Privacy Policy
Your privacy is very important to us. The Provider respects your privacy and understands the concerns that may arise regarding the privacy and protection of the personal data you provide to us when visiting or using our website or ticket sales platform. We therefore ask you to read how the Provider processes your personal data.
The purpose of this Privacy Policy is to explain, in a simple and transparent manner, what personal data we collect about you, the legal bases and purposes for which we process it, the options available to you for managing your privacy, and the rights you have in relation to the processing of your personal data.
This Privacy Policy complies with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation – GDPR), as well as with the applicable legislation of the Republic of Slovenia.
This Privacy Policy contains the following information:
contact information of the Provider and contact details of the Data Protection Officer;
legal bases and purposes for the processing of personal data;
types of personal data we collect;
management of privacy settings;
disclosure of personal data;
retention periods for personal data;
protection of personal data;
rights of individuals in relation to their personal data, including the right to lodge a complaint;
changes to the Privacy Policy.
1. DATA CONTROLLER AND DATA PROTECTION OFFICER
Data Controller:
Društvo MofuCon
Jenkova ulica 14
6230 Postojna
(hereinafter: the “Provider”)
Email: info@mofucon.si
Ticket sales website: https://vstopnice.mofucon.si/platforma
Data Protection Officer:
WPM, spletne storitve, d.o.o.
Brnčičeva ulica 13
1231 Ljubljana - Črnuče
Email: info@wpm.si
You can contact the Data Controller and/or the Data Protection Officer using the contact details provided above.
Your questions regarding this Privacy Policy, the confidentiality of your personal data, the manner in which your personal data is processed, or your requests concerning the exercise of your rights in relation to your personal data will be addressed by the responsible person of the Data Controller and/or the Data Protection Officer.
2. LEGAL BASES AND PURPOSES OF PROCESSING
The Provider collects, records, organizes, stores, transfers and otherwise processes the personal data it holds about you on various legal bases and for the purposes set out below.
2.1. Processing on the basis of a contract – purposes
The Provider processes individuals’ personal data for the exercise of rights and fulfillment of obligations arising from concluded contracts, in particular contracts relating to the sale, purchase or reservation of products or tickets. This includes the processing of personal data of purchasers and/or users of the online store for the purchase or reservation of tickets at the web address specified in Article 1, regardless of whether the individual creates a user account.
For the purpose of exercising rights and fulfilling contractual obligations, the Provider processes individuals’ personal data for the purposes of identifying the individual, concluding the contract (where the contract is deemed to have been concluded when the Provider sends the purchaser an email regarding the status of their purchase or reservation), communicating with the individual, providing user support, processing the order or reservation, sending notifications relating to the processing of the order or reservation, and for other purposes necessary for the performance of the contract.
In the case of a purchase, the Provider also processes personal data for the purpose of carrying out any debt collection procedures and for its own accounting and tax purposes.
2.2. Processing on the basis of legal obligations – purposes
The Provider also processes individuals’ personal data on the basis of legal obligations applicable to the Provider, in particular for the fulfillment of obligations arising from tax, accounting and other applicable legislation.
2.3. Processing on the basis of legitimate interests – purposes
The Provider may process personal data on the basis of the legitimate interests pursued by the Provider, except where such interests are overridden by the interests or fundamental rights and freedoms of the individual concerned that require the protection of personal data.
Where further processing of personal data collected about an individual is involved, the Provider carries out an assessment in accordance with the General Data Protection Regulation (GDPR). Such further use of data in pseudonymized or aggregated form may constitute lawful use of data for the Provider’s marketing, business and technical analyses. As an additional security measure, certain forms of further processing may also involve partial deletion or anonymization of data.
On the basis of legitimate interest, the Provider processes personal data to the extent strictly necessary and proportionate to ensure the operation of online services, improve the user experience, and protect its intellectual property rights relating to online services.
On the basis of legitimate interest, the Provider may also process purchasers’ personal data for the purposes of direct marketing of its products and services related to the purchase or reservation of tickets, including information about similar events, offers, news or benefits. Individuals have the right to object to such processing of personal data at any time, free of charge and in a simple manner.
On the basis of legitimate interest, the Provider may also process personal data for the purposes of preventing misuse, pursuing claims or defending against claims in administrative, judicial or other proceedings.
