NOTICE TO INDIVIDUALS UNDER ARTICLE 13 OF THE GENERAL DATA PROTECTION REGULATION (GDPR) REGARDING THE PROCESSING OF PERSONAL DATA
To fulfill our obligations regarding personal data protection, we provide you with the necessary information in accordance with Article 13 of the General Data Protection Regulation.
This document is intended to present information regarding the processing of personal data of individuals processed by JAPIANO, a music store, d.o.o. based in Ljubljana with the business address Cesta Ljubljanske brigade 25, 1000 Ljubljana, registration number 8159416000 (hereinafter: the company or JAPIANO). If the company processes your personal data, you can find the necessary information regarding the processing of your personal data here (hereinafter: Notice).
The protection of personal data is of special importance to the company. The company is committed to processing your personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter: General Regulation), the Personal Data Protection Act (Official Gazette of the Republic of Slovenia No. 163/2022, hereinafter: ZVOP-2), and the fundamental principles of personal data protection adopted therein.
Types of personal data, purposes of processing, retention periods, and other information are listed in this Notice as examples or non-exclusively.
Terms and definitions
Terms and definitions used in this Notice follow the definitions of the General Regulation and the applicable Personal Data Protection Act.
In this context, the term processing means collection, use, access, acquisition, and disclosure.
Contact
The controller in the sense of the General Regulation and ZVOP-2 is
JAPIANO, a music store, d.o.o.
Cesta Ljubljanske brigade 25
1000 Ljubljana
The representative of the controller is the company's director, Simona Ujlalki.
Individuals can contact us at any time regarding any questions and suggestions related to personal data protection at simona.ujlaki@japanpianocenter.com
What personal data do we collect?
For the purposes and on the grounds explained below, we may collect and use the following personal data: individual video footage, first name, last name, phone number, email address, individual tax number, and other data necessary for carrying out our business activities, such as purchasing products (musical instruments), booking classrooms, renting instruments (e.g., pianos), organizing service or transport of instruments, and fulfilling contractual obligations with other business partners, such as banks, accounting services, or professional services.
We also process personal data of job applicants, particularly contact details, resumes, photographs, birth dates, and other documents provided by the candidate voluntarily or in the context of a job advertisement. This data is collected and processed solely for the purpose of the selection and employment process. If a candidate provides data voluntarily, the company will delete it without delay if no employment contract is concluded.
Data may also be processed electronically, especially when a candidate submits relevant application documents via email or through an online form on the company's website. If we conclude an employment contract with the candidate, the submitted data is processed for the purpose of executing the employment contract, including maintaining personnel records, fulfilling legal obligations, and managing and developing personnel processes.
If no employment contract is concluded with the candidate, the application documentation will be deleted two months after the candidate's rejection, unless there is a legal obligation preventing the deletion of data. The processing of personal data is necessary for the execution of business processes and contractual relationships, where their absence may significantly hinder or prevent the quality and professional execution of our services.
How do we obtain and use your personal data?
We may obtain personal data directly from you (when you contact us – inquiries via email or phone or by mail).
We may also obtain your (contact) personal data from publicly available records or public sources (public registers, databases, internet applications, or other public sources of information) based on an appropriate legal basis.
The area of the company's sales premises and warehouse is under video surveillance to ensure the safety of people and property. This area is appropriately marked. In this way, we collect data about our visitors (individual video footage, date of recording, time (duration) of recording), which is stored for a limited period and is accessible only to authorized persons.
Purposes for which we collect your personal data and consequences if personal data is not provided
We process your personal data (first name and last name, phone number, email address, tax number) in connection with the execution of contracts necessary for purchasing our products, booking classrooms, and renting instruments from the company (e.g., piano rentals), as well as in cases where it is necessary to organize service or transport of instruments or to forward an order directly to the instrument manufacturer. The processing of personal data is thus essential for carrying out our business activities and fulfilling obligations arising from concluded sales, rental, or other related contracts.
In these relationships, we act as the controller of your personal data. If your data is provided in the context of service, transport, or other services performed for us by external contractors, they act as our contractual processors. In case of additional questions regarding the processing of your personal data, we recommend checking the information of the individual contractor, where appropriate.
We obtain and process personal data of job applicants for the purpose of the selection and employment process.
We need this data for the reasons mentioned above, and without it, in certain cases of our contractual relationships or operations, it is not possible to carry out, while in other cases, it may significantly hinder or reduce the quality and/or professionalism.
We also process your personal data for the purpose of fulfilling contractual obligations with other business partners (banks, ancillary activities – accounting, professional services).
Processing personal data for a purpose other than that for which it was collected is permissible if it is in accordance with the provisions of the fourth paragraph of Article 6 of the General Regulation. When it comes to further processing carried out due to a legal obligation, such processing must be determined by law.
