Purpose and scope
Gostol TST d.d. respects the privacy of visitors to its website, customers, prospective customers, business partners, job appliants, and all other individuals whose personal data it processes.
The Privacy policy explains:
- what personal data we process,
- the purposes for which we use your personal data,
- the legal bases for processing,
- with whom your personal data may be shared,
- how long we retain your personal data,
- whether your personal data is transferred outside the European Economic Area (EEA),
- how we use artificial intelligence in our communications,
- your rights regarding the processing of your personal data.
We process personal data in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation - GDPR), the Slovenian Personal Data Protection Act (ZVOP-2), the Electronic Communications Act (ZEKom-2), Regulation (EU) 2024/1689 (AI Act), and other applicable legislation.
The Policy primarily appliesto the processing of personal data collected through the website www.gostol-tst.eu, web forms, online chat, email, and other digital communication channels operated by Gostol TST d.d.
Data controller
The controller of your personal data is:
Gostol TST d.d.
Čiginj 63
5220 Tolmin
Slovenia
Phone: +386 5 380 12 80
Email: marketing@gostol-tst.eu
Categories of personal data, purpose of processing and legal bases
Personal data means any information relating to an identified or identifiable natural person. An identifiable natural person is one who can be identified directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social indentity of that person.
We process personal data for the purposes described below. A particular category of personal data may be processed for one or more compatible purposes.
We collect and process personal data primarily through the following forms and communication channels:
- Contact form
- Enquiry form,
- Catalogue download form
- Newsletter subscription form
- Job application form
- Scholarship application form
- Holiday work and internship application form
- Online chat and AI assistant
We process your personal data only where we have an appropriate legal basis. The applicable legal bases are:
- Processing necessary for the performance of a contract. We process your personal data where such processing is necessary to enter into or perform a contract.
- Processing based on consent. We may process your personal data where you have give your explicit consent. You may withdraw your consent at any time.
- Processing based legitimate interests. We may process your personal data where we have a legitimate interest that is not overridden by your interests or fundamental rights and freedoms. Where processing is based on legitimate interests, you have the right to object (see the section Your Rights).
- Processing required by law. We may process your personal data where processing is required by applicable legislation (for example, tax legislation requiring the retention of accounting records).
The personal data you submit through the contact form, enquiry form, catalogue request form or online chat is processed to respond to your enquiry, handle your request, prepare a quotation, or take other steps prior to the possible conclusion of a contract. The legal basis for such processing is the performance of pre-contractual measures at your request or our legitimate interest in ensuring efficient business communication and handling visitors' enquiries.
We process personal data for newsletter distribution based on your consent. Personal data relating to job applicants, scholarship applicants, holiday workers and interns is processed for the purpose of conducting the recruitment or selection process, taking pre-contractual steps and complying with our legal obligations.
Our legitimate interests include responding to business enquiries, managing customer relationships, ensuring the security of our website, preventing misuse, and establishing, exercising or defending legal claims.
Providing personal data is generally voluntary unless a specific data item is required by law or identified as mandatory. If you do not provide the personal data necessary for handling your enquiry, preparing a quotation, providing the requested information or conducting a recruitment process, we may be unable to process your request.
Online chat and AI assistant
We use tawk.to service on our website to enable visitors to communicate with our AI assistant and, where appropriate, with employees of Gostol TST d.d.
Before or, at the latest, during the first interaction, users are informed that they are communicating with AI assistant. The AI assistant provides general, non-binding information and does not make decisions that produce legal or similarly significant effects for individuals.
When you use the online chat, we my process the following data:
- the content of questions, answers, and other messages,
- the date, time, and language of the communication,
- your IP addess and session identifier,
- information about your device, browser, and the website visited,
- your name, email address, or telephone number, if you voluntarily provide this information,
- information relating to your business ore technical enquiry.
We use this information to respond to your questions, process enquiries, forward requests to the appropriate employee, ensure the operation and security of the online chat, and prevent misuse.
The legal basis for processing is the performance of pre-contractual measures taken at the request of the data subject where the user requests a quotation or technical consultation, or our legitimate interest in providing visitor support and ensuring the secure operation of our website. Where non-essential technologies are used for the operation of the online chat, the legal basis for processing is the user's consent.
The use of the online chat is voluntary. You may also contact us by email, telephone, or via the contact form.
Please do not enter passwords, bank details, special categories of personal data, trade secrets, confidential technical documentation, or any other information that is not necessary for handling your enquiry in the online chat.
We use tawk.to, Inc. as our data processor to provide the online chat service. Certain functionalities may also involve its subprocessors, including providers of artificial intelligence services.
To whom may your personal data be disclosed?
Where necessary to achieve the purposes described above or where required by applicable law, we may disclose your personal data to natural or legal persons, public authorities, or other entities (third-party recipients). Regardless of the recipient, we will disclose only the personal data that is necessary for the specific processing purpose.
Your personal data may be disclosed to the following categories of recipients:
- companies providing website hosting, website maintenance, email services, email marketing, business information systems, online chat, artificial intelligence services, and other digital services,
- advertising service providers and marketing agencies for web analytics and remarketing purposes, where you have given your consent to such processing,
- competent public authorities, courts, and other institutions where disclosure is required by law.
Where, in accordance with applicable legislation, we engage third parties to process your personal data exclusively on our behalf and in accordance with our instructions (data processors), we ensure that such processors implement appropriate technical and organisational measures that comply with the requirements of the General Data Protection Regulation (GDPR) and other applicable data protection legislation, thereby ensuring an adequate level of protection for your personal data and your rights.
Where is your personal data processed?