2.4. Processing on the basis of consent – purposes
The Provider processes individuals’ personal data on the basis of their explicit consent for the following purposes:
direct marketing and receiving notifications about events, offers, news and benefits;
conducting marketing analyses, customer segmentation and profiling, and providing tailored offers for products and services.
When purchasing or reserving tickets, individuals are informed of the possibility of processing their personal data for direct marketing purposes and may provide consent for the Provider to send them marketing communications and tailored offers by email, SMS or MMS, or in printed form to the address provided.
Where consent includes direct marketing based on an individual’s profile, the Provider may segment individuals based on their use of the Provider’s websites and services, exclusively for the purpose of providing tailored marketing content.
Individuals may withdraw their consent at any time in the simple manner described in this Privacy Policy. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
Direct marketing is not carried out through automated decision-making that would produce legal effects concerning an individual or similarly significantly affect the individual.
3. PERSONAL DATA WE COLLECT
The Provider collects various information about you, including personal data that can be used to identify you directly or indirectly, where you or others choose to share such personal data with the Provider. We receive data in various ways, including through purchases in the online store, subscription to email notifications (direct marketing), or visits to the Provider’s websites. The Provider collects information about your use of the services we offer.
The personal data we collect includes:
basic personal data, such as first name and last name, date of birth, email address, residential address (street, street number, postal code, city/town and country), and telephone number.
4. COOKIES
When you use our online services, cookies are placed on your computer. In general, cookies and related technologies work by assigning a unique number to your browser or device that has no meaning outside the Provider.
The Provider uses these technologies to personalize your experience and help provide content that is specific to your use.
You can manage the collection of information through cookies or related technologies using the settings available in your browser or mobile device. The Provider undertakes to enable you to manage your privacy and sharing preferences, but does not accept responsibility for missed “Do Not Track” signals sent by your web browser. Refusing cookies may result in some features of the services offered being unavailable to you.
5. DISCLOSURE OF PERSONAL DATA
5.1. Data Processors
The Provider may disclose your personal data to third parties with whom we have entered into data processing agreements (hereinafter: “Data Processors”) for the purposes of support, analysis and continuous improvement of our services, payment processing or order delivery.
Data Processors have access only to the personal data they strictly need to provide the services they perform for us and may use such data only for the purpose of carrying out these tasks on our behalf. They may not use the data for any other purpose and are required to protect your personal data.
The Provider may work with Data Processors that process statistical data on how you use our services for the purpose of advertising services or displaying information that may be of interest to you. Such processors have access only to anonymized data.
5.2. Joint Controllers
We may share your personal data with contractual partners with whom we act as joint controllers and who process your personal data in accordance with this Privacy Policy.
5.3. Universal Legal Succession
In the event of a merger, or if the Provider becomes involved in a business combination, division or transfer of its business to a third party, we may transfer your data to a third party associated with the acquisition of the Provider.
5.4. Public Authorities
Notwithstanding the provisions concerning personal data retention periods set out in this Privacy Policy, we may retain your personal data for a longer period and disclose it to third parties such as the police, public prosecutor’s office, courts and other competent state authorities within or outside the Republic of Slovenia if we determine that such disclosure is necessary and required by law, including for the purposes of preventing, investigating, detecting or prosecuting criminal offenses.
We may also disclose your personal data to public authorities where necessary to establish, exercise or defend legal claims in judicial proceedings or in administrative or out-of-court proceedings.
5.5. Transfer of Data to Countries Outside the EU or EEA
Where online services are used outside the Member States of the EU, data provided in order to provide online services may be transferred, stored or processed in third countries where data protection legislation provides for standards that differ from those applicable in EU or EEA Member States.
By using services in countries outside the EU, you consent to the transfer or disclosure of personal data to entities located in third countries. The Provider itself will not transfer your personal data to countries outside the EU or EEA.
6. RETENTION PERIODS FOR PERSONAL DATA
We retain personal data for as long as necessary to provide our services or for longer where required by law.
Data relating to ticket orders and the associated contact details of individuals may be retained for the purpose of fulfilling contractual obligations until the services have been fully paid for or until the applicable limitation period for an individual claim expires, which may be up to five years by law. In accordance with tax regulations, issued invoices are retained for 10 years after the end of the year in which the invoice was issued.
Personal data obtained in connection with a ticket order is retained until consent is withdrawn, but for no longer than five years.
