Privacy policy

This policy explains what personal data WindNext collects through this website, why, and what rights you have. It follows Articles 13 and 14 of the General Data Protection Regulation (EU) 2016/679 (GDPR) and the Slovenian Personal Data Protection Act (ZVOP-2).

1. Who is responsible (controller)

Controller

WindNext, vetrna energija, d.o.o.

Address

Prvomajska ulica 21, 5000 Nova Gorica, Slovenia

Contact for data protection

info@windnext.energy

Data protection officer

WindNext has not appointed a data protection officer, because one is not required under Art. 37 GDPR. For privacy questions, write to info@windnext.energy.

2. What we collect, why, and on what legal basis

Required fields are marked with an asterisk. Without them we cannot answer your request properly. The other fields are optional. We do not send newsletters or marketing emails from this form. If we want to, we will ask for your separate consent first, and you can withdraw it at any time.

We only collect business contact details and information about wind farms. Please do not send us sensitive data (for example health data) through the form.

Where the data comes from (Article 14)

We collect personal data only from you directly, when you fill in the form or write to us. We do not collect contact details from public sources, professional networks such as LinkedIn, or purchased lists.

3. How long we keep it

• Enquiries and leads: 24 months after our last contact, then we delete them.
• Ongoing business relationships: for as long as we work together, plus 5 years after it ends (the general limitation period under the Slovenian Obligations Code), unless the law requires a longer period.
• Contracts, offers and invoices: invoices and accounting records are kept for 10 years after the end of the year in which they were issued, as the Slovenian VAT Act (ZDDV-1) requires.
• Server logs: our hosting provider, GitHub, keeps them for the period set by its own retention rules (see the GitHub Privacy Statement). We do not store them ourselves.

4. Who receives it

We do not sell personal data. Inside WindNext, only the people who handle your request see it. We use these service providers (processors), who work on our instructions under a data processing agreement (Art. 28 GDPR):

This third party receives technical data directly from your browser when you open the map page:

We may also share data with our advisers (for example lawyers and accountants, who are bound by confidentiality), with a partner you agree to involve in a site study or pilot, or with authorities where the law requires it.

5. Transfers outside the EU/EEA

We aim to keep data in the EU/EEA. Where a provider processes data outside the EU/EEA, we rely on an adequacy decision of the European Commission (for example for the United Kingdom, or for US companies certified under the EU-US Data Privacy Framework) or on the EU Standard Contractual Clauses (Art. 46 GDPR). You can ask us for a copy of the safeguards.

Formspree: when you send the site-check form, your details are processed by Formspree, Inc. in the USA. This transfer is based on the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR) in Formspree's data processing agreement.

GitHub: the website is hosted on GitHub Pages by GitHub, Inc. in the USA, which also receives the server logs of every visit. This transfer is based on the EU-US Data Privacy Framework and the EU Standard Contractual Clauses in GitHub's data protection agreement.

Google: our email and our list of enquiries (Google Sheets) run on Google Workspace, provided by Google Ireland Ltd. Google may process this data in the USA. This transfer is based on the EU-US Data Privacy Framework and the EU Standard Contractual Clauses in Google's data processing terms.

MapTiler: the base map tiles come from MapTiler AG in Switzerland. Switzerland has an adequacy decision of the European Commission, so no further safeguards are needed.

6. Your rights

You have the right to:

• access your data and get a copy (Art. 15),
• correct it (Art. 16),
• delete it (Art. 17),
• restrict how we use it (Art. 18),
• receive it in a common format or have it sent to someone else (Art. 20),
• object at any time to processing based on our legitimate interest, and always to direct marketing (Art. 21),
• withdraw consent at any time where we asked for it, without affecting earlier processing (Art. 7(3)).

Write to info@windnext.energy. We answer within one month. We may ask you to confirm your identity.

Right to complain

You can complain to a data protection authority, in particular in the EU country where you live, work or think the breach happened. In Slovenia this is the Information Commissioner (Informacijski pooblaščenec), Dunajska cesta 22, 1000 Ljubljana, email gp.ip@ip-rs.si, www.ip-rs.si.

7. No automated decisions

We do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects (Art. 22). The estimates on the wind farm map are calculated for wind farms, not for people.

8. Security

We protect personal data with technical and organisational measures that suit a small company (Art. 32 GDPR):

• The website and the form are served only over HTTPS (TLS encryption).
• Only the founders of WindNext have access to enquiries. Our Google Workspace, GitHub and Formspree accounts are protected with two-factor authentication.
• Each person has only the access they need for their work (least privilege).
• Our service providers process data on our behalf under data processing agreements (Art. 28 GDPR).
• The website has no tracking, analytics or advertising tools, and the form asks only for what we need to answer you (data minimisation).
• We delete data when the periods in section 3 end.

9. Changes

We will update this policy when our services or the law change. The date at the top shows the current version.