Privacy policy and cookies

1. Controller

Totus proizvodno in trgovsko podjetje, d.o.o. (hereinafter Totus), registered office Tacenska cesta 25, 1210 Ljubljana-Šentvid. For questions about personal data protection, write to info@totus.si or call 041 388 100.

2. Which data we process

• Identification and contact data: first and last name, company, email address, telephone, delivery address.
• Enquiry data: the machine or product you are interested in, the selected equipment and the message you send us.
• Order data: in the online shop: order contents, price, delivery method, payment status. Card payments are processed by the payment service provider Stripe; Totus never sees or stores card details.
• Email usage data: (newsletter recipients only): delivery, opens and clicks in messages.
• Technical data: IP address, browser and device type, pages viewed — to the extent permitted by your cookie settings.

3. Purposes and legal bases

• Responding to an enquiry and preparing a quote — taking steps prior to entering into a contract (Article 6(1)(b) GDPR).
• Fulfilling an order, delivery, service and warranty — performance of a contract (Article 6(1)(b)) and legal obligations, e.g. accounting regulations (Article 6(1)(c)).
• Sending newsletters about machines, promotions, events and tips — only on the basis of your explicit consent (Article 6(1)(a) GDPR and Article 158 of ZEKom-2). Consent is voluntary, is not a condition for preparing a quote or making a purchase, and you may withdraw it at any time via the unsubscribe link in every message or at info@totus.si. When you consent, we record the time, IP address and the version of the consent text.
• Tailored communication with existing customers about related products and services — legitimate interest (Article 6(1)(f)); you may object at any time.
• Visit analytics and advertising performance measurement — only with your consent to cookies (see section 7).
• Site security and abuse prevention — legitimate interest (Article 6(1)(f)).

4. How long we keep data

• Enquiries and quotes: until the matter is closed and for a maximum of 5 years after the last contact, unless a contract is concluded.
• Order and invoice data: 10 years (tax and accounting legislation).
• Newsletter consent: until withdrawn; proof of consent for a further 5 years after withdrawal.
• Technical and analytics data: according to the settings of each tool, for a maximum of 26 months.

Once the retention periods expire, we delete or anonymise the data.

5. Who we share data with

We do not sell your data. We use carefully selected processors who process data on our instructions and under data processing agreements: hosting and database (Vercel, Neon — servers in the EU), email delivery (Resend — EU), online shop payments (Stripe), parcel delivery (GLS), and where necessary the leasing company for financing and the machine manufacturer for warranty matters. Where a processor is outside the EU, the transfer is based on standard contractual clauses or an applicable adequacy decision.

6. Your rights

At any time you may request access to your data, rectification, erasure, restriction of processing or data portability, object to processing based on legitimate interest, and withdraw consent (without affecting the lawfulness of processing before withdrawal). Send your request to info@totus.si; we respond within one month at the latest. You may lodge a complaint with the Information Commissioner of the Republic of Slovenia (Dunajska cesta 22, 1000 Ljubljana, www.ip-rs.si).

7. Cookies and similar technologies

On your first visit we ask for your consent via a banner. Your choice is stored in your browser for 12 months; you can change it at any time using the Cookie settings button. Categories:

• Essential — site operation, session, security, basket contents, remembered language choice. These do not require consent.
• Analytics — which sections are read and for how long; helps us improve the site. Only with consent.
• Advertising (Google Ads) — conversion measurement, transmission of a hashed email address and ad personalisation. Only with consent, per individual category (Google Consent Mode v2).

Video content is hosted by Mux and YouTube, which may set their own cookies under their own rules when a video is played.

8. Security

We protect data with technical and organisational measures: encrypted transmission (HTTPS), restricted access, encrypted key storage, backups, access logging and incident procedures.

9. Changes

We update this policy as needed; the current, dated version is always published on this page.