1. Who is the controller
ARHAR INŽENIRING Logatec, d.o.o.
Vodovodna cesta 7
1370 Logatec, Slovenia
- Registration number
- 1245031000
- VAT identification number
- SI71118462
- EORI number
- SI71118462
- Register court
- District Court in Ljubljana
- info@arhar.eu
- Telephone
- +386 31 469 109
The company’s tax number is 71118462; the entry with the SI prefix denotes the VAT identification number and for this company is the same as the EORI number. It is not an additional tax number.
For personal data protection and individuals’ requests, the contact is the company’s responsible person at info@arhar.eu or at the postal address above.
2. What data we process, why and for how long
We comply with the General Data Protection Regulation (GDPR), the ZVOP-2 and, for electronic messages and tracking technologies, the ZEKom-2. The legal basis is determined according to the purpose; general consent to all processing is not a condition for contacting us.
After the relevant period has expired, the data are deleted or irreversibly anonymised, except where further limited retention is required by law or by a specific legal procedure. Limited retention for evidentiary purposes does not allow further sending of advertisements. You can ask us about the deadline or criteria for your specific case at the contact above.
3. Sending an enquiry
In the contact form you select an area and enter your name, surname, email address and message. Company is optional. We use the data to process the enquiry and reply.
After clicking "Send enquiry" and successful security verification, the server sends the message to info@arhar.eu and a copy to the entered email address. Attachments are sent directly by email. The form does not sign you up for newsletters. If submission fails, the text remains in the open form so you can correct it or use it for direct email.
The form content is not stored in an additional enquiry database of this plugin. To prevent duplicate submissions, a hash, reference and sending status are stored. For messages received by ARHAR, the purposes and retention criteria from this notice apply. Depending on its settings, the browser may keep the entered fields.
Contact form protection — Cloudflare Turnstile
The contact form uses Cloudflare Turnstile in Managed mode to prevent automated spam submissions. When the protected form loads, the browser connects to Cloudflare. Technical data is checked, including IP address, browser and connection data, and the form domain. Our server verifies the response before sending the message.
We do not send Cloudflare the content of the enquiry, name, company or entered email address. Server-side verification forwards only the security token and service key. The protection is not an analytics or advertising tool. In this setup, the pre-clearance option is not enabled.
To prevent abuse, we also use rate limits and technical submission logs. These contain hashed markers, counters and sending status; they do not contain the enquiry text. Rate-limit windows last up to one day, and logs for preventing duplicate submissions are usually cleared after two days. Different criteria from the privacy notice apply to the retention of sent email.
The provider is Cloudflare, Inc., USA. ARHAR processes technical data on the basis of its legitimate interest in securing the form and preventing abuse (Article 6(1)(f) GDPR). You may also contact us directly by email or telephone. This legal basis is separate from the rules on device access: the exception under Article 225 of ZEKom-2 applies only to an essential security function, not to analytics or advertising.
Cloudflare acts as a processor when providing protection for ARHAR, and as an independent controller when improving bot detection under its own notice. Data may be processed outside the EEA, including in the USA. Cloudflare identifies the EU–US Data Privacy Framework for US transfers, and standard contractual clauses with additional measures where necessary for other relevant transfers or as a fallback. You may request information about, or a copy of, the relevant safeguards from us.
Cloudflare retention is separate from the ARHAR periods stated above: the provider limits it according to necessity for the stated purposes, legal obligations and dispute resolution. Its notice does not specify one uniform number of days for all Turnstile data. Its Turnstile addendum and privacy policy explain roles, transfers, retention and rights.
4. Newsletters and campaign tracking
We send newsletters via the service EmailOctopus, provided by Three Hearts Digital Ltd, 86–90 Paul Street, London, EC2A 4NE, United Kingdom. On our behalf, the service processes recipient list data, sending and reports.
You can unsubscribe via the link in each message or by request to info@arhar.eu. The withdrawal does not affect the lawfulness of processing carried out before the withdrawal. An enquiry, purchase or agreement with the general terms does not in itself mean unlimited permission for newsletters.
Measurement of opens and clicks: For sent campaigns with measurement enabled, EmailOctopus records opens via a tiny tracking image and clicks via redirected links. Events are linked to the recipient and the time of the event; when links are opened, the provider may also process the IP address and device data. The purpose is to assess response to the newsletter content. Automatic image loading and link safety checks can affect the accuracy of these measurements.
Individual tracking is not necessary for receiving newsletters and requires proper prior consent, separate from the subscription to updates itself. This notice alone is not consent. If you do not want such measurement or want information about your recorded events, write to info@arhar.eu. Privacy settings on this website do not change emails already sent.
Details about the service operation: privacy at EmailOctopus and campaign tracking explanation.
5. Who has access to the data
Within the company, enquiries and customer data are handled only by the responsible person of the company. Other employees or the representative office outside the EU do not have access to the enquiry database.
