Privacy
Policy
How PeK Automotive processes and protects personal data on the PEK Civil Defence website.
This Privacy Policy explains how PeK Automotive d.o.o., as data controller, processes personal data of visitors to https://pek-defence.com/, people who submit an inquiry, and other persons who contact us.
We process personal data in accordance with Regulation (EU) 2016/679 (GDPR), the Slovenian Personal Data Protection Act (ZVOP-2), electronic communications rules and other applicable legislation.
1) Data controller
The controller has not appointed a Data Protection Officer (DPO). For privacy questions or to exercise your rights, please use the contact details above.
2) How we obtain personal data
We obtain data directly from you when you complete a contact or demo form, email or call us, and automatically when you use the website where this is necessary for operation and security or where you have given the relevant consent.
- visiting and using the website;
- contact and demo request forms;
- email, telephone and business communications;
- interaction with external content, such as YouTube videos, if you activate it;
- website analytics, if you allow it.
3) Data we process, purposes and legal bases
The scope depends on how you use the website. Forms may include your name, company, email address, telephone number, system of interest, inquiry type, message and information you voluntarily provide. Server and security logs may contain IP address, request time, browser/device information and information required to detect abuse.
| Service / source | Provider | Data | Purpose | Legal basis |
|---|---|---|---|---|
| PEK Civil Defence forms | PeK Automotive d.o.o. / formhandler.pekauto.com | Name, company, email, telephone, system of interest, inquiry type, message and source page | Handling inquiries, preparing quotations, pre-contractual steps and business communication | Article 6(1)(b) GDPR; Article 6(1)(f) GDPR may also apply to general business communication |
| Cloudflare Turnstile | Cloudflare, Inc. | Technical browser/device data, network and security signals and verification result | Protecting forms against automated abuse and spam | Article 6(1)(f) GDPR; strictly necessary security technology |
| Google Analytics 4 (where measurement is enabled) | Google Ireland Limited / Google LLC | Online identifiers, device/browser information, usage events and approximate location derived from IP | Measuring use and improving the website | Article 6(1)(a) GDPR – only after consent to analytics technologies |
| YouTube embedded content | Google Ireland Limited / YouTube | IP address, device/browser information, video interactions and possible identifiers/cookies after player activation | Displaying video content | Article 6(1)(a) GDPR – the player loads only after consent to external/marketing content |
If you contact us about a specific product, demonstration, quotation or potential contractual relationship, we generally process the data in order to take steps at your request before entering into a contract (Article 6(1)(b) GDPR). For ordinary business communication, system security and prevention of misuse, we may rely on legitimate interests (Article 6(1)(f) GDPR), after balancing those interests against your rights and freedoms.
4) Cookies, analytics and external content
Non-essential analytics and marketing/external technologies are disabled by default. They are activated only after your explicit choice in Cookie Settings. You can change or withdraw consent at any time through Cookie Settings in the website footer.
Google Analytics 4, where measurement is enabled on the production website, may only be used after consent to the Analytics category. YouTube players are blocked until consent to external/marketing content and then use the youtube-nocookie.com domain. Details are provided in our Cookie Policy.
5) Contact forms and abuse prevention
Forms are submitted to PeK Automotive infrastructure through formhandler.pekauto.com. We use Cloudflare Turnstile to protect forms against automated abuse. Turnstile is loaded only when you interact with a form and is used to distinguish legitimate users from automated abuse. Cloudflare may receive technical data required for the security check.
6) Recipients and processors
Personal data may be accessed by authorised employees and contracted providers supporting hosting, IT, security, email, web forms or analytics where necessary. Where a provider acts as our processor, we require appropriate safeguards and contractual arrangements.
7) International transfers
Certain providers, particularly Google and Cloudflare, may process data outside the European Economic Area, including in the United States. Where such transfers occur, we rely on valid mechanisms under Chapter V GDPR, such as the EU–US Data Privacy Framework adequacy decision for certified recipients and/or Standard Contractual Clauses where required.
8) Retention
We retain data only for as long as necessary for the relevant purpose or as required by applicable law. Inquiries and business correspondence are generally retained for up to five years from the last relevant contact unless longer retention is required for contractual, accounting, tax or legal obligations. Data processed on the basis of consent is processed until consent is withdrawn or the applicable technology retention period expires.
For Google Analytics 4, retention of user-level and event-level data depends on the settings of our GA4 property (standard options include 2 or 14 months); aggregated reporting may be retained for longer. Individual cookie durations are listed in the Cookie Policy.
9) Your rights
Subject to the conditions of the GDPR, you have rights of access, rectification, erasure, restriction, data portability, objection to processing based on legitimate interests and withdrawal of consent at any time. Withdrawal does not affect the lawfulness of processing before withdrawal. Send requests to legal@pekauto.com.
We will respond without undue delay and generally within one month. That period may be extended where permitted by the GDPR.
10) Complaint to the supervisory authority
If you believe that our processing infringes data protection law, you may lodge a complaint with the Information Commissioner of the Republic of Slovenia, Dunajska cesta 22, 1000 Ljubljana, Slovenia, gp.ip@ip-rs.si, +386 1 230 97 30, www.ip-rs.si.
11) Automated decision-making and profiling
We do not make decisions based solely on automated processing of data collected through this website that produce legal or similarly significant effects for you. Website analytics is not used by us for such decision-making.
12) Security, external links and social networks
We use appropriate technical and organisational measures to protect personal data. The website also contains links to external websites and social networks. If you follow such a link, subsequent processing is governed by the relevant provider's privacy policy. A normal outbound link does not itself transmit data to the third party until you open it.
13) Minors
The website and our systems are not directed at children. We do not knowingly collect personal data from children under 15. If we become aware that such data has been received without an appropriate legal basis, we will handle it appropriately and delete it where required.
14) Changes to this policy
We may update this Policy when our services, technologies or legal requirements change. The current version is always published on this page. If a change materially affects processing, we will provide appropriate notice and, where required, request consent again.
Last updated: 7 October 2026, Logatec.