Privacy Policy
This policy describes what the website tech.irnas.eu actually does with personal data. It is written against the code that runs the site, not against a template: every statement below corresponds to a behaviour that exists in the application.
1. Who is responsible
The controller of the personal data described here is:
IRNAS Technologies d.o.o.
Sokolska ulica 51
2000 Maribor, Slovenia, EU
VAT ID: SI78993857
Email: tech@irnas.eu
We process personal data under Regulation (EU) 2016/679 (GDPR) and the Slovenian Personal Data Protection Act (ZVOP-2). We have not appointed a data protection officer.
2. What this website stores on your device
The public website sets no cookies at all. Visiting any public page produces no Set-Cookie response.
The homepage may save up to three preference values in your browser's localStorage. These are first-party values, they are read only by the page itself, and they are never sent to our server or to anyone else:
irnas_theme— your light or dark appearance choice.irnas_cookie_notice— the fact that you dismissed the storage notice, so it is not shown again.irnas_dnt— your answer to the "Store nothing on this device" option.
If your browser sends a Do Not Track signal, or if you tick "Store nothing on this device" in the notice, the page writes nothing to storage: your preferences are held in memory for that browser tab only and are forgotten when you close it. Any values previously written by this site are deleted at that moment.
A session cookie named IRNASADMSESS exists only inside the /dashboard administration area and only for logged-in company staff. It is not set for visitors of the public site. Details are in our Cookie Policy.
3. No third-party content
The public pages load nothing from other companies. There is no analytics tag, no advertising, no social media embed, no content delivery network and no external font service. A Content-Security-Policy response header restricts the page to resources from this origin, so third-party content cannot be loaded even by mistake.
4. The contact form
4.1 What is recorded
When you submit the contact form we record:
- Name and email address — required.
- Company and topic — optional.
- Your message.
- The language the form was displayed in (en or sl).
- Your browser's user agent string, truncated to the first 500 characters.
- An anonymised IP address.
4.2 How the IP address is anonymised
Before anything is written down, the address is shortened: for IPv4 the last octet is set to zero (203.0.113.45 becomes 203.0.113.0), and for IPv6 only the first 48 bits — the routed network prefix — are kept. Only this shortened value is stored, and it is also the value used for the form's rate limit. To be precise rather than flattering: the full address is unavoidably present in the server's memory for the moment it takes to compute the shortened form, and it is separately recorded in the web server log described in section 5. What we never do is write the full address into the enquiry record.
4.3 Why, and on what legal basis
The content of your message is processed to answer your enquiry. The user agent and the anonymised network address are kept to detect and limit automated abuse of the form.
The legal basis is Article 6(1)(f) GDPR, legitimate interest: you contacted a business with a business enquiry and expect an answer, so replying to you — and keeping the form usable by preventing spam — is a legitimate interest that does not override your rights, particularly because the record contains only what you chose to send us plus a network prefix that does not identify your connection. Where your enquiry concerns entering into a contract with us, Article 6(1)(b) (steps taken at your request prior to a contract) applies as well.
Providing the form data is not a statutory or contractual requirement; you are free not to use the form and to email us instead. Without a name, email address and message we cannot reply.
4.4 Where it is stored and who sees it
Enquiries are stored in a SQL database on the same server that serves this website, hosted in Germany. The database accepts connections only from that server, through a single account whose password is kept in a file outside the web root. There is no third-party analytics, CRM or marketing platform involved.
A notification copy of your enquiry is emailed to our own mailbox at tech@irnas.eu. The website hands that message to Microsoft 365 — over an authenticated SMTP connection, or through the Microsoft Graph interface when the site is signed in to Microsoft — so Microsoft handles it as our email provider. If the notification cannot be delivered, your enquiry is still in the database and we answer it from there. Beyond this, enquiry data is disclosed only if we are legally required to do so.
We do not sell, rent or trade personal data, and we do not use it for automated decision-making or profiling.
