Privacy Policy

Last updated: 7 October 2026

This Personal Data Protection Policy is intended to inform users (hereinafter also referred to as the “individual” or “data subject”) of the website https://pekauto.com/ (hereinafter: the “Website”) about the ways in which personal data is collected, processed, stored and protected when users visit the Website or provide information to us. Personal data includes information that enables the direct or indirect identification of an individual. Our aim is to clearly explain how we handle personal data and to inform users of their rights in relation to that data.

We collect, process, store and protect personal data in accordance with applicable legislation governing personal data protection and electronic communications, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the General Data Protection Regulation, hereinafter: the “GDPR”).

1. Controller of Personal Data

The controller of your personal data is:

PeK Automotive d.o.o.
Obrtniška ulica 17
1370 Logatec, Slovenia
Registration number: 8451273000
VAT number: SI 41693744
Telephone: +386 30 777 050
Email: legal@pekauto.com

The Controller has not appointed a Data Protection Officer. If you have any questions regarding the processing of your personal data, you may contact us using the email address or telephone number stated above.

2. How We Obtain Your Personal Data

We collect and process personal data when you provide it to us directly or when certain data is processed during your visit to the Website, particularly when:

• you use or visit our Website and certain technical data is processed through essential technologies, logs or other technologies;
• you subscribe to newsletters, where such an option is available;
• you contact us through various communication channels, including social media;
• you submit an enquiry or enter into a contract with us;
• you voluntarily provide personal data to us in other similar circumstances.

3. Categories of Personal Data, Purposes of Processing and Legal Basis

All personal data provided to us will be treated confidentially and used only for the purposes for which it was obtained. If it becomes necessary to process your personal data further for another purpose, we will act in accordance with applicable law and, where required, obtain an appropriate legal basis or your consent.

3.1 When You Visit Our Website

When you use the Website, certain technical data may be processed automatically, such as device information, browser type and language, IP address, request time, requested web resources, server responses and other technical or security information. This data is used to ensure the proper operation of the Website, maintain the security of our information systems, detect errors and prevent abuse.

Non-essential analytics or marketing technologies that require consent are not activated until the user has provided the relevant consent. We use Google Analytics 4 for analytics, and it may only be activated after consent to the “Analytics” category. Advertising or remarketing functions must be linked to separate consent to the “Marketing” category.

3.2 When You Use Contact Forms or Contact Us Directly

For the purposes of conducting our business activities, responding to enquiries, preparing quotations, communicating with customers and partners, recruitment and other business purposes, we may collect:

• first name and surname;
• company or organisation, where provided;
• email address;
• telephone number;
• the subject and content of your message;
• address or place of residence where required for a specific purpose;
• other personal data that you voluntarily enter into a form or provide to us by email, telephone or another communication channel.

3.3 Legal Bases for Processing

We process your personal data only where an appropriate legal basis exists, in particular:

• on the basis of your consent (Article 6(1)(a) GDPR);
• where processing is necessary for the performance of a contract or in order to take steps at your request before entering into a contract (Article 6(1)(b) GDPR);
• where processing is necessary for compliance with a legal obligation (Article 6(1)(c) GDPR);
• where processing is necessary for the purposes of our legitimate interests (Article 6(1)(f) GDPR).

Where we rely on legitimate interests, we take care to ensure that the processing does not disproportionately interfere with your interests, fundamental rights or freedoms. Examples of our legitimate interests include Website optimisation, responding to enquiries, ensuring the security of IT systems and preventing misuse or fraud.

3.4 Contact Form and Cloudflare Turnstile

The contact form is submitted through a service on formhandler.pekauto.com and forwarded to the relevant company mailbox. We use Cloudflare Turnstile to protect the form against automated abuse and spam. Turnstile is loaded when you start using the contact form. During the security check, Cloudflare may process your IP address, browser and device information, security signals and a verification token. This data is used for security and abuse prevention, not for our advertising.

4. Disclosure of Personal Data to Third Parties and Transfers to Third Countries

We may disclose your personal data to third parties only to the extent necessary to achieve the purpose of processing, fulfil contractual or legal obligations or ensure the operation and security of the Website.

