Privacy policy and accessibility

This policy explains how personal data are processed when you visit matejtomazin.com or contact its controller. It takes account of the General Data Protection Regulation (GDPR), Slovenia’s Personal Data Protection Act (ZVOP-2) and the cookie rules in Slovenia’s Electronic Communications Act (ZEKom-2).

Version 1.1 · Last updated: 16 October 2026.

1. Controller and contact

The controller is MATEJ TOMAŽIN – SAMOZAPOSLENI V KULTURI, SLIKAR, FOTOGRAF, OBLIKOVALEC, AVTOR RADIJSKIH ODDAJ, DIREKTOR FILMA, MONTAŽER IN PRODUCENT (Matej Tomažin, a self-employed cultural professional), Male Braslovče 10B, 3314 Braslovče, Slovenia. Registration number: 2590352000. Tax number: 47515562.

For privacy questions and requests to exercise your rights, email me@matejtomazin.com or write to the postal address above. Requests are handled directly by the controller.

2. Data processed when you visit

You do not need to register or sign in to view public content. The website has no contact form, public user accounts, comments, online checkout or newsletter subscription. Images, videos and fonts are served from this website. Social media content, maps and external video players are not loaded automatically.

When you visit, the server receives technical data needed to deliver the pages: your IP address, the date and time of the request, the requested URL, the server response and information about your browser and operating system. It may also receive the referring page if your browser supplies it. These data may be recorded in server logs.

The purposes are to operate the website, identify technical faults, prevent abuse and protect data. The legal basis is the controller’s legitimate interest in a secure, reliable website under Article 6(1)(f) GDPR. These logs are not used for advertising or visitor profiling. NEOSERV’s terms state that ordinary server logs are generally retained for 30–60 days, depending on the service and server settings. Records relating to a specific security incident may be retained separately for as long as necessary to address the incident or establish, exercise or defend legal claims.

3. Email enquiries and collaboration

If you write to the published email address, we process your email address, name and any other contact details you provide, the message, attachments and correspondence history. The purposes are to answer your question, handle your enquiry and discuss collaboration.

For enquiries about entering into a contract and delivering agreed work, the basis is Article 6(1)(b) GDPR: steps taken at your request before entering into a contract or performance of a contract. For other questions, it is the legitimate interest in answering and maintaining appropriate business correspondence under Article 6(1)(f) GDPR. Data that must be retained to meet legal obligations are processed under Article 6(1)(c) GDPR.

Ordinary contact messages and enquiries that do not result in a contract are retained for no more than one year after the last contact and are then deleted. If a message becomes part of a contractual relationship, accounting records or a specific legal proceeding, the exceptions described below apply to that part.

Providing contact data is voluntary. Without a return address we cannot reply; without the information needed for an agreement we cannot arrange or deliver the work. Please send only information necessary for your question. We do not ask for special categories of personal data such as health information.

4. Cookies and similar technologies

Cookies are small files stored in your browser. We use functional cookies for language, remembering your analytics choice and editorial login, and analytics cookies only with your consent. We do not use advertising cookies. Browser local storage holds the functional “Reduce motion” preference.

• pll_language — Polylang: remembers your language (sl or en). It lasts up to one year from creation or renewal and contains no analytics identifier.
• mt_analytics_consent — privacy choice: remembers acceptance or rejection of analytics and the choice version. It lasts up to 365 days from your choice, applies in both languages and is renewed only when you make a new choice. It respects your decision and is not used to measure visits.
• mt-reduced-motion — “Reduce motion” preference: browser local storage (localStorage) remembers whether you have enabled or disabled this display preference. It applies in both website languages and has no automatic expiry. You can change it on this page or remove it by clearing the website’s data in your browser. It is used to apply your display preference, not to measure visits, and contains no visitor identifier.
• _pk_id.3.[suffix] — Matomo: with consent, stores a random visitor identifier and information used to distinguish new and returning visits. It lasts up to 365 days from creation or renewal during a permitted visit.
• _pk_ses.3.[suffix] — Matomo: with consent, groups page views into a session. It lasts 30 minutes from creation or renewal. The suffix in these names is a technical identifier for the domain and path.
• wordpress_test_cookie — WordPress: checks cookie support on the login page and lasts until the browser session ends.
• wordpress_[hash], wordpress_sec_[hash] and wordpress_logged_in_[hash] — WordPress: support secure editorial login. Normal login uses session cookies, with login validity generally two days; “Remember me” generally extends this to 14 days. Logout removes them.
• wp-settings-[ID] and wp-settings-time-[ID] — WordPress: store editorial interface preferences for one year and are intended for editors.

All listed cookies are first-party cookies of this website. Cookies strictly necessary for a function explicitly requested by you do not require prior consent under Article 225(2) of Slovenia’s Electronic Communications Act (ZEKom-2). Analytics cookies are set only when you select “Allow analytics”. Your browser may shorten these periods or delete cookies earlier. If you delete the choice cookie, we ask again on your next visit and analytics remains disabled until you consent again.

