Privacy policy

Data Controller

The controller of personal data in relation to the website https://valens-health.com and your other interactions with VALENS INT. Proizvodnja in trženje d.o.o. is:

(hereinafter: the “Organisation” or the “Company”)

The Organisation has appointed a Data Protection Officer (DPO): Gregor Božič. All questions, requests, inquiries, and other communications related to personal data protection may be addressed to: [email protected].

Introduction

Basic information about the Organisation and its mission

The Organisation collects, stores, and otherwise processes certain information and data, including personal data, in accordance with the Personal Data Protection Act (ZVOP-2) and Regulation (EU) 2016/679 (GDPR).

Purpose and use of this notice

This Privacy Notice describes how the Organisation processes personal data of individuals who have provided their personal data directly to the Organisation as the data controller, in connection with the website https://valens-health.com.

Terminology and amendments to this notice

Unless otherwise stated, the terms used in this notice (e.g. personal data, processing, controller, processor) have the same meaning as defined in the GDPR.

The website refers to https://valens-health.com, including all related subpages, servers, and systems.

Singular terms include plural forms and vice versa; gendered terms apply to all genders.

Personal Data Retention Period

The retention period of personal data depends on the purpose for which the data were collected. Personal data are retained only for as long as necessary to fulfil the purpose for which they were collected. The specific periods applicable to data collected through this website are stated in section 3.

Taking into account the nature of the processed data and associated risks, the Organisation periodically and in a documented manner verifies compliance with data retention limitation principles.

Unless otherwise required by law, personal data are deleted, destroyed, anonymised, or otherwise rendered non-identifiable after the purpose of processing has been fulfilled.

An individual may request the deletion of personal data at any time by submitting a request to the official email address stated at the beginning of this document.

1. Legal Bases for the Processing of Personal Data

1.1 Performance of a contract or pre-contractual measures

The Organisation may process personal data based on the performance of a contract (e.g. provision of services) or steps taken prior to entering into a contract.

In such cases, personal data are provided as part of contractual obligations or negotiations, and explicit consent is not required.

Failure to provide such data may hinder or prevent the provision of services or cooperation, of which the individual will be informed accordingly.

1.2 Compliance with legal obligations

The Organisation processes personal data to comply with legal obligations, particularly those related to taxation and accounting (e.g. issued and received invoices), including:

• when required to disclose personal data to inspectors or other authorities in accordance with applicable law,
• when processing invoice-related data pursuant to the Value Added Tax Act (ZDDV-1).

1.3 Legitimate interests of the Organisation

Personal data may also be processed where necessary to protect the legitimate interests of the Organisation, such as for administrative, civil, or criminal proceedings, provided that only data strictly necessary for such purposes are processed.

Personal data may also be processed where necessary to protect the vital interests of an individual.

1.4 Consent

Use of the Organisation’s services is generally not conditional upon consent to personal data processing.

However, personal data may be processed based on explicit consent, defined as a freely given, specific, informed, and unambiguous indication of the individual’s wishes (e.g. consent to receive newsletters).

Consent may be withdrawn at any time via the unsubscribe link in communications or by contacting the Organisation.

Consent may also apply to online advertising, including the use of optional (marketing) cookies and tracking technologies.

Withdrawal of consent does not affect the lawfulness of processing carried out prior to withdrawal.

2. Recipients of Personal Data

2.1 Employees of the Organisation

Personal data are processed by authorised employees who require such data to perform their duties. All employees are bound by confidentiality obligations.

2.2 Public authorities

Where required by law, personal data may be disclosed to competent public authorities and supervisory bodies.

2.3 Contractual processors

Personal data may be processed by contractual processors acting solely on behalf of the Organisation under data processing agreements, including:

• IT service providers and developers,
• email distribution services (The Rocket Science Group LLC – Mailchimp),
• payment service providers (Stripe Payments Company),
• accounting service providers,
• website hosting providers,
• content delivery and website security services (Cloudflare, Inc.),
• web form and enquiry delivery services.

The Organisation does not disclose personal data to unauthorised third parties.

2.4 Website hosting provider

The website is hosted on servers located in Germany.

2.5 Transfers to third countries

As a rule, personal data are not transferred outside the European Economic Area (EEA). Exceptions may include limited transfers to service providers located in the United States, subject to appropriate safeguards — either the EU–US Data Privacy Framework or the standard contractual clauses adopted by the European Commission.

