Cookie and Privacy Policy

This translation is provided for information only. The Slovenian version is the legally binding one.

1. About the Privacy Policy

The purpose of this Policy is to inform the users of the services of the Cultural Society of Music Lovers Rock Arena (hereinafter: KD Rock Arena), the visitors to the website en.rockline.si and other persons of the purposes and legal bases for the processing of personal data at KD Rock Arena.

This Policy also further explains the consent to the processing of data, the data retention period, the rights of individuals in connection with the processing of personal data, and the rights of individuals in the event of a breach of regulations in the field of personal data protection.

In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: the General Data Protection Regulation), this Policy contains the following information:
• Contact information of KD Rock Arena,
• Purposes, legal bases and types of processing of various types of individuals’ personal data,
• Retention period of individual types of personal data,
• Rights of individuals in connection with the processing of personal data,
• The right to lodge a complaint in connection with the processing of personal data.

1. Personal Data Controller

The personal data controller is KD Rock Arena, which is the publisher of the online music portal RockLine (https://en.rockline.si; hereinafter: RockLine.si). KD Rock Arena handles personal data in accordance with its statutory and regulatory obligations.

Controller details:

KD Rock Arena, Arharjeva cesta 22, 1210 Ljubljana – Šentvid, registration number: 2244322000, tax number: 61163376, society president Aleš Podbrežnik.

1. Personal data collected by KD Rock Arena
   KD Rock Arena collects the following categories of data:
2. Data that you provide yourself

• when you participate in prize games,
• when you subscribe to notifications from KD Rock Arena or the RockLine.si website (RSS),
• when you browse our content,
• upon joining the society KD Rock Arena.

1. Data that you create while using our services:

• in particular when you post a question, comment or rating of a post on RockLine.si
• data concerning changes of data such as residential address and other personal data.

1. Data from other sources
2. Purposes of processing and legal bases for the processing of data
   In accordance with the regulations in the field of personal data protection, KD Rock Arena, as the personal data controller, is obliged to ensure, for each supply of personal data, that it can subsequently be determined which types of personal data were supplied, to whom, when and on what legal basis, for what purpose or for what reasons or for the needs of which procedure, unless another law provides otherwise for the supply of individual types of data.

Processing on the basis of law:

KD Rock Arena processes the personal data of users of the society’s services and of the RockLine.si website in accordance with legislation governing electronic communications and, for example, on the basis of legislation governing criminal liability for public incitement to hatred, violence or intolerance.

In addition, KD Rock Arena processes personal data that it obtains from members of the society and/or users of the society’s services for the purposes of providing the society’s services and maintaining the relevant records, all in accordance with the Societies Act (Zakon o društvih; Official Gazette of the Republic of Slovenia (Uradni list RS), No. 64/11).

Processing on the basis of a contract:

On the basis of a contractual relationship, KD Rock Arena processes users’ personal data to the extent necessary for the performance and conclusion of the contract. It thus processes personal data until the purpose is fulfilled or within the limitation periods for obligations that could arise from the processing of such personal data, in particular where the processing of personal data is necessary in connection with the conclusion or performance of a contract, except in cases where the retention period of personal data is prescribed by law. In the latter cases, KD Rock Arena retains the data in accordance with the statutory requirement.

Processing on the basis of a legitimate interest pursued by KD Rock Arena:

KD Rock Arena may also process data on the basis of a legitimate interest pursued by KD Rock Arena or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the individual to whom the personal data relate, which require the protection of personal data, in particular where they relate to a child. Where the data collected about an individual are to be further used, KD Rock Arena carries out an assessment in accordance with the General Data Protection Regulation.

In accordance with the General Data Protection Regulation, direct marketing is also considered a legitimate interest.

On the basis of a legitimate interest, KD Rock Arena may, for the purposes of improving services, contact individuals in order to ascertain their satisfaction with the services or the user experience, even in cases where this is not strictly necessary for the performance of a contract. In balancing this interest against the interests of the individual, KD Rock Arena does not contact again those individuals who have objected to this. In accordance with the legitimate interest, KD Rock Arena may process personal data to the extent that is strictly necessary and proportionate.

