Privacy policy and cookies

1. Controller

Totus proizvodno in trgovsko podjetje, d.o.o. (hereinafter Totus), registered office Tacenska cesta 25, 1210 Ljubljana-Šentvid. For questions about personal data protection, write to info@totus.si or call +386 41 388 100.

2. Which data we process

• Identification and contact data: first and last name, company, email address, telephone, delivery address.
• Enquiry data: the machine or product you are interested in, the selected equipment and the message you send us.
• Order data: in the online shop: order contents, price, delivery method, payment status. Card payments are processed by the payment service provider Stripe; Totus never sees or stores card details.
• Email usage data: (newsletter recipients only): delivery, opens and clicks in messages.
• Technical data: IP address, browser and device type, pages viewed and the referring page — to the extent permitted by your cookie settings. The exception is the record of a view of our campaign pages (addresses containing /c/): the server writes it on every view, regardless of your cookie settings, and it contains the time, a shortened IP address (without its last part), the browser type, the referring page without the query string and the campaign; if you came from our newsletter, we link the view to your contact and record it as interest in the campaign. The basis is our legitimate interest (Article 6(1)(f) GDPR): to know how many people view a campaign and whether the newsletter brought them. From the addresses of pages viewed and of pages from which you send an enquiry or express interest we always remove ad click identifiers (gclid, gbraid, wbraid, fbclid …) and advertising UTM tags (only our own tags for links within the site remain, e.g. from the machine selector to the configurator), and of the referring page we keep only the address without the query string.
• Visit source data: where you came from to our site: the domain of the referring page, UTM tags (source, medium, campaign, content, term), ad click identifiers (gclid, gbraid, wbraid, fbclid) and the Meta cookies _fbc and _fbp, the landing page and the time of the first and last visit. When you submit an enquiry or an order, we also record which advertising categories you allowed. We collect this source data only with your consent to advertising cookies (see section 7) and store it with the enquiry or order you submit. Without consent we do not keep it in our records, with two exceptions: we also record the referring page (the address only, without the query string) as technical data, and with an enquiry you submit through a form (including the chat, a price-view or callback request and a visit booking) we also record the UTM tags of the address the page was loaded with (source, medium, campaign, content, term), the landing page, the domain of the referring page and the time the page was loaded. The basis is our legitimate interest (Article 6(1)(f) GDPR): to know which of our advertising campaigns brought the enquiry. We do not store these tags in your browser, we do not record ad click identifiers (gclid, gbraid, wbraid, fbclid) without consent, and if you have refused advertising cookies or your browser sends a Global Privacy Control or Do Not Track signal, this exception does not apply. Ad click identifiers and advertising UTM tags in page addresses are also removed from technical records. The UTM tags of the second exception are kept only in the visit-source record of the enquiry, never in stored page addresses.

3. Purposes and legal bases

• Responding to an enquiry and preparing a quote — taking steps prior to entering into a contract (Article 6(1)(b) GDPR).
• Fulfilling an order, delivery, service and warranty — performance of a contract (Article 6(1)(b)) and legal obligations, e.g. accounting regulations (Article 6(1)(c)).
• Sending newsletters about machines, promotions, events and tips — only on the basis of your explicit consent (Article 6(1)(a) GDPR and Article 158 of ZEKom-2). Consent is voluntary, is not a condition for preparing a quote or making a purchase, and you may withdraw it at any time via the unsubscribe link in every message or at info@totus.si. When you consent, we record the time, IP address and the version of the consent text.
• Tailored communication with existing customers about related products and services — legitimate interest (Article 6(1)(f)); you may object at any time.
• Visit analytics — only with your consent to cookies (see section 7).
• Advertising measurement (Google Ads, Meta) — we measure which ad on Google or on Facebook and Instagram (Meta) brought a visitor to our site, and we link an enquiry or order to the ad that brought the customer (visit source data, section 2). Only on the basis of your consent (Article 6(1)(a) GDPR) to the conversion measurement category (see section 7). The exception is the campaign tags with an enquiry submitted through a form (section 2), which we record without consent on the basis of our legitimate interest (Article 6(1)(f) GDPR).
• Reporting enquiries, purchases and won deals to Google and Meta — we tell the two advertising systems that a form was submitted, a purchase was made or a deal was concluded (time, value, click or cookie identifier and an internal sale reference), so they can measure and improve the performance of ads. We report a won deal only if no more than 90 days have passed since the enquiry or order was submitted. We send Google, for won deals, only the click identifier, time and value, and no email address, telephone number or name (what the Google Ads tag reads when a form is submitted is described in section 7). Through our server (Conversions API) we send Meta the email address, telephone number, name and country only in hashed form (SHA-256), and, when a form or order is submitted, also the IP address and browser information, which Meta requires unhashed. We do this only on the basis of your consent (Article 6(1)(a) GDPR) to both the conversion measurement and the user data categories, given when you submitted the enquiry or order.
• Site security and abuse prevention — legitimate interest (Article 6(1)(f)).

