Privacy and Cookie Policy

The company VLANA PRO d.o.o., owner of the online store Hookah.si, is committed to protecting the privacy of individuals who use our services. To implement rules compliant with legislation, reliable and transparent processing of personal data obtained by the online store, a document called the Privacy Policy has been adopted.

1. Meaning of terms used in the Privacy Policy:

Company VLANA PRO d.o.o., Hookah.si, we, our - VLANA PRO d.o.o., with its registered office at Viška cesta 25, 1000 Ljubljana, Slovenia.

Customer - A Consumer or Entrepreneur who has ordered or intends to order or uses other services of the Online Store (hereinafter referred to as "Buyer").

Consumer - a natural person who performs legal acts that are not directly related to their business or professional activity.

Entrepreneur - a natural person, legal entity or organizational unit that has legal capacity in accordance with the law, which conducts business for purposes directly related to their economic or professional activity.

Customer Account (Account) - a subpage of the Store where the Customer has the opportunity, among other things, to manage their personal data, receive notifications about changes in Order status, monitor and manage the status of submitted Orders.

Online Store Hookah.si (hereinafter referred to as "Store" or "Online Store") - an online service available at https://hookah.si, where the Provider performs services specified in the Regulations, and the Customer can place Orders.

Regulations - Regulations for sales using means of distance communication and the provision of electronically provided services within the online store Hookah.si.

Goods - movable tangible item that is the subject of the Sales Agreement or a right that is the subject of the Sales Agreement (e.g., license).

Service (Services) - Order, License Order or Request for Quote and other services that we provide within the Store.

Order - a statement of the Customer's will, which is a proposal to conclude a Sales Agreement with VLANA PRO d.o.o., directly intended for concluding a distance Sales Agreement via the Online Store, which specifies the type and quantity of Goods that are the subject of the Sales Agreement.

Request for Quote - The Customer submits it through a form available in the Store for requesting a quote, which specifies the Goods or software that is the subject of the inquiry, as well as the customer's data necessary for contact, indicated in the form.

GDPR - Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

Settings (Privacy) - functionality of the Account that allows the User who uses selected services to manage these services, together with independently changing the scope of services and selecting preferences regarding their privacy.

User - is an entity for which, in accordance with the Regulations and legal provisions, electronic services may be provided or with which an Agreement for the provision of electronic services may be concluded.

2. Who is the controller of personal data?

The controller of your personal data regarding the use of online store services is VLANA PRO d.o.o., Hookah.si, with its registered office at Viška cesta 25, 1000 Ljubljana, Slovenia.

If you have questions related to the processing of your personal data and your rights, please contact us. Send questions related to privacy protection to the email address: mail@hookah.si.

3. What personal data do we process, for what purpose and on what legal basis?

In order to provide Users of our online store with various services, we process your personal data for various purposes, to varying extents and on various legal bases as defined in the GDPR. To provide as much transparent information as possible, we have organized them into groups according to the purpose of processing your personal data.

3.1. Creating an account and authenticating the User in the online store

Scope of data. For this purpose, we process personal data that you have provided to us in the registration form for the online store, namely first and last name, phone number, contact details, email address and a specified password.

Customers can send so-called tender documentation to obtain information relating to availability, price and product features. To use this function, we will ask the customer to provide their first and last name, phone number, email address and company name. Each time you contact us by phone or email, we use the provided data to answer your question.

Customers can also order selected products. When ordering these products, we will ask the Customer to provide the necessary data for the execution of the purchase and sale agreement.

Legal basis. Necessity to perform the contract for the provision of Account services (Article 6 (1)(b) GDPR).

3.2. Services that do not require creating an Account

Types of services. We process your personal data for services that do not require creating an Account, such as:

• sending electronic messages with marketing and commercial information,

• displaying advertisements.

Scope of data. For this purpose, we process personal data relating to your activities in the store, namely: data relating to products you have viewed and other pages in the store, as well as session data, your device and operating system, browser, location and unique ID.

Legal basis. Our legitimate interest (Article 6 (1) (f) GDPR), which relates to facilitating the use of electronic services and improving their functionality.

3.3. Services and functionalities that require creating an Account.

Types of services and functionalities. We process your personal data for performing services that require creating an Account, such as executing an order.

Scope of data. For this purpose, we process personal data specified in the registration form and data related to your activities in the online store, namely: data related to products you have viewed and other pages in the store, as well as session data, your device and operating system, browser, location and unique ID.

