Mobile app privacy policy for Melhi AR

In Mestni muzej Idrija/Idrija Municipal Museum we respect your privacy as a user. This Privacy
Policy explains how we collect, use, disclose, and safeguard your information when you visit our
mobile application Melhi AR. Please read this Privacy Policy carefully.
IF YOU DO NOT AGREE WITH THE TERMS OF THIS PRIVACY POLICY, PLEASE DO NOT ACCESS THE
APPLICATION.

Mobile application: Melhi AR

INFORMATION AND CONTACT

Name: Mestni muzej Idrija/Idrija Municipal Museum
Address: Prelovčeva 9, SI 5280 Idrija, Slovenija
VAT number: 72695439
Registration number: 5055741000
E-mail: tajnistvo@muzej-idrija-cerkno.si
Telephone number: +386 (0)5 37 26 600
Contact person: Ivana Leskovec, director, ivana.leskovec@muzej-idrija-cerkno.si

Idrija Municipal museum is the Controller of the website. That means the one who manages the
personal data and determines the purposes and means for the processing of your personal data.
We reserve the right to make changes to this Privacy Policy at any time and for any reason. We
will alert you about any changes by updating the “Last updated” date of this Privacy Policy.
You are encouraged to periodically review this Privacy Policy to stay informed of updates. You will
be deemed to have been made aware of, will be subject to, and will be deemed to have accepted
the changes in any revised Privacy Policy by your continued use of the Application after the date
such revised Privacy Policy is posted.

This Privacy Policy does not apply to the third-party online/mobile store from which you install
the Application or make payments, including any in-game virtual items, which may also collect
and use data about you. We are not responsible for any of the data collected by any such third
party.

COLLECTION OF YOUR INFORMATION

We don’t collect any information from your device (IP Address, Device IP, etc.). Yet, the app
Melhi AR is available on Google Play. Be aware that Google Play is subject to the Terms of Use
and Privacy Policy published by Google and must agree with them. We don’t have any influence
over the processing of personal data in relation to Google.

More about Google privacy policy:
– https://policies.google.com/privacy?hl=en-US,
– https://policies.google.com/privacy?hl=sl-si.

The Processors who process personal data on behalf of the Controller, according to instructions,
and within the framework of legitimate purposes and means of processing is Google Ireland, Inc.
Processors process personal data in accordance with the applicable legislation.

Both, the Controller and their Processor respect the general legal principles related to the
processing of the users’ personal data:
– legal, fair and transparent processing,
– determined, explicit, and legal purposes,
– personal data are processed in the smallest extent possible,
– the personal data is kept just as long as necessary for the purpose of processing,
– protection of personal data and prevention of unlawful or unauthorised process.

GENERAL INFORMATION

Further on, we present you some general information about collection and processing of
information, although we don’t collect or process them. When you download or use an App or
Subscription Service, it may automatically collect certain information about your use. Information
can be collected in a variety of ways. The information may collect via the Application and depends
on the content and materials you use, and includes:
– device information,
– tracking technologies and
– information you provide to us.

Device information: IP address; Device ID; The type of Internet browser or mobile device used;
The operating system of your computer or mobile device; and other similar technical information.
Device Information we collect automatically will not be linked with any personal information that
you provide.
Tracking technologies: cookies and web beacons, tracking pixels and other tracking technologies
on the Application help customize the Application and improve your experience. When you access
the Application, your personal information is not collected through the use of tracking
technology. Most browsers are set to accept cookies by default. Cookies are small computer files
that are transferred to your hard disc and which contain information such as your user name and
the activities that you performed while using the App and Subscription Services. Cookies
personalize your experience with the App and the Subscription Services, as well as to store your
login information so that you do not need to re-enter it each time you visit the App or access the
Subscription Services. We do not have access to or control over these cookies, and our Privacy
Policy does not cover the use of third-party cookies.
You can remove or reject cookies, but be aware that such action could affect the availability and
functionality of the Application. You may not decline web beacons. However, they can be
rendered ineffective by declining all cookies or by modifying your web browser’s settings to notify
you each time a cookie is tendered, permitting you to accept or decline cookies on an individual
basis.

