Privacy Policy

Last updated: 9 September 2026

This Privacy Policy explains how SG Automotive d.o.o. collects and processes personal data when you visit our website, contact us or submit a business or employment-related enquiry.

1. Controller

The controller responsible for processing personal data through this website is:

SG Automotive d.o.o.
Industrijska cesta 12
3210 Slovenske Konjice
Slovenia

Telephone: +386 3 757 16 50
Email: info@sga.si

For questions concerning this Privacy Policy or the processing of your personal data, please contact us using the email address above.

2. Personal data we process

Depending on how you use the website, we may process the following categories of personal data:

• technical information transmitted when you visit the website;

• your name and contact details;

• your company or organisation;

• information you enter into an inquiry form;

• the sector or subject selected in a form;

• correspondence between you and SG Automotive;

• information included in an employment application;

• cookie-consent preferences;

• website usage data collected through Google Analytics, where you consent, including cookie identifiers, pages viewed, interactions, referral sources, approximate location and browser and device information.

We do not use personal data collected through this website for automated decision-making or profiling within the meaning of Article 22 GDPR.

3. Server logs and website security

When you visit the website, our server automatically receives and records certain technical information, which may include:

• IP address;

• date and time of access;

• requested page or file;

• referrer URL;

• browser type and version;

• operating system;

• host name of the accessing device;

• HTTP status and other technical request information.

We process these data to deliver the website, maintain its technical stability, identify errors, prevent misuse and protect our systems against security threats.

The legal basis is our legitimate interest in operating a secure, reliable and functional website under Article 6(1)(f) GDPR.

Server logs are normally retained for no more than 30 days. Individual records may be retained for longer where necessary to investigate a security incident, prevent abuse, establish legal claims or comply with a legal obligation.

Server-log information is not combined with information from other sources for marketing or profiling purposes.

4. Contact and business enquiries

When you submit an inquiry through our website or contact us by email or telephone, we process the information you provide. This may include your:

• name;

• company email address;

• telephone number;

• company or organisation;

• selected business sector;

• message and other information included in your enquiry.

We use these data solely to review your enquiry, communicate with you and, where relevant, prepare or perform a business relationship.

Where your request relates to entering into or performing a contract, processing is based on Article 6(1)(b) GDPR.

For general business communication that is not directly connected with a contract, processing is based on our legitimate interest in responding to enquiries and maintaining business relationships under Article 6(1)(f) GDPR.

Information submitted through an inquiry form is retained for the time necessary to handle the enquiry and for no more than six months afterwards, unless:

• a business relationship results from the enquiry;

• a longer period is required by law;

• retention is necessary for the establishment, exercise or defence of legal claims.

Where a business relationship is established, the relevant information may be retained for the duration of that relationship and for the applicable statutory retention periods.

Fields marked as required are necessary for us to process your enquiry. If you do not provide the required information, we may be unable to respond. Other information is optional.

5. Employment applications

If you apply for employment with SG Automotive, we process the personal data included in your application, CV, supporting documents and subsequent correspondence.

The purposes of processing are to:

• assess your qualifications and suitability;

• communicate with you;

• conduct the recruitment and selection procedure;

• take steps at your request before entering into an employment contract.

Processing is based on Article 6(1)(b) GDPR and applicable employment legislation. Where processing is necessary for compliance with a legal obligation, it is based on Article 6(1)(c) GDPR.

Application data of unsuccessful candidates are normally deleted after completion of the recruitment procedure, unless a longer retention period is required for the establishment, exercise or defence of legal claims.

We will retain your application for consideration in future recruitment procedures only if you provide separate consent. You may withdraw that consent at any time.

6. Cookies

Cookies are small text files stored on your device by your browser. This website uses strictly necessary cookies for essential functionality, security and storing your cookie preferences. With your consent, we also use Google Analytics cookies to measure website usage and improve our content and performance.

Analytics cookies are optional. Rejecting them does not prevent you from using the website. We do not use advertising cookies.

Strictly necessary cookies are used on the basis of our legitimate interest in providing a secure and functional website under Article 6(1)(f) GDPR. Where the applicable electronic-communications legislation permits storage or access because it is strictly necessary to provide a service requested by the user, no consent is required.

Any non-essential cookies will be stored only after you provide consent through the cookie-settings panel. The legal basis for the related processing is Article 6(1)(a) GDPR.

You may change or withdraw your cookie preferences at any time through the Cookie Settings option available on the website. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

You may also delete or restrict cookies through your browser settings. Disabling necessary cookies may affect certain website functions.

Information about individual cookies, their purposes, providers and duration is available in the website’s cookie-settings panel.

7. Google Analytics

With your consent, we use Google Analytics 4, a website analytics service provided by Google, to understand how visitors find and use our website. We use this information to evaluate website performance and improve its content and usability.

Google Analytics may process cookie identifiers, pages visited, interactions with website content, visit times, referral sources, browser and device information, and approximate location. Cookies help distinguish visitors and associate interactions with visits.

For visitors in the European Union, Google states that IP addresses are used to derive approximate location and are then discarded before analytics data are logged or stored.