Providing some data is a condition for using individual services and functionalities of the Account (mandatory data). Our system automatically marks data. If you do not provide this data, it will not be possible to perform certain services and functionalities of the Account. In addition to data marked as mandatory, providing other personal data is voluntary.

Legal basis. Necessity to perform the contract for the provision of services in accordance with the Regulations (Article 6 (1) (b) GDPR) and our legitimate interest (Article 6 (1) (f) GDPR), which relates to facilitating the use of electronic services and improving their functionality.

3.4. Statistics of use of individual functionalities of the Store, facilitating the use of Store pages and ensuring IT security of the Store.

Scope of data. For this purpose, we process personal data related to your activity in the Store, such as: visited pages and subpages of the Store and the amount of time spent on each of them, as well as data about search history, your IP address, device ID and data about browser and operating system.

Legal basis. Our legitimate interest (Article 6 (1) (f) GDPR), which relates to facilitating the use of electronic services and improving their functionality.

3.5. Enforcement, execution and performance of claims

Scope of data. For this purpose, we may process some of your personal data contained in the Account, such as: name, surname, address, data related to the use of our services, if claims arise from the way you use our services, other data necessary to prove the existence of a claim, including the amount of damage incurred.

Legal basis. Our legitimate interest (Article 6 (1) (f) GDPR), which relates to the enforcement, execution and performance of claims and defense against claims in proceedings before courts and other state authorities.

3.6. Handling complaints and requests, answering questions

Scope of data. For this purpose, we may process some of your personal data contained in the Account, as well as data related to the use of our services that are the reason for a complaint or request, data contained in documents attached to the complaint or request.

Legal basis. Our legitimate interest (Article 6 (1) (f) GDPR), which relates to improving the functionality of electronic services and building positive relationships with the Customer based on reliability and loyalty.

3.7. Measuring Customer satisfaction

Scope of data. For this purpose, we process your personal data necessary for completing the order, as well as your answers to questions we have prepared and included in surveys and forms for measuring satisfaction.

Legal basis. Our legitimate interest (Article 6 (1) (f) GDPR), which relates to improving the functionality of electronic services and assessing satisfaction with the services we provide.

4. How do we adapt services to your interests and preferences?

The goal of our online store is to best adapt all marketing messages to your interests and preferences (profiling). To provide as much transparent information as possible, we describe below what profiling is.

4.1. Recommended products

Type of service. Recommended products are presented to you in the Store before and after login, as well as in the form of marketing messages and are sent to the specified email address.

Scope of data. For this purpose, we process your personal data that you provided when creating the Account and data related to the execution of the order, as well as data about activity in the Store that we collect and store via cookies.

Profiling. Based on the data obtained in this way, we select and present to you the most appropriate marketing messages.

Balance of interests. After reviewing your and our interests, rights and freedoms, we have determined that the presentation of recommended products and services, related to profiling, will not excessively infringe on your privacy and will not be too annoying for Users. When reviewing interests, rights and freedoms, we took into account the following circumstances:

a. recommended products are a tool that provides you with easier access to our offer of products and services by presenting products that may be attractive to you. This allows us to recognize that the processing of personal data for recommending products and services is consistent with the reasonable expectations of Users;

b. the presentation of recommended products and services, as well as other marketing messages and their sending to the email address, is consistent with the reasonable expectations of Users. They have expressed a desire to receive such messages in accordance with the regulations on the provision of electronic services;

c. we only use data related to your activity in the Store. We are interested in what products and services you are looking for, which offers are interesting to you, not what you do on other websites.

d. we respect your will and facilitate the exercise of rights. For this purpose, we provide the possibility of easier cancellation of consent for receiving recommended offers in the form of messages in the mobile application, in the web browser and in email messages, from Account settings (Settings (Privacy) tab) or browser settings.

Legal basis. Our legitimate interest (Article 6 (1) (f) GDPR), which relates to recommending offers that may match your wishes and interests.

4.2. Marketing of our products and services and our customers.

Scope of data. For this purpose, we process your personal data that you provided when creating the Account, placing an order and data about activity in the Store that we collect and store via cookies. Activity data specifically relates to: search history, clicks in the Store, visits to main pages of the Store and subpages, date of login and registration, data on the use of certain services in the Store, history and activity related to our communication by email.

Profiling. We use the above data to adapt marketing information about our products and services and our customers that may interest you.

Remarketing. To provide you with our marketing messages outside the Store, we use services of external providers. With the help of these services, our marketing messages are displayed to you on other websites. For this purpose, external providers install, for example, appropriate code or pixel to collect data about your activity in the Store. Details are described in the Cookie Policy.

