Legal information

Privacy policy

Effective from 19 October 2026

This is a translation. In case of any discrepancy, the Slovenian version prevails.

This policy explains which personal data we process when you visit the Kubivu website, send us an enquiry or when we establish business contact with you. We act in accordance with the General Data Protection Regulation (GDPR) and the Slovenian Personal Data Protection Act (ZVOP-2).

1. Controller

Controller
Garant24 spletna trgovina, proizvodnja in druge storitve d.o.o.
Address
Glavni trg 17B, 2000 Maribor, Slovenia
Company registration number
9620192000
VAT ID
SI23971924
Data protection contact
info@kubivu.com

We have not appointed a data protection officer, as the law does not require us to. For any questions about your data, write to us at the address above.

2. Visiting the website

When you open the site, our hosting provider's server automatically logs technical data: IP address, date and time of the visit, the page or file requested, browser and operating system type, and the page you came from. We need this data for the site to work, to deliver it securely and to detect abuse or errors.

  • Legal basis: our legitimate interest in the secure and smooth operation of the site (Article 6(1)(f) GDPR).
  • Retention: short-term, usually no more than 30 days, unless we need them to investigate a specific security incident.

The 3D models and configurators on this site run in your browser. The choices you make in the configurator or room planner are not sent to us and we do not store them.

We do not use analytics tools, social media plugins or third-party content on the site. We load the Google Ads tag only if you consent (see section 6). Fonts are loaded from our own server.

3. Enquiries and free demo

When you fill in the “Book a demo” form, email us or call us, we process the data you provide: full name, company, business email address, phone number, company website and the content of your message.

  • Purpose: replying to your enquiry, arranging and running the demo, and preparing a quote.
  • Legal basis: taking steps at your request before entering into a contract (Article 6(1)(b) GDPR) and our legitimate interest in responding to business enquiries (point (f)).
  • Do you have to provide the data? No, it is voluntary. Without contact details, however, we cannot reply to you.

Form data is sent over an encrypted connection to the Google Apps Script service in our business Google Workspace account, which forwards it to us as an email. We then keep enquiries in an internal enquiry log. We do not store your IP address; to protect against abuse we temporarily keep (for no more than one hour) only a count of messages sent from the same email address.

4. Quotes, contracts and invoices

If we prepare a quote or enter into a contract, we process the data of the client's contact persons (name, job title, business email and phone) and the material the client provides for building the configurator.

  • Legal basis: entering into and performing the contract (Article 6(1)(b) GDPR) and complying with legal obligations, such as keeping invoices under tax law (point (c)).

5. Business contacts with companies

We present our services to companies we believe would benefit from a 3D configurator. For this we use business contact details (company name, general or work email and phone, name and job title of the contact person) that are publicly available on company websites and in public business registers.

  • Purpose: presenting our services once or occasionally by email or phone.
  • Transparency: in the first message we state who we are, where we got your contact details and include a link to this policy. Every message includes a simple way to opt out of further messages.
  • Legal basis: our legitimate interest in presenting our services to businesses (Article 6(1)(f) GDPR).
  • Objection: you can ask us at any time to stop contacting you. Reply to our message or write to info@kubivu.com. We will then delete your data and keep only a note that we may not contact you again.

6. Cookies

On your first visit we ask whether you allow advertising cookies. Until you click “Accept”, the site loads no third-party tools and sets no cookies.

  • Essential local storage (always): we save your cookie choice in your browser's local storage (localStorage, key kubivu-consent) so we don't ask you on every visit. It is kept for 12 months. Legal basis: Article 236(5) of the Slovenian Electronic Communications Act (ZEKom-2) (strictly necessary for the service you request).
  • Google Ads (only with consent): if you click “Accept”, we load the Google tag (gtag.js) from Google Ireland Limited. It sets cookies (e.g. _gcl_aw, _gcl_au) that we use to measure whether a visit through our ad led to an enquiry or contact (a conversion). In the process, device and browser data, IP address, pages visited and the ad click identifier are sent to Google. Google Ads cookies are kept for up to 90 days. Legal basis: your consent (Article 6(1)(a) GDPR and Article 236 ZEKom-2).

You can withdraw or change your consent at any time via the “Cookie settings” link in the page footer; withdrawal does not affect the lawfulness of processing before it. We use the basic implementation of Google Consent Mode v2: without consent, nothing is sent to Google.

Your browser may store site files (fonts, 3D models, images) in its cache so the site loads faster on your next visit. These are not cookies and they send us no data.

7. Processors and recipients

We do not sell data or pass it to third parties for their own purposes. Only selected contracted processors that provide services to us and process data solely on our instructions may have access to it:

  • website hosting: IONOS SE, Elgendorfer Str. 57, 56410 Montabaur, Germany (servers in the EU);
  • email, office services and receiving form enquiries: Google Ireland Limited (Google Workspace), Gordon House, Barrow Street, Dublin 4, Ireland;
  • ad measurement (only with consent): Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland;
  • keeping the enquiry and business contact log: Anthropic (the Claude tool);
  • accounting: an accounting service, where quotes, contracts and invoices are concerned.

We may also disclose data to public authorities where required by law.

8. Data transfers outside the EU

The website is hosted on servers in the European Union. Some of our processors (Google for email, the form and, if you consent, Google Ads cookies, and Anthropic for the enquiry log) may also process data in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework, for which the European Commission has adopted an adequacy decision; transfers are additionally covered by standard contractual clauses adopted by the European Commission. There are no other transfers outside the EU and EEA.

9. Retention periods

  • Server logs: usually no more than 30 days.
  • Enquiries that did not lead to business: 12 months after the last contact, then deleted.
  • Business contact data (section 5): no more than 12 months after the last contact or until you object.
  • Quotes and contracts: until contractual obligations end and limitation periods for any claims expire.
  • Invoices and accounting records: 10 years after the end of the year in which the invoice was issued, as required by tax law.

10. Your rights

You have the following rights regarding your personal data:

  • access to your data and a copy of it (Article 15 GDPR);
  • rectification of inaccurate data (Article 16);
  • erasure (Article 17);
  • restriction of processing (Article 18);
  • data portability (Article 20);
  • objection to processing based on legitimate interest (Article 21). We always uphold an objection to processing for the purpose of presenting our services.

Send your request to info@kubivu.com. We reply without undue delay and within one month at the latest. Exercising your rights is free of charge. If we cannot reliably establish who sent the request, we may ask you for additional information.

If you believe we are processing your data unlawfully, you can lodge a complaint with the supervisory authority: Informacijski pooblaščenec Republike Slovenije (Information Commissioner of the Republic of Slovenia), Dunajska cesta 22, 1000 Ljubljana, gp.ip@ip-rs.si, www.ip-rs.si.

We do not carry out automated decision-making or profiling that would have legal or similarly significant effects on you.

11. Security and changes

The site is delivered over an encrypted HTTPS connection. Only people who need the data for their work have access to it.

We may update this policy, for example when we introduce new services or the law changes. The current version is always published on this page with its effective date.