Privacy policy

1. Who we are

The controller of personal data processed through this website isStatus izobraževanje Barbara Polutnik Brusnik, s. p., registered at Glavni trg 30, 2380 Slovenj Gradec, Slovenia, registration number 6564500000, VAT ID SI17462592, trading as Sertuga Production Co. ("we", "us").

For any question about this policy or about your personal data, contact[email protected]. We have not appointed a Data Protection Officer, as we are not required to under Article 37 GDPR.

2. What we collect, why, and on what legal basis

We do not run advertising or analytics tracking on this site, we do not build profiles of visitors, and we make no automated decisions that produce legal or similarly significant effects about you.

3. Where we got your details, if we contacted you first

If you received an email from us and had not contacted us before: We obtained your business contact details from publicly available sources, typically your company website, a public business register or a public advertising library. We only use business contact details, for a business purpose. Our first email to you tells you where we found your address and links to this policy.

You can stop this at any time. Reply asking us to stop, or email[email protected]. We will remove you from all outreach and keep only the minimum record needed to make sure we do not contact you again.

4. Who else processes the data

We keep the number of parties involved as small as we can. Except where stated below, each processor acts on our instructions under a data processing agreement:

• Our hosting provider: serves the website and keeps security logs. Our hosting provider, Cloudflare, tells the site which country you are visiting from, worked out from your IP address, so we can offer the Slovenian version. We use the country only for this and do not store it.
• Our email provider — hosts our mailboxes, so correspondence sits on their servers.
• Resend — delivers messages and call requests sent through the form on our website to our mailbox, and sends you one email confirming we received it. The form does not store your message; it is passed on as an email.
• Cloudflare Turnstile: checks that the enquiry form is sent by a person, not a bot, using technical data such as your IP address and browser signals. Cloudflare acts as our processor for this check and, under its Turnstile Privacy Addendum, as an independent controller when it uses these signals to improve bot detection. It is loaded only when you reach the form.
• Cloudflare Workers KV: limits how often the form can be used, to prevent abuse. It holds salted hashes (scrambled codes) of your IP address and email address instead of the addresses themselves. We still treat these codes as personal data. They are deleted automatically within 24 hours.
• Our accountant and accounting software — for invoicing and statutory bookkeeping.
• Production subcontractors — photographers, crew or retouchers, who only ever receive what is needed to deliver your project.

We do not sell personal data and we do not share it for anyone else's marketing. Some of these providers are based in, or may access data from, countries outside the European Economic Area, including the United States. Where that happens, we rely on an adequacy decision of the European Commission (for the United States, the EU-US Data Privacy Framework for certified providers) or on the Commission's Standard Contractual Clauses. You can ask us for details or a copy of these safeguards at the address above.

5. Material you send us for production

Files you provide for a project — product photography, brand assets, footage, or images of identifiable people — are processed solely to produce the work you have commissioned. If the material contains personal data, including a recognisable person, you are responsible for having a valid basis and any necessary model releases for us to use it. We delete or return project material on request once the project has ended, subject to the archive period in our terms of business.

6. Your rights

Under the GDPR you may ask us to:

• confirm what personal data we hold about you, and give you a copy (access);
• correct anything inaccurate or incomplete (rectification);
• delete data we no longer have a reason to hold (erasure);
• restrict how we use it while a dispute is resolved;
• provide the data in a portable, machine-readable format;
• object to processing based on legitimate interest — including all direct marketing, which we will always stop on request, without exception.

Write to [email protected]. We will respond without undue delay and within one month. For complex or numerous requests, we may extend this by up to two further months and will tell you why within the first month. If you believe we have handled your data unlawfully, you may complain to the Slovenian supervisory authority, the Information Commissioner (Informacijski pooblaščenec), Dunajska cesta 22, 1000 Ljubljana, www.ip-rs.si, or to the authority in your own country of residence.

7. Security

We apply measures appropriate to our size: encrypted connections to the website, access controls and two-factor authentication on the accounts that hold client data, and restricted sharing with subcontractors. No system is perfectly secure. If a breach occurs, we will notify the supervisory authority within 72 hours of becoming aware of it where required, unless it is unlikely to result in a risk to you, and will inform you directly if it is likely to result in a high risk to you.

8. Children

This site and our services are directed at businesses, not at children, and we do not knowingly collect personal data from anyone under 16.

9. Changes

If we change this policy we will update the date at the top of this page. Where the change materially affects how we use personal data we already hold, we will tell affected people directly.

This page is published in Slovenian and English. For clients established or receiving the services in Slovenia, the Slovenian version prevails. For all other clients, the English version prevails.