Desert Soul Adventures | Privacy policy

Privacy policy

1. About the Privacy Policy

The purpose of the Privacy Policy is to inform the clients, passengers and other persons (hereinafter referred to as "the Data Subjects") of the purposes and legal bases for processing of personal data by Desert Soul d.o.o., Murnova ulica 6, 1000 Ljubljana, Slovenia (hereinafter referred to as "Desert Soul Adventures"), as well as to inform the data subjects of their rights arising therefrom. In addition, this Privacy Policy explains the consent for processing personal data.

In accordance with the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the Protection of Natural Persons with Regard to the Processing of Personal Data and on the Free Movement of Such Data, and repealing Directive 95/46/EC (General Data Protection Regulation), this Privacy Policy covers the following types of information:

Contact information of Desert Soul Adventures;
Contact information of the data protection officer of Desert Soul Adventures;
The purposes, legal bases of processing of different categories of personal data of data subjects, including personal data profiling of data subjects;
Indication of legitimate interests pursued by Desert Soul Adventures when processing personal data;
Sending data to third parties and transferring data to third countries;
Data retention periods for individual categories of personal data;
The rights of data subjects in connection with the processing of personal data;
The right to lodge a complaint regarding the processing of personal data.

2. Data controller and data protection officer

Desert Soul d.o.o., Murnova ulica 6, 1000 Ljubljana, Slovenia, is the data controller of personal data of data subjects which is processed in accordance with the Privacy Policy. Desert Soul Adventures can be reached at info@desertsoul.com.

3. The legal bases and purposes of personal data processing

3.1 Processing based on the contractual or pre-contractual relationship:

Desert Soul Adventures processes personal data of data subjects to fulfil their liabilities arising from the contractual or pre-contractual relationship for the provision of services for organising travel or other services which are agreed between the contracting parties. Within the framework of exercising rights and fulfilling their contractual obligations, Desert Soul Adventures processes personal data of data subjects for the following purposes:

Identification of the data subject;
Preparation of the offer and concluding the contract;
Performing the service during which Desert Soul Adventures may send personal data to other contractual partners (e.g. partner agencies, hotels, airlines, carriers etc.) and transfer it to third countries if this is indispensable for the fulfilment of obligations arising from the contractual relationship;
Sending notifications to data subjects in connection with the fulfilment of contractual or other relationships;
Sending notifications on changes to the legislation in a certain field or changes to sales terms and conditions;
Charging services;
Solving claims or objections of data subjects;
Carrying out the necessary procedures for recovery procedure and/or sale of receivables;
Other purposes which are necessary for the fulfilment of or conclusion of a contract between Desert Soul Adventures and the data subject.

In order to carry out its travel organisation service, related services or other services requested by data subjects, Desert Soul Adventures processes all personal data which are necessary to perform such services. In particular, these primarily but not exclusively include: title, name and surname, gender, date of birth, address, state, region, telephone number, mobile phone number, fax number, email address, postcode, nationality, personal identification document number and/or passport number (if the country to which the passenger is travelling explicitly demands that, also whether the type of travel (by ship) requires this, e.g. the ship's manifest), expiry date of personal identification document, the date of issuing of personal identification document, smoker/non-smoker, contract number (booking), description of the product, description of the service, additional services, destination, date of commencement of service, price, discount, account number, account type, payment type, checkout document number, date of issue of invoice, maturity date (payment deadline), final amount, currency of payment, date of payment, non-payment information, information on the recovery of outstanding accounts, data which is necessary to complete the travel in accordance with Article 884. of the Code of Obligations (date and place of the issue, reference number and address of the travel organiser, passenger name, date and place of beginning and ending the travel; dates of lodging, the necessary data on timetables, prices, terms and conditions of transport, quality of transport means; the necessary data on lodging with information on the place of lodging, type and category of accommodation facility, number of meals served (e.g. bed and breakfast, half board, full board), detailed travel programme and data on other services included in the total price; whether a minimum number of passengers is required to organise the travel and the deadline for notifying passengers on possible cancellation of the travel; the total price for the set of services envisaged in the contract; the terms and conditions under which a passenger may request rescission of the contract, the deadline for submitting claims and requests for reducing the price due to services performed in a non-quality or incomplete manner; the necessary data for border and customs formalities, sanitary, monetary, and other administrative rules and regulations, as well as any other data deemed useful to be provided in the certificate), cash register receipt and knowledge of foreign languages.

