Privacy Policy

DERP respects your privacy, and we process your personal data only when necessary to provide our services, comply with legal obligations, or based on your consent.

1. Who processes your data?

The following entity is responsible for the processing of personal data:

Contact information for the Data Protection Officer: brezavta@derp.si.

Within the IJPP system, DERP processes personal data on behalf of DUJPP.

2. What data do we collect and why?

Depending on the service, we may primarily process:

• personal identification number (EMŠO) - only for verification, never stored,
• contact information,
• information about the user’s status, e.g., high school student, college student, or retiree,
• data necessary for issuing and using tickets,
• data regarding purchases, trips, and payments,
• data you provide to us in connection with complaints, questions, or other requests.

We use this data primarily for:

• payment for transportation,
• issuing and managing tickets,
• providing user support and resolving complaints,
• complying with legal obligations,
• preventing fraud and enforcing legal claims,
• improving our services (only anonymized data).

We do not store payment card information, as payment is processed directly through the payment service provider.

3. To whom may we disclose your data?

When necessary, we may disclose your data to:

• providers of payment, information, and other support services,
• contractual partners who perform specific services on our behalf,
• competent government authorities or courts, when required by law.

Partners may use the data only for the agreed-upon purposes.

If data is transferred outside the EU or the European Economic Area, we ensure an appropriate legal basis and protective measures are in place.

4. How long do we retain data?

We retain data only for as long as we need it for the purpose for which it was collected, or for as long as required by law.

For example:

• We may retain data related to payments and contractual obligations until the statute of limitations expires,
• we retain invoices in accordance with tax laws,
• we retain data for marketing purposes until consent is revoked.

The data is adequately protected through technical and organizational measures and is accessible only to authorized persons.

5. Your Rights

With regard to your personal data, you have the right to request:

• access to your data,
• correction of incorrect or incomplete data,
• erasure of data when the conditions for this are met,
• restriction of processing,
• portability of your data,
• objection to processing.

You may withdraw your consent to the processing of personal data at any time.

You can send your request to brezavta@derp.si.

We generally respond to requests within one month.

6. Personal Data Security

In the event of a personal data breach, we will take action in accordance with the law. If the breach could pose a high risk to your rights and freedoms, we will also notify you of this.

7. Complaints

If you believe that we are not handling your personal data properly, you may contact: brezavta@derp.si.

You also have the right to file a complaint with the Information Commissioner of the Republic of Slovenia.

8. Other Websites

Our website may contain links to other websites. We are not responsible for their content or how they process personal data.

9. Changes to the Privacy Policy

We may update this Privacy Policy from time to time. The current version is always posted on this website.