Data about you that is no longer required for the purposes for which it was collected or otherwise processed may be anonymized and combined with other data that does not permit the identification of an individual in order to obtain statistical information that is commercially useful to the Provider, such as statistics on the use of the services we offer. Such data is anonymized and cannot be linked to an identifiable individual.
7. PROTECTION OF PERSONAL DATA
We implement a range of technical and organizational measures to ensure the security of personal data during collection, transfer and storage. The Provider strives to appropriately protect your personal data, but does not guarantee the complete security of the personal data you provide to us and is not responsible for the theft, destruction, loss, intentional or accidental disclosure of your personal data or information about you.
The Provider follows generally accepted standards for protecting information received both during transmission and after receipt. However, no method of electronic transmission or storage is 100% secure, and therefore complete security cannot be guaranteed. The Provider uses SSL (Secure Sockets Layer) technology, which provides encryption of personal data. The Provider works with a company that provides security for our services and your personal data.
The user is also responsible for protecting their data by ensuring the appropriate security of their mobile device or computer, protecting their username and password, and using appropriate software, including antivirus protection, on their electronic device.
To ensure the effectiveness of these measures in preventing unauthorized access to your personal data, you should be aware of the security features available through your browser. Use a browser that allows you to configure security features before providing your personal data or credit card information over the internet. Please note that if you use a browser that does not support SSL technology, the transmission of personal data may be risky.
Most browsers provide notifications when you are visiting a website that does not provide a secure connection or when you are transmitting data over an unsecured connection. The Provider recommends that you enable these browser features to help protect your personal data.
You can also check the address of the website you are visiting (URL). Secure web addresses begin with https:// rather than http:// and display the secure connection symbol used by your browser (usually a padlock at the beginning of the web address). This symbol indicates that secure communication with the server is being used. Please also check the details and validity of the security certificate of the website you are visiting.
Limitation of liability. The Provider undertakes to protect personal data and information about you. However, no internet connection can be 100% secure, and complete security of the data you provide to us cannot be guaranteed. You provide your personal data to us at your own risk.
8. RIGHTS OF INDIVIDUALS
Requests concerning the exercise of individual rights may be sent to the Provider’s email address or to info@wpm.si, or by post to the addresses specified above. An individual whose request is not submitted from the email address of a registered user must provide proof of identity and/or address. The Provider will respond to your request in accordance with applicable regulations.
Individuals have the following rights in relation to their personal data:
8.1. Right of Access
Individuals may request at any time that the Provider confirm whether personal data concerning them is being processed and, if so, provide access to the personal data and information concerning its processing (e.g. the purpose of processing, the types of personal data, the recipients to whom the personal data has been or will be disclosed, the expected retention period, technical and organizational measures for protecting the data, etc.).
8.2. Right to Erasure
Subject to the conditions set out in applicable legislation, individuals may request at any time that the Provider erase their personal data (the so-called “right to be forgotten”).
8.3. Right to Data Portability
Individuals may request at any time that the Provider provide their personal data in a structured, commonly used and machine-readable format, and transmit it to the individual or to another controller chosen by the individual, where technically feasible and subject to the conditions set out in applicable legislation.
8.4. Right to Object
Where the Provider processes personal data on the basis of legitimate interests, as described above, individuals may, in certain circumstances, object to such processing. The Provider will cease processing the personal data unless it determines that it has compelling legitimate grounds for continuing the processing or that the processing is necessary for legal reasons.
8.5. Withdrawal of Consent
Individuals may withdraw their consent at any time where they have given consent for a specific purpose of processing their personal data.
Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
8.6. Right to Lodge a Complaint with the Supervisory Authority
Individuals have the right to lodge a complaint with the Information Commissioner of the Republic of Slovenia if they believe that their personal data is being processed in violation of the applicable personal data protection regulations. Information on the complaint procedure is available on the website of the supervisory authority.
9. CHANGES TO THE PRIVACY POLICY
The Provider reserves the right to amend this Privacy Policy in accordance with circumstances and legislation relating to personal data protection. Please review it periodically.
You will be appropriately informed in advance of any changes concerning the processing of your personal data and/or changes (updates) to this Privacy Policy. Changes to the Privacy Policy will also be published on our websites in a timely manner.
If you do not agree with this Privacy Policy, please stop using our online services and withdraw any consent you have provided.
This Privacy Policy was last updated on 22 September 2026.
