Participant Privacy Notice — Pragio Ljubljana PoC
- Purpose: Provide participants with the disclosures required by GDPR Art 13 and Art 14 in plain language. This is the notice linked from every page footer during the PoC.
- Scope: The Pragio Ljubljana invitation-only prototype. Not applicable to any future public product, which will carry its own public privacy policy.
- Last reviewed: 2026-09-26 — PostHog (behavioural analytics) added as a processor (ADR-0027); page-leave data disclosed. Previous review 2026-05-02 — Peter Uranjek.
- Contact: Peter Uranjek — peter.uranjek@gmail.com.
- Companion documents:
./participant-consent-form.md,./retention-schedule.md,./internal-data-handling-policy.md,./scraper-legitimate-interest-assessment.md,./peter-personal-data-location-inventory.md.
This notice is written to be readable by participants, and to stand up to review by the Slovenian supervisory authority. If any part is unclear, email the contact above and we will improve it.
Slovenian version — Obvestilo o zasebnosti
1. Upravljavec podatkov
Upravljavec vaših osebnih podatkov v okviru prototipa Pragio Ljubljana je Peter Uranjek, ki deluje v imenu projekta Pragio. Za PoC ni ustanovljene ločene pravne osebe; javna pravna oseba je odložena v pre-public-launch-checklist.md #29.
Kontakt za vsa vprašanja glede vaših osebnih podatkov: peter.uranjek@gmail.com.
Pooblaščene osebe za varstvo podatkov (DPO) nimamo — obseg obdelave je pod pragom iz čl. 37 Splošne uredbe o varstvu podatkov. Vlogo pooblaščenca neformalno opravlja Peter Uranjek.
2. Nameni obdelave in pravne podlage
| Dejavnost obdelave | Namen | Pravna podlaga |
|---|---|---|
| Ustvarjanje računa in prijava | Identifikacija udeleženca in omogočanje dostopa do prototipa | Čl. 6(1)(b) — pogodba |
| Transakcijska e-pošta (ponastavitev gesla) | Pošiljanje varnostne e-pošte za račun (preko Resend, ZDA) | Čl. 6(1)(b) — pogodba |
Iskanje nepremičnin, shranjene iskalne poizvedbe (vključno z nastavitvami e-poštnih opozoril: notify, alert_frequency), priljubljene, prošnje za ogled | Osnovne funkcije prototipa | Čl. 6(1)(b) — pogodba |
| Sporočanje med udeleženci (kupec – prodajalec / agent) | Varno komuniciranje znotraj platforme | Čl. 6(1)(b) — pogodba |
| Vedenjska analitika (dogodki uporabe; v Pragiu in pri PostHog, EU) | Izboljšanje prototipa med trajanjem PoC | Čl. 6(1)(a) — privolitev + čl. 46(2)(c) SCC |
| Poizvedbe pri AI-agentu (Anthropic, ZDA) | Generiranje AI-odgovorov | Čl. 6(1)(a) — privolitev + Čl. 46(2)(c) SCC |
| Zajem (scraping) oglasov z nepremicnine.net | Interno raziskovanje uporabe v okviru PoC | Čl. 6(1)(f) — zakoniti interes |
| Zajem javnih registrov (SURS, ZZZS, RPE, AKOS, podatki MOL) | Prikaz neosebnih soseskih kazalnikov | Odprti podatki; kjer velja, čl. 6(1)(e) |
| Varnostni dnevniki (hash IP-jev, napake) | Delovanje storitve in varnost | Čl. 6(1)(f) — zakoniti interes |
| Nočne varnostne kopije (Contabo Object Storage, EU — Nemčija) | Zaščita pred izgubo podatkov | Ista podlaga kot osnovne obdelave |
Podrobnejše informacije o zajemu oglasov nepremicnine.net najdete v scraper-legitimate-interest-assessment.md.
3. Prejemniki (obdelovalci)
Vaše podatke obdelujejo v našem imenu:
- Anthropic, PBC (ZDA) — obdelava poizvedb AI-agenta. Prenos v ZDA na podlagi standardnih pogodbenih klavzul EU. Anthropic po pogodbi vaših podatkov ne uporablja za učenje modelov. Pogodbo o obdelavi podatkov hranimo kot ADR.
- Netcup GmbH (EU — Dunaj, Avstrija) — gostovanje VPS-a, na katerem tečeta aplikacija in podatkovna baza. Pogodba o obdelavi podatkov (AVV) sklenjena; hranjena kot ADR 0006.
