Privacy Policy

Last amended and effective as of: 20 July 2026

Controller: PIKA. Digital d.o.o.

1. Introductory Provisions and the Role of PIKA. Digital d.o.o.

This Privacy Policy governs the collection, storage, processing, and protection of personal data relating to individuals and representatives of business entities who contact PIKA. Digital d.o.o., use our online services, or enter into contractual relationships with us.

At PIKA. Digital d.o.o. (hereinafter: the “Controller” or the “Company”), we process personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation – GDPR), the Slovenian Personal Data Protection Act (ZVOP-2), and the Electronic Communications Act (ZEKom-2).

Depending on the nature of our business activities, we act in two distinct capacities:

A. PIKA. Digital as a Data Controller

When you visit our website, complete a contact form or diagnostic questionnaire, subscribe to newsletters, or enter into a contract with us as a client, we act as the controller of your personal data. We independently determine the purposes and means of processing. This document governs processing activities carried out in this capacity.

Controller details:

Company: PIKA. Digital d.o.o.

Registered office: Topniška ulica 33A, 1000 Ljubljana, Slovenia

Company registration number: 9297570000

VAT ID: SI54098190

Contact email: hello@pikadigital.eu

Official website: pikadigital.eu

B. PIKA. Digital as a Data Processor (for Clients)

Where, as a client of our services, you provide the Company with access to your tools and databases (e.g., CRM systems, Meta Business Manager, Google Ads, customer email lists), the Company acts solely as a contractual data processor. We process personal data relating to your customers or leads exclusively on your behalf and in accordance with your instructions, pursuant to Article 28 GDPR.

The processing and protection of such personal data are governed by a separate Data Processing Agreement (DPA) entered into upon commencement of our cooperation.

2. What Personal Data Do We Collect and Process?

The Company limits data collection to information that is necessary for the performance of contractual obligations or the pursuit of legitimate interests, or that is collected on the basis of your explicit consent.

We collect the following categories of personal data:

• basic identification data: first and last name, company/employer name, job title,
• contact details: business email address, telephone number,
• quotation and invoicing data: address/registered office, tax identification number, bank account details, payment information, and order history,
• technical and website-related data: IP address, browser user agent string, technical cookies, time of visit, and interactions on the website (collected through analytics and tracking tools where consent has been provided),
• voice input data: where voice input is used when completing a questionnaire, the recording is used solely for speech-to-text conversion. The recording itself is not stored in our database after transcription; only the textual transcript is retained as part of your responses,
• communication data: content of messages submitted through contact forms, email communications, or diagnostic questionnaires.

2a. Sources of Personal Data

We obtain personal data from the following sources:

• directly from you: when you complete a form on our website, use one of our tools (diagnostics, calculator, report), contact us by email, or enter into a contract with us;
• through Meta (Facebook, Instagram) and Google advertising platforms: when you complete an inquiry form directly within the platform. In such cases, the platform provides us with the information you entered (first and last name, business email address, telephone number, company name). Meta and Google also process such data for their own purposes as independent controllers; their privacy policies are available on their respective websites;
• from publicly available sources: the Slovenian Business Register (AJPES), company websites, and professional business networks, where we verify business entity information prior to entering into a cooperation agreement.

The categories of personal data obtained from all of the above sources correspond to those listed in Section 2 of this Policy.

3. Legal Bases and Purposes of Processing

A. Processing for the Performance of a Contract or Pre-Contractual Measures (Article 6(1)(b) GDPR)

We process personal data for the purpose of establishing and maintaining a business relationship, including:

• preparing proposals, conducting diagnostics, and concluding agreements relating to services provided under the Performance OS methodology,
• providing the contracted services (advertising, process automation, conversion optimisation),
• communicating regarding project implementation, handling technical requests, and issuing invoices.

B. Processing Based on Legal Obligations (Article 6(1)(c) GDPR)

Certain personal data are processed because we are legally required to do so, including:

• retention of issued invoices and accounting records for tax compliance and audit purposes (Value Added Tax Act – ZDDV-1 and Tax Procedure Act).

C. Processing Based on Legitimate Interests (Article 6(1)(f) GDPR)

The Company may process personal data on the basis of legitimate business interests, provided that such interests are not overridden by the interests or fundamental rights and freedoms of the data subject:

• business protection and IT security: detecting and preventing abuse, fraud, unauthorised access, or technical issues affecting our systems and servers,
• B2B communications and direct marketing: marketing communications are sent only where permitted under GDPR, ZEKom-2, and ZEPT. Where consent is required, communications are sent solely on the basis of such consent. Every marketing communication includes a clear, free, and simple unsubscribe mechanism,
• establishment, exercise, or defence of legal claims: retention of personal data for the purpose of defending against legal claims or collecting outstanding receivables.

D. Processing Based on Consent (Article 6(1)(a) GDPR)

Where processing is not based on a contract or legal obligation, personal data are processed solely on the basis of your freely given and explicit consent:

• subscription to newsletters or downloading restricted professional content (reports, case studies),
• use of non-essential cookies (analytics and marketing cookies) on the website.

You may withdraw your consent at any time, free of charge, by sending a written request to hello@pikadigital.eu or by using the unsubscribe link contained in each communication.

