1. GENERAL INFORMATION

On 25 May 2018, a new regulation entered into force in the European Union, namely Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter the “GDPR”). It provides strict and specific rules, including rules on how personal data is collected and handled.

We hereby inform you that our company also complies with the GDPR. You can read the full Regulation at this link.

In the course of our business, we also process personal data in accordance with the Slovenian Personal Data Protection Act (ZVOP-2). The full Act is available at this link.

Who are we?

The controller of personal data is:
Company name: FRUTILU d.o.o.
Registered office: Žlebe 78, 1215 Medvode, Slovenia, EU
(hereinafter “FRUTILU” or the “Controller”)

Website: www.frutilu.com

(hereinafter the “website”)

Email address: [email protected]

Further contact details of the Controller are available at https://frutilu.com/kontakt/.

How do we protect your data?

We use various technical and organisational security measures, including encryption and authentication tools, to maintain the security of your personal data.

2. COLLECTION AND PROCESSING OF PERSONAL DATA

The Controller uses customers’ personal data for order processing purposes, such as sending an order summary, providing delivery information, issuing invoices and carrying out other necessary communication. The Seller may also use the customer’s email address to provide information about benefits, news and other promotional content. When sending promotional communications, the Seller does not use automated profiling and sends only general content. If a website user does not complete a purchase, the Seller may notify them by email about the incomplete purchase. Collected personal data may also be used for other general business purposes, such as maintaining user accounts, conducting internal and market research and measuring the effectiveness of advertising campaigns. Data collected on social media is processed for the purpose of informing consumers about current promotions and offers.

FRUTILU collects and processes personal data only where there is an appropriate legal basis under the GDPR and applicable law. Depending on the purpose of processing, the legal basis may in particular be the performance of a contract or steps taken prior to entering into a contract, compliance with legal obligations, FRUTILU’s legitimate interests or the consent of the individual.

Where certain personal data is necessary for the conclusion or performance of a sales contract, an order cannot be placed or fulfilled on our website without providing such data. Where processing is based on consent, providing the data is voluntary and the user may withdraw their consent at any time.

The personal data collected and processed by the Seller includes:

• customer contact details (email address and telephone number),
• delivery address,
• company name, where entered by the customer,
• date and time of the order,
• contents of the shopping cart,
• payment method and delivery method,
• history of the use of promotional discount codes,
• purchase history,
• invoice data,
• data relating to communication between FRUTILU and the user or customer (e.g. emails, contact forms and communication via the AI chatbot),
• the content of conversations with the AI chatbot and data voluntarily entered by the user in the chat (e.g. name, contact details, order number or other data necessary to handle the enquiry),
• technical data relating to the use of the AI chatbot (e.g. IP address, device and browser information, date and time of communication, conversation or session identifier and other technical data necessary for the operation and security of the service),
• data about website users (IP address or unique device ID, advertising ID, date, time and duration of website visits, location data or internet access point, type and version of operating system and browser, data on pages visited and settings made),
• data entered in online forms (e.g. competitions and newsletter subscriptions),
• other data voluntarily provided by users to the Seller when placing an order (e.g. notes, ratings, comments, etc.),
• comments, ratings and shares on our social media channels.

User data will under no circumstances be disclosed to unauthorised third parties.

Newsletter subscribers may unsubscribe at any time by sending an unsubscribe request to [email protected] or by clicking the unsubscribe link at the bottom of a newsletter.

FRUTILU d.o.o. does not use automated decision-making, including profiling, that produces legal effects concerning an individual or similarly significantly affects them within the meaning of Article 22 GDPR. We use an AI chatbot on the website that automatically generates answers to users’ questions using artificial intelligence. Such automated generation of answers is not used to make decisions about users’ rights, complaints, returns, contractual rights or other decisions that would have legal or similarly significant effects on an individual.

The lawfulness of personal data processing is governed by Article 6 of Regulation (EU) 2016/679, in particular points 1(a) – consent of the individual to the processing of personal data, 1(b) – processing necessary for the performance of a contract, and 1(f) – legitimate interests pursued by the Controller.

Use of analytics tools (Microsoft Clarity)

Purpose of processing
We collect data for the purpose of analysing the use of the website (e.g. heatmaps, session recordings and interaction measurements) and optimising our services.

Types of data
When Microsoft Clarity is used, the following data may be processed:

website usage data (clicks, movements, scrolling, session duration),

technical device data (device type, operating system, browser, screen resolution),

IP address (in anonymised or truncated form),

time and duration of the visit.

Cookies and tracking technologies
Microsoft Clarity uses cookies and similar technologies to collect data. This data may also be collected directly by Microsoft in accordance with its Privacy Policy.

Legal basis
The processing is based on the user’s consent (Article 6(1)(a) GDPR), which the user gives when accepting cookies on our website.