- Contabo GmbH — Contabo Object Storage (EU — Nemčija) — nočne šifrirane varnostne kopije. Šifriranje poteka na strani odjemalca (gpg AES256); ključ hrani izključno Pragio, zato Contabo nima dostopa do nešifriranih podatkov. Pogodba o obdelavi podatkov hranjena kot ADR.
- MapTiler AG (Švica) — strežba zemljevidnih ploščic. Pri MapTilerju se ne obdelujejo udeleženčevi identifikatorji, le tehnična zahteva IP in identifikator zahteve. Pogodba o obdelavi podatkov hranjena kot ADR.
- Resend, Inc. (ZDA) — pošiljanje transakcijske e-pošte (trenutno le ponastavitev gesla). Preneseta se le naslov vaše e-pošte in vsebina sporočila (povezava za ponastavitev). Sama dostava poteka prek strežnikov v EU (AWS SES, Irska); pogodbena stranka je v ZDA, zato je prenos zavarovan s standardnimi pogodbenimi klavzulami EU. Pogodba o obdelavi podatkov hranjena kot ADR.
- PostHog, Inc. (ZDA; podatki v oblaku EU, Nemčija) — analitika uporabe, le če ste privolili v vedenjsko analitiko. Prenesejo se: vaš identifikator udeleženca (UUID) z vrsto računa in vlogo, obiskane strani in odhodi s strani (pot brez poizvedbenega niza; lahko vsebuje ID oglasa ali pogovora), čas na strani in globina pomikanja po strani, dogodki uporabe, tehnični podatki brskalnika (brskalnik, operacijski sistem, velikost zaslona, napotitelj brez poizvedbenega niza) in vaš IP-naslov, kot ga PostHog prejme z zahtevo. Snemanje sej je izklopljeno. Pogodbena stranka je v ZDA, zato prenos zavarujejo standardne pogodbene klavzule EU. Pogodba o obdelavi podatkov: ADR 0027.
Drugim tretjim osebam vaših podatkov ne posredujemo.
4. Prenosi v tretje države
Anthropic (ZDA), Resend (ZDA) in PostHog (ZDA) so obdelovalci, katerih pogodbena stranka je izven EGP. Vsi trije prenosi so zavarovana s standardnimi pogodbenimi klavzulami EU (Priloga Izvedbenega sklepa Komisije (EU) 2021/914), modul kontrolor–obdelovalec. Kopijo klavzul lahko pridobite na zgornji kontakt. Pri Resend se e-pošta pošilja iz infrastrukture v EU (AWS, Irska), vendar so nekateri Resendovi podobdelovalci v ZDA, zato prenos zajemajo navedene standardne pogodbene klavzule.
5. Roki hrambe
Podrobni roki so v dokumentu retention-schedule.md. Povzetek za najpogostejše kategorije:
| Kategorija | Rok hrambe med PoC |
|---|---|
| Račun in profil udeleženca | Trajanje PoC + 30 dni |
| Seje | 30 dni |
| Dogodki vedenjske analitike | 90 dni |
| Analitični podatki pri PostHog | Po paketu PostHog (rok še potrjujemo); ob izbrisu računa izbrisani tudi pri PostHog |
| Dnevniki AI-klicev | 30 dni |
| Sporočila, shranjene iskalne poizvedbe, ogledi | Trajanje PoC + 30 dni |
| Zajeti oglasi | 90 dni po statusu expired |
| Hashi IP-jev v varnostnih dnevnikih | 90 dni |
| Nočne varnostne kopije | 30-dnevni rolling |
| Vsi podatki udeležencev po koncu PoC | Izbris v 14 dneh, razen če pisno, posamično privolite v hrambo za Stage 2 |
6. Vaše pravice
Po GDPR imate naslednje pravice:
- Dostop do svojih podatkov (čl. 15) — prejmete kopijo v strukturirani obliki prek
/api/user/exportali na zahtevo. Izvoz zajema podatke v Pragiu; kopijo podatkov pri PostHog pošljemo na zahtevo po e-pošti. - Popravek (čl. 16) — neposredno v
/profileali z zahtevo po e-pošti. - Izbris (čl. 17) — prek
/profile/privacyaliPOST /api/user/delete. - Prenosljivost (čl. 20) — ista izvozna točka kot za dostop; oblika JSON.
- Omejitev obdelave (čl. 18) — prek e-pošte.
- Ugovor (čl. 21) — prek e-pošte.
- Preklic privolitve (čl. 7(3)) — v
/profile/privacytakoj; ne vpliva na zakonitost prejšnjih obdelav. - Pritožba pri nadzornem organu — Informacijski pooblaščenec Republike Slovenije (ip-rs.si, gp.ip@ip-rs.si).
