Privacy policy

E-DISTI d.o.o. (“E-DISTI”, “SPARK”, “we”, “us” or “our”) is committed to protecting your privacy. This privacy policy explains what personal data we collect, why we collect it, how we use it and what rights you have in relation to your data when you use our website, online shop and services.

This policy applies to all visitors, customers and users of the sparkagregat.si website and its language versions, which E-DISTI operates under the SPARK Agregat brand for the sale of generators and UPS systems and for rental, installation, servicing and maintenance services.

1. Data controller

The controller responsible for your personal data is:

E-DISTI d.o.o. (SPARK Agregat)
Litijska cesta 259, 1261 Ljubljana – Dobrunje, Slovenia
VAT ID: SI72537094
Registration number: 3792234000
E-mail: [email protected]

For any questions or requests regarding your personal data, you can contact us at the e-mail address above.

2. Personal data we collect

2.1 Data you provide to us directly

We collect the personal data that you voluntarily provide to us when using our website:

• Online shop orders: full name, company name and VAT ID (for business customers), delivery and billing address, e-mail address, phone number, the products and configuration selected and the chosen payment method
• Inquiry and consultation forms: full name, e-mail address, phone number, type of inquiry (purchase, rental, industrial project, service, installation, maintenance, emergency call-out) and the content of your message
• Contact form: in addition to the above, your company or institution, town/city, country and any attached file
• Rental form: rental start and return dates, generator type and any coupon number
• Service form: customer type (individual, company or institution) and a description of the fault
• Product reviews: name, e-mail address and review text, when you submit a product review

2.2 Automatically collected data

When you visit our website, certain technical data is collected automatically:

• Device and browser data: browser type and version, operating system, screen resolution and device type
• Network data: IP address and approximate geographical location derived from the IP address, in server logs
• Advertising campaign attribution data: campaign parameters and advertising click identifiers from the URL through which you arrived (such as UTM parameters, gclid, fbclid, msclkid), and the referring page — stored in your browser for up to 30 days and attached to forms or orders you submit later, so that we know which campaign an inquiry originates from
• Order source: the online shop attaches traffic source information to the order (built-in WooCommerce order attribution)
• Cookies and similar technologies: as described in our Cookie policy

3. Purposes and legal bases of processing

We process your personal data only where we have a valid legal basis for doing so under Article 6 GDPR:

3.1 Performance of a contract (Art. 6(1)(b))

• Processing and fulfilling orders, including delivery, invoicing and sending confirmations
• Providing the rental, installation, servicing and maintenance services you have ordered
• Handling warranty claims and complaints
• Communicating with you about your orders and services

3.2 Legitimate interest (Art. 6(1)(f))

• Responding to inquiries submitted through the forms on the website
• Managing customer relationships through our CRM system
• Attributing inquiries and orders to the marketing campaign they originate from
• Improving our website, product range and services
• Protecting against fraud, abuse and security threats
• Keeping internal business records

3.3 Legal obligation (Art. 6(1)(c))

• Retaining invoices and transaction records as required by Slovenian tax and accounting legislation
• Complying with obligations under consumer protection and warranty regulations
• Responding to lawful requests from regulatory authorities

3.4 Consent (Art. 6(1)(a))

• Sending marketing communications or promotional offers (only where you have explicitly opted in)
• Publishing your product review on the website
• Placing non-essential cookies (analytics, marketing, functional), as described in our Cookie policy

You can withdraw your consent at any time by clicking the unsubscribe link in any marketing e-mail, via the “Cookie settings” button on the Cookie policy page, or by writing to us at [email protected]. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

4. How we share your data

We do not sell your personal data. We share data only with trusted third-party service providers who process it on our behalf or to the extent necessary for the provision of our services:

4.1 Customer relationship management

• Intrix CRM — used to manage inquiries, quotes and customer relationships. Data processed: name, e-mail address, phone, company, country, content of the inquiry, the page from which the inquiry was submitted, and campaign attribution. Intrix privacy policy

4.2 Payments

• Stripe — processing of payment card payments. You enter your card details directly into Stripe’s secure environment; E-DISTI does not receive or store them. Stripe privacy policy
• PayPal — processing of payments via a PayPal account. PayPal privacy policy

For payment against a proforma invoice, payment data is processed by our bank as part of executing the transfer.

4.3 Delivery

To deliver products, we pass the recipient’s name, address, phone number and, where necessary, e-mail address to the parcel service or carrier performing the delivery, solely for the purpose of carrying out the delivery.