Processors and data transfers
Data collected through Microsoft Clarity may be disclosed to Microsoft, which may also use such data for its own purposes in accordance with its privacy policy. Data may also be transferred to countries outside the EU/EEA, with Microsoft providing appropriate safeguards (e.g. Standard Contractual Clauses).

Data retention
Data is retained for as long as necessary for the purpose of analysing and improving services, or until the user withdraws consent.

User rights
In accordance with the GDPR and ZVOP-2, users have the right to request access to their data, rectification, restriction of processing, data portability, erasure and withdrawal of consent. They also have the right to lodge a complaint with the Information Commissioner of the Republic of Slovenia (https://www.ip-rs.si).

Use of the AI chatbot (Chatbase)

Purpose and operation of the AI chatbot
On the website www.frutilu.com we use a chatbot based on artificial intelligence (hereinafter the “AI chatbot”). The AI chatbot is intended to answer users’ questions, provide information about FRUTILU products and services, assist with the use of the online store and provide support to users and customers.

The AI chatbot’s responses are generated automatically using artificial intelligence. When using the chatbot, the user is informed that they are communicating with artificial intelligence and not with a human. The AI chatbot may generate incomplete, inaccurate or incorrect information. Where reliable confirmation is required, particularly in relation to orders, complaints, product composition, allergens or other important matters, the user should contact FRUTILU directly.

Service provider
To provide the AI chatbot, we use the Chatbase service provided by:

Chatbase Inc.
2261 Market Street STE 85690
San Francisco, CA 94114
United States of America.

FRUTILU d.o.o. is the controller of the personal data that users provide when using the AI chatbot. When processing such data for the purpose of providing the service, Chatbase Inc. generally acts as a contractual data processor. Chatbase may also use authorised sub-processors in providing the service, including hosting and infrastructure providers and providers of artificial intelligence models.

What data may be processed
When using the AI chatbot, the following data may in particular be processed:

• the content of questions, messages and conversations between the user and the AI chatbot,
• data voluntarily entered by the user in the conversation,
• name and contact details, if voluntarily provided by the user,
• order number or other order-related data where required to handle an enquiry,
• IP address,
• device, operating system and web browser information,
• date and time of communication,
• conversation or session identifier,
• technical and usage data necessary to provide, protect and ensure the proper operation of the service.

As a rule, users do not need to provide their name or other direct identifying information to use the AI chatbot, unless this is necessary to handle a specific question or request.

Purpose of processing
Personal data obtained through the use of the AI chatbot may be processed for the following purposes:

• answering users’ questions,
• providing support to users and customers,
• providing information about FRUTILU products, orders, delivery and other services,
• handling users’ requests,
• ensuring the safe and proper operation of the AI chatbot,
• preventing abuse and security incidents,
• checking the quality of responses and improving the operation and user experience of the AI chatbot,
• establishing, exercising or defending legal claims where necessary.

Legal basis
Depending on the circumstances, the processing of personal data when using the AI chatbot is based in particular on FRUTILU’s legitimate interests pursuant to Article 6(1)(f) GDPR, including providing efficient user support, answering enquiries, ensuring service security and improving the quality of our services.

Where a user submits a question through the AI chatbot relating to the conclusion or performance of a contract or an order, the legal basis may also be Article 6(1)(b) GDPR where processing is necessary for the performance of a contract or in order to take steps at the request of the individual prior to entering into a contract.

Where the user’s consent is required for a specific processing activity under applicable law, the processing is based on Article 6(1)(a) GDPR. The user may withdraw their consent at any time without affecting the lawfulness of processing carried out before the withdrawal of consent.

Special categories of personal data
The AI chatbot is not intended to process special categories of personal data within the meaning of Article 9 GDPR or other particularly sensitive personal data.

Users are therefore requested not to enter into the AI chatbot information about their health status, diagnoses, medical records, genetic or biometric data, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, sex life or sexual orientation, or information relating to criminal convictions or offences.

It is not necessary to disclose personal health information when asking questions about product composition, nutritional values or allergens. If a user nevertheless voluntarily enters such information in the chat, it may become part of the conversation content. FRUTILU does not request such data and recommends that users do not enter it into the AI chatbot.

Disclosure of data and transfers to third countries
To provide the AI chatbot, data is disclosed to Chatbase Inc. and its authorised sub-processors to the extent necessary to provide the service.

In providing the service, personal data may be processed or transferred to the United States of America or other countries outside the European Economic Area. Where the European Commission has not adopted an adequacy decision for the relevant country, appropriate safeguards in accordance with Chapter V GDPR are used, in particular the European Commission’s Standard Contractual Clauses and, where necessary, additional safeguards.

Data retention
We retain conversations with the AI chatbot and related personal data only for as long as necessary for the purpose for which they were collected.

