1. Data Controller Identification

The entity responsible for processing your personal data is:

2. What Information We Collect

We only collect personal information necessary to deliver contract research services, answer scientific inquiries, and maintain laboratory business operations:

• Inquiry & Contact Data: Name, professional title, company/institution name, corporate email address, telephone number, and message contents submitted via contact forms or direct email.
• Business Collaboration Data: Billing details, corporate tax identification (VAT number), official address, contractual authorizations, and communication history related to pharmaceutical projects.
• Technical & Log Data: IP addresses, browser type, device identifiers, and pages accessed, collected automatically to ensure web application security, prevent unauthorized access, and optimize site performance.

3. Legal Grounds for Processing (GDPR Article 6)

We process personal data based on the following legitimate legal bases under EU law:

• Performance of a Contract (Art. 6(1)(b)): Necessary to execute or enter into pharmaceutical research, testing, or analytical agreements with your organization.
• Legitimate Interests (Art. 6(1)(f)): Necessary to ensure network security, defend against fraudulent activity, and communicate with institutional partners.
• Legal Compliance (Art. 6(1)(c)): Fulfilling Slovenian and EU tax, commercial accounting, and laboratory record-keeping obligations.
• Consent (Art. 6(1)(a)): Where explicitly provided for optional newsletter subscriptions or specialized technical updates.

4. Confidentiality & Data Sharing

KV LAB d.o.o. does not sell, rent, or trade your personal data. Your information is only accessible to authorized personnel bound by confidentiality agreements. We may share data strictly with trusted service providers who assist our operations under compliant Data Processing Agreements (DPAs):

• Secure EU-based cloud hosting and data storage providers
• Certified analytical calibration and IT maintenance contractors
• Statutory bodies or judicial authorities when mandated by Slovenian or EU law

5. Cookies and Web Analytics

Our website utilizes essential functional cookies necessary for site navigation, security, and session management. We do not use intrusive third-party cross-site advertising trackers. You can adjust your browser settings to decline or delete cookies at any time; however, certain interactive website features may be affected.

6. Data Retention Period

We retain personal information only for as long as necessary to fulfill the purposes for which it was gathered, including satisfying legal, accounting, scientific auditing, or contractual reporting obligations. Inactive inquiries not leading to commercial collaboration are securely erased within 24 months.

7. Your Rights Under the GDPR

Under the European Union General Data Protection Regulation, you hold the following statutory rights regarding your personal data:

• Right of Access (Art. 15): Request a copy of the personal data we hold about you.
• Right to Rectification (Art. 16): Request correction of inaccurate or incomplete information.
• Right to Erasure / Right to be Forgotten (Art. 17): Request deletion of your personal data where retention is no longer legally justified.
• Right to Restriction (Art. 18): Request temporary limitation of processing in specific circumstances.
• Right to Data Portability (Art. 20): Receive your data in a structured, machine-readable format.
• Right to Object (Art. 21): Object to processing based on legitimate interests.

To exercise any of these rights, please submit a written request to research@kvlab.si. We will respond within 30 days without undue delay.

8. Supervisory Authority

If you believe your personal data has been processed in violation of applicable data protection law, you have the right to lodge a complaint with the Slovenian Information Commissioner (Informacijski pooblašČenec RS), Dunajska cesta 22, 1000 Ljubljana, Slovenia (www.ip-rs.si).