5P Group Privacy Statement

This statement explains how the companies of the 5P Group (hereinafter: the 5P network) collect, process, retain and protect your personal data. It applies to all websites, shops and services of the 5P network listed in Section 2 or referring to this statement.

This statement has been prepared in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation, hereinafter: the GDPR), ZVOP-2 (Personal Data Protection Act), ZEKom-2 (Electronic Communications Act) and ZVPot-1 (Consumer Protection Act). We process personal data lawfully, fairly and transparently, for specified and legitimate purposes, and only to the extent necessary for those purposes.

1. Who is the controller of your personal data?

Each company in the 5P network is an independent controller of the personal data it processes in the course of its business activities. The controller is the company with which you enter into a contract, place an order or communicate, or the company that operates the website you visit.

The following companies in the 5P network act as controllers:

• Aero Print d.o.o., Bratovševa ploščad 34, 1000 Ljubljana, Slovenia, VAT ID: SI12636533
• Graving d.o.o., Bratovševa ploščad 34, 1000 Ljubljana, Slovenia, VAT ID: SI92079814
• Celzija d.o.o., Bratovševa ploščad 34, 1000 Ljubljana, Slovenia
• Studio Jager d.o.o., Bratovševa ploščad 34, 1000 Ljubljana, Slovenia
• Aprinti Hub d.o.o., Ulica Franje Petračića 4, 10110 Zagreb, Croatia, OIB: 81981529948

A common contact point is available for all questions concerning personal data protection: [email protected] or Bratovševa ploščad 34, 1000 Ljubljana. Given the scope and nature of the processing, none of the companies is required to designate a data protection officer (DPO) under Article 37 GDPR.

2. Which websites does this statement apply to?

This statement applies, inter alia, to the following websites of the 5P network:

Website	Controller
5p.si, 5p.is	Aero Print d.o.o.
aeroprint.si	Aero Print d.o.o.
managerka.si, klub.managerka.si, shop.managerka.si, akademija.managerka.si	Aero Print d.o.o.
graving.si, gravingx.com	Graving d.o.o.
studio-jager.si	Studio Jager d.o.o.
cangura.com, knjige.plus, karma-plus.com, lep-paket.si, hude-majice.si, mojadarila.com, moj-planer.com, pobarvam.si, libri.one, 3x.si, prihrani.info, plagi.net, lardiology.com	the company in the 5P network identified in the footer or legal notice of the relevant website

If the controller of a particular website is not identified, please contact us at [email protected]. We will inform you who the controller is.

3. What personal data do we process?

Depending on your relationship with us, we process the following categories of personal data:

• Identification data: first name and surname, company name where you act as a legal person or sole trader, and tax number or VAT identification number.
• Contact details: email address, telephone number, delivery address and billing address.
• Order and business relationship data: order history, order specifications and special requirements, payment data, and complaints and warranty documentation. We do not retain full payment card details. Certified payment service providers process payments.
• Technical data: IP address, browser type and version, device and operating system data, cookies and similar technologies, and server access logs.
• Communications data: the content of emails and other correspondence, support requests, complaints, feedback and reviews.

We do not collect or process special categories of personal data under Article 9 GDPR, such as data concerning health, religious beliefs, ethnic origin or biometric data used to identify a person uniquely.

4. For what purposes and on what legal basis do we process data?

We process personal data only where one or more of the legal bases set out in Article 6(1) GDPR apply:

• Consent (point (a)): to send newsletters and marketing communications and to use analytics and marketing cookies. You may withdraw your consent at any time using the unsubscribe link in the communication, through the cookie notice or by sending a request to [email protected]. Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.
• Performance of a contract (point (b)): to prepare quotations, process and confirm orders, arrange delivery, issue invoices, process payments, handle complaints and warranties, and provide after-sales services.
• Legal obligation (point (c)): to retain accounting and tax documents pursuant to ZDavP-2 (Tax Procedure Act) and the Accounting Act; comply with obligations under anti-money laundering legislation; provide data to tax authorities and other competent authorities on the basis of a lawful request; and, where the controller is a publisher, comply with obligations under the Legal Deposit of Publications Act.
• Legitimate interests (point (f)): to ensure the security of information systems and websites; prevent misuse and fraud; improve services on the basis of feedback; recover claims and establish, exercise or defend legal claims; inform existing customers about our own similar products and services; and publish client references as described in Section 9. You may object to processing on this basis at any time.

5. How long do we retain data?

We retain data only for as long as necessary for the purpose of processing or as required by law. After the applicable retention period expires, we securely delete or anonymise the data.