Conversations that are not required for further handling of a user’s request are generally retained for no more than 90 days from the last activity in the conversation and are then deleted or anonymised, unless longer retention is necessary to handle a specific order, complaint, legal claim, security incident or other legal obligation.

Data transferred from a conversation to other FRUTILU business records for the purpose of handling an order, complaint or other user request is retained in accordance with the retention periods applicable to the relevant type of business documentation.

Automated generation of responses
The AI chatbot automatically generates responses based on users’ questions and the information available to it. FRUTILU does not use the AI chatbot to make automated decisions that produce legal effects concerning an individual or similarly significantly affect them within the meaning of Article 22 GDPR.

Accordingly, the AI chatbot does not independently decide whether a user is entitled to a refund, complaint remedy, compensation, special pricing conditions or other user rights.

User rights
With regard to personal data processed when using the AI chatbot, users have the rights provided for by the GDPR and ZVOP-2, in particular the right of access, rectification, erasure and restriction of processing and, where the statutory conditions are met, the right to data portability and the right to object to processing.

Where processing is based on FRUTILU’s legitimate interests, the individual has the right to object to such processing in accordance with Article 21 GDPR.

Requests concerning personal data processed through the AI chatbot may be addressed to FRUTILU d.o.o. using the contact details provided in this Privacy Policy. The user also has the right to lodge a complaint with the Information Commissioner of the Republic of Slovenia.

3. MY ACCOUNT SERVICE

Purpose of processing personal data

The purpose of processing personal data provided by a user of My Account (hereinafter the “account user”) is to provide services to the account user, including providing the following information:

• information about the account user’s recent orders placed through the website,
• the account user’s first name, surname, email address, delivery addresses and billing addresses for orders they place through the website, and
• information about goods that the account user has marked on the website as Add to wishlist.

The account user may change their details, such as first name, surname, email address and shipping and billing addresses for their orders.

Legal basis for processing personal data

The legal basis for processing personal data provided by the user of My Account is the performance of the Controller’s obligations arising from the concluded user account agreement and from legal regulations (for example, the Controller’s obligation under statutory rules on mandatory archiving of personal data).

How long do we retain your data?

We retain the data only for as long as necessary to provide the My Account service and, where applicable, for the period required by mandatory personal data archiving rules.

What rights do you have regarding your data?

The account user has the right to request from the Controller access to personal data, rectification or erasure of personal data, restriction of processing concerning the data subject, or to object to processing, as well as the right to data portability. These rights are set out in more detail in Articles 15–20 GDPR.

The account user has the right to lodge a complaint with the Information Commissioner of the Republic of Slovenia at Dunajska cesta 22, 1000 Ljubljana, Slovenia, telephone: +386 (0)1 230 97 30, email: [email protected], website: https://www.ip-rs.si/.

The user of My Account has the right to terminate the agreement, as does the Controller (for example by written notice or email sent to the user’s email address).

Requirement to provide personal data

The requirement to provide personal data supplied by the account user is based on the customer account agreement and the requirement that must be included in that agreement. If the account user did not provide the relevant personal data to the Controller, the Controller would, for example, be unable to fulfil its obligations under the customer account agreement. Providing the account user’s email address is necessary to conclude the customer account agreement. If such personal data is not provided, the user account agreement cannot be concluded.

4. SALES CONTRACT

Purpose of processing personal data

The purpose of processing personal data provided by the customer is to complete the purchase of goods.

Legal basis for processing personal data

The legal basis for processing personal data provided by the customer is the performance of the Controller’s obligations under the concluded sales contract (for example, the Controller’s obligation to deliver the ordered goods to the customer) and obligations arising from legal regulations (for example, mandatory archiving obligations), as well as the Controller’s legitimate interest in establishing, exercising or enforcing potential legal claims against the customer in connection with the purchase of goods, including the pursuit of such claims by out-of-court means.

How long do we retain your data?

Personal data provided by the customer will be retained for four years from the conclusion of the sales contract and, where necessary, for any additional mandatory archiving period.

What rights do you have regarding your data?

The customer has the right to request from the Controller access to and rectification or erasure of personal data, restriction of processing concerning the data subject, to object to processing and to data portability. These rights are set out in more detail in Articles 15–20 GDPR.

The customer has the right to lodge a complaint with the supervisory authority, the Information Commissioner, Dunajska 22, 1000 Ljubljana, Slovenia, Europe, website: www.ip-rs.si/en/, email: [email protected], telephone: +386 (0)1 230 97 30.

Requirement to provide personal data

The requirement to provide personal data to the Controller is based on the law, the sales contract and the requirements that must be included in the sales contract. If a customer wishes to enter into a sales contract with the Controller, they are required to provide personal data to the Controller. If the customer did not provide such personal data, the Controller would, for example, be unable to fulfil its obligations under the sales contract and the applicable legal regulations. Customer identification data is also required in order to conclude a sales contract. If such personal data, namely the customer’s identification data, is not provided, the sales contract cannot be concluded.

