Personal data protection policy and user rights

In accordance with the applicable Personal Data Protection Act, the Electronic Communications Act and the General Data Protection Regulation ("GDPR"), Libona, (online shop HempLight) provides you with the following rights in relation to the protection of your personal data, which are set out in more detail below:

  • the data controller;
  • the purpose of the processing of data and the type of personal data;
  • visit and use of the website;
  • storage period;
  • the right of access to data;
  • the right to rectification;
  • the right to erasure ("right to be inlivion");
  • the right to restrict processing;
  • the right to data portability;
  • the right to object.


Data controller

The controller of your personal data is Libona d. o. o. o.s.p., Radgonska c. 2, 2235 Sv. Trojica.

Purpose of data processing and type of personal data

All personal data provided will be treated confidentially and used only for the purposes for which you have provided it. If there is a need to further process your data for any other purpose, we will inform you in advance and ask for your consent.

Visit and use the website

Every time you visit the website, a log file is automatically stored on the web server (e.g. IP number - a number that identifies the individual computer or other device connected to the internet; browser version, time of visit, etc.). This data is processed for the purposes of keeping statistics on website visits. Libona d.o.o.s.p. processes the data collected in this way separately and does not combine it with other data.

Retention period

We assure you that we only keep your data for as long as it takes to fulfil the purpose for which it was collected and used, namely:

  • Web server log files are kept for three months;
  • your contact details for communication purposes are processed until the completed transaction or completed communication;
  • if there is a different legal storage period (e.g. accounting or tax data) for individual data processed for the realisation of contracts, the retention period shall be 10 years. In the meantime, data processing is limited.

Upon termination of the need to keep the data, i.say, after fulfilling the purpose for which it was collected, the data shall be immediately irreversible and permanently deleted.

Right of access to data

You have the right to obtain confirmation from the company that your personal data is processed by the company and, where so, you have the right to obtain access to your personal data and the following information regarding the processing of personal data:

  • the purposes of the processing;
  • the types of personal data;
  • users or categories of users to which your personal data has been or will be disclosed, in particular users in third countries or international organisations;
  • where possible, the period of retention of personal data or, if this is not possible, the criteria to be used to determine that period should be envisaged;
  • the existence of the right to require the controller to rectification or erasure of personal data or to restrict the processing of personal data in relation to the data subject or the existence of a right to object to such processing;
  • the right to lodge a complaint with a supervisory authority;
  • where personal data are not collected from the user, all available information relating to their source;
  • the existence of automated decision-making, including profiling, and meaningful information on the reasons for it, as well as the significance and foreseeable consequences of such processing for the user.

Based on your request, the company will provide you with one free copy of your personal data being processed. For additional copies of the information you would request, the company will charge you a reasonable fee, taking into account administrative costs.

Right to rectification

You have the right to require the Company to correct inaccurate personal data relating to you without undue delay. Taking into account the purposes of the processing, you have the right to supplement incomplete personal data in writing.

Right to erasure ("right to be inau"

You have the right to require the Company to delete personal data relating to you without undue delay, and the company must delete your personal data without undue delay in the following cases:

  • where personal data are no longer necessary for the purposes for which they were collected or otherwise processed;
  • when you withdraw the consent underlying the processing of your personal data, there is no other legal basis for the processing;
  • where you object to processing on the basis of the legitimate interest of the controller, there are no overriding legitimate reasons for processing them;
  • when you object to processing for direct marketing purposes;
  • where personal data need to be erased in order to fulfil a legal obligation under European Union or Slovenian law.

When a company publishes your personal data in accordance with the policy, it takes reasonable steps, including technical, to inform the controllers who process your personal data that the data subject requests them to delete any links to or copies of that personal data.

Right to restrict processing

You have the right to require the company to restrict the processing of your personal data when one of the following cases applies:

  • when you dispute the accuracy of the data, for a period that allows the controller to verify the accuracy of your personal data;
  • where processing is unlawful and you object to the erasure of personal data and instead request a restriction on their use;
  • where the undertaking no longer needs personal data for the purposes of processing but is required by you to enforce, pursue or defend legal claims;
  • when you have raised an objection to the processing until it is verified that the legitimate reasons of the controller outweigh your reasons.

Right to data portability

You have the right to receive personal data relating to you held by the company in a structured, widely used and machine-readable form, and the right to provide that information to another controller without being impeded by the company to which the personal data was provided when:

  • processing is based on your consent or contract;
  • processing is carried out by automated means.

Right to object

On grounds relating to your particular situation, you have the right to object at any time to the processing of personal data if it is based on the legitimate interests pursued by the company or a third party. The Company will cease processing personal data unless it demonstrates compelling reasons for processing that outweigh your interests, rights and freedoms, or for the exercise, exercise or defense of legal claims. When personal data are processed for direct marketing purposes, you have the right to object at any time to the processing of your personal data for the purposes of such marketing, including profiling, if it is related to such direct marketing. Where direct marketing is based on consent, the right of opposition may be effected by withdrawing the personal consent granted.

Procedure for the exercise of rights

Any of the above requests concerning the exercise of rights in relation to your personal data may be addressed in writing to the controller, by e-mail to,aliby post to Libona, Radgonska c. 2, 2235 Sv. Trojica.

If you submit a request in accordance with the above paragraph by electronic means, the information will, if possible, be provided to you by electronic means, unless you ask otherwise.

For the purposes of reliable identification, the controller may, in the event of exercising your rights in relation to personal data, request additional information necessary to confirm your identity and may refuse to act in accordance with this Chapter only if it proves that it cannot identify you reliably.

The controller will respond without undue delay and no later than one month after receipt of the request to the request, at the request by which you exercise your rights in relation to your personal data. An enterprise may extend the time limit for the exercise of največ̌ two additional months, taking into account the complexity and number of requests. If the company extends the deadline, you will be notified of any such extension within one month of receipt of the request, together with the reasons for the delay.

If your requests are manifestly unfounded or excessive under this Chapter, in particular because they are repeated, the company may:

  • charge a reasonable fee, taking into account the administrative costs of providing the information or communication or implementing the requested action;
  • refuse to act on the request.

Right to lodge a complaint concerning the processing of personal data

Any complaint regarding the processing of your personal data may be addressed in writing to the Controller, by e-mail to or by post to
Libona, Radgonska c. 2, 2235 Sv. Trojica.

You also have the right to lodge a complaint directly with the Information Commissioner if you believe that the processing of personal data relating to you violates Slovenian or European Union regulations in the field of the protection of personal data.


The record shall be valid from 22. 4. 2020 onwards and may be amended or supplemented at any time. Therefore, we ask that you check the current version before any personal data is forwarded so that you are aware of any changes and additions.