5. Server logs and website statistics
Like any web server, ours writes an access log. Each entry contains the requesting IP address in full, the date and time, the requested URL, the HTTP status, the referring page and the user agent. These logs exist to keep the server running and secure and to investigate faults and attacks; the legal basis is Article 6(1)(f), our legitimate interest in operating a secure service. Log files are rotated daily by the hosting platform and older files are removed automatically after roughly two weeks.
Since February 2026 we produce visitor statistics with AWStats. This is important to understand correctly: AWStats reads the server log files described above on the server. It is not a JavaScript tag, it does not run in your browser, it sets nothing on your device and it sends nothing to anyone else. The generated reports are password-protected and are not publicly accessible.
What those reports contain is worth stating plainly. Because they are built from the raw log, several of their pages — the host list, the most recent visits and the unresolved addresses — show full IP addresses, not the shortened form described in section 4.2. One report is kept for each month AWStats has run, at present back to February 2026, so an address that appears in a report is held longer than the log file it came from. If you would like your address removed from the statistics, write to tech@irnas.eu.
6. How long we keep things
| Data | Retention |
|---|---|
| Contact form enquiries | 24 months from submission |
| Administrator action records (audit log) | 24 months |
| Application diagnostic logs | 6 months |
| Failed login counters | 30 days |
| Web server access logs | Rotated daily, about two weeks |
| AWStats monthly reports (contain full IP addresses) | One per month, currently kept from February 2026 onwards |
Email correspondence that grows out of an enquiry lives in our mailbox and is kept for as long as the business relationship or applicable accounting and statutory obligations require.
7. Your rights
Under Articles 15 to 22 GDPR you have the right to:
- Access the personal data we hold about you and receive a copy of it.
- Rectification of inaccurate or incomplete data.
- Erasure of your data, where the conditions of Article 17 are met.
- Restriction of processing in the cases listed in Article 18.
- Data portability for data you provided to us.
- Object at any time to processing based on legitimate interest, including everything described in sections 4 and 5.
To exercise any of these, email tech@irnas.eu. Be honest with us about which enquiry you are asking about, since that is usually the only way we can find your record. Requests are handled manually by a person — there is no self-service export or account area — and we answer within one month, as Article 12(3) requires. We may ask for information that lets us confirm the request comes from you.
None of the processing described here relies on consent, so there is no consent for you to withdraw. Your storage choices on the device are described in section 2 and you can change them at any time.
8. Complaints
If you believe we are handling your personal data unlawfully, you may lodge a complaint with the Slovenian supervisory authority:
Informacijski pooblaščenec (Information Commissioner of the Republic of Slovenia)
Dunajska cesta 22
1000 Ljubljana, Slovenia
Email: gp.ip@ip-rs.si
Web: www.ip-rs.si
You may also complain to the supervisory authority of your habitual residence or place of work.
9. Security
The site is served over HTTPS, so traffic between your browser and the server is encrypted. The database is not reachable from the internet, and its credentials — like every other secret this site holds — sit in a single file outside the document root that only the web account can read. The administration area requires a password and locks out repeated failed logins, and the browser is constrained by a Content-Security-Policy and related security headers.
10. Transfers outside the EEA
The website and its database run on a server in Germany. We do not transfer enquiry records outside the European Economic Area ourselves. The mailbox copy described in section 4.4 is handled by our email provider under its own data protection terms.
11. Children
This is a business website and is not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has sent us data through the form, write to tech@irnas.eu and we will delete it.
12. Changes to this policy
If the website's behaviour changes, this page is updated in the same change. The date at the top always refers to the version you are reading.
13. Contact
Questions about this policy or about your data:
IRNAS Technologies d.o.o.
Sokolska ulica 51
2000 Maribor, Slovenia, EU
Email: tech@irnas.eu
Politika zasebnosti
Ta politika opisuje, kaj spletno mesto tech.irnas.eu z osebnimi podatki dejansko počne. Napisana je po kodi, ki spletno mesto poganja, in ne po predlogi: vsaka trditev spodaj ustreza ravnanju, ki v aplikaciji resnično obstaja.
1. Kdo je odgovoren
Upravljavec opisanih osebnih podatkov je:
IRNAS Technologies d.o.o.
