Covered here: this website, the enquiry form on it, and mail you address to one of the @apply.si inboxes. Excluded is anything we touch inside a client's own systems on that client's behalf, say while looking after its servers or its Microsoft 365 environment. There, the client company decides what happens to the data, and Apply only follows its instructions as processor, as agreed in a separate processing contract.
Controller
Responsibility for your data lies with the operator of apply.si, trading as Apply. Its seat lies beyond the EU, but since it works for individuals and firms in Slovenia and elsewhere in the Union, it applies the GDPR and ZVOP-2 to this processing.
- Company - Apply LLP; director and legal representative Andrey Vasin
- Seat - Bukhar Zhyrau Boulevard 62B, 050057 Almaty, Kazakhstan
- BIN - 220540005599, the official business identification number in Kazakhstan
- Mailbox for privacy matters - office@apply.si
- EU representative under the GDPR - [to be confirmed: appointment of a representative in the Union, plus name, postal address and email if one is appointed]
Whoever on our team holds the data protection brief reads privacy messages sent to office@apply.si. More company information is in our Legal notice.
Data we hold
We keep the amount of data small: just enough to reply or to deliver what was ordered. No ID card numbers, health details or other special categories are collected through the site, and children are not its audience. Everything we hold comes from you directly, via the form, email or a video call.
- Enquiry form - who you are, where we should answer, the subject you choose and what you write.
- Submission metadata - the URL the form was submitted from, the IP and the user agent string of your browser. With them we weed out spam and notice abuse.
- Commercial dealings - contact persons at the client, invoicing data and emails exchanged about the agreement.
- Support work - what went wrong, how the ticket evolved, and what our engineers wrote down about the fix.
- Card payments by individuals - sum, payment date and an order ID. Card numbers stay with the card processor; Apply never receives them.
Keep passwords out of the form and out of ordinary email. Log-in data for your systems is shared solely over an encrypted channel agreed between us beforehand.
What it is used for
- Replying to what you asked and pricing the work.
- Concluding and fulfilling an agreement with you or the firm you work for.
- Handling tickets and documenting each intervention so it can be traced later.
- Issuing invoices and meeting tax and bookkeeping duties.
- Keeping junk submissions, bots and intrusion attempts away from the site.
- Protecting our legal position if a disagreement ever ends up as a formal claim.
There is no profiling, no decision about you is left to an algorithm alone, and newsletters or offers reach you only after you have opted in.
Legal bases and storage periods
For every purpose we name a GDPR legal basis and a time limit. After the limit, unless a statute obliges us to keep something longer, the data is erased or made anonymous.
| Purpose | Basis | Kept for |
|---|---|---|
| Replying to a message sent through the form or by email | Steps you asked us to take before a possible contract, or our legitimate interest in answering correspondence | Until the matter and any follow-ups are closed, or until you raise an objection |
| Delivering contracted services and support | Necessity for a contract | While the agreement runs, then for the period in which contractual claims could still be brought |
| Invoices and bookkeeping | A legal duty that applies to us | The span set by the accounting record-keeping rules |
| Protecting the site against misuse | Legitimate interest in a secure website | IP and user agent only as long as an abuse case needs to be detected and examined |
| Preferences saved in your browser | Strictly needed for the site to function | Until you remove them yourself |
Cookies and local storage
You will find no analytics, no ad trackers and no third-party cookies on apply.si. Only two cookies exist, both technical: one keeps your session, the other guards the form against cross-site request forgery (CSRF). Without them an enquiry cannot be submitted, and both expire as soon as you close the session. ZEKom-2 does not make such cookies subject to consent; we mention them anyway for transparency.
Three small preferences are also kept in your browser's localStorage: the region picked in the header, your choice of light or dark theme, and a note that the cookie message was already shown. They stay on your device, are never uploaded to us, and can be cleared from the browser at any moment. Should analytics ever be added, this page will change first and you will be asked to agree.
Recipients
Your data is not for sale and is never used in advertising. Only the suppliers that keep the business running can reach it, and each of them is tied by contract to process it strictly as we direct.
- Hosting - provides the server where the site runs and incoming enquiries are saved. Who that provider is, the Legal notice explains.
- Email - hosts the @apply.si inboxes along with all mail exchanged with clients and prospective clients.
- Alerts - pushes the name, contact, subject and message of every new enquiry into a chat app, so somebody on the team picks it up quickly. That app's operator may also process data outside the EU; the transfers section below applies.
- Card processor - charges cards for individual clients and is itself responsible for the card data.
- Authorities and courts - only under a legal obligation, such as an order from a court or a request by the tax administration.
Data leaving the EU
We prefer to say it plainly. Apply LLP is registered in Kazakhstan, the people on our team work from several places, a number of them open data from locations outside the EU, and certain tools we rely on may be hosted outside the Union as well. Processing of your data beyond the European Economic Area is therefore possible, and the GDPR treats this as a third-country transfer.
Kazakhstan has no adequacy finding from the European Commission. Any transfer must then rest on one of the safeguards the GDPR recognises, typically the Commission's standard contractual clauses, or in narrow situations on the exception for transfers that are necessary to fulfil your contract or the pre-contract steps you asked for. This part is still open: [to be confirmed: transfer mechanism (standard contractual clauses or other), destination countries and categories of recipients]. Technically, connections are encrypted, accounts are personal and sign-in requires more than one factor. Write to office@apply.si if you would like to see the safeguards we apply.
Protection and disposal
Data that no purpose listed here still needs, and that no rule obliges us to keep, is erased or stripped of anything that could identify a person.
- Access follows need: colleagues see only what their task requires.
- Accounts are individual, with multi-factor sign-in on every system that offers it.
- Traffic is encrypted, and backup copies live separately from the live environment.
- Where a breach could endanger your rights, the Information Commissioner hears from us within 72 hours of our learning of it, and in high-risk cases the affected people are told promptly as well.
Your rights
The GDPR and ZVOP-2 give you, as the person the data relates to, the right to:
- ask whether we hold data about you and receive a copy of it;
- have wrong or incomplete details corrected;
- have data erased where the legal conditions are met;
- have processing restricted;
- take the data you supplied with you in a portable format;
- object where we rely on legitimate interest;
- complain to a supervisory authority.
Email office@apply.si, preferably from an address already on record, and name the right in question. If it is unclear that the request really comes from you, we may ask you to confirm who you are. The answer comes promptly and no later than one month after receipt, usually at no cost; for complicated cases the deadline can be extended, and we would let you know about that within the first month.
Should you believe we are mishandling your data, you can turn to the Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec), or to the data protection authority of the EU country where you reside or are employed.
Accounting records and invoices have to be kept for the statutory period, so they cannot be erased early even if you ask. Meanwhile access to them is restricted, they serve only legal obligations, and they are destroyed when the period ends.
Getting in touch about privacy
For anything concerning this notice, or to ask for a copy, a correction or deletion, use office@apply.si. We monitor that inbox on weekdays from 9:00 to 17:00 Central European Time. Other channels are described under Contact.