How we handle your enquiry, who has access to the data and how you can exercise your rights.
Updated: 15 September 2026 · withdrawal of the old website
Personal handlingEnquiries to ARHAR are handled by the company’s responsible person.
Separate choicesAn enquiry does not mean signing up for e-newsletters or giving permission to track you.
Clear contactFor questions about data, write to us at info@arhar.eu.
This notice applies to personal data processing by ARHAR and use of arhar.eu, including the industrial and ice cream programmes. Both programmes include an AI assistant and Microsoft Clarity analytics, which loads only after consent.
The old forms using Google reCAPTCHA are no longer available. Contact forms for the industrial and ice cream programmes use Cloudflare Turnstile, described in this notice. You can also send an enquiry directly by email or call us.
1. Who is the controller
ARHAR INŽENIRING Logatec, d.o.o. Vodovodna cesta 7 1370 Logatec, Slovenia
The company’s tax number is 71118462; the entry with the SI prefix denotes the VAT identification number and for this company is the same as the EORI number. It is not an additional tax number.
For personal data protection and individuals’ requests, the contact is the company’s responsible person at info@arhar.eu or at the postal address above.
2. What data we process, why and for how long
We comply with the General Data Protection Regulation (GDPR), the ZVOP-2 and, for electronic messages and tracking technologies, the ZEKom-2. The legal basis is determined according to the purpose; general consent to all processing is not a condition for contacting us.
Enquiries, quotations and business communication
Data
Name, surname, e-mail address, company details, if you provide them, the content of the question and the data you submit yourself for preparing a reply. For online enquiries, also the source page, area and selected section.
Purpose and basis
Reply, selection of the appropriate solution and preparation of an offer: Article 6(1)(b) GDPR, where you yourself are the intended contractual party. For company contact persons and general business communication: Article 6(1)(f) GDPR – legitimate interest in handling the requested enquiry and cooperating with a business partner.
Retention
Until the enquiry has been handled or the offer and any related negotiations have expired. If no order follows, further retention of the entire message is not automatically justified: only the data needed for the specific open request or for proving a business agreement are kept, until the limitation period applicable to it expires or the procedure is finally concluded.
Orders, delivery, service and mandatory records
Data
Contact and contractual data, order, delivery details, invoices and communication about contract performance, complaints or service.
Purpose and basis
Performance of a contract with an individual: Article 6(1)(b) GDPR; communication with a company representative and enforcement of legal claims: Article 6(1)(f); tax and other mandatory records: Article 6(1)(c) GDPR.
Retention
For the duration of contract performance and handling of related obligations; individual documents also until the expiry of the applicable limitation periods for claims. Invoices are retained under Article 86 of the ZDDV-1 for ten years after the end of the year to which they relate. This period does not mean that all marketing messages and all enquiries are retained for ten years.
E-newsletters and unsubscribe records
Data
E-mail address, name and selected interests, if provided, data on the basis for sending and delivery, bounces and unsubscribe. Measurement of opens and clicks is explained separately below.
Purpose and basis
Notification of an offer: consent under Article 6(1)(a) GDPR. The exception for existing customers may be used only under the conditions of Article 226 of the ZEKom-2 for the controller’s own similar products or services, with an option to object already when the address is obtained and in every message.
Retention
For sending until consent is withdrawn, an objection is made, or another applicable legal basis ceases to apply. The minimal record of the address and unsubscribe details is kept separately for as long as necessary to prevent re-import to the active list. Evidence of the lawfulness of past sending is retained only to the extent and for the period needed to handle specific claims and the applicable limitation periods for enforcing them.
Operation and security of the website
Data
Connection technical data, such as IP address, request time, requested address and browser data, which the server infrastructure needs to deliver pages and handle errors or abuse.
Purpose and basis
Secure access, error handling and abuse prevention: Article 6(1)(f) GDPR – legitimate interest in reliable operation and data protection.
Retention
The retention period is determined by the type of security log, the time needed to identify and rectify the error or abuse, and the overwrite cycle of technical logs. Records needed as evidence in a specific incident are kept for a limited period until the matter is resolved or the related procedure is concluded. Backups are intended for restoration and are replaced in the backup cycle; they are not an additional database for marketing.
After the relevant period has expired, the data are deleted or irreversibly anonymised, except where further limited retention is required by law or by a specific legal procedure. Limited retention for evidentiary purposes does not allow further sending of advertisements. You can ask us about the deadline or criteria for your specific case at the contact above.
3. Enquiry and source page
The contact form marks the required fields: first name, surname, email and question. Company name is optional. The data allow us to know who is contacting us and where to reply. You can also use email or phone to get in touch. Submitting an enquiry does not sign you up for newsletters.
The source page and selected section information helps us understand which machine, tool or material your question refers to. The source is shown next to the form. This is not a screen recording or a full browsing history. From the assistant, the question is transferred only at your choice; before using it, you can add to it or delete it.