When personal data is inadvertently collected that is clearly unnecessary for the specific processing, it will be deleted without unnecessary delay, otherwise irretrievably destroyed or returned to the individual to whom it relates, or to the controller or processor who sent it.
Who uses your personal data?
Employees of the company
Your personal data is used by our employees or persons working for us, within the scope of their work responsibilities and authorizations, bound by the obligation to protect personal data as confidential.
External service providers
To fulfill our contractual and legal obligations, we also collaborate with selected external service providers (piano technicians, service providers, accounting services, piano manufacturers, IT maintenance services, etc.).
Data sharing with other users
We may be required by law to share your personal data with other recipients who have a legal basis for such a request. These primarily include government authorities (such as FURS, courts, police, etc.) and other holders of public authority.
We may also share your data with our lawyers, internal and external auditors, and tax and other advisors for the provision of their services in accordance with the contract concluded with us.
Personal data is shared with other individuals or legal entities or public sector entities only based on a request under the first paragraph of Article 41 of ZVOP-2, which provides a valid legal basis for obtaining the data and justifying the request, unless otherwise provided by law.
Protection of personal data
We want to protect your data, so we have taken appropriate measures designed to prevent unauthorized access to your personal data and its misuse. We are committed to taking all reasonable and appropriate steps to protect the personal data we hold from misuse, loss, or unauthorized access. We achieve this with a set of appropriate technical and organizational measures. If you suspect any misuse, loss, or unauthorized access to your personal data, please notify us immediately, and we will investigate the matter and inform you of the next steps as soon as possible. Additional information about our policy and procedures for ensuring information security can be found in our Personal Data Processing and Protection Policy.
Legal basis for processing personal data
The legal basis for processing personal data necessary for fulfilling pre-contractual and contractual purposes (i.e., for concluding and executing contracts related to the purchase of our products, booking classrooms, renting instruments, and performing service or transport) is point (b) of the first paragraph of Article 6 of the General Regulation. On this legal basis, we process personal data to the extent necessary to carry out the procedures prior to the conclusion of the contract and to fulfill the obligations arising from the concluded contracts in which the individual is a party.
We also process your personal data to fulfill our legal obligations, which represents the legal basis in point (c) of the first paragraph of Article 6 of the General Regulation (see section Data sharing with other users).
In cases where the processing of personal data is necessary to protect the vital interests of the individual or a third party, the legal basis is point (d) of the first paragraph of Article 6 of the General Regulation.
When we process personal data for the protection of our legitimate interests or the interests of third parties, the legal basis is point (f) of the first paragraph of Article 6 of the General Regulation. Such processing is necessary, for example:
for legal reasons (e.g., enforcing outstanding claims);
for business reasons (e.g., actions in case of contract violations);
for security reasons (e.g., preventing threats to the integrity, authenticity, availability, or confidentiality of data);
to ensure information security and the functioning of information systems.
We may also process your personal data based on your consent if you provide it voluntarily, which represents the legal basis in accordance with point (a) of the first paragraph of Article 6 of the General Regulation. When the processing of personal data is based on consent, you have the right to withdraw your consent in writing at any time. The withdrawal of consent does not affect the lawfulness of processing based on such consent before its withdrawal.
Data deletion and retention period
Your data will be stored as long as necessary to achieve the purpose for which the data is processed. Once the purpose of processing is achieved, your personal data will be stored until the expiration of the periods specified by law, considering the specific purpose of processing. The periods can be as long as 5 years or more. After this time, your data will be deleted or destroyed in accordance with data protection regulations.
Personal data collected based on your consent will be retained for the shortest possible period, as long as there is a purpose for their collection or until consent is withdrawn. The withdrawal of consent does not affect the lawfulness of processing that was carried out based on consent until its withdrawal.
Certain data is also retained for the purpose of demonstrating compliance with your requests (see section Rights of the individual).
Retention periods are defined in our records of personal data processing.
After the retention period expires, personal data is deleted, destroyed, or anonymized, or another procedure is carried out that prevents the identification of the individual to whom the personal data relates, particularly limiting access to them, blocking them, or archiving them, unless otherwise provided by law or another act.
Cookies
Our website uses only essential cookies that are necessary for the proper functioning of the site and enabling basic functionalities. These cookies do not store personal data that would allow for the identification of an individual and are used only to the extent necessary for the operation of the website. Your consent is not required for the use of essential cookies.
We use the following essential cookies:
Cookie Name Type / Purpose Duration Description
PHPSESSID Mandatory – session cookie Until the end of the session Manages the user session when the website uses PHP.
PH_HPXY_CHECK Mandatory – security / session information Until the end of the session Checks and maintains session information and the security of the site.
wpEmojiSettingsSupports Mandatory – technical functionality Until the end of the session Checks whether the browser supports emoji symbols.