Sokolska ulica 51
2000 Maribor, Slovenija, EU
Identifikacijska številka za DDV: SI78993857
E-pošta: tech@irnas.eu
Osebne podatke obdelujemo v skladu z Uredbo (EU) 2016/679 (Splošna uredba o varstvu podatkov) in Zakonom o varstvu osebnih podatkov (ZVOP-2). Pooblaščene osebe za varstvo podatkov nismo imenovali.
2. Kaj spletno mesto shrani na vašo napravo
Javni del spletnega mesta ne nastavlja nobenih piškotkov. Ob obisku katere koli javne strani odgovor strežnika ne vsebuje glave Set-Cookie.
Domača stran lahko v lokalno shrambo (localStorage) vašega brskalnika shrani do tri nastavitve. Gre za lastne vrednosti tega spletnega mesta; bere jih le stran sama in nikoli ne potujejo do našega strežnika ali do kogar koli drugega:
irnas_theme— izbira svetlega ali temnega videza;irnas_cookie_notice— podatek, da ste obvestilo o shranjevanju zaprli, da se ne prikaže znova;irnas_dnt— vaš odgovor na možnost »Ne shranjuj ničesar na tej napravi«.
Če vaš brskalnik pošilja signal Do Not Track ali če v obvestilu označite »Ne shranjuj ničesar na tej napravi«, stran ne zapiše ničesar: nastavitve ostanejo le v pomnilniku tistega zavihka in se pozabijo, ko ga zaprete. Vrednosti, ki jih je to spletno mesto zapisalo prej, se v tistem trenutku izbrišejo.
Sejni piškotek IRNASADMSESS obstaja izključno v skrbniškem delu in samo za prijavljene sodelavce podjetja. Obiskovalcem javnega dela se ne nastavi. Podrobnosti so v Politiki piškotkov.
3. Brez vsebin tretjih oseb
Javne strani ne naložijo nobene vsebine drugih podjetij. Ni analitične kode, oglaševanja, vgrajenih vsebin družbenih omrežij, omrežja za dostavo vsebin (CDN) in ne zunanje storitve za pisave. Glava Content-Security-Policy stran omejuje na vire z lastnega izvora, zato vsebin tretjih oseb ni mogoče naložiti niti pomotoma.
4. Kontaktni obrazec
4.1 Kaj se zabeleži
Ob oddaji kontaktnega obrazca zabeležimo:
- ime in e-poštni naslov — obvezno;
- podjetje in temo — neobvezno;
- vaše sporočilo;
- jezik, v katerem je bil obrazec prikazan (en ali sl);
- identifikacijski niz brskalnika (user agent), skrajšan na prvih 500 znakov;
- anonimiziran naslov IP.
4.2 Kako je naslov IP anonimiziran
Preden se karkoli zapiše, se naslov skrajša: pri IPv4 se zadnji oktet nastavi na nič (203.0.113.45 postane 203.0.113.0), pri IPv6 pa ohranimo le prvih 48 bitov, torej omrežno predpono. Shrani se samo ta skrajšana vrednost, ki je hkrati vrednost za omejevanje pogostosti oddaj obrazca. Da bomo natančni in ne bomo ničesar olepševali: celoten naslov je neizogibno v pomnilniku strežnika tisti trenutek, ko se izračuna skrajšana oblika, in se ločeno zapiše v dnevnik spletnega strežnika iz 5. točke. Nikoli pa celotnega naslova ne zapišemo v zapis povpraševanja.
4.3 Zakaj in na kateri pravni podlagi
Vsebino vašega sporočila obdelamo zato, da vam odgovorimo. Identifikacijski niz brskalnika in anonimizirano omrežno predpono hranimo za zaznavanje in omejevanje samodejnih zlorab obrazca.