Submitting sends the form details, displayed source page and selected section to info@arhar.eu. We send confirmation with a copy of the question to your address. To prevent duplicates and abuse, the submission identifier, delivery status and hashed data and network address are retained for up to two days. Form content is not stored in an additional form database. Email messages are retained according to the criteria in this notice.
4. Newsletters and campaign tracking
We send newsletters via the service EmailOctopus, provided by Three Hearts Digital Ltd, 86–90 Paul Street, London, EC2A 4NE, United Kingdom. On our behalf, the service processes recipient list data, sending and reports.
You can unsubscribe via the link in each message or by request to info@arhar.eu. The withdrawal does not affect the lawfulness of processing carried out before the withdrawal. An enquiry, purchase or agreement with the general terms does not in itself mean unlimited permission for newsletters.
Measurement of opens and clicks: For sent campaigns with measurement enabled, EmailOctopus records opens via a tiny tracking image and clicks via redirected links. Events are linked to the recipient and the time of the event; when links are opened, the provider may also process the IP address and device data. The purpose is to assess response to the newsletter content. Automatic image loading and link safety checks can affect the accuracy of these measurements.
Individual tracking is not necessary for receiving newsletters and requires proper prior consent, separate from the subscription to updates itself. This notice alone is not consent. If you do not want such measurement or want information about your recorded events, write to info@arhar.eu. Privacy settings on this website do not change emails already sent.
Within the company, enquiries and customer data are handled only by the responsible person of the company. Other employees or the representative office outside the EU do not have access to the enquiry database.
Technical processing by hosting, email and EmailOctopus providers must be distinguished from internal access. In the course of providing their services, they may process data for ARHAR. Where they act as processors under contract, processing is governed by Article 28 GDPR, limited to the agreed purpose and protected by confidentiality.
To fulfil your specific order or requested service, necessary data may be passed to the supplier, carrier or service technician; to fulfil legal obligations, to the competent authorities. Such transfer does not mean access to the full customer database. We do not sell data.
6. Processing outside the European Economic Area
EmailOctopus states that the application and data are hosted and sent for its core service in the EU; the technical infrastructure includes Amazon Web Services. The contractual provider is based in the United Kingdom, for which the European Commission adequacy decision applies, renewed in December 2025. The server location alone does not exclude access from another country.
In the case of an international transfer, depending on the recipient, a valid adequacy decision or appropriate safeguards are used, for example the European Commission’s standard contractual clauses and any necessary supplementary measures. For information about the recipient, the country and the applicable safeguards in the processing of your data, or for a copy of them, please write to info@arhar.eu. The rights and data of other persons, as well as business secrets, are appropriately protected when disclosed.
7. Cookies, videos and external links
To improve navigation, we use Microsoft Clarity, which loads only after you choose “Allow analytics”. It captures pages visited, timing, clicks, scrolling and browser or device information to produce heatmaps and session replays. Microsoft also receives your IP address when connecting. Identifiers are pseudonymous: this is not a visitor directory and we do not link the records to enquiries.
The legal basis is your prior consent under GDPR Article 6(1)(a) and Article 225 of the Slovenian Electronic Communications Act (ZEKom-2). Without consent, we do not load Clarity, including its cookieless measurement mode. Consent to a video, newsletter or enquiry does not cover analytics. You can change your choice under “Privacy settings” in the footer.
We do not record contact pages, signed-in administrators or URLs with query parameters. Forms and the entire chat are additionally masked before capture. We do not send names or email addresses as visitor identifiers. Advertising consent is sent as denied; Microsoft Ads, Google Ads, Google Analytics, Meta Pixel and LinkedIn Insight Tag integrations are not enabled.
The provider for EU customers is Microsoft Ireland Operations Limited. Microsoft also acts as a data controller for Clarity under its terms. Processing can take place in Microsoft Azure infrastructure and outside the EEA, including the United States; Microsoft describes standard contractual clauses for transfers between its affiliates. ARHAR reports are accessed by the company’s responsible person. Microsoft has access under its terms.
Session replays are normally retained for 30 days and heatmap data for 9 months; labelled or favourite sessions may remain for up to 9 months. Withdrawal stops future measurement but does not erase data already sent. To exercise your rights, contact info@arhar.eu. Pseudonymous identifiers may prevent us from matching a specific record to your identity.
YouTube connects only when you specifically allow the selected video to be viewed. At that point, Google Ireland Limited processes connection and viewing data; transfers outside the EEA may also occur in accordance with its policy. In the cookie notice more detailed information on the data, retention period, choices and withdrawal is provided.
When you click a link to a manufacturer, a supplier’s catalogue or a social network, you leave our website. The rules of the operator of the destination site then apply. The link itself does not mean that you are subscribing to its services.
The assistant uses generative AI. When you submit a question, our server sends OpenAI the question, up to six previous messages and the topic identifier. The contact form is not sent to AI; personal information entered in the chat becomes part of the submitted text.