4.4 Embedded content and maps

• YouTube — product presentation videos are embedded in privacy-enhanced mode (youtube-nocookie.com), which means that YouTube does not place cookies until you play a video. Google privacy policy
• CARTO / OpenStreetMap — the map on the contact page loads map tiles from CARTO servers, which receive your IP address in the process. CARTO privacy policy

4.5 Analytics and advertising

The website is prepared for tools from Google (Google Analytics 4, Google Tag Manager, Google Ads), Meta (Meta Pixel) and Microsoft (Clarity). When enabled, they operate within Google Consent Mode, so that cookies are placed only with your consent given via the consent banner; without consent, measurement takes place only in aggregated, cookieless form. At the time this policy was published, these tools are not enabled. Google privacy policy · Meta privacy policy · Microsoft privacy statement

4.6 Hosting and infrastructure

Our website is hosted on servers within the European Union. We use established hosting providers that maintain appropriate technical and organisational security measures.

4.7 Legal requirements

We may disclose your data if required to do so by law, a court order or a regulatory authority, or if disclosure is reasonably necessary to protect the rights, property or safety of E-DISTI, our customers or the public.

5. International data transfers

Wherever possible, your data is processed within the European Economic Area (EEA). Some of our service providers (such as Stripe, PayPal, Google, Meta and Microsoft) may transfer data outside the EEA. In such cases, we ensure appropriate safeguards, including:

• adequacy decisions of the European Commission (including the EU–US Data Privacy Framework)
• standard contractual clauses (SCCs) approved by the European Commission
• certification of the service provider under an applicable mechanism

You can request information about the specific safeguards applied to transfers of your data by contacting us.

6. Data retention

We retain personal data only for as long as is necessary to fulfil the purposes described in this policy or as required by law:

• Order, invoice and transaction records: retained for at least 10 years from the date of the transaction, as required by Slovenian tax and accounting legislation
• Warranty and service records: retained for the entire duration of the warranty and for 2 years after its expiry
• Data from inquiry and contact forms: retained for up to 2 years from the date of the last interaction or until you request erasure
• Marketing data: retained until you withdraw your consent or unsubscribe
• Campaign attribution data: stored in your browser for up to 30 days; where attached to an inquiry or order, it is retained together with that inquiry or order
• Server logs: retained for up to 90 days for security and troubleshooting purposes

When data is no longer needed, we securely delete or anonymise it so that it can no longer be linked to you.

7. Your rights

Under the GDPR, you have the following rights in relation to your personal data. You can exercise any of them by writing to us at [email protected].

• Right of access — you can request a copy of the personal data we hold about you
• Right to rectification — you can request the correction of inaccurate or incomplete data
• Right to erasure (“right to be forgotten”) — you can request the erasure of your data, subject to statutory retention obligations
• Right to restriction of processing — in certain circumstances, you can request that we restrict the use of your data
• Right to data portability — you can request your data in a structured, commonly used and machine-readable format
• Right to object — you can object to processing based on legitimate interest, including direct marketing
• Right to withdraw consent — where processing is based on consent, you can withdraw it at any time
• Right to lodge a complaint — you have the right to lodge a complaint with the Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec) at www.ip-rs.si

We will respond to your request within 30 days. In complex cases, we may extend this period by a further 60 days; in that case, we will inform you of the extension and the reasons for it.

8. Data security

We implement appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure or destruction. These measures include:

• SSL/TLS encryption for all data transmitted between your browser and our servers
• processing of payment data exclusively by certified payment service providers (E-DISTI does not store card data)
• files attached via the contact form stored outside the public media library
• access controls that limit employee access to personal data to the extent strictly necessary
• regular security updates and monitoring of our systems

No method of transmission or storage is 100% secure. While we strive to protect your data, we cannot guarantee absolute security. If you become aware of a security vulnerability or breach, please notify us immediately.

9. Cookies

Our website uses cookies and similar technologies to ensure the proper functioning of the online shop and to remember your preferences. For detailed information about the cookies we use, their purposes and how to manage your preferences, please see our Cookie policy.

10. Children’s privacy

Our website and services are not intended for persons under the age of 18. We do not knowingly collect personal data from children. If we discover that we have inadvertently collected data from a person under the age of 18, we will delete it immediately. If you believe that a child has provided us with personal data, please notify us immediately.

11. Third-party links

Our website may contain links to third-party websites and services, including our social media profiles. This privacy policy applies only to our website. We are not responsible for the privacy practices of third-party websites and recommend that you read their privacy policies before providing any personal data.

12. Changes to this privacy policy

We may update this privacy policy from time to time to reflect changes in our practices, legal requirements or services. Changes will be published on this page with an updated “Last updated” date. Your continued use of the website after changes have been published constitutes acceptance of the amended policy.

13. Contact

If you have any questions about this privacy policy, wish to exercise your data protection rights or have concerns about how we handle your data, please contact us:

E-DISTI d.o.o. (SPARK Agregat)
Litijska cesta 259, 1261 Ljubljana – Dobrunje, Slovenia
E-mail: [email protected]
VAT ID: SI72537094

You also have the right to lodge a complaint with the supervisory authority:

Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec)
Dunajska cesta 22, 1000 Ljubljana, Slovenia
Website: www.ip-rs.si