3.2 Processing based on law:

Desert Soul Adventures may send personal data to the police and other competent authorities if this is required by law.

Other purposes for processing personal data may arise from the currently applicable legislation.

3.3 Processing based on legitimate interest pursued by Desert Soul Adventures:

Personal data may be processed on the basis of a legitimate interest pursued by Desert Soul Adventures or a third party, except when such interests are overridden by the interests of fundamental rights and freedoms of data subjects and which require protection of personal data, but especially when personal data refers to a child. When processing of personal data of data subjects is involved, Desert Soul Adventures shall carry out the assessment thereof in accordance with the General Data Protection Regulation. For example, such further use of personal data in a pseudonymised or aggregated form represents a legitimate use of personal data for marketing and other business purposes or for technical analyses of Desert Soul Adventures.

In accordance with the General Data Protection Regulation, direct marketing is one of the legitimate interests of the company. For direct marketing purposes, Desert Soul Adventures may create profiles of data subjects, based on the basic information on selected products, such as the type or specific characteristics of the selected product, the time of selection or past marketing contacts with the data subject with regard to their expressed interest or lack of interest for particular services or products. This kind of basic profiling shall never include sensitive personal data. In accordance with item 6/iv of the Privacy Policy, data subjects may object to the aforementioned type of processing of their personal data.

Based on their legitimate interest, Desert Soul Adventures may contact data subjects for purposes of improving services or establishing their satisfaction with services, even in cases when this is not necessary for the fulfilment of the contract. Data subject may at any time refuse or prohibit use of his personal data for this purpose.

Within the necessary scope for checking the authenticity and identification of transactions, Desert Soul Adventures also processes personal data to calculate commissions of their employees and business partners who are selling services to data subjects, as well as to evaluate their efficiency, prepare reports and plan further sales activities. Upon the expiry of the legal period of data retention, Desert Soul Adventures has a legitimate interest in storing and further use to carry out analyses and research for marketing purposes, business planning and similar.

3.4 Processing based on consent for processing personal data:

Processing of personal data may be based on consent which Desert Soul Adventures has obtained from the data subject. For example, consent may refer to sending notifications on services and offers, preparation of tailor-made offers in accordance with consumer habits of the data subject. Notifications are sent through the channels selected by the data subject in their consent.

The data subject may revoke their consent at any time or change it in the same manner as the consent was given or in the manner defined by Desert Soul Adventures, wherein Desert Soul Adventures reserves the right to identify the data subject. Revocation or a change of consent refers only to the personal data which is processed on the basis of consent and not to the personal data which is processed in accordance with other legal bases. The possibility to revoke the consent does not represent a withdrawal entitlement in the business relationship concluded between the data subject and Desert Soul Adventures. For an underage person, consent may be given by one of their parents, foster parents or caretakers, since in accordance with the applicable legislation an underage person cannot provide consent on their own. Such consent shall remain valid until one of the parents, foster parents or a caretaker revokes it or after the underage person has become an adult and obtained the right to revoke or change the consent in accordance with the applicable legislation.

Where the consent includes direct marketing based on the data subject profile, Desert Soul Adventures may carry out data subject profiling based on their ordered services, the actually performed services or other data obtained by Desert Soul Adventures on the data subject in accordance with their consent. Profiling may result in an offer or information on the offer from Desert Soul Adventures which is tailored to the data subject, but which in no event creates any legal obligations for the data subject.

