Ask around Slovenian SMEs and you will often hear that data protection was “sorted” years ago: a privacy page went up on the website and staff signed a confidentiality form. GDPR and ZVOP-2, the Slovenian implementing act, expect a good deal more from a controller. You should know which personal data you hold and on what grounds, keep that in a written register of processing, have contracts with every outside party that handles the data on your behalf, and back all of it up with real security controls. Weak spots usually surface on a bad day. Imagine a dental surgery in Maribor. A former patient requests every record kept on her, a receptionist sends lab results to the wrong address, or Informacijski pooblaščenec, the national supervisory authority, writes asking for details after a complaint. Nobody then cares how elegant the website wording is. The question becomes: where exactly is this person's data, and who has been able to open it? We handle the technical and organisational groundwork. Legal judgement stays with your solicitor or DPO, because Apply is not a law practice and does not sign off notices or contracts. What we do is hand your legal adviser a factual picture instead of assumptions.
A mailing list for a web shop and a surgery's patient files call for very different care. Health information is a special category under GDPR and raises expectations considerably. We scale the project to what you actually process, not to a fixed package.
We trace data to where it is really kept: Minimax or Pantheon, the payroll tool, your CRM, online booking, SharePoint, OneDrive, network shares, mailboxes and stray spreadsheets on laptops. Each finding becomes an entry ready for your register, covering purpose, categories, recipients, location and retention.
Contact forms, the cookie banner, newsletter sign-up and booking screens are checked. What gets collected, is consent asked for separately, and where is it logged? Your lawyer receives the findings so the published wording and the real behaviour line up.
Bookkeeper, payroll bureau, software house, delivery firm, mail provider: we establish who reaches your data and under which log-in. Unneeded access is removed, and we write up the security measures your lawyer can annex to each processing contract.
Group-based permissions in Entra ID or Google Workspace, a second sign-in factor, encrypted laptops, audit trails in Microsoft 365 and on file shares. Every control is logged with the date it went live and the person accountable.
Where the processing is higher risk, say camera surveillance, fleet tracking or handling medical records in bulk, we produce the technical chapter of the DPIA: how data flows, what could go wrong and which controls reduce it.
Retention periods from your policy are turned into actual rules in mail, document libraries and backups, so expired data disappears on schedule and you have proof that it did.
A single page covering the first few hours: who judges severity, which logs to freeze at once, what facts the person writing to the supervisory authority will need, and how affected people will be told.
High-value, low-effort fixes come first. Bigger changes wait until the groundwork is in place.
We speak with your data protection lead on video and examine your setup online. Afterwards you hold an overview of every system containing personal data and its current level of protection.
Dormant accounts of people who have left, shared log-ins and accounts without a second factor are closed within days. Little cost, visible results.
Encrypted laptops, audit trails, permissions by role and tighter rules for external sharing. Departments move over one at a time, so no one is suddenly shut out of their files.
A document lists each control with dates and accountable people. Reuse it for the register, processor contracts and any inquiry from the authority.
An inspector is not interested in whether you own antivirus. They want proof of what you have done. After a complaint or a leak, everything turns on proof: whose accounts had access, since when, which log shows it and when anyone last reviewed those rights. A safeguard that exists only in someone's memory looks exactly like no safeguard, so each one we introduce is dated and written down.
It hinges on your activities and the scale of processing. A surgery working with medical records on a large scale probably needs one; a small design studio often does not. Your legal adviser decides. If you already have a DPO, whether employed or contracted, we liaise with them directly and feed them the technical detail.
Work through the systems named in your register, from CRM and accounting to mailboxes, file shares and backup sets. Content search in Microsoft 365 locates messages and files that mention her name or address in a matter of minutes. The reply is generally due within a month, and it is wise for your lawyer to review it before sending.
Write to support@apply.si immediately, or to helpme@apply.si under a contract. We attempt to pull the message back, preserve logs and work out precisely what was exposed. With those facts, your legal adviser judges whether a notification to Informacijski pooblaščenec is required, bearing in mind that the 72-hour limit counts from when you first knew.
That is a third-country transfer, permitted only under specific safeguards such as standard contractual clauses, and your lawyer picks the right basis. We find out the actual hosting locations of your mailboxes, backup copies and applications, and document it so it slots straight into the register.
No; wording is a lawyer's task. Our role is checking the systems do what the notice promises. Where it states a two-year retention period, we check for a setting in mail and the CRM that enforces it, and report any mismatch in a brief memo.
Tell us in a few lines which systems hold information about clients and staff. Expect an initial view and a shortlist of where to start.
Enquiry received
An engineer will write back no later than the following working day. Faults that leave your staff unable to work are always looked at first.
No town by that name here. Check the letters, or settle for the nearest larger place. Our engineers work only over the internet, so Kočevje and Koper get precisely the same treatment.