Google Analytics is activated only after you consent to analytics cookies through our cookie-settings panel. The legal basis for the related processing of personal data is your consent under Article 6(1)(a) GDPR.

You can refuse analytics cookies or withdraw your consent at any time through Cookie Settings. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

We do not use Google Analytics for remarketing or advertising personalisation, and Google Signals is disabled. We do not intentionally send names, email addresses, contact-form messages or other directly identifying information to Google Analytics.

Google processes analytics data on our behalf under its applicable data-processing terms. Processing may involve transfers outside the European Economic Area, as explained in section 10.

Information about analytics cookies and their duration is available in our cookie-settings panel. Information about Google’s processing practices is available in Google’s Privacy Policy: https://policies.google.com/privacy.

The configured retention period for user-level and event-level analytics data is 2 months. Google automatically deletes data covered by this setting after the applicable period. Standard aggregated reports are not subject to the same retention setting.

8. Locally hosted fonts

Fonts used on this website are hosted locally on our server. When the fonts are displayed, your browser does not establish a connection with Google or another external font provider.

9. Recipients and service providers

Personal data may be accessible to service providers that support the operation of our website and information systems, including providers of:

• website hosting and server infrastructure;

• website development and maintenance;

• email and communication services;

• IT support and information security;

• recruitment or professional advisory services, where applicable;

• website analytics services, specifically Google Analytics, where you have consented to analytics.

These providers receive personal data only to the extent necessary to perform their services. Where they act as processors, they process personal data on our instructions and under an appropriate data-processing agreement.

We may also disclose personal data where required by law, by a competent authority or for the establishment, exercise or defence of legal claims.

We do not sell personal data.

10. Transfers outside the European Economic Area

Some service providers may process personal data outside the European Economic Area.

Where such transfers take place, we ensure that an appropriate transfer mechanism is in place, such as:

• an adequacy decision adopted by the European Commission;

• the EU–US Data Privacy Framework, where applicable;

• standard contractual clauses approved by the European Commission;

• another legally permitted safeguard under Chapter V GDPR.

You may contact us for further information about the safeguards applicable to a particular transfer.

11. Retention of personal data

We retain personal data only for as long as necessary for the purpose for which they were collected.

Retention periods are determined by considering:

• the purpose of processing;

• the duration of a contractual or business relationship;

• statutory accounting, tax, employment and other retention obligations;

• applicable limitation periods;

• the need to prevent misuse or investigate security incidents;

• the establishment, exercise or defence of legal claims.

The more specific retention periods stated elsewhere in this Privacy Policy apply to the relevant processing activity.

After the applicable retention period expires, personal data are deleted or anonymised unless further retention is required or permitted by law.

12. Legal obligations

We may process and retain personal data where necessary to comply with legal obligations, regulatory requirements, court orders or lawful requests from competent authorities.

The legal basis for such processing is Article 6(1)(c) GDPR.

13. Security

We implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure and unauthorised access.

The website uses SSL/TLS encryption to protect information transmitted between your browser and our website. You can normally identify an encrypted connection by the https:// prefix and lock symbol displayed by your browser.

No method of transmission or storage is completely secure. Security measures are therefore regularly reviewed and adjusted to the nature and risks of processing.

14. Your rights

Subject to the conditions and limitations established by applicable law, you have the right to:

• request access to your personal data;

• request correction of inaccurate or incomplete data;

• request deletion of your personal data;

• request restriction of processing;

• receive personal data you provided in a structured, commonly used and machine-readable format where the right to data portability applies;

• request transmission of those data to another controller where technically feasible;

• object to processing based on legitimate interests;

• withdraw consent at any time where processing is based on consent;

• lodge a complaint with a competent supervisory authority.

Withdrawal of consent applies prospectively and does not affect the lawfulness of processing carried out before withdrawal.

To exercise your rights, contact us at info@sga.si. We may request additional information where reasonably necessary to verify your identity.

We normally respond within one month of receiving a complete request. That period may be extended by up to two additional months where permitted by GDPR due to the complexity or number of requests. We will inform you if an extension is necessary.

15. Right to object

Where we process personal data on the basis of Article 6(1)(f) GDPR, you have the right to object at any time on grounds relating to your particular situation.

If you object, we will stop processing the relevant data unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or processing is necessary for the establishment, exercise or defence of legal claims.

16. Right to lodge a complaint

If you believe that the processing of your personal data infringes applicable data-protection law, you may lodge a complaint with:

Information Commissioner of the Republic of Slovenia
Informacijski pooblaščenec
Dunajska cesta 22
1000 Ljubljana
Slovenia

Email: gp.ip@ip-rs.si
Website: https://www.ip-rs.si

You may also have the right to lodge a complaint with another competent supervisory authority, particularly in the EU Member State of your habitual residence, place of work or place of the alleged infringement.

17. Changes to this Privacy Policy

We may amend this Privacy Policy where necessary to reflect changes to our website, processing activities, service providers or legal obligations.

The current version is always published on this page. The date of the most recent revision is shown at the beginning of the policy.