4. How long we keep data

• Enquiries and quotes: until the matter is closed and for a maximum of 5 years after the last contact, unless a contract is concluded.
• Order and invoice data: 10 years (tax and accounting legislation).
• Newsletter consent: until withdrawn; proof of consent for a further 5 years after withdrawal.
• Technical and analytics data: according to the settings of each tool, for a maximum of 26 months.
• Visit source data: the totus_attr cookie stays in your browser for a maximum of 90 days (we delete it as soon as you withdraw consent to advertising cookies). Ad click identifiers (gclid, gbraid, wbraid, fbclid, _fbc, _fbp) are deleted from the enquiry or order record 90 days after submission. The remaining source data (channel, campaign, UTM tags, landing page, time, allowed categories) stays with the record it relates to and is deleted when the case is anonymised (automatically 30 days after it is moved to the bin, or immediately on your request). The campaign tags from section 2 that we record without consent with an enquiry submitted through a form (UTM tags, landing page, domain of the referring page and the time the page was loaded) stay with the record until the case is anonymised, like the other UTM tags.
• Log of reports to the advertising systems: contains only the case or quote number, amount, channel, campaign, time and delivery status, without names, email addresses or telephone numbers; it has no automatic deletion.

Once the retention periods expire, we delete or anonymise the data.

5. Who we share data with

We do not sell your data. We use carefully selected processors who process data on our instructions and under data processing agreements: hosting and database (Vercel, Neon — servers in the EU), email delivery (Resend — EU), online shop payments (Stripe), parcel delivery (GLS), and where necessary the leasing company for financing and the machine manufacturer for warranty matters. Where a processor is outside the EU, the transfer is based on standard contractual clauses or an applicable adequacy decision.

If you allow advertising cookies, your data is also processed by Google Ireland Limited (Google Ads, Google tag) and Meta Platforms Ireland Limited (Meta Pixel, Meta Conversions API; Facebook and Instagram). They process data for their own purposes (e.g. serving and measuring ads and the security of their services) as independent controllers under their own privacy policies; the hashed contact data (email address, telephone, name) that they use to link events to accounts, however, they process as our processors under their own terms (Google Ads Data Processing Terms, Meta Business Tools Terms). For the collection of data by the Meta Pixel on our site and its transmission to Meta we are jointly responsible with Meta Platforms Ireland Limited (judgment of the Court of Justice of the EU in Case C-40/17, Fashion ID); Meta is responsible for further processing at Meta. The companies may process data in the United States; transfers are based on the EU-US Data Privacy Framework or standard contractual clauses.

6. Your rights

At any time you may request access to your data, rectification, erasure, restriction of processing or data portability, object to processing based on legitimate interest, and withdraw consent (without affecting the lawfulness of processing before withdrawal). Send your request to info@totus.si; we respond within one month at the latest. You may lodge a complaint with the Information Commissioner of the Republic of Slovenia (Dunajska cesta 22, 1000 Ljubljana, www.ip-rs.si).

7. Cookies and similar technologies

On your first visit we ask for your consent via a banner. Your choice is stored in your browser for 12 months (we ask again if the wording changes materially); you can change it at any time using the Cookie settings button. Categories:

• Essential — site operation, session, security, basket contents, remembered language choice. These do not require consent.
• Analytics — which sections are read and for how long; helps us improve the site. Only with consent.
• Advertising (Google Ads and Meta) — conversion measurement and linking an enquiry or order to an ad (the Google Ads and Meta Pixel tags and the Meta Conversions API). Only with consent, per individual category (Google Consent Mode v2): conversion measurement (the Google Ads and Meta Pixel tags and our visit-source cookie), user data (hashed customer data: the email address read by the Google Ads tag and the data we send to Meta through our server) and personalization (Google personalized advertising). The exception is the campaign tags recorded with an enquiry submitted through a form (section 2), which we record without consent and without a cookie.