Processing on the basis of consent to the processing of personal data:

In certain cases, KD Rock Arena may request individuals to give consent to the processing of their personal data for the evaluation of certain personal aspects relating to the individual, e.g. for the analysis of that individual’s personal taste, interests and behaviour (profiling), for the purpose of creating and presenting to the individual personalised service offers, including notification or direct marketing, and for the purpose of carrying out market research. In these cases, the processing of personal data takes place within the scope of personal data, the purpose and the agreed notification channels permitted by the individual’s statement, until withdrawal. Notification in connection with the processing of personal data is carried out in the manner selected by the individual in the consent.

Consent is valid only if it is given by a clear affirmative act, which means that the individual to whom the personal data relate has freely, specifically, knowingly and unambiguously expressed agreement to the processing of personal data relating to them, such as by a written statement, including by electronic means, or an oral statement.

The individual to whom the personal data relate may at any time withdraw or change their consent in the same manner in which the consent was given or in another manner defined by KD Rock Arena, whereby KD Rock Arena reserves the right to identify the customer. The withdrawal or change of consent applies only to data processed on the basis of consent. The most recent consent of the individual received by KD Rock Arena is the valid one. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

1. How long do we retain your personal data?
   We retain your personal data for as long as is necessary to fulfil the purpose of their processing, until the withdrawal of consent to the processing of personal data for an individual purpose or for all purposes of processing, or in accordance with the minimum retention periods laid down by law, or where necessary for the enforcement of our legitimate rights (and the legitimate rights of others).

Personal data that we process on the basis of your consent are retained for the shortest possible period or until any withdrawal of consent. The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent until its withdrawal. After the purpose of processing has been fulfilled, personal data are erased, destroyed, blocked or anonymised, unless the law provides otherwise for individual types of personal data.

1. Categories of processors of personal data
   The personal data of individuals may be processed by the following recipients:

• members of the society KD Rock Arena and journalists of the online portal RockLine.si (your data may be processed by members of the society and journalists within the scope of their duties and authorisations),
• competent state authorities and holders of public authority within the exercise of their statutory competences (e.g. the Ministry of Culture),
• contractual processors of personal data with whom KD Rock Arena has concluded a personal data processing agreement
• other persons exclusively if you have given consent to the processing,
• other persons where they have a legal basis for obtaining and processing personal data.

The above-mentioned recipients include, among others, companies that provide KD Rock Arena with technical support in the processing of personal data, such as creators and maintainers of computer applications, websites and information services, developers and implementers of software solutions, and persons engaged by KD Rock Arena to provide services necessary for the performance of contracts or statutory obligations, such as postal services, research and analytics companies, representatives of KD Rock Arena in any court proceedings, etc.

Some organisations or companies to which we, as our processors, may disclose your personal data are established outside the European Union, in countries that may not have laws protecting the right to the protection of personal data in the same way as in the European Union or Slovenia. In the event that your personal data are transferred to third countries (outside the EU and the EEA), we will ensure the provision and implementation of appropriate measures for ensuring the security of personal data and the fundamental rights and freedoms of individuals, in accordance with applicable national and EU regulations and this Privacy Policy, by using the envisaged mechanisms, such as binding corporate rules, standard contractual clauses, etc.

1. Rights of individuals to whom the personal data relate

KD Rock Arena ensures that individuals can exercise their rights without undue delay and in any event within one month of receipt of the request. KD Rock Arena may extend the period for the exercise of an individual’s rights by a maximum of two additional months, taking into account the complexity and number of requests. If KD Rock Arena extends the period, it shall inform the individual of any such extension within one month of receipt of the request, together with the reasons for the delay.