Pravna podlaga je člen 6(1)(f) Splošne uredbe, tj. zakoniti interes: na podjetje ste se obrnili s poslovnim povpraševanjem in pričakujete odgovor, zato sta odgovarjanje in ohranjanje uporabnosti obrazca s preprečevanjem neželene pošte zakoniti interes, ki ne prevlada nad vašimi pravicami — zlasti zato, ker zapis vsebuje le tisto, kar ste nam poslali sami, in omrežno predpono, ki vašega priključka ne identificira. Kadar se vaše povpraševanje nanaša na sklenitev pogodbe z nami, se uporablja tudi člen 6(1)(b) (ukrepi na vašo zahtevo pred sklenitvijo pogodbe).
Posredovanje podatkov v obrazcu ni zakonska ali pogodbena obveznost; obrazca vam ni treba uporabiti in nam lahko pišete po e-pošti. Brez imena, e-poštnega naslova in sporočila vam ne moremo odgovoriti.
4.4 Kje so shranjeni in kdo jih vidi
Povpraševanja shranjujemo v podatkovno bazo MariaDB na istem strežniku, ki streže to spletno mesto in gostuje pri družbi Hetzner Online GmbH v Nemčiji. Baza sprejema povezave samo s tega strežnika, in sicer prek enega samega računa, čigar geslo je shranjeno v datoteki zunaj korenske mape spletnega mesta. Pri tem ne sodeluje nobena analitična platforma, sistem CRM ali trženjska platforma tretjih oseb.
Kopijo obvestila o vašem povpraševanju pošljemo v naš lastni e-poštni predal tech@irnas.eu. Spletno mesto to sporočilo preda storitvi Microsoft 365 — prek overjene povezave SMTP ali prek vmesnika Microsoft Graph, kadar je spletno mesto prijavljeno v Microsoft — zato ga Microsoft obdeluje kot naš ponudnik e-pošte. Če obvestila ni mogoče dostaviti, vaše povpraševanje kljub temu ostane v podatkovni bazi in nanj odgovorimo od tam. Sicer podatke iz povpraševanj razkrijemo le, če nam to nalaga zakon.
Osebnih podatkov ne prodajamo, ne oddajamo v najem in ne izmenjujemo ter jih ne uporabljamo za avtomatizirano odločanje ali oblikovanje profilov.
5. Dnevniki strežnika in statistika obiska
Kot vsak spletni strežnik tudi naš piše dnevnik dostopov. Vsak vnos vsebuje celoten naslov IP, datum in čas, zahtevani naslov URL, statusno kodo HTTP, napotitveno stran in identifikacijski niz brskalnika. Ti dnevniki obstajajo zato, da strežnik deluje varno in da lahko raziščemo napake in napade; pravna podlaga je člen 6(1)(f), torej naš zakoniti interes za varno delovanje storitve. Gostiteljska platforma dnevnike dnevno rotira, starejše datoteke pa samodejno odstrani po približno dveh tednih.
Od februarja 2026 pripravljamo statistiko obiska z orodjem AWStats. To je pomembno razumeti pravilno: AWStats na strežniku bere zgoraj opisane dnevniške datoteke. Ni sledilna koda JavaScript, ne teče v vašem brskalniku, na vašo napravo ne zapiše ničesar in nikomur ničesar ne pošlje. Ustvarjena poročila so zaščitena z geslom in niso javno dostopna.
Povedati je treba tudi, kaj ta poročila vsebujejo. Ker nastanejo iz surovega dnevnika, več njihovih strani — seznam gostiteljev, zadnji obiski in nerazrešeni naslovi — prikazuje celotne naslove IP, ne skrajšane oblike iz točke 4.2. Za vsak mesec, v katerem je AWStats deloval, se ohrani eno poročilo, trenutno vse od februarja 2026, zato je naslov v poročilu shranjen dlje kot dnevniška datoteka, iz katere izvira. Če želite, da vaš naslov odstranimo iz statistike, nam pišite na tech@irnas.eu.