USE OF INFORMATION

Having accurate information about you permits collector to provide you with a smooth, efficient,
and customized experience.
Your data can be retained for the following purposes:
– to develop new features and improve the App and Subscription Services;
– to support subsequent customer service inquiries;
– to improve the safety and security of the App and Subscription Services;
– to comply with our legal obligations.

Your information is retained for as long as is reasonably necessary in relation to the purposes for
which this data was collected.

HOW PERSONAL INFORMATION IS SHARED

We do not sell, trade, or rent your personal information to others, and will not do so except as
required by law or in connection with a merger, asset sale or similar business transaction. We use
third-party service providers to help us operate our business and the Melhi AR App or administer
activities on our behalf. We do not use analytics software to collect and send device data to third
parties.

LINKS TO OTHER APPLICATIONS

Our App does not present any type of advertisements or Third-Party advertisements and does
not contain links to other applications and services (“Third-Party Apps”). Melhi AR will not share
your personal information with Third-Party Apps. Melhi AR is not responsible for the privacy
practices of Third-Party Apps. Some Third-Party Apps may possess styles and appearances that
are similar to our Apps. This Privacy Policy covers only our App. If you decide to utilize Third-Party
Apps, we suggest that you read their privacy policies carefully.

Service provider

We may also engage third parties to perform services in connection with the operation of the
Melhi AR app. Each of these third parties is contractually obliged to protect the security of any
information we share with them, and limited in their use of the information to the services being
provided solely to Melhi AR:
– Google Android: Your Android input method editor is shared with Google Android in
connection with performance of network communications.
– Apple: Your iOS identifier is shared with Apple in connection with performance of network
communications.
– Internet service provider (ISPs): Your IP address is shared with ISPs to ensure legal or
regulatory compliance.

SECURITY OF INFORMATION

The Personal Information is stored on a secure, password-protected server. Only authorized
personnel have access to your Personal Information. However, despite best efforts, no
transmission over the Internet or cellular phone network, nor any other method of data storage,
can be guaranteed to be safe 100% of the time.
Google uses administrative, technical, and physical security measures to help protect your
personal information. Please be aware that despite our efforts, no security measures are perfect
or impenetrable, and no method of data transmission can be guaranteed against any interception
or other type of misuse. Any information disclosed online is vulnerable to interception and misuse
by unauthorized parties.

LEGISLATION

If you are an individual in the European Union (EU) or an EU citizen, data about you can be
collected and processed only when there are legal bases for doing so under applicable EU laws.
This means your data can be collected and processed only when:
– it is necessary for a legitimate interest (which is not overridden by your individual privacy 6
interests), such as preventing fraud, improving the App, and increasing the security of the
App and network infrastructure;
– you have consented to this collection and processing for a specific purpose;
– it is necessary to fulfil contractual obligations;
– it is necessary to comply with a legal obligation.

Where you give your consent to process your Personal Information, you have the right to
withdraw or decline consent at any time. If you wish to withdraw your consent, you can.

This Privacy policy is evaluated by following Slovenian and European legislations:

– the Personal Data Protection Act (ZVOP-1, Official Gazette of the RS, no. 94/2007 and
amend.),
– the Regulation (EU) 2016/679 of the European Parliament and the Council from
27/04/2016 regarding the protection of individuals in personal information processing
and the free flow of such information and repealing Directive 95/46/EC (General Data
Protection Regulation, GDPR),
– the Electronic Communications Act (ZEKom-1, Official Gazette of the RS, no. 109/12 and
amend.)
– other Slovenian and European legislation regulating these fields.

If you are an EU citizen or reside in the EU and wish to raise a concern about our use of your
information (and without prejudice to any other rights you may have), you have the right to do
so with your local supervisory authority.

INDIVIDUAL RIGHTS

We make certain choices available to you when it comes to your Personal Information and any
Device Information that can identify you (“Personal Data”). Please review the below 7
information outlining your choices and how to exercise them. We will respond to all requests
within a reasonable timeframe (30 days). If our full response will ever take more than a month
due to complexity or scope, we will notify you of this and keep you updated on our progress.

You have the right to:
– review and update your data,
– erase your data,
– restriction of processing of personal data;
– data portability,
– objection to processing of personal data.