With your consent to the conversion measurement category we set or load the following cookies:

• totus_attr — our cookie: remembers where you came from (referrer, UTM tags, ad click identifier, landing page) so that we can link an enquiry or order to an ad. It expires after 90 days; we delete it if you withdraw consent.
• _fbp, _fbc — Meta Platforms Ireland Limited (Meta Pixel): _fbp identifies your browser, _fbc stores the Meta ad click identifier (fbclid); Meta uses them to measure and serve ads. They expire after 90 days.
• _gcl_au, _gcl_aw, _gcl_gb — Google Ireland Limited (Google Ads): to measure conversions and attribute a conversion to a click on a Google ad. They expire after 90 days.

With your consent to the analytics category, on the pages of our campaigns (addresses containing /c/) we write a random visit identifier, _totus_sid, to the local storage of your browser and send our server events: a page view, scrolling (50, 75 and 100 %), a visit longer than 60 seconds, a click on a button, a telephone number or WhatsApp, and which form you saw, which field you selected, whether you filled it in and whether you submitted the form (we do not send the contents of fields). We link the events to your contact if you opened the page from a link in our newsletter, and to your enquiry when you submit a form. Together with each event we record a shortened IP address (without its last part), the country, and the browser and device type. Before storing, we remove ad click identifiers and advertising UTM tags from the page address and the referring page. The _totus_sid identifier has no expiry date: we delete it as soon as you withdraw consent to analytics, and on your first visit to the site after the consent no longer applies (after 12 months or when the wording changes materially); until then it stays in your browser. Without consent to analytics we neither write the identifier nor send events.

The Totus Agent page keeps two functional entries in this browser tab (sessionStorage, no cookie): ta.route.v1 (your choice for each phase of the process in the section "For every way of working") and ta.motion.v1 (the "Pause motion" setting). The entries contain only labels from closed lists, no free text; they are needed for the page to work, do not require consent, are deleted when the tab is closed and never leave the browser. Your choice for the phases is copied into the "I am interested" form, where it is shown as a label under the button; the answers to the short optional questions in the form are not stored in the browser. We receive the choice and the answers only when you submit the form. With your consent to the analytics category, the Google tag (gtag) receives on this page only the label of a command you try in the 3D kitchen (a command from a closed list, or the label "unknown" if the page does not know the command), never any text you type.

The shop checkout keeps a draft of the order form (name, e-mail, phone, company, VAT ID, address, town, note, delivery method and payment method) in this browser tab (sessionStorage, no cookie), so that you do not have to enter it again after an interrupted payment or a page refresh. The entry is needed for the checkout to work, does not require consent and never leaves the browser; it is deleted when the order is completed (paid by card or placed as a pro-forma invoice) and, at the latest, when the tab is closed. The newsletter tick box is not stored.

When the Google and Meta tags load, they also receive your IP address and browser information, and under their own rules they may set their own cookies (e.g. on the domains google.com, doubleclick.net and facebook.com). The Google Ads and Meta Pixel tags load only after your consent to conversion measurement; without it these two tags receive nothing through our site. Cookies that Google and Meta have already set are not deleted by our banner when you withdraw consent; you can delete them in your browser settings.

The Meta Pixel is set up in the Meta account with automatic advanced matching: on an event it may read the data you enter into a form on the page (e.g. email address, telephone, first name, last name, address) and send it to Meta in hashed form (SHA-256) so that Meta can link the event to your account. This applies once you have allowed conversion measurement.

The Google Ads tag is set up with automatic email detection (enhanced conversions): when a form is submitted or a purchase is made on the page, it may read the email address you enter and send it to Google in hashed form (SHA-256) so that Google can link the conversion to an ad; it does not read telephone numbers or addresses. This applies once you have allowed both conversion measurement and user data; without user data Google receives no data from the form.

You can withdraw consent at any time with the same button; withdrawal applies to further collection. We delete the visit source data already stored with your enquiry or order and stop reporting your enquiry or deal to Google and Meta if you tell us so at info@totus.si.

Video content is hosted by Mux and YouTube, which may set their own cookies under their own rules when a video is played.

8. Security

We protect data with technical and organisational measures: encrypted transmission (HTTPS), restricted access, encrypted key storage, backups, access logging and incident procedures.

9. Changes

We update this policy as needed; the current, dated version is always published on this page.