Type of data	Retention period
Contract and order data	for the duration of the business relationship and for 5 years after its termination (limitation period under the Code of Obligations)
Accounting and tax documentation	10 years from the end of the financial year to which it relates
Consent to marketing communications	until consent is withdrawn and for a further 30 days
Technical data and access logs	60 days from their creation
Complaints documentation	3 years from the closure of the complaint
Cookies	according to the lifetime of each cookie (see the Cookie Policy)
Data required for legal claims	until the proceedings have been concluded by a final decision, irrespective of the periods specified above

6. To whom do we disclose data?

We disclose data only where necessary for the purpose of processing or where required by law. We have concluded a data processing agreement in accordance with Article 28 GDPR with each external processor.

We may disclose data to the following categories of recipients:

• delivery service providers (e.g. Pošta Slovenije, GLS, DPD and DHL), which receive only the data required for delivery, namely your name, address and telephone number;
• payment service providers (banks, payment card processors and other certified providers) operating in accordance with the PCI DSS standard;
• accounting service providers for accounting, tax reporting and audits;
• IT infrastructure providers for hosting, email, backups, content delivery and protection against misuse, e.g. Cloudflare, whose access is limited to the minimum necessary;
• Google Analytics 4 for website traffic analysis, but only with your consent;
• advertising platforms (e.g. Google Ads and Meta), but only with your explicit consent to marketing cookies;
• tax authorities, courts and other competent authorities on the basis of a legal obligation or lawful order;
• other companies in the 5P network, but only to the extent necessary to fulfil an order involving more than one company. All companies in the network ensure an equivalent level of data protection.

Transfers to third countries: As a rule, we process data within the EU or EEA. Where a transfer to a third country is unavoidable, for example when using global cloud services, we carry it out only in accordance with Chapter V GDPR: on the basis of an adequacy decision under Article 45, standard contractual clauses under Article 46(2)(c), or your explicit consent. We will provide details of the safeguards upon request.

7. How do we use cookies?

We use strictly necessary cookies to operate our websites, including cookies for sessions, shopping baskets, login and security. We place analytics and marketing cookies only after you have given your consent through the cookie notice.

The Cookie Policy provides a list of cookies, their purposes and lifetimes, and instructions for changing your consent.

8. How do we inform you about our offers?

We send marketing communications in accordance with ZEKom-2 and the GDPR:

• we send newsletters and promotional communications only to persons who have explicitly consented to receive them;
• on the basis of legitimate interests under Article 6(1)(f) GDPR in conjunction with ZEKom-2, we may send existing customers communications concerning our own similar products and services;
• each communication contains the sender’s details and a functioning unsubscribe link; we process unsubscribe requests within 3 working days;
• we send no more than 60 marketing communications per year to each recipient, except during temporary special promotional campaigns.

9. Do we publish client references?

We may publish the customer’s name or company name, a brief description of the completed project and samples of completed work on websites, in presentations and on social media. Publication is based on legitimate interests under Article 6(1)(f) GDPR and does not include trade secrets or the personal data of the customer’s employees.

If you object to such publication, please notify us at [email protected]. We will act upon your objection within 10 working days.

10. Do we use automated decision-making?

We may process data by automated means to display relevant products, segment customers for marketing communications, but only with consent, and prioritise orders according to deadline and complexity. We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR.

11. What are your rights?

Under the GDPR and ZVOP-2, you may exercise the following rights free of charge:

• access to your data and obtain a copy of it (Article 15);
• rectification of inaccurate data or completion of incomplete data (Article 16);
• erasure (Article 17), except where we are required to retain the data due to legal obligations or legal claims;
• restriction of processing (Article 18);
• data portability for data you have provided to us, in a structured, machine-readable format (Article 20);
• objection to processing based on legitimate interests; we will always uphold an objection to direct marketing without requiring you to provide reasons (Article 21);
• withdrawal of consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

Please send your request to [email protected] or by post to Bratovševa ploščad 34, 1000 Ljubljana. We will respond within 30 days of receiving your request. In the case of complex or numerous requests, we may extend this period by up to 60 days and will inform you of the extension in advance. To protect your data, we may verify your identity before responding.

12. Where can you lodge a complaint?

If you believe that the processing of your data infringes the applicable rules, you may lodge a complaint with the supervisory authority. The competent authority for the Slovenian companies in the 5P network is:

Informacijski pooblaščenec Republike Slovenije (Information Commissioner of the Republic of Slovenia)
Dunajska cesta 22, 1000 Ljubljana
Email: [email protected]
Telephone: 01 230 97 30
Website: www.ip-rs.si

For Aprinti Hub d.o.o., the competent authority is the Croatian Agencija za zaštitu osobnih podataka (AZOP), www.azop.hr. You may also lodge a complaint with the supervisory authority of the EU Member State in which you reside or work.

13. Changes to this statement

We update this statement whenever there is a material change in our practices or the applicable legislation. The current version is always published on this page together with its effective date.

This version applies from 12 November 2026. We will notify you of material changes by email or through a prominent notice on the website.

14. Contact

For questions, requests or complaints concerning personal data, please contact us at [email protected] or write to us at Bratovševa ploščad 34, 1000 Ljubljana.