• Service providers, business partners and contractors: personal data may be processed by providers of hosting, email, form processing, information security and other contracted services where necessary for the provision of those services. Where required, appropriate data processing agreements are concluded.
• Cloudflare: Cloudflare, Inc. provides the Turnstile service used to protect the contact form. Where processing involves a transfer of personal data outside the European Economic Area, appropriate safeguards are used as required by the GDPR.
• Google Analytics: Google Ireland Limited provides Google Analytics 4 for measuring use of the Website. Google may use Google LLC and other subprocessors to provide the service. Processing is carried out only after analytics consent. Where data is transferred outside the EEA, applicable transfer mechanisms are used, including the EU–U.S. Data Privacy Framework where available and Standard Contractual Clauses where required.
• Law enforcement and competent authorities: personal data may be disclosed where required by law, a court decision, administrative act or another binding legal instrument. We disclose only the data lawfully required for the specific case.

We do not disclose personal data to other third parties or transfer it to third countries without an appropriate legal basis and, where required, an adequate level of protection or appropriate safeguards.

5. Consent of Minors

We are committed to protecting children's online privacy. Our goods and services are not directed at children and we do not knowingly collect or request personal data from children under the age of 15. If we receive a communication that we reasonably believe originates from a child under the age of 15, we will handle it in accordance with applicable law and will not retain the data longer than necessary.

6. Automated Decision-Making and Profiling

Personal data is not used for decisions based solely on automated processing that produce legal or similarly significant effects for an individual. We also do not use data collected through this Website for profiling for such purposes.

7. Data Protection

We are committed to protecting your personal data. We implement appropriate technical and organisational measures to protect data against unauthorised access, alteration, disclosure, loss or destruction. Access to personal data is limited to employees, service providers and other authorised persons who need the data to perform their duties.

The Website may contain links to third-party websites that we do not own or control. We are not responsible for the content or privacy practices of those third parties. We recommend that you review their privacy policies before using their services.

8. Your Rights

In relation to personal data processed by us, and subject to the conditions set out in the GDPR and other applicable legislation, you have in particular the right to:

• withdraw your consent at any time where processing is based on consent; withdrawal does not affect the lawfulness of processing carried out before withdrawal;
• obtain confirmation as to whether we process your personal data;
• access your personal data and obtain information about the purposes of processing, categories of data, recipients and any transfers to third countries or international organisations;
• request the correction of inaccurate personal data and completion of incomplete data;
• request erasure of personal data (the “right to be forgotten”) where the legal conditions are met;
• request restriction of processing in the circumstances provided for by the GDPR;
• receive personal data in a structured, commonly used and machine-readable format and transmit it to another controller where the legal conditions for data portability are met;
• object to processing based on our legitimate interests and object at any time to direct marketing and related profiling;
• not be subject to a decision based solely on automated processing, including profiling, where such a decision produces legal effects or similarly significantly affects you, except where permitted by law;
• lodge a complaint with the competent supervisory authority.

You may lodge a complaint with:

Information Commissioner of the Republic of Slovenia
Dunajska cesta 22, 1000 Ljubljana, Slovenia
Email: gp.ip@ip-rs.si
Telephone: +386 1 230 97 30
Website: www.ip-rs.si

For all of the rights listed above, you may contact us at legal@pekauto.com or +386 30 777 050. We will respond within the period required by the GDPR, normally no later than one month. The first copy of your personal data is generally provided free of charge; a reasonable fee may be charged for additional copies where permitted by law.

9. Retention Period of Personal Data

We retain personal data for as long as necessary to fulfil the purpose for which it was collected and in accordance with applicable statutory retention periods. Personal data processed on the basis of consent is generally processed until consent is withdrawn or the purpose of processing expires. For Google Analytics 4, further collection stops when analytics consent is withdrawn; previously collected user-level and event-level data remains subject to the Google Analytics retention settings, which for standard properties provide 2-month or 14-month options. Standard aggregated reports may remain available for longer. Personal data processed on the basis of our legitimate interests may be retained for up to five years unless the nature of the purpose, a legal obligation or the circumstances of a particular case require a shorter or longer period.

