Privacy Policy
1. Introductory Provisions
The Privacy Policy defines how HFL Institute, Dr. Maja Berlic s.p. (hereinafter: the Provider) collects, uses, protects, and processes personal data of users of the website hflinstitute.eu in accordance with the General Data Protection Regulation (GDPR) and Slovenian legislation (ZVOP-2).
Purpose: to ensure transparency, security, and lawful processing of personal data.
2. Data Controller
HFL Institute, Center for Children’s Nutrition, Dr. Maja Berlic s.p.
Gallusovo nabrežje 39, 1000 Ljubljana, Slovenia
Email: info@hflinstitute.eu
Website: www.hflinstitute.eu
The Controller is responsible for the processing and security of personal data.
3. Data We Collect
Data voluntarily provided by the user (e.g., name, surname, email address, phone number, company, tax number) when registering for an event, making a purchase, or submitting an inquiry.
Data on event participation and payment status.
Data on website usage (through cookies or analytics).
4. Purpose and Legal Basis of Processing
We process data for the following purposes:
- to perform ordered services or event registrations (contractual obligation),
- to issue invoices and maintain administrative records (legal obligation),
- to inform users about current events and news (based on consent),
- to improve the website user experience (based on legitimate interest).
5. Retention of Personal Data
Personal data is kept only as long as necessary to fulfill the purpose for which it was collected or in accordance with applicable regulations. After the retention period expires, the data is securely deleted or anonymized.
6. Disclosure of Data to Third Parties
Data is not shared with third parties, except in the following cases:
- if required by law (e.g., tax authorities),
- if necessary for service delivery (e.g., IT or accounting providers with appropriate data protection agreements),
- if the user gives explicit consent.
7. Rights of Individuals
Users have the following rights under the GDPR:
- access to their personal data,
- correction of inaccurate data,
- erasure of personal data (“right to be forgotten”),
- restriction of processing,
- objection to processing,
- data portability.