4. Sending data to third parties and transfer of data to third countries (i.e. countries which are not members of the European Economic Area)

If this corresponds to the purpose of processing of personal data according to the legislation, Desert Soul Adventures may send personal data on data subjects to:

Physical and legal entities which are business partners of Desert Soul Adventures and which (on behalf of Desert Soul Adventures) carry out individual services to realise the contractual relationship between Desert Soul Adventures and the data subject (e.g. partner agencies, hotels, airlines, carriers, etc.);
State bodies in third countries;
Physical and legal entities which are contractual partners of Desert Soul Adventures and which carry out processing tasks for Desert Soul Adventures, for example prepare and send invoices or carry out data analytics, development of services, including software, when such tasks include processing of personal data within the necessary scope;
Physical and legal entities who carry out sales and marketing services for Desert Soul Adventures, including sales and on-site marketing or cooperation with Desert Soul Adventures in terms of marketing and sale of services or services offered by third parties, within the scope which is necessary for this kind of tasks and corresponds to the purposes and legal bases which are defined in this Privacy Policy.

Transfer of data to third countries may be carried out in accordance with the legal bases for transferring data to third countries, in accordance with the EU legislation and the applicable Slovenian regulations. The possible legal bases include:

The implementing act of the European Commission on the adequacy of data protection provided by the third country;
Binding legal rules in accordance with the General Data Protection Regulation if they have been correspondingly approved;
Standard provisions on the protection of personal data;
Other mechanisms allowed by the General Data Protection Regulation;
If transfer of personal data is necessary for the implementation of a contract, or for the preparation of a tender, or negotiations for the conclusion of a contract between the Data subject and Desert Soul Adventures;
If transfer is necessary for the enforcement or defence of legal claims.

5. Duration of personal data retention

For reasons of proof in cases of claims arising from this contractual relationship, Desert Soul Adventures may retain personal data for five (5) years after the termination of the contractual relationship or until the payment of claims. Invoices shall be retained for ten (10) years after the expiry of the year to which the invoice refers, in accordance with the Value Added Tax Act.

If personal data is processed based on consent of the data subject for marketing services purposes of Desert Soul Adventures, such data may be processed within the necessary scope and until this is necessary for such marketing services or until consent is revoked.

6. The rights of data subjects in connection with the processing of personal data

Desert Soul Adventures guarantees to data subjects that they will be able to exercise their rights without undue delay, but in any case within one (1) month after receiving their claim. For the purpose of exercising the rights of the data subjects, Desert Soul Adventures may extend such deadline for no more than two (2) additional months whilst taking into consideration the complexity and the number of claims. In the event of extending the deadline, Desert Soul Adventures shall inform the data subject of each such extension within one (1) month after receiving their claim and provide the reasons for such delay.

Please send any claims in connection with the rights of data subjects by e-mail to info@desertsoul.com or by post to Desert Soul Adventures d.o.o., Murnova ulica 6, 1000 Ljubljana, Slovenia.

Where the data subject makes a request by electronic means, the information shall be provided by electronic means where possible, unless otherwise requested by the data subject.

Where there are reasonable doubts concerning the identity of the data subject who is making the request in connection with any of their rights, Desert Soul Adventures may request the provision of additional information necessary to confirm the identity of the data subject.

Where requests are manifestly unfounded or excessive, in particular because of their repetitive character, Desert Soul Adventures may charge a reasonable fee based on administrative costs of providing information or notification or carrying out the requested measure or refuse to act in connection with the request.

Desert Soul Adventures provides the following rights to the data subjects in connection with the processing of their personal data:

the right to access,
the right to rectification,
the right to erasure ("the right to be forgotten"),
the right to restriction of processing,
the right to data portability,
the right to object.

6.1 The right to access personal data

Data subjects shall have the right to obtain from Desert Soul Adventures confirmation as to whether or not personal data concerning them is being processed, and, where that is the case, access their personal data and the following information in connection with the processing of personal data which includes:

the purposes of processing;
the categories of personal data;
the recipients or categories of recipients to whom personal data has been or will be disclosed, in particular recipients in third countries or international organisations;
where possible, the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
the existence of the right to request from Desert Soul Adventures rectification or erasure of personal data or restrict processing of personal data concerning the data subject or to object to such processing;
the right to lodge a complaint with a supervisory authority;
where personal data is not collected from the data subject, any available information as to their source;
the existence of automated decision-making, including profiling, and meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the data subject.