Legal basis. Our legitimate interest (Article 6 (1) (f) GDPR), which relates to the marketing of our products and services.

Balance of interests. After reviewing your and our interests, rights and freedoms, we have determined that marketing related to profiling will not excessively infringe on your privacy and will not be too annoying. When reviewing interests, rights and freedoms, we took into account the following circumstances:

a. you have expressed a desire to receive marketing messages at the specified email address, therefore we have determined that you reasonably expect that we will send you such messages.

b. we only use data related to your activity in the Store. We are interested in what products and services you are looking for and which offers are interesting to you, not what you do on other websites.

c. we respect your will and facilitate the exercise of rights. For this purpose, we provide the possibility of easier cancellation of consent for receiving email messages, from Account settings (Settings (Privacy) tab) or browser settings.

5. Who do we share your personal data with?

Our databases are protected from access by third parties. Data that we collect during registration and purchase is used for the correct execution of orders, as well as for tracking the status of orders and changes in them according to the customer's wish, before it is sent. To execute the contract, the online store Hookah.si may share data collected from you with the following entities:

5.1. Service providers.

We share your personal data with service providers that we use in managing the website. Service providers with whom we share your personal data, depending on contractual agreements and circumstances, either follow our instructions regarding the purposes and methods of processing this data (processors), or independently determine the purposes and methods of their processing (controllers).  The list of providers whose services we use can be found here. The list is constantly updated.

Processors. We cooperate with providers who process your personal data only according to our instructions. They provide us with cloud hosting services, provide us with systems for online marketing, systems for displaying web push notifications, for sending email messages, for analyzing traffic on the website, for analyzing the effectiveness of marketing campaigns, as well as support the implementation of certain functionalities of the Account.

Controllers. We cooperate with providers who do not act only according to our instructions and independently determine the purposes and methods of using your personal data. They provide us with services for remarketing campaigns and conduct statistical research.

Location. Our providers are mainly located in Poland and other countries of the European Economic Area (EEA), e.g., in Ireland. Some of our providers are located outside the EEA territory. Due to the transfer of your data outside the EEA territory, we ensure that our providers provide a high level of protection of personal data. These guarantees arise in particular from the obligation to use standard contractual clauses adopted by the Commission (EU) or participation in the privacy shield program established by the Commission's Implementing Decision (EU) 2016/1250 of 12 July 2016 on the adequacy of protection provided by the EU-US Privacy Shield.

You have the right to request a copy of the standard contractual clauses from us, according to the procedure specified in point 2 of the Privacy Policy.

5.2. State authorities.

We may share your personal data with competent state authorities.

6. How long do we store your personal data?

We store your personal data until you delete the Account in the online store Hookah.si, for the provision of Account services and related functionalities and other services in accordance with the Regulations, and also for marketing purposes. After deletion of the Account, your data will be anonymized, except for the following data: name, surname, email address, order history and consent information (we will store this data for another period of 3 years from the deletion of the Account for handling complaints and claims related to the use of our services).

Your personal data related to the execution of Orders and License Orders in our Store are stored for the period required by other legal provisions, e.g., tax legislation. After this period, your data will be anonymized.

Personal data collected through cookies is stored for the lifetime of cookies stored in users' devices. More information about the cookies we use is provided in the Cookie Policy.

7. What rights do you have regarding the processing of personal data?

We ensure the exercise of your rights listed below by contacting us at the email address: mail@hookah.si. Additionally, you can change the selected Account settings in the Settings (Privacy) tab after logging into the Store.

7.1. Right to withdraw consent

Based on Article 7(3) GDPR, you have the right to withdraw any consent given during registration in the Store, as well as during the use of individual services and functionalities offered in the Store. Withdrawal of consent takes effect from the moment of withdrawal of consent. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

Withdrawal of consent has no negative consequences for you. However, it may prevent further use of services or functionalities that we can provide only with consent in accordance with the law.

7.2. Right to object to data processing

Based on Article 21 GDPR, you have the right to object to the processing of personal data, including profiling, if we process it based on our legitimate interest, e.g., in connection with the use of recommended products and services, marketing of our products and services, maintaining statistics of use of individual functionalities of the service and facilitating the use of the Store, as well as measuring satisfaction.

Opting out of receiving recommended products and services in the form of email messages, as well as opting out of receiving marketing messages related to our products or services or our customers, will mean for us that you object to the processing of personal data, including profiling for this purpose.

