Privacy Policy

1. Data controller

We have not appointed a Data Protection Officer, as we are not required to do so. For all data protection questions, please write to the email address above.

• IOK Rehab, Ian Oskar Katanec s.p.
• Cesta Cirila Kosmača 9, 1211 Ljubljana-Šmartno, Slovenia
• Tax number: SI21718512 (VAT liable)
• Registration number: 8693447000
• Email: ian@ianoskarkatanec.com
• Phone: +386 40 800 198

2. Personal data we process

• Contact data you give us: name, email address, phone number and the content of your message when you use the contact form, email, phone or the booking tool.
• Newsletter data: email address and the date and record of your consent.
• Client and service data: information relevant to delivering a session, including health information you choose to share (e.g. injuries, pain, medical history). This is special category data under Article 9 GDPR and is processed only with your explicit consent or where necessary for health-care purposes.
• Invoicing data: name, address, tax number where required and payment details.
• Technical data: IP address, browser and device type, pages visited and time of visit, collected in server logs and, with your consent, analytics.

3. Legal bases for processing

• Performance of a contract or steps prior to a contract (Art. 6(1)(b) GDPR): arranging and delivering appointments and services.
• Legal obligation (Art. 6(1)(c) GDPR): accounting and tax records.
• Legitimate interest (Art. 6(1)(f) GDPR): security and proper operation of the website, responding to general enquiries, defence of legal claims.
• Consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR): newsletter, analytics and marketing cookies, and processing of health information. You may withdraw consent at any time with effect for the future.

4. Purposes

• responding to enquiries and arranging appointments;
• delivering therapy, training, bike fitting and mentoring services safely;
• issuing invoices and meeting statutory obligations;
• sending the newsletter, where you have subscribed;
• measuring and improving the website, where you have accepted analytics cookies;
• ensuring the security and integrity of the website.

5. Retention periods

When the retention period expires, data is deleted or irreversibly anonymised.

• Enquiries and correspondence: up to 2 years after the last contact.
• Client records including health information: up to 10 years after the last session, in line with professional and legal requirements.
• Invoices and accounting records: 10 years, as required by tax law.
• Newsletter data: until you unsubscribe or withdraw consent.
• Cookie consent record: 6 months; analytics data: up to 12 months.

6. Recipients and processors

Your data is confidential and is accessed only by the controller and, where necessary, by processors acting on our documented instructions under a data processing agreement.

• Website hosting and infrastructure providers.
• Calendly LLC — online scheduling, loaded only if you accept marketing/embedded-content cookies or open the booking link.
• Email and newsletter service providers.
• Our accountant, for invoicing and statutory records.

7. Transfers outside the EU/EEA

Some processors (for example Calendly) are located in the United States. Transfers take place only on the basis of an adequacy decision (EU–US Data Privacy Framework) or Standard Contractual Clauses adopted by the European Commission, together with supplementary safeguards where necessary. You may request a copy of the safeguards by writing to us.

8. Automated decision-making

We do not carry out automated decision-making or profiling that produces legal effects for you.

9. Your rights

To exercise your rights, write to ian@ianoskarkatanec.com. We respond without undue delay and within one month at the latest; in complex cases this may be extended by two further months, of which we will inform you.

You also have the right to lodge a complaint with the Information Commissioner of the Republic of Slovenia, Dunajska cesta 22, 1000 Ljubljana, gp.ip@ip-rs.si.

• access to your personal data and a copy of it;
• rectification of inaccurate or incomplete data;
• erasure (“right to be forgotten”), where no legal obligation requires retention;
• restriction of processing;
• objection to processing based on legitimate interest;
• data portability;
• withdrawal of consent at any time, without affecting the lawfulness of processing before withdrawal.

10. Providing data is voluntary

Providing personal data is voluntary. If you do not provide the data marked as required, we may be unable to answer your enquiry, arrange an appointment or deliver a service safely.

11. Security

We use appropriate technical and organisational measures — encrypted connections (HTTPS), access control, limited access to records and regular updates — to protect personal data against unauthorised access, loss or disclosure.

12. Cookies

This website uses cookies and similar technologies. Details of each cookie, its purpose and duration, and how to change your choices, are set out in the Cookie Policy.

13. Changes to this policy

We may update this policy. The current version, with the date of the last update, is always published on this page.