This English version is provided for information. The Slovenian version is legally binding.

Privacy policy

Version 2026-10. This policy explains which personal data we process on the Asistenca.si portal, why, for how long and what rights you have. It follows the General Data Protection Regulation (GDPR) and the Slovenian Personal Data Protection Act (ZVOP-2).

1. Controller

The controller of personal data is The operator of Asistenca.si. Contact: via the contact page.

The operator has not appointed a data protection officer; please send questions about personal data to the contact above.

2. What data we process and why

Account and profile — email address, password (stored only in hashed form), display name, role, municipality, description, types of help, availability; for assistants experience and skills, for providers the organisation's details. Purpose: operating the portal and connecting people. Legal basis: contract — terms of use (Art. 6(1)(b) GDPR).

Sign-in with Google or Apple — if you register this way, we receive your email address and name from the provider (with Apple you can choose a hidden email address). We do not receive the provider password. Basis: contract.

Contact details (phone, contact email) — visible only to people you are connected with. Basis: contract.

Listings — content, municipality, hours, schedule, types of help. Basis: contract.

Connection requests, conversations and messages — purpose: contact between users. Basis: contract.

Provider reviews — rating and text. The author is not shown publicly. Basis: contract.

Assistants' documents (proof of training) — only to grant the "verified assistant" badge; deleted after the decision. Basis: consent given by submitting the document (Art. 6(1)(a)).

Consents — which terms and consents you accepted and when. Basis: legal obligation to demonstrate consent (Art. 7(1) and 6(1)(c)).

Notifications — notification settings and, if you enable them, a device notification subscription. Basis: contract; device notifications only with your browser permission.

Security and abuse prevention — abuse reports, blocks, logs of staff actions (audit trail), and on login the IP address and browser type for session security. Basis: legitimate interest in keeping the portal and its users safe (Art. 6(1)(f)).

Listing view statistics — only the total number of views per day, with no data about visitors.

Portal news — only if you choose to receive it. Basis: consent, which you can withdraw at any time.

3. Health data and special needs

A user of personal assistance may enter data about their health or special needs in their profile only with explicit consent (Art. 9(2)(a) GDPR). Only you can see this data — not other users, not providers, and not portal staff. If you withdraw consent, it is deleted immediately. Please do not publish such data in your public description or listing.

4. Who can see your data

• Public (only when a profile or listing is approved and you have made it public): display name, role, municipality, description, verification badge. We never publish an address or contact details.
• People you are connected with (after a request is accepted): contact details and the conversation.
• A provider and their team members: if you contact a provider, members of their team also see your request and the conversation; the provider may keep private notes about the requests it receives.
• Moderators: profile and listing content for review before publication, and reports. They cannot see email addresses, contact details or private messages.
• The administrator: account data for managing the portal and assistants' documents (every view is logged). The administrator does not read private messages and cannot see health data.

5. Processors and other recipients

The portal is supported by processors with whom we have data processing agreements:

• hosting provider for the servers and database (EU)
• email delivery provider (EU)

Other recipients:

• Map: when you open a page with the map, your browser loads map images from OpenStreetMap servers, which receive your IP address.
• Device notifications: if you enable them, a notification is delivered via your browser's push service (e.g. Google, Mozilla, Apple), which may be outside the EU. The notification is encrypted and contains no names or message content.
• Sharing on social networks: the buttons are plain links; data is passed to a network only when you click.
• Public authorities: only where required by law.

We do not sell data or use it for advertising.

6. Cookies and browser storage

We use only essential cookies and storage of your choices — no analytics or tracking:

• login session (Supabase) — enables login; valid until you log out or the session expires;
• `oa_soglasje` — so that we do not check your acceptance of the terms on every visit (30 days);
• `oa_prikaz` — your display settings (text size, contrast …; 1 year);
• `oa_jezik` — your chosen language (1 year);
• `oa_nastavitve` — administrators only: unlocking the Settings page;
• in browser storage: that you closed the cookie notice or the app install notice.

Bot protection (ALTCHA) runs in your browser without cookies or third-party services. Fonts are served from our own server.

7. How long we keep data

• Account data is kept for as long as the account exists. When an account is deleted, we delete the profile, contact details, listings, requests and consents; the content of your messages in conversations with others is deleted.
• Expired, rejected and unpublished listings are deleted 12 months after expiry or the last change.
• If you do not log in for 24 months, we remind you by email. If you still do not log in, the account and all its data are deleted after 30 months of inactivity, but not earlier than 30 days after the reminder.
• Closed abuse reports and requests to update data are kept for 24 months.
• Logs of administrator and moderator actions (audit trail) are kept for 5 years.
• Records of sent notifications are kept for 30 days.
• Assistants' documents are deleted immediately after the decision.
• Backups are encrypted and kept for 14 days, after which they are deleted automatically.

8. Security

The connection is encrypted (HTTPS), access to data is restricted by rules in the database, staff use two-step login, staff actions are logged, and passwords are stored only in hashed form. Data is stored in the European Union.

9. Your rights

• Access and portability: in My profile → Privacy and data you can download all your data (JSON).
• Rectification: correct your data in your profile.
• Erasure: delete your account in My profile → Privacy and data.
• Withdrawal of consent: you can withdraw consent for health data and for news at any time; this does not affect the lawfulness of processing before withdrawal.
• Restriction of processing and objection to processing based on legitimate interest: write to us at via the contact page.

We respond to requests without undue delay and at the latest within one month.

If you believe we are breaching data protection rules, you can lodge a complaint with the Information Commissioner of the Republic of Slovenia, Dunajska cesta 22, 1000 Ljubljana, gp.ip@ip-rs.si, phone +386 1 230 97 30, www.ip-rs.si.

10. Minors

An account can be created by an adult. For a person who cannot conclude an agreement themselves, the account is created by their legal representative, who is responsible for the data entered.

11. Automated decision-making

We do not carry out automated decision-making or profiling with legal effects. Content with several reports may be withdrawn automatically and temporarily; any further measure is decided by a moderator.

12. Changes

We will inform you of substantive changes to this policy at your next login, when you confirm the new version.

This policy applies from 28 October 2026.

Last updated: 29/10/2026