Based on the request of the data subject, Desert Soul Adventures shall provide a copy of personal data which is being possessed. For any further copies requested by the data subject, Desert Soul Adventures may charge a reasonable fee based on administrative costs.

6.2 Pravica do popravka

The data subject shall have the right to obtain from Desert Soul Adventures, without undue delay, the rectification of inaccurate personal data concerning them. Taking into account the purposes of data processing, the data subject shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

6.3 The right to erasure ("the right to be forgotten")

The data subject shall have the right to obtain from Desert Soul Adventures the erasure of personal data concerning them without undue delay. Desert Soul Adventures shall have the obligation to erase personal data without undue delay where one of the following grounds applies:

the personal data is no longer necessary in relation to the purposes for which they have been collected or otherwise processed;
when the data subject has withdrawn the consent on which the processing is based and where there is no other legal ground for the processing;
when the data subject objects to the processing pursuant to a legitimate interest of Desert Soul Adventures, as there are no overriding legitimate grounds for the processing;
when the data subject objects to processing for direct marketing purposes;
when the personal data has to be erased for compliance with a legal obligation arising from EU law or Slovenian law;
when the personal data has been incorrectly collected from an underage person in connection with using information society services, since such person cannot provide such data in accordance with the applicable legislation.

6.4 The right to restriction of processing

The data subject shall have the right to obtain from Desert Soul Adventures restriction of processing where one of the following applies:

the accuracy of personal data is contested by the data subject for a period enabling Desert Soul Adventures to verify the accuracy of such personal data;
the processing is unlawful and the data subject opposes the erasure of their personal data and requests the restriction of their use instead;
Desert Soul Adventures no longer needs such personal data for the purposes of processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;
the data subject has objected to processing, pending the verification whether the legitimate grounds of the controller override those of the data subject.

6.5 The right to data portability

The data subject shall have the right to receive the personal data concerning them and which they have provided to Desert Soul Adventures in a structured, commonly used and machine-readable format and shall have the right to transmit those data to another controller without hindrance from Desert Soul Adventures, where processing is based on the consent of the data subject or a contract and where the processing of personal data is carried out by automated means.

The data subject shall have the right to have the personal data transmitted directly from Desert Soul Adventures to another controller, where technically feasible.

6.6 The right to object

The data subject shall have the right to object, on grounds relating to their particular situation, at any time to processing of personal data concerning them if they are based on legitimate interests pursued by Desert Soul Adventures or a third party. In such case, Desert Soul Adventures shall no longer process their personal data unless they can demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims. Where personal data is processed for direct marketing purposes, the data subject shall have the right to object at any time to the processing of their personal data for such marketing, which includes profiling to the extent that it is related to such direct marketing. Where direct marketing is based on the consent of the data subject, the right to object may be carried out by revoking the given personal consent.

7. The right to lodge a complaint with a supervisory authority regarding the processing of personal data

Every data subject shall have the right to lodge a complaint with a supervisory authority regarding the processing of their personal data. Please send any claims by e-mail to info@desertsoul.com or by post to Desert Soul d.o.o., Murnova ulica 6, 1000 Ljubljana, Slovenia.

Every data subject shall have the right to lodge a complaint directly with the Information Commissioner if the data subject considers that the processing of their personal data relating is violating the provisions of the Slovenian laws or the EU regulations on the protection of personal data.

If the data subject has exercised their right to access their personal data with Desert Soul Adventures and if, after having received the decision, they believe that the personal data they had received are not the personal data they had required or if they had not received all of the required personal data, the data subject may lodge a written complaint which includes reasons thereto within fifteen (15) days with Desert Soul Adventures before lodging a complaint with the Information Commissioner. Desert Soul Adventures shall decide on the claim as a new request within five (5) workdays from its receipt.

8. Validity of the Privacy Policy

This Privacy Policy is available at www.desertsoul.com and shall enter into force on 25 May 2018.