Privacy Policy

Last updated: 9 September 2026

This Privacy Policy explains how SG Automotive d.o.o. collects and processes personal data when you visit our website, contact us or submit a business or employment-related enquiry.

1. Controller

The controller responsible for processing personal data through this website is:

SG Automotive d.o.o.
Industrijska cesta 12
3210 Slovenske Konjice
Slovenia

Telephone: +386 3 757 16 50
Email: info@sga.si

For questions concerning this Privacy Policy or the processing of your personal data, please contact us using the email address above.

2. Personal data we process

Depending on how you use the website, we may process the following categories of personal data:

• technical information transmitted when you visit the website;

• your name and contact details;

• your company or organisation;

• information you enter into an inquiry form;

• the sector or subject selected in a form;

• correspondence between you and SG Automotive;

• information included in an employment application;

• cookie-consent preferences.

We do not use personal data collected through this website for automated decision-making or profiling within the meaning of Article 22 GDPR.

3. Server logs and website security

When you visit the website, our server automatically receives and records certain technical information, which may include:

• IP address;

• date and time of access;

• requested page or file;

• referrer URL;

• browser type and version;

• operating system;

• host name of the accessing device;

• HTTP status and other technical request information.

We process these data to deliver the website, maintain its technical stability, identify errors, prevent misuse and protect our systems against security threats.

The legal basis is our legitimate interest in operating a secure, reliable and functional website under Article 6(1)(f) GDPR.

Server logs are normally retained for no more than 30 days. Individual records may be retained for longer where necessary to investigate a security incident, prevent abuse, establish legal claims or comply with a legal obligation.

Server-log information is not combined with information from other sources for marketing or profiling purposes.

4. Contact and business enquiries

When you submit an inquiry through our website or contact us by email or telephone, we process the information you provide. This may include your:

• name;

• company email address;

• telephone number;

• company or organisation;

• selected business sector;

• message and other information included in your enquiry.

We use these data solely to review your enquiry, communicate with you and, where relevant, prepare or perform a business relationship.

Where your request relates to entering into or performing a contract, processing is based on Article 6(1)(b) GDPR.

For general business communication that is not directly connected with a contract, processing is based on our legitimate interest in responding to enquiries and maintaining business relationships under Article 6(1)(f) GDPR.

Information submitted through an inquiry form is retained for the time necessary to handle the enquiry and for no more than six months afterwards, unless:

• a business relationship results from the enquiry;

• a longer period is required by law;

• retention is necessary for the establishment, exercise or defence of legal claims.

Where a business relationship is established, the relevant information may be retained for the duration of that relationship and for the applicable statutory retention periods.

Fields marked as required are necessary for us to process your enquiry. If you do not provide the required information, we may be unable to respond. Other information is optional.

5. Employment applications

If you apply for employment with SG Automotive, we process the personal data included in your application, CV, supporting documents and subsequent correspondence.

The purposes of processing are to:

• assess your qualifications and suitability;

• communicate with you;

• conduct the recruitment and selection procedure;

• take steps at your request before entering into an employment contract.

Processing is based on Article 6(1)(b) GDPR and applicable employment legislation. Where processing is necessary for compliance with a legal obligation, it is based on Article 6(1)(c) GDPR.

Application data of unsuccessful candidates are normally deleted after completion of the recruitment procedure, unless a longer retention period is required for the establishment, exercise or defence of legal claims.

We will retain your application for consideration in future recruitment procedures only if you provide separate consent. You may withdraw that consent at any time.

6. Cookies

Cookies are small text files stored on your device by your browser. This website uses cookies that are necessary for its operation and for storing your cookie preferences.

Strictly necessary cookies are used on the basis of our legitimate interest in providing a secure and functional website under Article 6(1)(f) GDPR. Where the applicable electronic-communications legislation permits storage or access because it is strictly necessary to provide a service requested by the user, no consent is required.

Any non-essential cookies will be stored only after you provide consent through the cookie-settings panel. The legal basis for the related processing is Article 6(1)(a) GDPR.

You may change or withdraw your cookie preferences at any time through the Cookie Settings option available on the website. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

You may also delete or restrict cookies through your browser settings. Disabling necessary cookies may affect certain website functions.

Information about individual cookies, their purposes, providers and duration is available in the website’s cookie-settings panel.