KD Rock Arena accepts requests in connection with the rights of the individual by e-mail or by post to the address Kulturno društvo ljubiteljev glasbe Rock Arena, Arharjeva 22, 1000 Ljubljana.

Where the individual to whom the personal data relate submits the request by electronic means, the information shall, where possible, be provided by electronic means, unless the individual to whom the personal data relate requests otherwise.

Where there is reasonable doubt concerning the identity of the individual submitting a request in connection with any of their rights, KD Rock Arena may request the provision of additional information necessary to confirm the identity of the individual to whom the personal data relate.

If the requests of the individual to whom the personal data relate are manifestly unfounded or excessive, in particular because of their repetitive character, KD Rock Arena may:

• charge a reasonable fee, taking into account the administrative costs of providing the information or communication or taking the action requested, or
• refuse to act on the request.

KD Rock Arena provides individuals with the following rights in connection with the processing of personal data:
a) the right of access to data,
b) the right to rectification,
c) the right to erasure (“right to be forgotten”),
d) the right to restriction of processing,
e) the right to data portability,
f) the right to object.

a) the right of access to data
The individual to whom the personal data relate has the right to obtain from KD Rock Arena confirmation as to whether personal data concerning them are being processed and, where that is the case, access to the personal data and additional information in connection with the processing of personal data, including:

• the purposes of the processing;
• the types of personal data;
• the recipients or categories of recipients to whom the personal data have been or will be disclosed; – where possible, the envisaged period for which the personal data will be retained or, if that is not possible, the criteria used to determine that period;
• the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the individual to whom the personal data relate, or the existence of the right to object to such processing;
• the right to lodge a complaint with a supervisory authority;
• where the personal data are not collected from the individual, any available information as to their source;
• the existence of automated decision-making, including profiling, and meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the Individual.

At the request of the individual, KD Rock Arena shall provide a copy of their personal data that are being processed. For any additional copies of data requested by the individual to whom the personal data relate, KD Rock Arena may charge a reasonable fee taking into account administrative costs.

b) the right to rectification

The individual to whom the personal data relate has the right to obtain from KD Rock Arena, without undue delay, the rectification of inaccurate personal data concerning them. Taking into account the purposes of the processing, the individual to whom the personal data relate has the right to have incomplete personal data completed, including by means of providing a supplementary statement.

c) the right to erasure (“right to be forgotten”)

The individual to whom the personal data relate has the right to obtain from KD Rock Arena the erasure of personal data concerning them without undue delay, and KD Rock Arena has the obligation to erase personal data without undue delay:

• where the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
• where the individual withdraws the consent on which the processing of data is based, and there is no other legal basis for the processing;
• where the individual objects to processing based on the legitimate interest of KD Rock Arena, and there are no overriding legitimate grounds for the processing;
• where the individual objects to processing for direct marketing purposes;
• where the personal data must be erased for compliance with a legal obligation under EU law or the Slovenian legal order; where the data relate to the offering of information society services and were improperly collected from a child who, under applicable legislation, cannot give such data.

Where directory data or otherwise published data are concerned, KD Rock Arena shall take reasonable steps, including technical measures, to inform controllers which are processing the personal data that the individual to whom the personal data relate has requested that they erase any links to, or copies of, those personal data.

d) the right to restriction of processing

The individual to whom the personal data relate has the right to obtain from KD Rock Arena the restriction of processing where:

• the individual contests the accuracy of the data, for a period enabling the controller to verify the accuracy of the personal data;
• the processing is unlawful and the individual opposes the erasure of the personal data and requests the restriction of their use instead;
• KD Rock Arena no longer needs the personal data for the purposes of the processing, but they are required by the individual to whom the personal data relate for the establishment, exercise or defence of legal claims;
• the individual has objected to processing, pending the verification of whether the legitimate grounds of the controller override those of the individual to whom the personal data relate.

e) the right to data portability

The individual to whom the personal data relate has the right to receive the personal data concerning them, which they have provided to KD Rock Arena, in a structured, commonly used and machine-readable format, and the right to transmit those data to another controller without hindrance from KD Rock Arena to which the personal data were provided, where:

• the processing is based on the individual’s consent or on a contract and
• the processing is carried out by automated means. f) the right to object

The individual to whom the personal data relate has the right, on grounds relating to their particular situation, to object at any time to the processing of personal data where it is based on legitimate interests pursued by KD Rock Arena or by a third party. KD Rock Arena shall cease processing the personal data unless it demonstrates compelling grounds for the processing which override the interests, rights and freedoms of the individual to whom the personal data relate, or for the establishment, exercise or defence of legal claims. Where personal data are processed for direct marketing purposes, the individual has the right to object at any time to the processing of personal data concerning them for such marketing, including profiling to the extent that it is related to such direct marketing. Insofar as direct marketing is based on consent, the right to object may be exercised by withdrawing the personal consent given.

You may exercise the above rights by requesting access, completion, rectification, erasure or restriction of the processing of personal data processed in relation to you, by means of a written request sent to the address: Kulturno društvo ljubiteljev glasbe Rock Arena or by e-mail to [email protected]. In the same manner, you may also at any time, permanently or temporarily, in whole or in part, withdraw any consents to the processing of personal data that you have given, insofar as you have given them.

1. The right to lodge a complaint

At KD Rock Arena we will make every effort to ensure that your personal data are carefully processed and protected by appropriate technological and organisational means for the protection of the transmission and storage of personal and other confidential data. Notwithstanding the foregoing, we wish to draw your attention to the fact that you have the right to lodge a complaint if you believe that personal data are being stored or otherwise processed in contravention of the applicable regulations governing the protection of personal data.

An individual may send any complaint in connection with the processing of personal data to the e-mail address [email protected] or by post to the address Kulturno društvo ljubiteljev glasbe Rock Arena, Arharjeva 22, 1000 Ljubljana.

Likewise, every individual to whom the personal data relate has the right to lodge a complaint directly with the Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec RS), Dunajska cesta 22, 1000 Ljubljana, if they believe that the processing of personal data concerning them violates Slovenian or EU regulations in the field of personal data protection.

If an individual has exercised the right of access to data with KD Rock Arena. and, after receiving the decision of KD Rock Arena., believes that the personal data received are not the personal data requested, or that they have not received all of the requested personal data, they may, before lodging a complaint with the Information Commissioner of the Republic of Slovenia, lodge a reasoned complaint with KD Rock Arena within 15 days. KD Rock Arena must decide on the complaint as on a new request within five working days.

1. Ensuring accurate, complete and up-to-date data

KD Rock Arena, endeavours to ensure the accuracy and up-to-date status of individuals’ personal data, which it may do in accordance with regulations and/or on the basis of the individual’s consent. Complete and up-to-date data may be used only for the purposes laid down by the Societies Act (Zakon o društvih) and the Electronic Communications Act (Zakon o elektronskih komunikacijah) and not for other purposes, insofar as you have not given us consent for this or such use is not permitted under the regulations.

At KD Rock Arena we are aware that the privacy of the users of our services is of the utmost importance, and we therefore handle their personal data responsibly, carefully and in accordance with the regulations in force in the Republic of Slovenia and the statute of KD Rock Arena. Access to personal data is permitted only to authorised members of the society and contractual processors, to the extent and for the purpose strictly necessary for the smooth provision of the society’s services and the fulfilment of rights and obligations arising from contractual relationships concluded with the user.

1. Cookies
   Cookies are small files that store the settings of websites. Websites store cookies on the devices of users with which they access the internet, for the purpose of recognising individual devices and the settings that users used when accessing. Cookies enable websites to recognise whether a user has already visited the website and, in the case of advanced applications, individual settings can be adapted accordingly with their help. Their storage is under the complete control of the browser used by the user – the user can limit or disable the storage of cookies as desired.

