Privacy Policy
Operato Privacy Policy
Operato d.o.o. ("Operato", "we", "us") respects your privacy and is committed to protecting your personal data. This policy explains what we collect, why, how we use it, and the rights you have. We process personal data in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and applicable Slovenian law.
This policy applies to our website and to any related forms, applications, downloads, services, and tools (together, the "Services"), however you access them.
Who we are
The data controller is:
Operato d.o.o. Barvarska ulica 7, 2000 Maribor, Slovenia Email: info@operato.eu
If you have any question or complaint about how we handle your data, contact us at the address above.
Some definitions
- Personal data — any information relating to an identified or identifiable person.
- Processing — any operation performed on personal data (collecting, storing, using, sharing, deleting, etc.).
- Controller — the party that determines why and how personal data is processed. For the purposes of this policy, that is Operato.
- HubSpot — HubSpot, Inc. (Cambridge, Massachusetts, USA), the marketing and CRM provider we use to receive and manage enquiries submitted through our forms.
What we collect
Information you give us. When you submit one of our forms (for example a contact, demo, or event-registration form), we collect the details you provide. Depending on the form, this may include:
- First and last name
- Email address
- Company / organisation name
- Job title
- Country
- Any message or additional information you choose to send us
Information collected automatically. When you visit the site, our server records standard technical information such as your IP address and the date and time of your visit. This is used for security and to keep the site running reliably. We do not use it to identify you and do not combine it with your form submissions.
Cookies and tracking
We do not use analytics, advertising, or tracking cookies on this website. We do not run Google Analytics, Google Tag Manager, the HubSpot tracking script, or any similar profiling technology, and we do not build behavioural profiles of visitors. Because of this, no cookie-consent banner is required to browse the site.
Our forms submit your details directly to HubSpot only at the moment you choose to send them — no HubSpot tracking cookies are placed on your device by simply visiting a page.
If we introduce analytics or other non-essential cookies in the future, we will update this policy and ask for your consent before any such cookies are set.
Web fonts
Our pages load fonts from Google Fonts (fonts.googleapis.com / fonts.gstatic.com). To deliver these fonts, Google may receive your IP address. Google Fonts does not set cookies through our site. See Google's privacy policy for how Google handles this data.
Why we use your data, and our legal basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Responding to your enquiries, demo requests, and event registrations | Your consent, and/or steps taken at your request prior to entering into a contract (Art. 6(1)(a)/(b)) |
| Sending you occasional information about our products, offers, or events you may be interested in | Your consent (Art. 6(1)(a)) — you can withdraw it at any time |
| Keeping the website secure and operational (server logs) | Our legitimate interest in running a safe, reliable service (Art. 6(1)(f)) |
We only send marketing emails where you have agreed to receive them, and every such email includes an easy way to unsubscribe.
Who we share it with
We do not sell your personal data. We share it only with service providers who help us operate, and only as far as needed:
- HubSpot — receives and stores the details you submit through our forms so that we can manage and respond to your enquiry. HubSpot acts as our processor under a data processing agreement.
We may also disclose data where required by law.
International transfers
The details you submit through our forms are sent to and stored by HubSpot, including on servers in the United States. Transfers of personal data from the EU to the USA are protected by the EU–US Data Privacy Framework (DPF), under which HubSpot is certified, together with the European Commission's Standard Contractual Clauses and appropriate technical safeguards. These mechanisms are designed to ensure your data receives a level of protection comparable to that in the EU.
Note: The "Privacy Shield" framework referenced in our previous policy was invalidated by the Court of Justice of the EU in 2020 and has been superseded by the Data Privacy Framework described above.
How long we keep it
We keep your personal data only as long as necessary for the purposes above, and in any case no longer than 5 years from the date of your consent, unless a longer period is required by law or you ask us to delete it sooner.
How we protect it
We apply appropriate technical and organisational measures to keep personal data secure, including encryption of data in transit, firewalls, controlled physical access to our premises and equipment, and password-based access controls so that only authorised people can reach your information.
Your rights
Under the GDPR you have the right to:
- Access the personal data we hold about you, and receive a copy in a structured, commonly used, machine-readable format, free of charge;
- Rectify inaccurate or incomplete data;
- Erase your data ("right to be forgotten");
- Restrict or object to our processing of your data;
- Withdraw your consent at any time, without giving a reason and at no cost — after which we will stop using your data for the relevant purpose and delete it where appropriate.
To exercise any of these rights, email us at info@operato.eu. We also take care to keep the information we hold accurate and up to date.
If you believe we have not handled your data properly, you have the right to lodge a complaint with the Slovenian supervisory authority, the Information Commissioner (Informacijski pooblaščenec, ip-rs.si), or with the authority in your country of residence.
Changes to this policy
We may update this policy from time to time. The version published on this page, with its stated effective date, is always the one that applies.