Effective from 30 September 2026

This policy explains which personal data we process when you use optimod.net, why, and what rights you have under the General Data Protection Regulation (GDPR) and the Slovenian Personal Data Protection Act (ZVOP-2).

1. Controller

Optimod Enterprise, Sara Kremsar s.p., Svečane 23b, 2214 Sladki Vrh, Slovenia, registration number 9083588000, VAT ID SI63357178.
For anything about your personal data write to info@optimod.net. We have not appointed a data protection officer, as the law does not require one for our activities.

2. What we process and why

Your account

Name, email address, a hashed password (we never store it in readable form), when you accepted these terms, and, if you turn it on, an encrypted two factor authentication key. If you sign in with Google or LinkedIn we receive your name, email address, whether that address is verified and an identifier of your account there; we do not receive your password there. Legal basis: the contract with you (Article 6(1)(b) GDPR).

Sign in history and security

For every sign in we record the time, the method, your IP address and your browser's user agent. We show them to you on your dashboard so you can spot access that is not yours, and we use them to protect accounts from misuse. They are deleted after 90 days. Failed sign in attempts are counted briefly to block password guessing. Legal basis: our legitimate interest in keeping accounts and the website secure (Article 6(1)(f) GDPR).

Forms, enquiries and applications

When you contact us, book a call, request a quote, apply to one of our programmes or submit a contribution to the Knowledge Hub, we process what you enter in the form to handle your request and, where you asked for it, to prepare or perform a contract. Contributions you submit for publication are published as the form describes. Legal basis: steps at your request before a contract and the contract itself (Article 6(1)(b)), your consent where the form asks for it (Article 6(1)(a)), and our legitimate interest in answering enquiries (Article 6(1)(f)).

Newsletter

If you subscribe, we process your email address and name to send the newsletter. You can unsubscribe with the link in every email. Legal basis: your consent (Article 6(1)(a) GDPR), which you may withdraw at any time.

Cookies, statistics and spam protection

We use cookies needed to run the website (for example your session), statistics through Google Analytics, and Google reCAPTCHA to keep automated spam out of our forms. The details, and how to control them, are in our Cookie Policy.

Business records

Where we perform a paid service, we keep invoices and related records for as long as tax and accounting law requires. Legal basis: legal obligation (Article 6(1)(c) GDPR).

3. Who receives your data

We do not sell personal data. We share it only with service providers who process it for us, under data processing agreements, or where the law requires it:

• our hosting and infrastructure providers, including Cloudflare, which delivers and protects the website;
• Defikon, which runs our email delivery and our error monitoring;
• Google (sign in with Google, Google Analytics, reCAPTCHA, Google Fonts) and LinkedIn (sign in with LinkedIn), when you use those features;
• Mailchimp (Intuit), which sends our newsletter;
• authorities, where a law obliges us to disclose data.

4. Transfers outside the EEA

Some of these providers, notably Google, LinkedIn, Mailchimp and Cloudflare, may process data in the United States. Such transfers rely on the EU-U.S. Data Privacy Framework where the recipient is certified, or on the European Commission's standard contractual clauses.

5. How long we keep it

• account data: until you delete your account, then it is erased;
• sign in history: 90 days;
• enquiries and applications: as long as needed to handle them and any follow up, then deleted, unless a contract followed;
• newsletter data: until you unsubscribe;
• invoices and business records: for the period tax and accounting law prescribes.

6. Your rights

You have the right to:

• access your personal data and receive a copy (Article 15);
• have inaccurate data corrected (Article 16);
• have your data erased (Article 17), which you can do yourself for your account in its settings;
• restrict processing (Article 18);
• receive your data in a portable format (Article 20);
• object to processing based on our legitimate interest (Article 21);
• withdraw consent at any time, without affecting processing that took place before.

Write to info@optimod.net to use them. We answer within one month. You also have the right to lodge a complaint with the supervisory authority: Informacijski pooblaščenec (Information Commissioner of the Republic of Slovenia), Dunajska cesta 22, 1000 Ljubljana, gp.ip@ip-rs.si, www.ip-rs.si.

7. Security

The website is served only over encrypted connections. Passwords are hashed, two factor keys are encrypted, and staff access is limited to what their work needs. You can protect your account further with two factor authentication in your account settings.

8. Changes

We update this policy when our processing or the law changes. The current version is always on this page with its effective date; significant changes are announced to account holders by email.