Cookies are of fundamental importance for providing user-friendly online services; the most common e-commerce functions would not be possible without cookies. Interaction between the online user and the website is faster and simpler with the help of cookies. With their help, the website remembers the individual’s preferences and experiences, and browsing websites is thereby more efficient and pleasant. There are several reasons for the use of cookies. They are used to store data on the state of an individual website (details of the customisations of an individual website), they help in the provision of online services (e.g. online shops), and they help in collecting statistics on users and the number of visits to the website, on the habits of the online user, etc. With the help of cookies we can therefore assess the effectiveness of the design of our website. You can also read about the recommended and permitted use of cookies on websites in the Information Commissioner’s guidelines on the use of cookies, which you can find here.

List of cookies on our website:

List of cookies on our website:

Cookie name	Duration	Description
_cfduid	29 days	Determines the source of traffic
PHPSESSID	Duration of the session	Remembers the choice regarding the user’s permission to use cookies
wordpress_test_cookie	Duration of the session	Checks whether the browser supports cookies
_ga	2 years	Measures statistical data
_gat	1 day	Measures statistical data
_gid	1 day	Measures statistical data
ads/ga-audiences	Duration of the session	Google AdWords
GPS	1 day	Tracking of GPS location
IDE	1 year	Google DoubleClick
PREF	8 months	Checks whether the browser supports cookies
VISITOR_INFO1_LIVE	179 days	YouTube
YSC	Duration of the session	Statistics on views of videos on YouTube
yt-remote-cast-installed	Duration of the session	Yotube
yt-remote-fast-check-period	Duration of the session	Yotube
yt-remote-session-app	Duration of the session	Youtube
yt-remote-session-name	Duration of the session	Youtube

The cookies that we use on our website do not collect your personal data with which you could be personally identified and cannot damage your computer, tablet or mobile phone. Cookies enable the operation of our website and help us understand which information is most useful to visitors.

By using this website, you agree that this website sets cookies on your computer or mobile device.

If you wish to change the way cookies are used in your browser, including blocking or deleting them, you can do so by making the appropriate change to your browser settings. For the management of cookies, most browsers allow you to accept or reject all cookies, accept only a certain type of cookies, or be alerted that a site wishes to store a cookie. You can also easily delete cookies that the browser has stored. If you change or delete the browser’s cookie file, change or replace your browser or device, you may have to disable cookies again. The procedure for managing and deleting cookies differs from browser to browser. If you need help with this, you can consult your browser’s user help. You can also disable Google Analytics tracking at the following link: tools.google.com/dlpage/gaoptout

Some pages include the services of web services or social networks (e.g. Facebook buttons for liking posts). These services may set their own cookies. We have no influence over how these web services use your data. However, we recommend that you read carefully the security policies of these web services and familiarise yourself with what happens to the data that these web services collect when you use their services.
If you wish to learn more about cookies and how you can manage them in your browser, visit piskotki.net (in Slovenian), aboutcookies.org or allaboutcookies.org (in English).

1. Changes to the Privacy Policy

KD Rock Arena reserves the right to update the Privacy Policy from time to time in accordance with changes to services, on the basis of user feedback and due to changes in regulations. Upon any change, the date of the last update is also stated at the end of the Privacy Policy.
In the event of material changes or a change in the way KD Rock Arena uses personal data, it shall, before the changes are introduced, notify users on the website or, where consent to notification by e-mail has been given, also in that manner.

KD Rock Arena, recommends that users review this policy regularly, thereby ensuring that they have information on how KD Rock Arena, protects their privacy.

1. Additional information
   For additional information in connection with the processing of personal data and suggestions for improvements, you may contact us at the e-mail address [email protected] or write to us at the address: Kulturno društvo ljubiteljev glasbe Rock Arena, Arharjeva cesta 22, 1000 Ljubljana.
2. Validity and publication of the Privacy Policy
   This Privacy Policy is valid until withdrawn or until any amendment.

This Privacy Policy is published on the website, so that every individual can freely and at any time familiarise themselves with its content.