Depending on the services used, your personal data may be processed within the European Economic Area (EEA) as well as in countries outside the EEA.
Where personal data is transferred to recipients in third countries or to international organisations, we unsure that such transfers are carried out in accordance with Chapter V of the General Data Protection Regulation (GDPR). Such transfers may take place, in particular, on the basis of:
- an adequacy decision adopted by the European Commission,
- the European commission's Standard Contractual Clauses (SCCs), together with additional technical and organisational safeguards where necessary,
- Binding Corporate Rules (BCRs)
- any other valid transfer mechanism permitted under applicable data protection legislation.
We require our data processors and other recipients to implement appropriate safeguards to protect personal data and to process it solely for the agreed purposes and, where acting as our data processors, in accordance with our instructions.
You may request information about whether your personal data is transferred to a particular third country, the legal basis for such transfer, and how to obtain a copy of the applicable safeguards by contacting us at marketing@gostol-tst.eu.
How long do we retain your personal data?
The retention period of your personal data depends on the legal basis and the purpose of processing for each category of personal data. We retain personal data only for as long as necessary to fulfil the purpose for which it was collected or subsequently processed.
When determining the appropriate retention period, we take into account, in particular, the duration of handling and enquiry, request or application, the duration of the business or contractual relationship, statutory retention periods, and limitation periods for the establishment, exercise, or defence of legal claims.
Once the purpose of processing has be fulfilled, we delete, destroy, anonymise, or restrict the further processing of your personal data, unless there is another legal basis requiring or permitting its continued retention.
Automated decision-making
We do not use personal data for solely automated decision-making that produces legal effects concerning individuals or similarly significantly affects them.
The AI assistant does not make decisions regarding employment, contractual rights, the final technical suitability of a proposed solution, pricing, or any other important rights or interests of individuals. All significant technical, sales, HR, and business decisions are made or approved by an authorised representative of Gostol TST d.d.
What are your rights regarding the processing of your personal data?
As a data subject whose personal data we process, you are entitled, under the conditions set out in the General Data Protection Regulation (GDPR), to exercise the following rights regarding the processing of your personal data:
Right of access
You have the right to obtain access to the personal data we process about you in order to understand how your personal data is being processed and to verify the lawfulness of such processing.
Right to rectification
You have the right to have your personal data updated and to request the correction of inaccurate or incomplete personal data, ensuring that we always maintain accurate and up-to-date information about you.
Right to erasure
You have the right to request that the controller erase your personal data without undue delay where one of the following grounds applies:
- the personal data is no longer necessary for the purposes for which it was collected or otherwise proceseed,
- you withdraw your consent on which the processing is based, and there is no other legal basis for the processing,
- you object to the processing, and there are no overriding legitimate grounds for continuing the processing,
- the personal data has been processed unlawfully,
- the personal data must be erased to comply with a legal obligation under applicable law.
The individual has the right to obtain the erasure of personal data concerning him or her by the controller without undue delay, where one of the following grounds applies:
- The personal data are no longer necessary for the purposes for which they were collected or otherwise processed,
- The individual withdraws the consent on the basis of which the processing is carried out and where there is no other legal basis for the processing,
- The individual objects to the processing and there are no overriding legitimate grounds for the processing,
- The personal data have been unlawfully processed,
- If the law so provides.
Right to object
You have the right to object at any time to the processing of your personal data for direct marketing purposes. If you object, we will cease processing your personal data for direct marketing without undue delay.
You also have the right to object to any processing based on our legitimate interests.
Where processing is based on our legitimate interests, you may object on grounds relating to your particular situation. In such cases, we will stop processing your personal data unless we demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or where the processing is necessary for the establishment, exercise, or defence of legal claims.
Right to restriction of processing
You have the right to request the restriction of the processing of your personal data. Processing may be restricted in the following circumstances:
- where you contest the accuracy of your personal data, for a period enabling us to verify its accuracy,
- where the processing is unlawful and you oppose the erasure of your personal data and request the restriction of its use instead,
- where we no longer need the personal data for the puposes of processing, but you require it for the establishment, exercise, or defence of legal claims,
- where you have objected to processing pusuant to article 21(1) of the GDPR, pending verification of whether our legitimate grounds override yours.
Right to data portability
You have the right to receive the personal data that you have provided to us in a structured, commonly used, and machine-readable format and to transmit that dat to another controller, where the processing is based on your consent or on a contract and is carried out by automated means.
Right to withdraw consent
Where the processing of your personal data is based on your consent, you have the right to withdraw that consent at any time. The withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
You may withdraw your consent in the same or an equally simple manner as it was given, or by contacting us at marketing@gostol-tst.eu. If you have subscribed to our newsletter, you may also withdraw your consent by clicking the unsubscribe link included in each newsletter.
Right to lodge a complaint with a supervisory authority
If you believe that the processing of your personal data infringes applicable data protection legislation, you have the right to lodge a complaint with the competent supervisory authority.
In the republic of Slovenia, the competent supervisory authority is the Information Commissioner (address: Dunajska cesta 22, 1000 Ljubljana, e-mail: gp.ip@ip-rs.si, phone: +386 1 230 97 30, website: www.ip-rs.si).
Validity of this Privacy policy
Gostol TST d.d. may update this Privacy policy from time to time to reflect changes in applicable legislation, our personal data processing activities, the services we use, or our service providers.
The current version of this Privacy policy is always available on our website at www.gostol-tst.eu.
This Privacy policy was originally published on ) October 2023 and was last updated on 22 July 2026.
The updated version of this Privacy policy is effective as of 22 July 2026
Čiginj, 22.06.2026
