Privacy Policy

Sanela Dmitrović, Psychological Counseling and Coaching Services
Effective Date: June 1, 2026

1. Introduction

This privacy policy explains how Sanela Dmitrović, Psychological Counselling and Coaching Services (hereinafter: "the Controller") collects, uses, stores and protects the personal data of individuals who use the Controller's services or visit the website www.saneladmitrovic.com.

The Controller is committed to protecting the privacy of individuals in accordance with Regulation (EU) 2016/679 (GDPR), the Personal Data Protection Act (ZVOP-2) and the Electronic Communications Act (ZEKom-2).

2. Data Controller

Sanela Dmitrović, Psychological Counselling and Coaching Services
Address: Pilonova ulica 10, 1000 Ljubljana, Slovenia
Email: contact@saneladmitrovic.com
Website: www.saneladmitrovic.com
Phone: +386 41 353 403

3. Categories of Personal Data

The Controller collects and processes the following categories of personal data:

  • Identity data – first name, surname;
  • Contact details – email address, phone number, postal address;
  • Contact form data – name, email address, phone number (optional), message content;
  • Appointment booking data – name, email address, preferred appointment time, any notes (where booking is available via the website);
  • Appointment records – date and time of sessions;
  • Payment data – transaction records, issued invoices;
  • Health and sensitive data – information obtained during psychological counselling and coaching sessions. This constitutes a special category of personal data under Article 9 GDPR;
  • Website usage data – IP address, browser type, time of visit;
  • Cookie data – further information is provided in the Cookie Policy.

4. Purposes of Processing and Legal Bases

The Controller processes personal data for the following purposes and on the following legal bases:

  • provision of psychological counselling and coaching services, including managing appointments and orders – Article 6(1)(b) GDPR (performance of a contract);
  • responding to enquiries received via the contact form or email, and communication with prospective clients – Article 6(1)(b) GDPR (steps taken at the request of the data subject prior to entering into a contract);
  • appointment booking via the website – Article 6(1)(b) GDPR (steps taken at the request of the data subject prior to entering into a contract);
  • compliance with legal obligations (tax and accounting legislation) – Article 6(1)(c) GDPR (legal obligation);
  • processing of health and sensitive data obtained during sessions – Article 9(2)(a) GDPR (explicit, separate and specific consent obtained before processing begins; consent is documented in accordance with Article 7(1) GDPR);
  • marketing, notifications and the use of cookies – Article 6(1)(a) GDPR (consent).

Providing personal data is in some cases a legal requirement (for example under tax legislation) and in others a contractual requirement for the provision of services. If an individual does not provide the requested data, the Controller may be unable to provide services or to meet legal obligations.

5. Data Retention

The Controller retains personal data only for as long as necessary to fulfil the purposes of processing, or in accordance with legal requirements:

  • Client and session records (including health data): 5 years after the end of the working relationship, or less where the individual requests erasure and no legal obligation prevents it;
  • Contact form data: 6 months after the end of the communication, where no contract is concluded;
  • Accounting records: 10 years, in accordance with legal requirements;
  • Consent records: for the duration of the consent and for 1 year after its withdrawal;
  • Website usage data: 12 months;
  • Cookies: depending on the type of cookie (details are provided in the Cookie Policy).

6. Rights of Data Subjects

Under the GDPR (Articles 15–22) you have the following rights:

  • Right of access (Art. 15) – to obtain confirmation of processing and access to your data;
  • Right to rectification (Art. 16) – to have inaccurate data corrected;
  • Right to erasure (Art. 17) – to have data erased where there is no longer a lawful basis for processing;
  • Right to restriction of processing (Art. 18) – to restrict processing in certain circumstances;
  • Right to data portability (Art. 20) – to receive your data in a structured, machine-readable format;
  • Right to object (Art. 21) – to object to processing based on legitimate interests or for direct marketing purposes; in the latter case the Controller will cease processing without delay;
  • Right not to be subject to automated decision-making (Art. 22) – the Controller does not carry out automated decision-making or profiling;
  • Right to withdraw consent – you may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal. Withdrawing consent must be as straightforward as giving it (Art. 7(3) GDPR).

To exercise these rights, contact the Controller by email at contact@saneladmitrovic.com. You will receive a response within 30 days. Where a request is complex, this period may be extended by two months.

If you believe that the processing of your personal data breaches the GDPR or ZVOP-2, you have the right to lodge a complaint with the supervisory authority:

Information Commissioner of the Republic of Slovenia
Dunajska cesta 22, 1000 Ljubljana
Email: gp.ip@ip-rs.si
Website: www.ip-rs.si

7. Disclosure to Third Parties and International Transfers

The Controller may disclose personal data to the following categories of recipients where necessary to fulfil the purposes of processing:

  • Webflow – website hosting and processing of contact form data (Webflow Forms);
  • YouTube / Google – embedded videos and analytics (details of processing via these providers' cookies are set out in the Cookie Policy);
  • Payment providers – [___];
  • Accounting services – [___].

Appropriate data processing agreements are in place with all processors in accordance with the GDPR. Some processors (in particular Webflow, Google and YouTube) are based in the United States. In such cases the Controller ensures an adequate level of protection on the basis of the EU-US Data Privacy Framework, standard contractual clauses (SCC) or other safeguards under Chapter V GDPR.

8. Cookies and Tracking Technologies

The website uses cookies and other tracking technologies. Detailed information is provided in the Cookie Policy, available on the website.

9. Data Security

The Controller applies appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction or disclosure, including encryption, access restrictions and regular security reviews. Despite these measures, the Controller cannot guarantee absolute security of data transmitted over the internet.

10. Changes and Contact

The Controller reserves the right to amend this policy. An updated version will be published on www.saneladmitrovic.com, stating the new date of effect.

For any questions or to exercise your rights, contact the Controller:

Email: contact@saneladmitrovic.com
Address: Pilonova ulica 10, 1000 Ljubljana, Slovenia
Website: www.saneladmitrovic.com