Privacy and cookies

A user is any person or organisation that visits www.logout.org. A buyer is anyone who enters a contract under the terms of the Nora Institute online shop.

By using the site you confirm that you have read this policy. We use personal data only for the purposes below and protect it under the EU General Data Protection Regulation, the Slovenian Personal Data Protection Act (ZVOP-2), this policy and our internal rules.

1. Controller

The controller is Zavod Nora, Križna ulica 12, 1000 Ljubljana, Slovenia.

2. Data protection officer

Boris Veler, [email protected].

3. Processors

We use contracted processors who provide an appropriate level of protection, under data-processing agreements.

• Innovatif d.o.o. (development and maintenance)
• Google Ireland Limited (Google Workspace, and Google Analytics G-1HSCK2GJYM if you allow statistics)
• monday.com Ltd. (work and project organisation)
• Zoom Video Communications, Inc. (remote meetings)
• NGOE.org (staff and internal processes)
• The Rocket Science Group LLC (Mailchimp newsletters)
• Brevo (newsletters and SMS)
• DocuSign, Inc. (electronic signatures)

3.1 Joint controllers

For some programmes we act as a joint controller with MKZ Rakitna under Article 26 GDPR. Responsibilities, including how people exercise their rights, are set out in a separate agreement.

4. Transfers outside the EEA

Some providers may process data outside the European Economic Area. Transfers then rely on the EU–US Data Privacy Framework, standard contractual clauses, or another mechanism recognised by the European Commission.

5. Data and purposes

We process data on the basis of consent, a contract, or legitimate interest. Special-category data, such as health or family circumstances, is processed only with explicit consent and only for professional support. Where we rely on legitimate interest, we balance that interest against your rights.

• Booking an introductory meeting: consent.
• Delivering services (counselling, workshops, camps): contract.
• Replies to contact forms: legitimate interest.
• Newsletters: consent.

5.1 Consent

News and updates about the institute's work. You can withdraw consent at any time.

5.2 Contract

Delivering services, including the shop, events and camps.

5.3 Legitimate interest

Replying to enquiries sent through contact forms.

5.4 Booking an introductory meeting

A booking may include your name, phone, email and a description of the reason for the meeting. You may voluntarily include sensitive personal or family information.

We use that information only to arrange the meeting and prepare the counsellor. The basis is consent (Article 6(1)(a) GDPR) and, for sensitive data, explicit consent (Article 9(2)(a) GDPR). Only authorised staff can access it. You can ask for erasure or restriction at any time.

6. Digital tools

Google Workspace is used for internal mail and organising data. We keep the data to what is needed, do not store sensitive health data there, and limit access to authorised people.

monday.com is used to organise work and projects, with a limited set of contact details.

Zoom is used for remote counselling and meetings. We process only what is needed, such as a name and email. We do not record a meeting without the explicit consent of everyone present, and we restrict access with a password or waiting room.

7. Security

We limit access, use secure systems, keep an audit trail and protect data in transit. Programme records are confidential. The national identification number is visible only to managers and owners. An owner can anonymise a client and relatives: name, identification number, phone and email are cleared, while codes and links remain.

8. Retention

We keep data until you withdraw consent, until the contract is fulfilled, or for as long as the law requires.

9. Your rights

You can ask for access, correction, erasure, restriction, portability or object to processing. Write to [email protected]. You can also contact the Slovenian Information Commissioner.

10. Personal-data breaches

If a breach occurs we take appropriate steps and notify the authority and affected people when the law requires it.

Cookies

Cookies are small text files. Essential cookies are needed for the site to work and do not require consent. Statistics cookies are set only after you allow them. We do not set advertising cookies.

The essential cookie logout_consent stores your choice for six months. Staff sign-in uses an essential session cookie that is not used to track visitors.

Google Analytics loads only after you allow statistics. The measurement ID is G-1HSCK2GJYM.

You can change this choice at any time with Cookie settings in the footer.

Validity

We update this policy when needed and publish the change on this page. It has been published on www.logout.org and applies from 25 May 2018.