4. Retention of Personal Data

We retain personal data only for as long as necessary to fulfil the purpose for which the data were collected:

• contractual and billing data: retained for the duration of the business relationship and thereafter until the expiry of the applicable statutory limitation periods. Claims arising from commercial contracts generally become time-barred after three years, unless otherwise provided by law;
• accounting records and invoices: retained for ten (10) years following the end of the year to which the invoice relates (in accordance with the Value Added Tax Act – ZDDV-1);
• data processed on the basis of consent: retained until consent is withdrawn or, at the latest, two (2) years after the individual's last interaction with our content;
• data relating to abuse, disputes, and legal proceedings: retained until the final conclusion of the relevant proceedings or the expiry of applicable limitation periods.

Upon expiry of the applicable retention period, personal data shall be permanently deleted, destroyed, or anonymised in such a manner that the identification of the individual is no longer possible.

5. Disclosure and Transfer of Personal Data (Recipients of Personal Data and Service Providers)

Personal data are disclosed only to the extent necessary for the provision of a specific service. Depending on the nature of the service and the contractual arrangements in place, the service providers listed below may act as data processors, independent controllers, or joint controllers.

Hosting and Infrastructure

• Vercel Inc. (USA) – website hosting

CRM, Automation, and Email Services

• HighLevel Inc. / GoHighLevel (USA) – CRM, contact management, and email communications
• n8n GmbH (Germany) – workflow automation
• Google Ireland Limited – business email and document services (Google Workspace)

Advertising and Analytics Platforms

• Google Ireland Limited – Google Ads, Google Analytics
• Meta Platforms Ireland Limited – advertising on Facebook and Instagram

Artificial Intelligence Tools

• Anthropic PBC (USA) – Claude
• OpenAI (USA) – ChatGPT
• Google Ireland Limited – Gemini

Business Services

• Accounting service providers and, where necessary, legal and financial advisers

Use of Artificial Intelligence Tools

We use artificial intelligence tools as support tools for analysis, content creation, and process automation. We do not input special categories of personal data into such tools. Personal data relating to clients are processed only within the scope agreed in the applicable Data Processing Agreement.

We use business-grade versions of these services under which the service providers do not use submitted data for the training of their models.

Transfers of Personal Data to Third Countries

Where personal data are transferred outside the European Economic Area, particularly to the United States, we ensure that such transfers are carried out using appropriate safeguards, including:

• Standard Contractual Clauses (SCCs) approved by the European Commission; and/or
• cooperation with organisations certified under the EU–U.S. Data Privacy Framework.

Further information regarding the safeguards applied, as well as a copy thereof, may be requested by contacting hello@pikadigital.eu.

6. Cookies

What Are Cookies?

Cookies are small text files that are stored on your device when you visit a website. They enable the operation of the website, the retention of preferences, and the measurement of website usage and advertising effectiveness.

Types of Cookies We Use

Strictly necessary cookies operate without consent because they are essential for the functioning of the website. All other cookies are installed only after you have provided your consent.

Withdrawal of Consent

You may modify or withdraw your consent at any time through the “Cookie Settings” link located in the footer of this website. You may also delete cookies through your browser settings. Withdrawal of consent does not affect the lawfulness of processing carried out prior to such withdrawal.

7. Rights of Data Subjects

In accordance with the GDPR and ZVOP-2, you have the following rights regarding the processing of your personal data:

• right to withdraw consent: where processing is based on your consent, you may withdraw such consent at any time, free of charge (via email or through the link contained in the communication), without affecting the lawfulness of processing carried out prior to the withdrawal;
• right of access: the right to obtain confirmation as to whether we process your personal data and to access such data;
• right to rectification: the right to have inaccurate personal data corrected and incomplete personal data completed;
• right to erasure (“right to be forgotten”): the right to have personal data erased where such data are no longer necessary or where you withdraw consent and no other legal basis for processing exists;
• right to restriction of processing: the right to obtain a temporary restriction of processing where you contest the accuracy of the data or the lawfulness of the processing;
• right to data portability: the right to receive personal data in a structured, commonly used, and machine-readable format and to transmit those data to another controller;
• right to object: the right to object to processing based on legitimate interests or for direct marketing purposes.

Procedure for Exercising Rights

Requests relating to the exercise of your rights may be submitted by email to hello@pikadigital.eu or by post to the Company's registered address. We will respond to your request without undue delay and, in any event, within one (1) month of receipt. In the case of complex requests, this period may be extended by up to an additional two (2) months, of which you will be informed in a timely manner.

8. Nature of Data Provision and Consequences

• Contractual and legal requirement: The provision of basic identification and contact information necessary for the preparation of quotations and invoices is required for the conclusion and performance of a contract. If such information is not provided, it will not be possible to conclude a contract or provide the requested services.
• Voluntary provision of data: The provision of data for diagnostics, newsletters, or cookies is entirely voluntary. Failure to provide such data does not affect your ability to enter into a contract for our services.

9. Right to Lodge a Complaint with a Supervisory Authority

If you believe that the processing of your personal data infringes applicable data protection legislation, you have the right to lodge a complaint with the competent supervisory authority:

Information Commissioner of the Republic of Slovenia

Dunajska cesta 22, 1000 Ljubljana, Slovenia

Email: gp.ip@ip-rs.si · Website: www.ip-rs.si

10. Data Security

PIKA. Digital d.o.o. implements appropriate technical and organisational measures (including HTTPS/TLS encryption, access control mechanisms, firewalls, and regular backups) to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or unauthorised access.

11. Final Provisions

The Controller reserves the right to amend or update this Privacy Policy due to changes in legislation, regulatory requirements, or business processes. The most recent version shall always be published on the Company's official website together with the relevant amendment date.

For any questions or clarifications relating to the protection of personal data, please contact us at: hello@pikadigital.eu.