7. Analytics and tracking

We do not use website analytics, advertising or cross-site tracking tools and do not analyse visitors’ behaviour for marketing purposes.

If such tools are introduced in the future, this Privacy Policy and the cookie-settings panel will be updated before they are activated. Non-essential analytics or advertising technologies will not be loaded without prior consent where consent is required.

8. Locally hosted fonts

Fonts used on this website are hosted locally on our server. When the fonts are displayed, your browser does not establish a connection with Google or another external font provider.

9. Recipients and service providers

Personal data may be accessible to service providers that support the operation of our website and information systems, including providers of:

• website hosting and server infrastructure;

• website development and maintenance;

• email and communication services;

• IT support and information security;

• recruitment or professional advisory services, where applicable.

These providers receive personal data only to the extent necessary to perform their services. Where they act as processors, they process personal data on our instructions and under an appropriate data-processing agreement.

We may also disclose personal data where required by law, by a competent authority or for the establishment, exercise or defence of legal claims.

We do not sell personal data.

10. Transfers outside the European Economic Area

Some service providers may process personal data outside the European Economic Area.

Where such transfers take place, we ensure that an appropriate transfer mechanism is in place, such as:

• an adequacy decision adopted by the European Commission;

• the EU–US Data Privacy Framework, where applicable;

• standard contractual clauses approved by the European Commission;

• another legally permitted safeguard under Chapter V GDPR.

You may contact us for further information about the safeguards applicable to a particular transfer.

11. Retention of personal data

We retain personal data only for as long as necessary for the purpose for which they were collected.

Retention periods are determined by considering:

• the purpose of processing;

• the duration of a contractual or business relationship;

• statutory accounting, tax, employment and other retention obligations;

• applicable limitation periods;

• the need to prevent misuse or investigate security incidents;

• the establishment, exercise or defence of legal claims.

The more specific retention periods stated elsewhere in this Privacy Policy apply to the relevant processing activity.

After the applicable retention period expires, personal data are deleted or anonymised unless further retention is required or permitted by law.

12. Legal obligations

We may process and retain personal data where necessary to comply with legal obligations, regulatory requirements, court orders or lawful requests from competent authorities.

The legal basis for such processing is Article 6(1)(c) GDPR.

13. Security

We implement appropriate technical and organisational measures to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure and unauthorised access.

The website uses SSL/TLS encryption to protect information transmitted between your browser and our website. You can normally identify an encrypted connection by the https:// prefix and lock symbol displayed by your browser.

No method of transmission or storage is completely secure. Security measures are therefore regularly reviewed and adjusted to the nature and risks of processing.

14. Your rights

Subject to the conditions and limitations established by applicable law, you have the right to:

• request access to your personal data;

• request correction of inaccurate or incomplete data;

• request deletion of your personal data;

• request restriction of processing;

• receive personal data you provided in a structured, commonly used and machine-readable format where the right to data portability applies;

• request transmission of those data to another controller where technically feasible;

• object to processing based on legitimate interests;

• withdraw consent at any time where processing is based on consent;

• lodge a complaint with a competent supervisory authority.

Withdrawal of consent applies prospectively and does not affect the lawfulness of processing carried out before withdrawal.

To exercise your rights, contact us at info@sga.si. We may request additional information where reasonably necessary to verify your identity.

We normally respond within one month of receiving a complete request. That period may be extended by up to two additional months where permitted by GDPR due to the complexity or number of requests. We will inform you if an extension is necessary.

15. Right to object

Where we process personal data on the basis of Article 6(1)(f) GDPR, you have the right to object at any time on grounds relating to your particular situation.

If you object, we will stop processing the relevant data unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or processing is necessary for the establishment, exercise or defence of legal claims.

16. Right to lodge a complaint

If you believe that the processing of your personal data infringes applicable data-protection law, you may lodge a complaint with:

Information Commissioner of the Republic of Slovenia
Informacijski pooblaščenec
Dunajska cesta 22
1000 Ljubljana
Slovenia

Email: gp.ip@ip-rs.si
Website: https://www.ip-rs.si

You may also have the right to lodge a complaint with another competent supervisory authority, particularly in the EU Member State of your habitual residence, place of work or place of the alleged infringement.

17. Changes to this Privacy Policy

We may amend this Privacy Policy where necessary to reflect changes to our website, processing activities, service providers or legal obligations.

The current version is always published on this page. The date of the most recent revision is shown at the beginning of the policy.