Privacy policy. Your data, clearly explained.

At Academia we respect your privacy. This policy explains in plain language which personal data we collect when you use the academia.si website, our forms, portals and services, why we need them, who we share them with, how long we keep them and what rights you have.

We process personal data in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679 – GDPR), the Personal Data Protection Act (ZVOP-2), the Electronic Communications Act (ZEKom-2) and sector legislation on short-cycle higher education (ZVSI). The policy is supplemented by the Terms and conditions and Cookie Policy.

The processing of students' data during their studies (records, grades, attendance, the Orbita platform) is also governed by the school's internal acts and the statutory records under the ZVSI, in addition to this policy.

The controller of your personal data is ACADEMIA, izobraževanje in druge storitve d.o.o. (Academia Institute of Technology), Glavni trg 17b, 2000 Maribor, Slovenia; registration number 1195280000, VAT ID SI52188353; entered in the court register on 9 February 1998; legal representative: Žan Dapčevič, Director.

Registered office: Glavni trg 17b, 2000 Maribor. Ljubljana unit: Leskoškova 12, 1000 Ljubljana. Phone: 02 228 35 35. E-mail: info@academia.si.

The data protection officer (DPO) can be reached at info@academia.si (subject: "data protection"). You can contact them with any questions about the processing of your data and the exercise of your rights.

We obtain data directly from you (forms, e-mail, phone, in person), automatically when you use the website (server logs, cookies – only with consent) and exceptionally from third parties (an employer as payer of tuition, a previous school when recognising qualifications, public registers).

We do not request special categories of personal data (health, disability); we process them only if you provide them yourself to claim special status or adjustments to your studies, on the basis of your explicit consent or the law.

• visitors to the academia.si website and subdomains;
• people who send an enquiry, request materials or register for an event or the newsletter;
• prospective students, students and graduates (alumni);
• payers of tuition (parents, employers) and company contact persons (placements, scholarships, recruitment, projects);
• lecturers, instructors, company mentors and candidates for these roles;
• participants in events, micro-credentials, Erasmus+ mobilities and projects;
• followers and users of our social media profiles.

We process each item of data only for a specific purpose and on one of the legal bases laid down by the GDPR: contract or steps prior to entering into one, law, legitimate interest of the school (which does not override your interests) or your consent, which you can withdraw at any time. Overview:

You withdraw consent via the unsubscribe link in every e-mail, by changing your cookie settings or by writing to info@academia.si. Withdrawal does not affect the lawfulness of processing before the withdrawal.

We do not make automated decisions based on your data that would have legal or similarly significant effects, and we do not profile you other than segmenting the newsletter by chosen programme.

We do not sell your data. We disclose them only to:

• contracted processorsthat provide services for us (hosting, CRM, e-mail, analytics, accounting) and process data exclusively on our instructions under a data processing agreement (GDPR Art. 28);
• state authorities and public institutionswhere required by law (the ministry responsible for short-cycle higher education, CEUVIZ/eVŠ, inspectorates, courts, the Financial Administration);
• project partners (Erasmus+, DUALIS, Map the System) to the extent required by your participation in the project, and employers in placements, scholarships and recruitment – only with your knowledge or consent;
• Pearson.

Main processors

As a rule we process data in Slovenia and the European Economic Area (EEA). Some processors (Google, Meta, LinkedIn, Vercel, Salesforce, Resend) are based in or have part of their infrastructure in the USA. Transfers to the USA are based on the European Commission's adequacy decision for companies certified under the EU-U.S. Data Privacy Frameworkor on the European Commission's standard contractual clauses with additional safeguards.

For Erasmus+ mobilities to countries outside the EEA (e.g. the United Kingdom, partner universities), participants' data are passed to the host organisation on the basis of the mobility agreement and for the implementation of the programme; we inform you of this when you apply.

You can request a copy of the safeguards used at info@academia.si.

We keep data only for as long as necessary for the purpose for which we collected them, or as long as the law requires. The specific periods are in the table in section 5; in summary:

• enquiries, requests for information and event registrations: until you unsubscribe or request erasure;
• newsletters: until you withdraw consent (unsubscribe) or request erasure;
• enrolment and study records: within the periods laid down by the ZVSI and archiving regulations – some records (e.g. of diplomas issued) are kept permanently;
• invoices and accounting documentation: 10 years after the end of the financial year;
• lecturer candidates: until withdrawal or a request for erasure (kept for future calls for applications);
• server logs: 12 months; cookie data: at most 12 months (the duration of individual cookies is in the cookie table).

Once the period expires we delete, destroy or anonymise the data so that they can no longer be linked to you. If a dispute or proceedings between us are open, we keep them until a final decision.

We protect data with technical and organisational measures: encrypted connections (HTTPS), access control on the least-privilege principle, two-factor authentication for key systems, backups, security policies for employees and data processing agreements with external providers. Only employees who need it for their work have access to student data.

Despite our care, no transmission over the internet is completely secure. We will notify you without undue delay of any security breach likely to pose a high risk to your rights, and the Information Commissioner within 72 hours, as the GDPR requires.

With regard to your personal data you have the right:

• of access – to find out whether and which data we process and to receive a copy;
• to rectification of inaccurate or incomplete data;
• to erasure ("right to be forgotten") when the data are no longer needed, you have withdrawn consent or the processing is unlawful – unless we must keep them by law;
• to restriction of processing while we verify the accuracy of the data or your objection;
• to data portability – to receive the data you gave us in a structured, machine-readable format;
• to object to processing based on legitimate interest and, at any time, to direct marketing;
• until consent is withdrawn at any time, without affecting the lawfulness of earlier processing.

Send your request to info@academia.si (subject "Personal data") or in writing to Glavni trg 17b, 2000 Maribor. To avoid disclosing data to the wrong person, we may ask you to confirm your identity. We reply without undue delay and no later than within one month; for complex or numerous requests we may extend the period by up to two months, of which we will inform you. Exercising your rights is free of charge, except for manifestly unfounded or excessive requests.

If you believe we process your data unlawfully or you are not satisfied with our reply, please contact us first (info@academia.si); we respond to a complaint within 5 working days.

You can also lodge a complaint with the supervisory authority: Information Commissioner of the Republic of Slovenia, Dunajska cesta 22, 1000 Ljubljana, phone +386 1 230 97 30, e-mail gp.ip@ip-rs.si, www.ip-rs.si.

Matters not governed by this policy are subject to the GDPR, ZVOP-2, ZEKom-2, ZVSI and other applicable regulations.

We may amend this Policy because of changes in legislation, services or processors. We publish the new version on this page at least 15 days before it takes effect; in the event of material changes we also notify you by e-mail, if we have your e-mail address.

The policy is published at academia.si/zasebnost/ and applies from 1. 11. 2026. It replaces the previous version in full.