Privacy Policy

1. Data controller

The controller is PZB, Prestolnica Zdravja Bled, d.o.o. (short name: PZB d.o.o.), Ljubljanska cesta 8, 4260 Bled, Slovenia. Registration number: 6305733000. VAT ID: SI74779931. For privacy questions or requests, use our contact page, where the direct email address and phone number can be revealed.

2. Data we receive

• Inquiry data: name, email address, subject, message, and any information you choose to include.
• Client and booking data: contact details, service or retreat preferences, dates, correspondence, agreement details, and information needed to organise delivery.
• Billing data: company or customer details, billing address, VAT information, payment status, invoices, and legally required accounting records. We do not request payment-card details through this website.
• IT project data: authorised contact details, project requirements, access records, support correspondence, and technical information supplied for an agreed engagement.
• Security data: IP address, request time, browser request data, anti-spam interaction signals, and a short-lived fingerprint used to detect duplicate form submissions.

3. Why we use data and our legal bases

4. Health and other sensitive information

Information concerning health is a special category of personal data under the GDPR. If specific wellbeing services genuinely require such information, PZB will request only what is necessary through an appropriate process, explain the purpose and safeguards, and establish a valid legal basis, including explicit consent where required. PZB wellbeing information and retreats are not a substitute for medical diagnosis or treatment.

5. Who may receive data

Access is limited to authorised PZB personnel and service providers who need the information for their work. Depending on the engagement, recipients may include hosting and email providers, IT support, accounting advisers, payment or banking providers, instructors, venues, accommodation or logistics partners, and public authorities where disclosure is legally required. Providers acting for PZB must process data only under appropriate instructions and confidentiality obligations.

We do not sell or rent personal data. If a service requires a transfer outside the European Economic Area, we will use a lawful transfer mechanism and appropriate safeguards.

6. How long we keep data

• Unsuccessful or one-off inquiries are normally deleted or anonymised within 12 months after the last meaningful contact.
• Client, booking, project, and support records are kept for the engagement and afterwards for the applicable limitation period, normally up to 5 years, unless a longer period is required for a dispute or legal claim.
• Invoices and accounting records are kept for the period required by Slovenian tax and accounting law, generally 10 years.
• Active contact-form rate data is used for up to one hour and duplicate fingerprints for up to 24 hours; temporary server files are then ignored and removed through server housekeeping.
• Data based solely on consent is kept until consent is withdrawn or the stated purpose ends, unless another legal basis requires retention.

7. Your rights

Subject to the GDPR and applicable Slovenian law, you may request access to your data, correction, deletion, restriction of processing, data portability, or object to processing based on legitimate interests. Where processing relies on consent, you may withdraw consent at any time without affecting earlier lawful processing. Some rights are limited where retention or processing is required by law or necessary for legal claims.

We may need to verify your identity before acting on a request. We normally respond within one month. You also have the right to lodge a complaint with the Information Commissioner of the Republic of Slovenia, Dunajska cesta 22, 1000 Ljubljana.

8. Security and children

We use proportionate organisational and technical safeguards, including access controls, local hosting controls, transport encryption on HTTPS, limited form fields, anti-abuse checks, and backups where appropriate. No internet transmission is completely risk-free, so sensitive information should be provided only through a method agreed with us.

This general website is not directed to children. A parent or legal guardian must handle inquiries and contractual consent for a minor unless applicable law and the specific service allow otherwise.

9. Changes and contact

We will update this policy when the website, processing activities, or legal requirements materially change. The effective date above identifies the current version. Contact PZB through the contact page for any privacy request.