

With your consent, we can share data with third parties (our partners) to display offers on other websites as well as to enable you to access certain additional products or services. We have the right to process your personal data based on the preparation or performance of a contract with you, compliance with legal obligations, our legitimate claims, or your consent. Within our activities and offers, we process personal data for various purposes and to various extents, namely:

• without your consent based on contract performance, our legitimate interest, or for the purpose of complying with legal obligations, or
• based on your consent.

What data processing we can perform without your consent depends on the purpose of the respective processing and how you relate to us – whether you are just a visitor to our online store, you register with us, or you order or buy products or services. We may also process your data if you are the recipient of products or services ordered from us, if you communicate with us or have been involved in any process related to our offer.

Disclosure and Processing of Personal Data

We may disclose personal data to our affiliated companies (stake in ownership structure) for the purpose of informing about other tailored offers that may interest you. Specifically, this refers to the company KinetiQ d.o.o. We may also disclose personal data to other legal entities (our partners) acting as personal data processors in relation to the following needs:

• order processing – primarily for managing payment systems to ensure payments (especially in relation to payment cards) and distribution of ordered products (vouchers);
• customized advertising display – based on your consent primarily to advertising and social networks (includes the use of cookies and other technologies);
• marketing and offer personalization – primarily to marketing tool managers, who help us optimize the web and personalize content and offers for you.

We do not disclose personal data to third countries (countries outside the EU), except in cases where it concerns our affiliated companies operating in third countries, in which case the data are primarily disclosed for the purpose of informing about other tailored offers that may interest you.

Sources of Personal Data Acquisition

We mostly acquire personal data directly through our online store or any other communication with you. Additionally, we may also obtain some other data from our partners (e.g., banks, payment system providers, distribution or transportation companies, etc.).

Retention Period of Personal Data

In cases where the purpose of collecting personal data or any other appropriately provided explanation does not specify the retention period for personal data, a retention period of up to three (3) years applies. In the case of extending the retention period, the controller will obtain your consent for the extension of the retention period in an appropriate manner before the extension (e.g., an email requesting confirmation of the extension of the retention period, etc.). Retention periods may also depend on the type of product or service that the user ordered on the website.

Rights Related to the Processing of Personal Data

In accordance with applicable legislation and EU Regulation (2016/679), each of our users has the following rights in relation to their personal data that we manage and process:

• The right to be informed about what personal data we collect, for what purposes and how long, where we obtain them from, and to whom we disclose them, who else processes them besides us, and what other rights are related to their processing. In accordance with the right, we can provide a user with a copy of the processed personal data upon request (the first copy is free of charge, each subsequent one is issued for a fee).
• The right to rectification in cases where it is found that the processed personal data are incorrect or incomplete. Based on the request, we will correct or complete the personal data as soon as possible.
• The right to erasure, whereby we will delete personal data as soon as possible if one of the following reasons is fulfilled: the data are no longer needed in accordance with the purpose of collection or processing; consent regarding the data, where consent was required, has been withdrawn; the right to object against data processing, which was collected based on legitimate interest and the latter no longer exists; there is an assumption that processing of personal data is no longer in accordance with generally binding regulations.
• The right to restriction of processing, which in certain cases (e.g., disputing the accuracy of data, processing without an appropriate legal basis, data not needed or inconsistent with described purposes, filed objection against data processing, etc.) allows for the request that personal data be specially marked and excluded from any processing procedures – in this case, the effect is temporarily limited.
• The right to data portability, which allows obtaining all data that we process based on given consent and on the basis of contract performance. We provide personal data in a structured, commonly used, and machine-readable format (simple data transfer is possible only for data that we process automatically in our electronic databases).
• The right to object against data processing, which, based on reasons related to the user's particular situation, gives the right to object against the processing of personal data based on point (e) or (f) of Article 6(1) REGULATION (EU) 2016/679 and against processing of data for direct marketing purposes. We will immediately cease processing data for marketing activities; in other cases, we will do the same unless we have legitimate reasons for processing that outweigh the user's rights or for the establishment, exercise, or defense of legal claims.
• The right to complain, which regardless of the exercise of all mentioned rights in no way affects the right to lodge a complaint with the competent authority. The right can be exercised especially in cases of suspicion that personal data are being processed unjustifiably or in contravention of generally binding legal regulations. A complaint can be lodged with the supervisory authority, which is the Information Commissioner (address: Dunajska 22, 1000 Ljubljana, email: gp.ip@ip-rs.si, phone: 012309730, website: www.ip-rs.si).

The user may at any time in writing to the address of the controller or in another agreed manner request that the controller permanently or temporarily cease using their personal data for direct marketing purposes. The controller is obliged to appropriately prevent the use of personal data for direct marketing purposes within 15 (fifteen) days and to inform the user about this within the following 5 (five) days in writing or in another agreed manner (e.g., via email) who requested this. A user who does not wish to receive special offers can unsubscribe from all forms of notification in writing to the controller's address (home address, email, GSM). We recommend that the user submits the request to exercise their rights through the form available in their user account, which they fill out and send in accordance with the instructions on the form itself. Any publication of comments, pictures, or videos on forums or social networks related to the provider or organizer is considered a public publication, thereby automatically transferring the right to use copyright material in any form or for any purpose to KinetiQ d.o.o.