1. Data Controller

The controller of personal data is:

Company name: Erik Fras s.p.
Registered address: Ulica Stanka Volka 1, 6215 Divača, Slovenia
Registration number: 9985138000
Tax number: 43807895 (Erik Fras s.p. is not liable for VAT)E-mail: info@riverclubljubljana.com Phone: +38669360596

This Privacy Policy explains what personal data we collect, for what purposes we use it, on what legal basis, who it may be shared with, and what rights you have in relation to your personal data, in accordance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Slovenian Personal Data Protection Act (ZVOP-2).

2. What Personal Data We Collect

Depending on how you interact with us, we may collect the following categories of data:

‍a) Data provided when booking: All orders/bookings are processed through our external booking system, secure.ez-booker.com, which collects the following data for this purpose:
‍
‣ first and last name,
‣ e-mail address,
‣ phone number,
‣ number of participants and any special information relevant to the safe conduct of the experience (e.g. age of children, health limitations, voluntarily disclosed by the guest),
‣ booking details (selected date, experience, any special requests).

‣data required to issue an invoice (name, address, and tax number for business customers where applicable),
‣ payment data (processed by the payment provider — see Section 6; the controller generally does not store card payment details).

‍b) Data collected during the experience:

‣ photographs and video recordings taken during the experience for promotional purposes (see Section 4).

‍c) Data collected via the website:

‣ data submitted through the contact form,technical data (e.g. IP address, browser type, visit data), where the website uses cookies or analytics tools (see Section 8 on cookies).

‍d) Communication:the content of e-mail, phone, or other communication with you, to the extent necessary to fulfil your request or booking.

3. Purposes and Legal Bases of Processing

Purpose of processingLegal basis (GDPR)Conclusion and performance of the contract (booking, delivery of the experience, related communication)Art. 6(1)(b) GDPR – performance of a contractIssuing invoices and fulfilling tax/accounting obligationsArt. 6(1)(c) GDPR – legal obligationEnsuring safety during the experienceArt. 6(1)(b) and 6(1)(f) GDPR – performance of a contract / legitimate interestPhotography/video recording for promotional purposes (website, social media)Art. 6(1)(a) GDPR – consent (guests may opt out before the experience)Direct marketing (e.g. informing you of new experiences or offers)Art. 6(1)(a) GDPR – consentResponding to enquiries via the contact form / e-mailArt. 6(1)(f) GDPR – legitimate interest in responding to enquiriesHandling complaints and establishing/defending legal claimsArt. 6(1)(c) and 6(1)(f) GDPRCookies and web analyticsArt. 6(1)(a) GDPR – consent (where not strictly necessary for the site to function)

4. Photographs and Video Recordings

During the experience, we may take photographs and video recordings that may be used for promotional purposes (published on the website and on social media such as Facebook/Instagram).

A guest who does not wish to be photographed, filmed, or featured in such material may inform our staff before the start of the experience. In that case, we will take reasonable steps to exclude the guest from promotional material, or remove such material upon request where technically feasible.

5. Data Retention Period

We retain personal data only for as long as necessary to fulfil the purpose for which it was collected, or as required by law:booking and communication data: up to 2 years after completion of the experience, or until the expiry of applicable statute-of-limitations periods for potential claims,accounting/tax documents (invoices): 10 years, in accordance with the Slovenian Tax Procedure Act,photographs/video material processed on the basis of consent: until consent is withdrawn,data processed on the basis of consent for direct marketing: until consent is withdrawn.

6. Recipients of Personal Data

We may share personal data with the following categories of processors or recipients, strictly to the extent necessary to provide the service:the booking system provider, secure.ez-booker.com, through which all bookings/orders are processed,payment service providers (e.g. Stripe, PayPal]),our website hosting and e-mail service providers,our accounting service provider,competent state authorities, where required by law.We do not sell your personal data to third parties.

Any transfer of data outside the EU/EEA (e.g. through the use of certain online tools) is carried out only on the basis of appropriate safeguards (e.g. EU Standard Contractual Clauses).

7. Your Rights

In relation to your personal data, you have the following rights:the right of access to the data we hold about you,the right to rectification of inaccurate data,the right to erasure ("the right to be forgotten"), where there is no legal basis for continued retention,the right to restriction of processing,the right to object to processing based on legitimate interest, including direct marketing,the right to data portability,the right to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

Requests may be submitted to info@riverclubljubljana.com. We will respond without undue delay, and no later than within one month.

If you believe that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the Information Commissioner of the Republic of Slovenia (Dunajska cesta 22, 1000 Ljubljana, www.ip-rs.si).

8. Cookies

The website may use cookies to ensure basic site functionality, to analyse visitor traffic (e.g. Google Analytics), and, where applicable, for marketing purposes. Non-essential cookies are only set after obtaining your consent, which you may withdraw at any time via the cookie settings on the website.

9. Data Security

The controller implements appropriate technical and organizational measures to protect personal data against unauthorized access, loss, misuse, or disclosure, in accordance with applicable law.

10. Changes to this Privacy Policy

The controller reserves the right to amend this Privacy Policy. Any amendment will be published on this page, together with the date of the last update.

11. Contact

For any questions regarding the processing of personal data, you may contact us at: Erik Fras s.p. Ulica Stanka Volka 1, 6215 Divača, Slovenia.

Last updated: 12 October 2026