If your objection is justified and we have no other legal basis for processing personal data, we will delete the data to which you have objected.

7.3. Right to erasure ("right to be forgotten")

Based on Article 17 GDPR, you have the right to request the erasure of all or some personal data. With a request to erase all personal data, we will treat it as a request to delete the Account.

You have the right to request the erasure of personal data in the following situations:

a. a specific consent has been withdrawn on the basis of which personal data were processed;

b. personal data are no longer necessary for the purposes for which they were collected or processed;

c. an objection has been filed against the use of data for marketing purposes;

d. an objection has been filed against the use of data for the purpose of maintaining statistics of website use and measuring satisfaction, and the objection was justified;

e. personal data have been processed unlawfully.

Despite the request for erasure of personal data, in connection with an objection or withdrawal of consent, we may store some personal data that are necessary for asserting, exercising or defending legal claims. This particularly applies to personal data that includes: name, surname, email address and purchase history, which we store for handling complaints and legal claims related to the execution of orders.

7.4. Right to restriction of processing

Based on Article 18 GDPR, you have the right to restriction of processing of personal data. In case such a request is filed, until a decision is made, you will not be able to use certain functions or services that were related to the processing of data to which the request relates. We will also not send you any messages, including marketing ones.

You have the right to request restriction of personal data in the following situations:

a. the accuracy of personal data has been contested - the use of this data will be limited for the time necessary to verify their accuracy, but not more than 7 days;

b. the processing of this data is unlawful, but instead of erasing the data, a request has been filed to restrict their use;

c. personal data are no longer necessary for the purposes for which they were collected or used, but they are necessary for you to assert, exercise or defend legal claims;

d. an objection has been filed in connection with the processing of this data - then the restriction applies for the time necessary to verify whether the protection of your interests, rights and freedoms prevails over the interests we pursue by processing this personal data.

7.5. Right of access to data

Based on Article 15 GDPR, you have the right to obtain confirmation from us of the processing of personal data. If this data is actually processed, you have the right to:

a. obtain access to your personal data;

b. obtain information about the purposes of use, types of personal data processed, about users or category of users of this data, the intended period of storage of personal data or criteria used to determine this period, about rights under GDPR and about the right to file a complaint with the supervisory authority, about the source of this data, about the existence of automated decision-making, including profiling, and about protective measures used in connection with the transfer of this data outside the European Union.

c. obtain a copy of your personal data.

If you wish to exercise your right of access to data, please contact the personal data controller mentioned in point 2.

7.6. Right to rectification

Based on Article 16 GDPR, you have the right to rectification of personal data (if they are inaccurate) that you have provided, as well as to their completion (if they are incomplete).

7.7. Right to data portability

Based on Article 20 GDPR, you have the right to receive the personal data you have provided and then transfer this data to another personal data controller of your choice. You also have the right to request that we transfer the personal data directly to another controller, where this is technically feasible.

We will send your data in the form of a csv file. The csv format is a commonly used format that is suitable for machine reading and enables sending the obtained data to another personal data controller.

7.8. When will we fulfill your requests?

If you contact us with a request for the above authorizations, we will immediately execute or reject that request, but no later than 30 days after receipt. However, if - due to the complex nature of the request or the number of requests - we are unable to execute your request within 30 days, we will execute it within the next 60 days, notifying you in advance of the intention to extend the deadline.

For technical reasons, we always need 48 hours to update settings selected by the User in our systems. Therefore, it may happen that during system updates, the User will receive an email message from us, from which they have unsubscribed.

7.9. Filing complaints, questions and requests

You can file complaints, questions and requests related to the processing of personal data and the exercise of your rights.

If you believe that the rights for the protection of personal data or other rights granted under the GDPR have been violated, you have the right to file a complaint with the Inspector General for the Protection of Personal Data.

8. How do we ensure the security of your personal data?

We strive to do everything to ensure the security of your personal data. The pages use encrypted data transmission (SSL) during registration and login, which ensures the protection of data that identifies the User of the online store and significantly impedes the interception of access to the Customer Account by unauthorized systems and persons.

9. Changes to the Privacy Policy

We reserve the right to change the above Privacy Policy by publishing a new Privacy Policy on this website. We will inform you about all changes and additions with appropriate messages on the main pages of the online store, and in case of significant changes, we may also send a message to the specified email address.

The Privacy Policy does not limit any rights you have in accordance with the Regulations and legislation.