Technical processing by hosting, email and EmailOctopus providers must be distinguished from internal access. In the course of providing their services, they may process data for ARHAR. Where they act as processors under contract, processing is governed by Article 28 GDPR, limited to the agreed purpose and protected by confidentiality.
To fulfil your specific order or requested service, necessary data may be passed to the supplier, carrier or service technician; to fulfil legal obligations, to the competent authorities. Such transfer does not mean access to the full customer database. We do not sell data.
6. Processing outside the European Economic Area
EmailOctopus states that the application and data are hosted and sent for its core service in the EU; the technical infrastructure includes Amazon Web Services. The contractual provider is based in the United Kingdom, for which the European Commission adequacy decision applies, renewed in December 2025. The server location alone does not exclude access from another country.
In the case of an international transfer, depending on the recipient, a valid adequacy decision or appropriate safeguards are used, for example the European Commission’s standard contractual clauses and any necessary supplementary measures. For information about the recipient, the country and the applicable safeguards in the processing of your data, or for a copy of them, please write to info@arhar.eu. The rights and data of other persons, as well as business secrets, are appropriately protected when disclosed.
7. Cookies, animations and external links
Microsoft Clarity is loaded only with your permission for analytics. We do not include advertising trackers, Google reCAPTCHA checks or automatically loaded external players. Photos, previews, short dessert videos, animations, icons and catalogues in the collection are hosted on our website. Animations run in the browser and do not themselves establish connections to external service providers. Short dessert videos created with the help of Higgsfield are stored by us; viewing them does not establish a connection to Higgsfield. Videos begin loading when they enter the visible part of the page, and you can stop them. We respect the reduced motion and data saving setting when the browser reports it.
The server infrastructure uses a necessary cookie for technical connection checks and security. Details are given in the cookie notice. Closing the privacy notice does not consent to tracking.
By clicking a link to the manufacturer, an external catalogue, a map or another external website, you leave our presentation. The terms of the destination site apply there. The link itself does not mean you are signing up for its services.
7a. Manufacturer videos on YouTube
Video previews are stored on our site. Clicking "Play video" first opens an explanation and the options "I allow this video" and "I do not allow". Only choosing "I allow this video" loads YouTube and establishes a connection to Google. The same applies to text links marked for playback on the page. Refusing does not limit browsing of the content.
The player uses the youtube-nocookie.com domain and an enhanced privacy mode. When played, it connects to Google or YouTube services; the provider receives the IP address and technical data needed for the connection and playback. This mode does not mean that the external service processes no data at all. More: About embedded YouTube player and Google Privacy Policy.
When you close the video, we remove the player from the page. Permission applies only to this viewing. We do not store it in cookies or browser storage and do not use it for the next clip. For every new viewing, we ask again. You can revoke permission with the button "Revoke permission and close video", with the cross, or the Escape key; in the privacy settings there is also the option "Revoke permission for videos". Closing does not delete data already received or stored by the provider; data from external websites is managed in your browser settings. Descriptions, photos, technical data and catalogues are available even without playback.
The "Open on YouTube" link opens an external page where the provider's terms and settings apply.
7b. Microsoft Clarity analytics – with your permission
To improve navigation, we use Microsoft Clarity, which loads only after you choose "Allow analytics". It records visited pages, time, clicks, scrolling and technical browser/device data, and uses them to create heatmaps and session replays. Microsoft also receives the IP address when connecting. Identifiers are pseudonymous; this is not a visitor directory, and we do not link the data with enquiries.
The legal basis is your prior consent under Article 6(1)(a) GDPR and Article 225 of ZEKom-2. Without it, we do not load the Clarity script, not even in cookieless measurement mode. Consent for video, newsletters or submitting a question does not apply to analytics. You can change your choice via "Privacy settings" in the footer.
We do not record contact pages, logged-in administrators or addresses with additional parameters. We also mask forms and the entire chat from capture. Clarity does not receive names or email addresses as our visitor identifiers. We send advertising consent as rejected; we do not include links to Microsoft Ads, Google Ads, Google Analytics, Meta Pixel or LinkedIn Insight Tag.
The provider for users in the EU is Microsoft Ireland Operations Limited; Microsoft also acts as a data controller for Clarity under its own terms. Data may be processed in Microsoft Azure infrastructure and outside the EEA, including in the US; Microsoft explains transfers between affiliated companies with standard contractual clauses. ARHAR reports are reviewed by the company's responsible person. Microsoft has access under its own terms.
Session recordings are usually retained for 30 days, click map data for 9 months; flagged or favourite sessions may remain for up to 9 months. Revocation stops future measurement but does not delete data already sent. To exercise your rights, write to info@arhar.eu; due to pseudonymous identifiers, we may not be able to link an individual record to your identity.