The use of these cookies is essential for the technical operation of the website and enabling basic functionalities, and therefore cannot be disabled without affecting the operation of the site.
Transfer to third countries
Certain personal data of customers processed within the CRM system and other cloud services may be transferred or stored on servers outside the European Union, primarily in the USA.
Cloud services used by the company (e.g., Google Workspace/Google Drive, external CRM systems) may, in certain cases, involve transatlantic data transfers due to their infrastructure. Recipients, such as Google, are certified under the EU–US Data Privacy Framework, which allows for lawful transfers of personal data to the USA.
When a specific cloud service provider does not rely solely on the EU–US Data Privacy Framework or when processing takes place in another third country, the company ensures an adequate level of personal data protection by using standard contractual clauses of the European Commission (SCC) and, if necessary, additional protective measures.
Individual rights
Access to your personal data
You have the right to obtain confirmation from us as to whether personal data concerning you is being processed, which data, and the right to access this data, information about the purpose of processing, users, retention periods, and other information contained in this Information.
Right to rectification
You have the right to have any inaccurate data concerning you rectified.
Right to request deletion of data
If the processing of personal data is based on your consent, you can withdraw it in writing at any time. The withdrawal of consent does not affect the lawfulness of processing based on that consent before its withdrawal.
You have the right to request the deletion of data if:
the personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
the personal data have been processed unlawfully;
the personal data must be deleted to comply with a legal obligation under Union law or Slovenian law.
The right to deletion is limited in cases where the processing of personal data is necessary as provided for in Article 17 of the General Regulation.
The right to restriction of processing
You have the right to obtain a restriction of processing in accordance with the provisions of Article 18 of the General Regulation.
The right to data portability
You have the right to receive your personal data that you have provided to us in a structured, commonly used, and machine-readable format and the right to have those data transmitted to another data controller, in accordance with your requests, within the limits and under the conditions set by law (if the processing of personal data is based on consent or a contract and, if the personal data are processed automatically and, if this is technically feasible).
The right to object
Based on reasons related to your particular situation, you have the right to object at any time to the processing of your personal data based on legitimate interest, as explained above. We will cease processing your personal data unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights, and freedoms or for the establishment, exercise, or defense of legal claims.
The right to lodge a complaint with the Information Commissioner of the Republic of Slovenia
The company ensures that your personal data is processed lawfully and in accordance with regulations. If you believe that your personal data is being stored or otherwise processed in violation of applicable regulations governing the protection of personal data, you have the right to file a request in accordance with the law governing general administrative procedure, requesting supervision of the lawfulness of the processing of your personal data, and you may also propose necessary action in case of identified violations, in order to achieve the establishment of a lawful state with the Information Commissioner of the Republic of Slovenia. You can contact them in the following ways:
Republic of Slovenia
Information Commissioner
Dunajska cesta 22
1000 Ljubljana
Phone: 01 230 97 30
Fax: 01 230 97 78
Email: gp.ip(at)ip-rs.si
Withdrawal of consent
When processing personal data is based on your consent, you have the right to withdraw that consent in writing at any time. The withdrawal of consent does not affect the lawfulness of processing based on that consent before your withdrawal.
The rights of individuals may be restricted in accordance with Article 18 of the ZVOP-2 and Article 23 of the General Regulation.
Individuals should address their requests to simona.ujlaki@japanpianocenter.com. Any end user who receives a potential request from an individual must immediately forward it to simona.ujlaki@japanpianocenter.com.
The company must provide the individual to whom the personal data relates with information and messages in as accurate, understandable, and accessible a form as possible, and in clear and simple language, if requested by the individual. Information and messages are provided to the individual in an appropriate format. The individual's request is resolved according to the procedures and deadlines prescribed by the General Regulation and ZVOP-2.
In handling requests from individuals under Articles 15 to 22 of the General Regulation and other requests from individuals regarding personal data protection, access to personal data, their acquisition, and processing, the company informs the individual of the decision and, if it is the subject of the request, of the personal data relating to them, within the time frame specified by the General Regulation. If the individual requests it, the company may also inform them orally about their personal data.
The decision includes reasons and information about the right to appeal to the supervisory authority within 15 days of being informed of the decision under the provisions of point f) of the first paragraph of Article 15 of the General Regulation. The decision is in the form of an official note sent to the individual in a manner that allows them to be informed of the decision and to prove its receipt.
Existence of automated decision-making
Automated decision-making based on collected personal data is not carried out.
Validity, changes, and amendments to this Notice
This Notice may be changed or supplemented at any time, with the latest valid version always applying, as indicated by the date of adoption of the last valid version.
This Notice is valid from 01.01.2026 onwards.