In certain cases, anonymised data may be retained for longer where individuals can no longer be identified from that data. Where sector-specific legislation requires data to be retained for a specified period, we retain the data for that period and delete or appropriately anonymise it after the period expires.

10. Security

All personal data is protected in accordance with applicable personal data protection legislation and the Controller's internal measures. The Company implements appropriate technical and organisational measures to ensure the confidentiality, integrity and availability of personal data.

Despite our security measures, absolute security of information systems cannot be guaranteed. If a personal data breach occurs, we will take the measures required by the GDPR, including notifying the competent supervisory authority and, where required, affected individuals.

11. Links to Other Websites

Our Website may contain links to third-party websites. Those websites have their own privacy and cookie policies, which you should review independently. PeK Automotive accepts no responsibility for the content or privacy practices of third-party websites.

12. Links to Social Networks and External Platforms

Our Website contains or may contain standard links to social networks and external platforms such as Facebook, Instagram, YouTube, LinkedIn and X. These links are not embedded tracking plugins: information is generally transmitted to the provider only after you click an external link and leave our Website. Further processing is governed by the privacy policy of the respective platform.

• Instagram and Facebook: Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland.
• YouTube: Google/YouTube; privacy information is available in the applicable YouTube and Google privacy policies.
• LinkedIn: LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland.
• X: the provider of the X platform processes data in accordance with its current privacy policy.

13. Amendments to This Personal Data Protection Policy

We reserve the right to update or amend this Personal Data Protection Policy due to changes in our services, technologies, providers or legal requirements. Amendments become effective when the updated version is published on the Website. The date of the latest update is stated at the top of this document.

Cookies and Similar Technologies

Our Website uses cookies and similar technologies. Cookies are small text files that a website may store on an individual's device. In addition to traditional cookies, other technologies may be used, including browser local storage (localStorage), security tokens and similar technical mechanisms.

Cookies and similar technologies serve different purposes: they enable the Website to function correctly, store the user's privacy choices, protect forms against abuse and, where the user has expressly consented, support analytics and marketing.

Consent is not required for strictly necessary technologies required for the proper and secure operation of the Website. Google Analytics 4 and other non-essential analytics technologies are disabled by default and may only be activated after the user has provided the appropriate consent. Marketing and advertising technologies are handled separately and require the appropriate marketing consent.

Which cookies and similar technologies do we use?

Strictly necessary technologies

Functional technologies

The current version of the Website does not use separate functional cookies requiring consent. The language selection is implemented through links between the Slovenian and English versions of the Website and is not stored in a separate functional cookie.

Analytics technologies

We use Google Analytics 4 (GA4) for analytics. It is activated only after explicit consent to the “Analytics” category. It is used to measure traffic and understand use of the Website. Analytics consent alone does not constitute consent to advertising personalisation.

Advertising and marketing technologies

Marketing technologies are provided as a separate category within the consent-management system, but Google Ads, Meta Pixel and similar marketing trackers are not active on the current version of the Website. If such tools are introduced in the future, they will only be loaded after the user's explicit consent.

YouTube and other external video content

YouTube players are not currently embedded in a way that causes them to load automatically when a page is opened. If embedded YouTube content is added in the future and activated by the user, YouTube or Google may use the cookies and storage technologies listed below, or comparable technologies. The following list is provided for information and may change when the provider changes its service.

How can you manage cookies and similar technologies?

On your first visit to the Website, you can select “Accept all”, “Reject all” or “Settings” and separately decide whether to allow analytics and marketing technologies. You can change your choice at any time via the “Cookie settings” link in the Website footer.

You can also manage cookies directly in your browser settings. Most browsers allow you to accept or reject all cookies, accept specific categories, receive a warning when a website attempts to store a cookie, and delete previously stored data.

If you delete cookies or website data, change devices, upgrade your browser or use private browsing, you may need to configure your cookie preferences again.

• Google Chrome (desktop, Android, iPhone and iPad)
• Mozilla Firefox
• Microsoft Edge
• Safari
• Opera

If you completely disable strictly necessary web technologies at browser level, some parts of the Website may not function correctly. More information about our consent-management system is available in our Cookie Policy.

Logatec, 7 October 2026