Ciljni odzivni časi so navedeni v spodnji tabeli. Najpozneje odgovorimo v 30 dneh (čl. 12(3)).
| Pravica | Cilj | Zakonski rok |
|---|---|---|
| Dostop / prenosljivost | 24 ur | 30 dni |
| Popravek | 14 dni | 30 dni |
| Izbris | 7 dni (aktivni sistemi) + 30 dni (varnostne kopije, ki se rotirajo) | 30 dni |
| Preklic privolitve | Takoj | — |
| Ugovor | Potrditev v 7 dneh, rešitev po presoji | 30 dni |
7. Avtomatizirano odločanje
Ne izvajamo profiliranja ali avtomatiziranega odločanja s pravnim učinkom (čl. 22). AI-agent ponuja informacije in gradiva; ne sprejema odločitev o vas.
8. Varnost
Glej internal-data-handling-policy.md. Na kratko: dostop ima danes samo Peter Uranjek; dostop preko SSH-ključev; podatkovna baza ni dostopna z interneta; varnostne kopije so šifrirane; vsi procesorji so pod pogodbo o obdelavi.
9. Obveščanje o kršitvi
V primeru potrjene kršitve osebnih podatkov bomo obvestili prizadete udeležence v 72 urah, in če je ustrezno, Informacijskega pooblaščenca (čl. 33). Dnevnik kršitev hranimo v ljubljana-poc/legal/breach-log.md.
10. Spremembe tega obvestila
Če se to obvestilo bistveno spremeni, vas bomo po e-pošti obvestili in ponovno prosili za privolitev (kjer je privolitev podlaga). Različice s časovnimi žigi hranimo v repozitoriju.
English version — Privacy Notice
1. Controller
The controller of your personal data for the Pragio Ljubljana PoC is Peter Uranjek, acting on behalf of the Pragio project. No separate legal entity is incorporated for the PoC; the public-product legal entity decision is deferred in pre-public-launch-checklist.md #29.
Contact for any question about your personal data: peter.uranjek@gmail.com.
We do not have a Data Protection Officer — processing volumes are below the Art 37 thresholds. The DPO role is informally held by Peter Uranjek.
2. Purposes and lawful bases
| Processing activity | Purpose | Lawful basis |
|---|---|---|
| Account creation and authentication | Identify the participant and grant access to the PoC | Art 6(1)(b) — contract |
| Transactional email (password reset) | Send account-security email (via Resend, US) | Art 6(1)(b) — contract |
Search, saved searches (including email alert preferences: notify, alert_frequency), favourites, viewing requests | Core features of the PoC | Art 6(1)(b) — contract |
| Messaging between participants (buyer – seller / agent) | Safe in-platform communication | Art 6(1)(b) — contract |
| Behavioural analytics (usage events; in Pragio and via PostHog, EU Cloud) | Improve the prototype during the PoC | Art 6(1)(a) — consent + Art 46(2)(c) SCCs |
| AI-agent queries (sent to Anthropic, US) | Generate AI-assisted responses | Art 6(1)(a) — consent + Art 46(2)(c) SCCs |
| Scraping of nepremicnine.net listings | Internal research during the PoC | Art 6(1)(f) — legitimate interest |
| Ingestion of public registers (SURS, ZZZS, RPE, AKOS, Ljubljana open data) | Non-personal neighbourhood indicators | Open data; Art 6(1)(e) where applicable |
| Security logs (hashed IPs, error traces) | Service operation and security | Art 6(1)(f) — legitimate interest |
| Nightly backups to Contabo Object Storage (EU — Germany) | Data-loss protection | Same basis as the underlying processing |
The legitimate-interest assessment for the scraping activity is at scraper-legitimate-interest-assessment.md.
3. Recipients (processors)
The following processors act on our behalf:
- Anthropic, PBC (United States) — processes AI-agent queries. Transfer to the US is covered by the EU Standard Contractual Clauses. Under our contract, Anthropic does not use your data to train models. DPA recorded as an ADR.
- Netcup GmbH (EU — Vienna, Austria) — hosts the VPS that runs the application and database. DPA (AVV) concluded; recorded as ADR 0006.
- Contabo GmbH — Contabo Object Storage (EU — Germany) — encrypted nightly backups. Client-side encrypted (gpg AES256); the key is held only by Pragio, so Contabo never sees plaintext. DPA recorded as an ADR.
- MapTiler AG (Switzerland) — serves map tiles. MapTiler does not receive participant identifiers, only the technical IP of the tile request. DPA recorded as an ADR.