Microsoft Privacy Statement ↗ · Microsoft Clarity — data retention ↗
8. Help choosing a machine
The "Help me choose" guide compares your selections with pre-prepared recommendations for the type of ice cream, workload and machine operating mode. It works locally in the browser, without an account and without sending answers to the AI provider.
You can transfer selected answers to the contact tool of your choice. For this transfer, the summary is written into the part of the link after the # sign. This part is not sent to the server when the page loads, but it may remain in your browser history or in the link you copy and share. Before sending an enquiry, you can amend or delete the text in the contact form.
The website does not store answers in local storage or tab storage. The guide state is preserved while the page is open; you can clear link history in your browser settings. The guide does not request contact details.
The guide is intended to help you navigate the offer. It does not conclude contracts, does not set binding prices, and does not decide on the buyer’s rights. Specific questions about price, configuration, compatibility or service are handled by the responsible person at ARHAR. In this presentation we do not carry out solely automated decision-making with legal or similarly significant effects for an individual.
8a. AI guide to the ice cream offer
OpenAI — Data Processing Addendum (DPA)
ARHAR processes the question on the basis of its legitimate interest in helping users navigate the range at their own request (Article 6(1)(f) GDPR). Using AI is optional; you can also email or call ARHAR. This does not constitute automated decision-making with legal or similarly significant effects. The right to object and other rights are explained in the section on your rights.
The provider of OpenAI API services to EEA customers is OpenAI Ireland Ltd. When processing questions for ARHAR, it acts as a processor under the Data Processing Addendum (DPA). Data may be processed outside the EEA, including in the USA; the DPA provides for standard contractual clauses and other valid safeguards for relevant transfers. You may request information about, or a copy of, the relevant safeguards at info@arhar.eu.
We send requests with store:false, which disables storage of the response for later retrieval. This does not guarantee that the provider keeps no records. Under OpenAI's published API policy, API data is not used for model training by default unless sharing is explicitly enabled. Abuse monitoring logs may contain questions and responses and are retained for up to 30 days by default, or longer when required by law or reasonably necessary to prevent harm. Deleting the local conversation does not delete those logs.
The AI guide is separate from the simple machine selector. It helps you explore the ice cream and pastry programme and shows links to the pages used. Answers are automated and may be incorrect. ARHAR confirms prices, availability, the final configuration and whether the equipment is suitable for your case.
When you send a question, our server sends your question to OpenAI, up to six latest messages in the conversation, the label of the current ice cream page and selected data from our offer. Simply opening the window does not send the question to the provider. Do not enter personal data, contact details or confidential business information.
The conversation is temporarily saved in your tab under the label arhar_ice_helper_v1, for up to two hours from the last use. When you choose the contact link, the question is temporarily transferred under the label arhar_ice_inquiry_handoff_v1, for up to ten minutes; on retrieval, the record is removed. We do not mix this conversation with the one about industrial equipment.
The “New conversation” option starts again from the beginning; in privacy settings you can use “Delete AI conversation” to delete both records in this tab. Deleting in the browser does not erase data already received by the provider. ARHAR does not store conversation text in the collection used to run the guide; the server keeps technical counters to limit abuse and usage. We send requests with response retention disabled for later retrieval via the API; this does not exclude all processing or any security logs kept by the provider. OpenAI: data when using the API.
Submitting a question to the AI does not send an enquiry to the company and does not sign you up for newsletters. For a business reply, use the contact tool or email ARHAR directly.
9. Your rights
Under the GDPR, you may request access to your data and a copy of it, rectification, erasure or restriction of processing. The right to data portability applies to data you have provided, where processing is automated and based on consent or a contract.
You may object to processing based on legitimate interest on grounds relating to your particular situation. You may object to direct marketing, including related profiling, at any time; for that purpose, we must then no longer process the data. You may withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
Send the request to info@arhar.eu or by post to the company’s address. We respond without undue delay, and no later than within one month. If, due to complexity or the number of requests, an extension of up to two additional months is necessary, we will inform you of the reason within the first month. Where there are justified doubts, we may request proportionate additional data to verify identity.
Exercising rights is generally free of charge. Restrictions apply in cases laid down by the GDPR, for example where we must retain certain data due to a legal obligation. We will inform you of the reason for any refusal and of the available legal remedies.
You may lodge a complaint with Information Commissioner of the Republic of Slovenia, Dunajska cesta 22, 1000 Ljubljana; email gp.ip@ip-rs.si; website www.ip-rs.si. This does not exclude judicial protection or a complaint to another competent supervisory authority under the GDPR.
10. Protection and updates of the notice
Access is restricted according to tasks and need to know. Protection takes into account the type of data, the purpose of processing and the risks. We update the notice when the actual purposes, providers or operation of the website change. A change to the notice does not replace consent where consent is required.