At a glance
- No cookies, no local storage, and nothing else stored on or read from your device. No consent banner, because there is nothing to consent to.
- No analytics, advertising, pixels, fingerprinting or profiling.
- No tracking: the only record of a visit is the hosting provider’s standard, short-lived server log, which we do not analyse.
- No third-party requests. Fonts, images, styles and scripts are served from our own domain, and the site’s content security policy blocks everything else.
- No forms and no accounts. We receive personal data from you only if you choose to email us.
Who is responsible
The controller is SPACE LABS, računalniško programiranje d.o.o., Parmova ulica 53, 1000 Ljubljana, Slovenia, registration number 9794247000. For any privacy matter write to info@spacelabs.si. We are not required to appoint a data protection officer under Article 37 GDPR and have not appointed one.
This policy applies Regulation (EU) 2016/679 (GDPR) and the Slovenian Personal Data Protection Act (ZVOP-2).
What we process, and why
Visiting the website
To deliver a page, the server processes the IP address your browser connects from, the date and time, the address requested, the referring address if your browser sends one, and your browser’s user-agent string. Our hosting provider records these in a standard server log and uses them, together with its security systems, to keep the service secure and available. We do not analyse these logs, do not combine them with other data and do not use them to identify visitors. They are deleted on a rolling basis, normally within 30 days, unless a security incident requires longer retention.
Legal basis: our legitimate interest in delivering and securing the website (Article 6(1)(f) GDPR). You are not required to provide any data to read this website.
Email correspondence
If you write to us at any of our addresses (info@, investors@ or media@spacelabs.si), we process your email address, your name, role and organisation if you give them, and the content of your message, in order to reply and to continue the conversation you started. If you ask for access to confidential materials, we may ask for information that confirms who you are and whom you represent.
Legal basis: our legitimate interest in handling business, investor and media enquiries (Article 6(1)(f) GDPR) and, where the conversation concerns a contract, steps taken at your request before entering into one (Article 6(1)(b) GDPR). Writing to us is voluntary; without your contact details we simply cannot reply.
Please do not send special categories of personal data, identity documents or confidential files by ordinary email unless we have asked for them through a secure channel.
People named on this website
We publish the name, role, biography and portrait of our founder, with his agreement, to present the company. Legal basis: our legitimate interest in presenting the people responsible for the company (Article 6(1)(f) GDPR).
Links to other websites
Links such as the one to LinkedIn are ordinary links. Nothing is loaded from those services while you read our pages. If you follow a link, that service processes your data under its own privacy policy.
Who receives your data
We use service providers who act as our processors under contracts that meet Article 28 GDPR and who may use the data only on our instructions:
- website hosting and email: NEOSERV d.o.o., Slovenia, on servers located in Slovenia.
We may share correspondence with professional advisers bound by confidentiality, where that is needed to handle your enquiry. We do not sell personal data, do not share it for advertising, and disclose it to public authorities only where the law obliges us to.
International transfers
The website and our mailboxes are hosted in Slovenia, in the European Union. If a provider processes personal data outside the European Economic Area, the transfer takes place on the basis of a European Commission adequacy decision or the Commission’s standard contractual clauses, with additional safeguards where needed. You may ask us for a copy of the safeguards that apply.
How long we keep data
- Server logs of website visits: normally up to 30 days.
- Correspondence: for as long as the enquiry or relationship lasts, and for up to two years after the last contact.
- Records that tax or accounting law requires us to keep, such as invoices: for the statutory period, which is up to ten years.
- Where a legal claim is possible or pending: until the claim is resolved or time-barred.
Your rights
Under the GDPR you have the right to access your personal data, to have it corrected or erased, to restrict its processing, to receive it in a portable format, and to object at any time, on grounds relating to your situation, to processing based on our legitimate interests. We do not rely on consent for any processing; if we ever do, you will be able to withdraw it at any time.
To exercise a right, write to info@spacelabs.si. We may ask for information that confirms your identity. We respond within one month; the law allows an extension of up to two further months for complex requests, and we will tell you if we need it. Exercising your rights is free of charge.
You also have the right to lodge a complaint with a supervisory authority. In Slovenia this is the Information Commissioner (Informacijski pooblaščenec), Dunajska cesta 22, 1000 Ljubljana, gp.ip@ip-rs.si, www.ip-rs.si. You may instead contact the authority in the EU member state where you live or work.
Visitors outside the European Union
We apply this standard to every visitor, wherever you are, including visitors in the United Kingdom, Switzerland and the United States. We do not sell or share personal information and do not use it for targeted advertising, as those terms are defined in the California Consumer Privacy Act and comparable laws. We do not offer goods or services to, or monitor, people in any particular country outside the EU. You may use the contact address above to exercise any right your local law gives you.
Automated decisions and profiling
We make no automated decisions about you and do no profiling.
Children
This website is addressed to businesses and professionals. It is not directed at children, and we do not knowingly process children’s personal data.
Security
The website is served only over an encrypted connection. It is a static site with no database, no login and no user input, which removes most common attack surfaces, and a strict content security policy limits each page to resources from our own domain. Access to correspondence is limited to the people who need it.
If a personal data breach occurs that is likely to put your rights at risk, we will notify the Information Commissioner within 72 hours and inform you without undue delay, as Articles 33 and 34 GDPR require. To report a vulnerability, see security.txt.
Changes to this policy
We update this policy when our practices or the law change, and before any change that affects how your data is handled. The date at the top of the page shows the current version. The English text is the original; if the English and Slovenian versions differ, the English text prevails unless mandatory law requires otherwise.