- Resend, Inc. (United States) — sends transactional email (currently password reset only). Only your email address and the message content (the reset link) are transferred. Email is delivered through EU-based infrastructure (AWS SES, Ireland); the contracting party is in the US, so the transfer is covered by the EU Standard Contractual Clauses. DPA recorded as an ADR.
- PostHog, Inc. (United States; data in the EU Cloud, Germany) — product analytics, only if you consented to behavioural analytics. What is sent: your participant ID (a UUID) with your account type and role, the pages you visit and leave (the path without its query string; it can contain a listing or conversation ID), time on page and scroll depth, usage events, technical browser data (browser, operating system, screen size, referrer without its query string), and your IP address as PostHog receives it with each request. Session recording is off. The contracting party is in the US, so the transfer is covered by the EU Standard Contractual Clauses. DPA: ADR 0027.
We do not share your data with any other third parties.
4. International transfers
Anthropic (US), Resend (US) and PostHog (US) are the processors whose contracting party is outside the EEA. All three transfers are protected by the EU Standard Contractual Clauses (Annex to Commission Implementing Decision (EU) 2021/914), controller-to-processor module. A copy of the clauses is available on request. For Resend, email is sent from EU infrastructure (AWS, Ireland), but some of Resend's sub-processors are US-based, so the transfer is covered by the Standard Contractual Clauses. For PostHog, analytics data is stored in PostHog's EU Cloud (Germany), but PostHog's contract allows processing outside the EEA, so the Standard Contractual Clauses cover it too.
Switzerland (MapTiler) benefits from the European Commission's adequacy decision; no SCCs required.
5. Retention
Full detail is in retention-schedule.md. Summary for the most common categories:
| Category | Retention during the PoC |
|---|---|
| Participant account and profile | Length of PoC + 30 days |
| Sessions | 30 days |
| Behavioural analytics events | 90 days |
| Analytics data held by PostHog | Per PostHog's plan (period being confirmed); deleted at PostHog when you delete your account |
| AI-call logs | 30 days |
| Messages, saved searches, viewing requests | Length of PoC + 30 days |
| Scraped listings | 90 days after status='expired' |
| Hashed IPs in security logs | 90 days |
| Nightly backups | 30-day rolling |
| All participant data after PoC close | Purged within 14 days, unless you have given written, individual consent to retain for Stage 2 |
6. Your rights
Under the GDPR you have the following rights:
- Access (Art 15) — receive a copy of your data in a structured format via
/api/user/exportor on request. The export covers data held by Pragio; a copy of your data held by PostHog is sent on request by email. - Rectification (Art 16) — directly in
/profile, or by email. - Erasure (Art 17) — via
/profile/privacyorPOST /api/user/delete. - Portability (Art 20) — same export endpoint; JSON format.
- Restriction (Art 18) — by email.
- Object (Art 21) — by email.
- Withdraw consent (Art 7(3)) — in
/profile/privacy, immediate effect; does not affect past processing. - Lodge a complaint — with the Information Commissioner of the Republic of Slovenia (ip-rs.si, gp.ip@ip-rs.si).
Target response times are below. The legal deadline in all cases is 30 days (Art 12(3)).
| Right | Target | Legal deadline |
|---|---|---|
| Access / portability | 24 hours | 30 days |
| Rectification | 14 days | 30 days |
| Erasure | 7 days (active systems) + 30 days (rolling backups) | 30 days |
| Withdraw consent | Immediate | — |
| Object | Acknowledge in 7 days, decide case by case | 30 days |
7. Automated decision-making
We do not perform profiling or automated decision-making with legal effect (Art 22). The AI agent surfaces information and suggestions; it does not make decisions about you.
8. Security
See internal-data-handling-policy.md. In short: today access is held only by Peter Uranjek; SSH key authentication only; the database is not exposed to the public internet; backups are encrypted; all processors operate under a DPA.
9. Breach notification
In the event of a confirmed personal-data breach, we will notify affected participants within 72 hours and, where applicable, the Information Commissioner (Art 33). A breach log is kept at ljubljana-poc/legal/breach-log.md.
10. Changes to this notice
If this notice changes materially, we will email you and re-request consent where consent is the lawful basis. Timestamped prior versions are kept in the repository.
Source-of-truth cross-references
- Retention details:
./retention-schedule.md - Internal handling controls:
./internal-data-handling-policy.md - Scraping LIA:
./scraper-legitimate-interest-assessment.md - Consent form shown at
/register:./participant-consent-form.md - Items deferred to a future public launch:
./pre-public-launch-checklist.md