3. Personal Data Collected Through This Website

This website has no user accounts, no shopping cart and no payment function. It contains two forms. The following states, for each form and for the technical operation of the site, which data are processed, for what purpose, on what legal basis, and for how long they are kept.

3.1 “Request a Quote” enquiry form

• Data: name, business email address, company, your message (optional), and your consent to receive the newsletter (optional).
• Purpose: to answer your enquiry and, where applicable, to prepare an offer.
• Legal basis: Article 6(1)(b) GDPR — steps taken at your request prior to entering into a contract.
• Retention: for as long as your enquiry is being handled, and for two years after our last communication, so that a later enquiry can be placed in context. If a contract follows, the data are retained under that contract and under the statutory accounting and tax rules described in section 1.2.

3.2 “Sign Up for Updates” newsletter form

• Data: name, business email address, company, and your consent, which is mandatory for this form.
• Purpose: sending the Valens newsletter with product updates, offers and industry news.
• Legal basis: Article 6(1)(a) GDPR — consent.
• Retention: for as long as you remain subscribed. Your details are removed from the mailing list when you unsubscribe.

3.3 Evidence of consent

Where you give consent in either form, the Organisation additionally records the date and time of submission (UTC), the IP address from which the form was submitted, and the exact wording of the consent statement that was shown to you, together with the version identifier of that wording.

• Purpose: to be able to demonstrate that consent was given, and precisely what was consented to.
• Legal basis: Article 6(1)(c) GDPR, in conjunction with the controller’s obligations under Articles 5(2) and 7(1) GDPR.
• Retention: for as long as you remain subscribed, and for three years after you unsubscribe or withdraw consent, after which the record is deleted.

This record is kept solely as proof of consent. It is not used to contact you, to build a profile, or for any other purpose.

3.4 Server logs, content delivery and security

Requests to this website pass through a content delivery and security network before reaching the hosting server. In this process the IP address, the requested address, the time of the request and the browser identification string are processed.

• Purpose: delivering the website, protecting it against attack and abuse, and diagnosing faults.
• Legal basis: Article 6(1)(f) GDPR — the legitimate interest of the Organisation in operating a secure and available website.
• Retention: no longer than necessary for those purposes; log files are rotated and deleted by the providers concerned.

3.5 Embedded video

The “About us” page contains a video hosted on YouTube, embedded in privacy-enhanced mode. Nothing is loaded from YouTube and no cookie is set until you actively click play. If you do click play, your IP address and information about your browser are transmitted to Google Ireland Limited, which acts as an independent controller in respect of that data and whose own privacy policy then applies.

3.6 Cookies and similar technologies

This website sets no advertising, analytics, profiling or tracking cookies, and loads no content from third-party servers when a page is opened. Only technologies strictly necessary for the operation and security of the website are used, for which consent is not required under Article 5(3) of Directive 2002/58/EC as implemented in Slovenian law.

Should the Organisation introduce analytics or marketing technologies in the future, they will not be activated before consent has been obtained, and this notice will be amended accordingly.

Special Categories of Personal Data

The Organisation does not encourage the provision of special categories of personal data. If such data are inadvertently disclosed, appropriate safeguards will be applied.

Your Rights under the GDPR

You may contact the Organisation at any time using the email address stated above to exercise your rights, including:

• right to information,
• right of access,
• right to erasure (“right to be forgotten”),
• right to withdraw consent,
• right to rectification,
• right to restriction of processing,
• right to data portability,
• right to object,
• rights related to automated decision-making and profiling,
• right to lodge a complaint with a supervisory authority.

In Slovenia, the competent authority is:

Automated Decision-Making and Profiling

The Organisation does not carry out automated decision-making or profiling.

Processing of Personal Data of Children

The Organisation’s services are intended for individuals aged 15 years or older. If personal data of individuals under 15 are processed without parental consent, such data will be deleted without delay.

Data Security

The Organisation protects personal data using appropriate technical, organisational, and security measures to prevent unauthorised access, alteration, loss, or disclosure. Equivalent safeguards are required from contractual processors.

Version and Effective Date

This Privacy Policy constitutes version 2.1 and is applicable as of 9 September 2026. It replaces version 2.0 of 22 January 2026.

Changes introduced in version 2.1: a new section 3 stating the data, purposes, legal bases and retention periods applicable to the two forms on this website, to server logs, to the embedded video and to cookies; the addition of the content delivery and security provider to the list of contractual processors; and an explicit statement of the safeguards applied to transfers outside the EEA.