Privacy policy

Privacy policy

1. Introduction

This privacy policy explains to customers, prospective customers and visitors to the websites of Orthexa d.o.o., Gornji Rudnik I 1, 1000 Ljubljana, Slovenia (referred to below as “Orthexa,” “we” or the “data controller”), why we process personal data and the legal bases for doing so.

We take care to handle your personal data responsibly.

We may update this privacy policy from time to time. The latest version will be published on our website. Where a change requires your consent or a separate notice, we will follow the applicable requirements.

Our processing of personal data is subject to applicable data protection law, including the EU General Data Protection Regulation (Regulation (EU) 2016/679, GDPR) and Slovenia’s Personal Data Protection Act (ZVOP-2), together with applicable electronic communications and e-commerce rules.

This policy covers information we receive when you visit or use Orthexa websites, make a purchase or communicate with us, including by telephone.

2. Data controller

The data controller is:

Orthexa d.o.o.
Gornji Rudnik I 1
1000 Ljubljana
Slovenia
Email: support@orthexa.com

For questions or requests about data protection or this policy, contact us at support@orthexa.com.

3. Personal data

Personal data is information relating to an identified or identifiable person. A person may be identifiable directly or indirectly, for example by a name, identification number, location data, online identifier or a factor specific to their physical, physiological, genetic, mental, economic, cultural or social identity.

For the purposes described in this policy, Orthexa may collect the following categories of personal data:

  • Basic customer information: (first name, last name, home address, date of birth and location, where provided or required for the relevant service);
  • Contact details and communications: (email address, telephone number, dates, times and content of postal or email correspondence, and the date, time and duration of telephone calls, including recordings where applicable);
  • Channel and campaign information: how you first came into contact with Orthexa, such as through a website, advertising campaign, call center or physical store;
  • Purchase and invoice information: (purchase date and location, items purchased, prices, order total, payment method, delivery address, invoice number and date, invoice issuer identifier and similar details), together with information about product complaints;
  • Website usage information: (visit dates and times, pages or URLs visited, time spent on pages, number of pages viewed, total time on the website and website preferences), together with information about interactions with our communications, such as email and SMS;
  • Information you provide voluntarily: for example, when entering a prize draw or using a product guide to help choose an item;
  • Other information: information you choose to provide when it is needed for a particular service.

Orthexa processes personal data where an appropriate legal basis applies, such as your consent, performing a contract, meeting a legal obligation or pursuing a legitimate interest. This may include placing an order, subscribing to a newsletter or entering a prize draw.

Further information about how long we keep data appears in the Data retention section of this policy.

4. How we use your personal data

Orthexa uses personal data to:

  • Process and fulfill orders, including taking payments, arranging delivery and providing invoices or order confirmations;
  • Communicate with you;
  • Check orders for potential fraud or other risks;
  • Send information and advertising about our products and services in line with your preferences and applicable requirements.

5. Sharing your personal data

We share personal data with service providers that help us carry out the purposes described above. For example:

We may also share personal data to meet legal obligations, respond to court orders, search warrants or other lawful requests, or protect our rights.

6. Targeted advertising

Where permitted by applicable law and your choices, we use personal data to show advertising we think may interest you. For more information about targeted advertising, visit the Network Advertising Initiative (NAI): http://www.networkadvertising.org/understanding-online-advertising/how-does-it-work

You can manage targeted advertising preferences here:

You can also opt out of some services through the Digital Advertising Alliance: http://optout.aboutads.info/

7. Data retention

Orthexa keeps personal data only for as long as needed for the purposes for which it was collected and processed, such as fulfilling orders, checking payments or providing offers, subject to applicable legal requirements.

  • Data processed to meet a legal obligation is kept for the period required by law.
  • Data processed to perform a contract is kept for as long as needed to fulfill the contract and for 5 years after it ends, unless there is a dispute between you and Orthexa about the contract. In that case, Orthexa keeps the data for a further 5 years after the final court or arbitration decision or settlement, or, where there are no court proceedings, 5 years from the settlement date.
  • Data processed on the basis of consent or legitimate interests is kept while the relevant purpose and lawful basis continue to apply. You may withdraw consent or object to processing as described below. Data may be deleted earlier when it is no longer needed or where required by law.

At the end of the retention period, Orthexa deletes or anonymizes the personal data so it can no longer be linked to an identifiable person.

8. Your data protection rights

If you have questions about our data protection policy or how we process your personal data, contact us at support@orthexa.com. We will respond in writing in line with applicable law.

To support fair and transparent processing, you have the following rights under applicable data protection law:

  • Right to withdraw consent
    If you have consented to processing for one or more specific purposes, you may withdraw that consent at any time by emailing support@orthexa.com.
    Withdrawing consent does not affect the lawfulness of processing before withdrawal. We may be unable to provide a service if it depends on processing that requires your consent.
  • Right of access
    You may ask Orthexa whether we process personal data about you and, if so, request access to that data and related information, including the purposes, categories of data, retention periods and other rights available to you.
  • Right to rectification
    You may ask us to correct inaccurate personal data without undue delay. Depending on the purpose of processing, you may also ask us to complete incomplete data.
  • Right to erasure (“right to be forgotten”)
    You may ask Orthexa to erase personal data without undue delay where a relevant ground applies, including:
    • (a) The data is no longer needed for the purposes for which it was collected.
    • (b) You withdraw consent and there is no other legal basis for processing.
    • (c) You object to processing and there are no overriding legitimate grounds to continue.
    • (d) The data has been processed unlawfully.
    • (e) Erasure is required to comply with an applicable EU or Member State legal obligation.
    • (f) The data was collected in connection with information society services offered to a child.
      Exceptions under Article 17(3) GDPR may limit this right.
  • Right to restrict processing
    You may ask us to restrict processing where:
    • (a) You dispute the accuracy of the data, while we check it.
    • (b) Processing is unlawful and you request restriction rather than erasure.
    • (c) Orthexa no longer needs the data, but you need it for legal claims.
    • (d) You object to processing, while we assess whether our legitimate grounds override your interests.
  • Right to data portability
    Where the conditions in Article 20 GDPR apply, you may receive your personal data in a structured, commonly used and machine-readable format and transfer it to another controller without hindrance.
  • Right to object
    You may object at any time to processing based on a public-interest task (Article 6(1)(e) GDPR) or legitimate interests (Article 6(1)(f) GDPR), including related profiling. Orthexa will stop that processing unless we demonstrate compelling legitimate grounds that override your interests or the processing is needed to establish, exercise or defend legal claims.
    You may object to processing for direct marketing at any time. We will then stop processing your data for that purpose.
  • Right to complain
    If you believe your data protection rights have been infringed, you may complain to a supervisory authority. In Slovenia, this is the Information Commissioner.

9. Personal data breaches

Where required by applicable law, Orthexa will notify the competent supervisory authority of a personal data breach. This is generally required unless the breach is unlikely to pose a risk to individuals’ rights and freedoms. Where a crime is suspected, we will also follow any applicable reporting obligations.

If a breach is likely to pose a high risk to individuals’ rights and freedoms, Orthexa will inform affected individuals without undue delay in clear, plain language, subject to applicable legal requirements.

10. Changes to this policy

We will publish changes to this privacy policy on our website. Where required, we will give a separate notice or obtain consent for a change in how personal data is processed.

Last updated: January 21, 2025

Wait, your secret discount is almost unlocked

This offer is reserved for a short time only. Unlock the coupon and save today.

Continue without a discount