6. Kako dolgo hranimo podatke
| Podatki | Rok hrambe |
|---|---|
| Povpraševanja iz kontaktnega obrazca | 24 mesecev od oddaje |
| Zapisi o dejanjih skrbnikov (revizijska sled) | 24 mesecev |
| Diagnostični dnevniki aplikacije | 6 mesecev |
| Števci neuspelih prijav | 30 dni |
| Dnevniki dostopov spletnega strežnika | dnevna rotacija, približno dva tedna |
| Mesečna poročila AWStats (vsebujejo celotne naslove IP) | eno na mesec, trenutno hranjena od februarja 2026 naprej |
E-poštna korespondenca, ki se razvije iz povpraševanja, ostane v našem predalu in se hrani toliko časa, kolikor zahtevajo poslovno razmerje ter računovodske in zakonske obveznosti.
7. Vaše pravice
Po členih od 15 do 22 Splošne uredbe imate pravico do:
- dostopa do osebnih podatkov, ki jih hranimo o vas, in do njihove kopije;
- popravka netočnih ali nepopolnih podatkov;
- izbrisa podatkov, kadar so izpolnjeni pogoji iz člena 17;
- omejitve obdelave v primerih iz člena 18;
- prenosljivosti podatkov, ki ste nam jih posredovali;
- ugovora zoper obdelavo, ki temelji na zakonitem interesu, torej zoper vse, kar je opisano v 4. in 5. točki.
Za uveljavljanje pravic pišite na tech@irnas.eu. Bodite z nami odkriti glede tega, na katero povpraševanje se zahteva nanaša, saj je to običajno edini način, da vaš zapis najdemo. Zahteve ročno obravnava človek — samopostrežnega izvoza ali uporabniškega računa ni — odgovorimo pa v enem mesecu, kot zahteva člen 12(3). Zaprosimo vas lahko za podatke, s katerimi potrdimo, da zahteva prihaja od vas.
Nobena tu opisana obdelava ne temelji na privolitvi, zato ni privolitve, ki bi jo lahko preklicali. Vaše izbire glede shranjevanja na napravi so opisane v 2. točki in jih lahko kadar koli spremenite.
8. Pritožbe
Če menite, da vaše osebne podatke obdelujemo nezakonito, lahko vložite pritožbo pri slovenskem nadzornem organu:
Informacijski pooblaščenec Republike Slovenije
Dunajska cesta 22
1000 Ljubljana, Slovenija
E-pošta: gp.ip@ip-rs.si
Splet: www.ip-rs.si
Pritožbo lahko vložite tudi pri nadzornem organu v državi svojega običajnega prebivališča ali kraja dela.
9. Varnost
Spletno mesto strežemo prek protokola HTTPS, zato je promet med vašim brskalnikom in strežnikom šifriran. Podatkovna baza ni dosegljiva iz interneta, njeni dostopni podatki pa so — tako kot vse druge skrivnosti tega spletnega mesta — v eni sami datoteki zunaj korenske mape, ki jo lahko bere samo spletni račun. Skrbniški del zahteva geslo in ob ponavljajočih se neuspelih prijavah zaklene dostop, brskalnik pa omejujejo glava Content-Security-Policy in druge varnostne glave.
10. Prenosi zunaj EGP
Spletno mesto in njegova podatkovna baza tečeta na strežniku v Nemčiji. Zapisov o povpraševanjih sami ne prenašamo iz Evropskega gospodarskega prostora. Kopijo v e-poštnem predalu iz točke 4.4 obravnava naš ponudnik e-pošte v skladu s svojimi pogoji varstva podatkov.
11. Otroci
To je poslovno spletno mesto in ni namenjeno otrokom. Osebnih podatkov oseb, mlajših od 16 let, zavestno ne zbiramo. Če menite, da nam je otrok poslal podatke prek obrazca, nam pišite na tech@irnas.eu in podatke bomo izbrisali.
12. Spremembe te politike
Če se ravnanje spletnega mesta spremeni, hkrati s to spremembo posodobimo tudi to stran. Datum na vrhu se vedno nanaša na različico, ki jo berete.
13. Kontakt
Vprašanja o tej politiki ali o vaših podatkih:
IRNAS Technologies d.o.o.
Sokolska ulica 51
2000 Maribor, Slovenija, EU
E-pošta: tech@irnas.eu