5. DISCLOSURE OR TRANSFER OF DATA TO THIRD PARTIES

The Controller may disclose personal data of customers and users of www.frutilu.com to third parties where required by applicable law, where the Controller receives a request from a competent authority, or in response to judicial or other official proceedings.

Personal data of customers and website users will be processed by employees of FRUTILU d.o.o. and by contractual partners and other processors with which FRUTILU d.o.o. has entered into appropriate contractual arrangements, insofar as such processing is necessary for the provision of their services. These include in particular delivery providers (e.g. Pošta Slovenije, GLS and Packeta), payment service providers (e.g. PayPal and Stripe), the bank or payment account provider, IT and hosting infrastructure providers, analytics service providers and the AI chatbot provider Chatbase Inc., 2261 Market Street STE 85690, San Francisco, CA 94114, United States of America, together with its authorised sub-processors.

6. COOKIES

Our website uses so-called cookies.

The list of cookies and cookie settings are available at the following link.

Legal basis for processing personal data

The processing of personal data in connection with technical cookies is necessary for the purposes of the legitimate interests pursued by FRUTILU.

The processing of personal data in connection with credit card and the PayPal plugin is necessary for the purposes of the legitimate interests pursued by FRUTILU.

The legal basis for processing personal data in connection with other non-technical cookies is your consent to the use of non-technical cookies.

Legitimate interests pursued by FRUTILU

FRUTILU’s legitimate interest in relation to technical cookies is its ability to operate its business and website.

FRUTILU’s legitimate interest in connection with credit card and the PayPal plugin is to prevent fraud against FRUTILU and to protect FRUTILU’s legal rights as set out in the Terms and Conditions.

Recipients of personal data

A recipient of your personal data may be the provider of the Google Analytics service, namely Google LLC, with registered office at 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States of America. Further information on Google Analytics is available at https://marketingplatform.google.com/about/analytics/. Further information about the company is available at https://about.google/?utm_source=google-CZ&utm_medium=referral&utm_campaign=hp-footer&fg=1.

A recipient of your personal data may be the provider of the Meta Pixel service, namely Meta Platforms, Inc., with registered office at 1 Meta Way, Menlo Park, CA 94025-1453, United States of America. Further information on Meta Pixel is available at www.facebook.com/business/tools/meta-pixel. Further information about the company is available at https://about.meta.com/metaverse/?utm_source=about.facebook.com&utm_medium=redirect.

We hereby inform you of the existence of an adequacy decision of the European Commission.

What rights do you have regarding your data?

You have the right to request from the Controller access to, rectification and erasure of personal data, restriction of processing relating to your personal data, and the right to data portability. These rights are set out in more detail in Articles 15–20 GDPR.

You have the right to object to processing. This right is set out in more detail in Article 21 GDPR.

You have the right to lodge a complaint with the supervisory authority, the Information Commissioner, Dunajska 22, 1000 Ljubljana, Slovenia, Europe, website: www.ip-rs.si/en/, email: [email protected], telephone: +386 (0)1 230 97 30.

You have the right to withdraw your consent at any time without affecting the lawfulness of processing based on consent before its withdrawal. You may withdraw your consent, for example, by sending an email to [email protected] with the text I withdraw my consent to non-technical cookies.

7. DIRECT MARKETING

Purpose of processing

The purpose of processing the email address is to send newsletters, product notifications, offers, benefits, promotions and other marketing communications from FRUTILU.

Legal basis for processing

Where a user voluntarily subscribes to newsletters or otherwise gives valid consent to direct marketing, the processing of their email address is based on consent pursuant to Article 6(1)(a) GDPR.

Where permitted by applicable electronic communications legislation, FRUTILU may also use the email address of an existing customer, obtained in connection with the sale of a product or service, for the direct marketing of its own similar products or services, provided that the customer was given a clear and free opportunity to object to such use both when the email address was collected and in each individual communication.

What data do we process?

For direct marketing purposes, we may in particular process the email address, information relating to subscription to or unsubscription from communications, and technical data relating to the delivery or use of emails where such data is collected on a valid legal basis.

How long do we retain your email address?

Where processing is based on consent, we retain the email address for direct marketing purposes until consent is withdrawn or the user unsubscribes from marketing communications, unless another legal basis exists for the continued retention of certain data.

Where FRUTILU uses an existing customer’s email address on the basis of legally permitted direct marketing of similar products or services, it uses the address for this purpose until the user objects or unsubscribes.

Right to unsubscribe or object

The user may at any time, easily and free of charge, withdraw consent or object to the use of their email address for direct marketing. This can be done by clicking the “unsubscribe” link in the footer of each marketing email or by sending a request to [email protected].

Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

Žlebe, 20.08.2026