ARHAR processes the question on the basis of its legitimate interest in helping users navigate the range at their own request (Article 6(1)(f) GDPR). Using AI is optional; you can also email or call ARHAR. This does not constitute automated decision-making with legal or similarly significant effects. The right to object and other rights are explained in the section on your rights.
The provider of OpenAI API services to EEA customers is OpenAI Ireland Ltd. When processing questions for ARHAR, it acts as a processor under the Data Processing Addendum (DPA). Data may be processed outside the EEA, including in the USA; the DPA provides for standard contractual clauses and other valid safeguards for relevant transfers. You may request information about, or a copy of, the relevant safeguards at info@arhar.eu.
We send requests with store:false, which disables storage of the response for later retrieval. This does not guarantee that the provider keeps no records. Under OpenAI's published API policy, API data is not used for model training by default unless sharing is explicitly enabled. Abuse monitoring logs may contain questions and responses and are retained for up to 30 days by default, or longer when required by law or reasonably necessary to prevent harm. Deleting the local conversation does not delete those logs.
To use it, you do not need a user account. In the same tab, up to the last 20 messages and the assistant state are temporarily retained, for up to two hours after the last use. The basis for the local retention of the required function is the emergency storage exception under Article 225 of ZEKom-2; the purpose is not advertising profiling.
When you select “Send enquiry”, your question and the source page are temporarily stored for transfer into the form, for up to ten minutes. The record is removed upon handover. Only the public path of the page and the selected section are written into the link; the name, email and content of the question are not written into the link address.
You can delete the conversation with the “New conversation” option or in . This deletes the assistant’s local storage, but not messages you have already sent by email yourself. Do not enter passwords, health data, other sensitive personal data or business secrets into the assistant.
The assistant is intended to help you navigate the offer. It does not conclude contracts, set binding prices or decide on customer rights. Specific questions about price, configuration, compatibility or service are handled by the responsible ARHAR person. This presentation does not perform solely automated decision-making with legal or similarly significant effects for an individual.
Contact form protection — Cloudflare Turnstile
The contact form uses Cloudflare Turnstile in Managed mode to prevent automated spam submissions. When the protected form loads, your browser connects to Cloudflare. Technical signals include the IP address, browser and connection information, and the form domain. Our server validates the response before sending the message.
We do not send your enquiry text, name, company or entered email address to Cloudflare. Server verification sends only the security token and service key. This protection is not an analytics or advertising tool. Pre-clearance is disabled in this installation.
We also use submission limits and technical records to prevent abuse. These contain hashed identifiers, counters and delivery status, not the enquiry text. Limit windows last up to one day; duplicate-submission records are normally cleaned after two days. Sent email is retained under the separate criteria in our privacy notice.
The provider is Cloudflare, Inc., USA. ARHAR processes technical data on the basis of its legitimate interest in securing the form and preventing abuse (Article 6(1)(f) GDPR). You may also contact us directly by email or telephone. This legal basis is separate from the rules on device access: the exception under Article 225 of ZEKom-2 applies only to an essential security function, not to analytics or advertising.
Cloudflare acts as a processor when providing protection for ARHAR, and as an independent controller when improving bot detection under its own notice. Data may be processed outside the EEA, including in the USA. Cloudflare identifies the EU–US Data Privacy Framework for US transfers, and standard contractual clauses with additional measures where necessary for other relevant transfers or as a fallback. You may request information about, or a copy of, the relevant safeguards from us.
Cloudflare retention is separate from the ARHAR periods stated above: the provider limits it according to necessity for the stated purposes, legal obligations and dispute resolution. Its notice does not specify one uniform number of days for all Turnstile data. Its Turnstile addendum and privacy policy explain roles, transfers, retention and rights.
Under the GDPR, you may request access to your data and a copy of it, rectification, erasure or restriction of processing. The right to data portability applies to data you have provided, where processing is automated and based on consent or a contract.
You may object to processing based on legitimate interest on grounds relating to your particular situation. You may object to direct marketing, including related profiling, at any time; for that purpose, we must then no longer process the data. You may withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.
Send the request to info@arhar.eu or by post to the company’s address. We respond without undue delay, and no later than within one month. If, due to complexity or the number of requests, an extension of up to two additional months is necessary, we will inform you of the reason within the first month. Where there are justified doubts, we may request proportionate additional data to verify identity.
Exercising rights is generally free of charge. Restrictions apply in cases laid down by the GDPR, for example where we must retain certain data due to a legal obligation. We will inform you of the reason for any refusal and of the available legal remedies.
You may lodge a complaint with Information Commissioner of the Republic of Slovenia, Dunajska cesta 22, 1000 Ljubljana; email gp.ip@ip-rs.si; website www.ip-rs.si. This does not exclude judicial protection or a complaint to another competent supervisory authority under the GDPR.
10. Protection and updates of the notice
Access is restricted according to tasks and need to know. Protection takes into account the type of data, the purpose of processing and the risks. We update the notice when the actual purposes, providers or operation of the website change. A change to the notice does not replace consent where consent is required.