5. Visitor statistics — Matomo and your choice

We use a self-hosted Matomo installation at matomo.snov.si, hosted by NEOSERV, to measure page views, understand content readership and improve the website. The legal basis is your voluntary consent under Article 6(1)(a) GDPR and Article 225(1) ZEKom-2 for analytics cookies.

We load Matomo only after consent. Before consent, after rejection and after withdrawal, we do not send new visit data. Visiting, scrolling or continuing to use the website does not constitute consent. The first notice offers “Allow analytics” and “Reject analytics”. Rejecting analytics does not restrict access to the content. The “Cookie settings” button in the footer of every page opens the analytics settings. These have one button: “Allow analytics” when analytics is disabled, or “Disable analytics” when you have allowed it. Withdrawal stops further tracking and removes analytics cookies from this browser. Choices are separate for each browser or device.

After acceptance, page views send the page address and title, view time, random visitor or visit identifiers, session information and basic technical information about the browser, device and screen size. Query parameters and URL fragments are removed from the address sent to analytics; referral addresses and advertising campaign information are not sent. We do not send email content, names, email addresses or user IDs. We do not use session recording, heatmaps, download or click tracking, or tracking across different websites.

The server receives an IP address on connection and anonymises it before storing analytics visits. Data remains pseudonymised while it contains visit identifiers; IP anonymisation alone does not make all data anonymous. Detailed visit logs are automatically deleted no later than after 365 days. Aggregate reports may remain only if they cannot identify individuals. The statistics controller is Matej Tomažin, identified above. Access is limited to authorised persons needed for administration and technical support; NEOSERV provides hosting as a processor.

Withdrawal does not affect the lawfulness of processing before withdrawal or automatically delete visits already recorded on the server. For requests regarding previously collected personal data, contact the controller listed in section 1; the conditions and rights in section 9 apply. When your saved choice expires, we ask for consent again.

6. Hosting, recipients and data transfers

The website, email and Matomo are hosted by NEOSERV, AVANT.SI d.o.o., Poslovna cona A 49, 4208 Šenčur, Slovenia. As a processor, the provider supplies hosting, email storage, technical security and backups. Its data protection statement describes processing and security measures.

Data are accessed by the controller and, when necessary, authorised technical support personnel subject to confidentiality and appropriate contractual obligations. Competent authorities may receive necessary data where required by law or a specific proceeding. For contractual work, accounting or legal service providers may receive the data needed for their task. We do not sell personal data or disclose them to advertising networks.

For the website’s current operation, the controller does not commission transfers outside the European Economic Area. NEOSERV states that it stores data in the EU or in territories recognised by the EU as providing adequate protection. If a service requires a transfer to a third country, it must have an appropriate basis under Chapter V GDPR, such as a valid adequacy decision or appropriate safeguards. You may ask the controller for information about any transfer and a copy of the applicable safeguards.

7. Retention, deletion and backups

The one-year period applies to ordinary contact correspondence and enquiries that do not lead to work, and to detailed analytics visits as described in section 5, rather than every category of data. Contractual data are retained during performance of the contract and afterwards to the extent necessary until the relevant periods for establishing or defending claims expire. If proceedings begin, necessary data are retained until the final conclusion and expiry of related deadlines. Invoices and tax or accounting records are kept for the periods required by the applicable legislation. Data are not retained solely because a contract once existed if there is no remaining basis or need.

Editorial account data are retained while the account is needed to manage the website. Afterwards the account is removed or data are anonymised, except for records needed for security or legal obligations. Records of privacy requests are kept only to the extent and for the time needed to demonstrate compliance and deal with related proceedings.

Backups support recovery from technical failures and incidents and are not intended for ordinary use of deleted data. Deletion from active records does not immediately delete every backup. Copies are removed through the provider’s replacement cycle. NEOSERV’s published data schedule states that data are removed from its backup systems within 3–9 months after the hosting subscription expires. This separate provider period does not extend the period for ordinary use of contact messages. If data are restored from a backup, previous deletions must be reapplied.

8. Published projects and external links

Project presentations may include collaborators’ names, credits, professional details and project photographs or videos. Their purpose is to present work and credit contributors accurately. These data come from collaboration, agreed materials or public project publications. Professional credits rely on the legitimate interest in presenting work and authorship under Article 6(1)(f) GDPR; where publication is based on consent, Article 6(1)(a) GDPR applies. Artistic expression also takes account of the specific ZVOP-2 rules balancing data protection and freedom of expression.

These materials remain published while relevant to the presentation and archive of work and while a legal basis exists. The one-year enquiry period does not apply to them. If a publication includes your personal data and you would like an explanation, correction or removal, please use the contact above. Each request is assessed against its legal basis and other legitimate rights.

You choose whether to open links to LinkedIn, project websites and other external pages. When you leave this website, the external provider may receive technical visit data and use its own cookies. Its privacy policy applies to its processing.

9. Your rights

Subject to the GDPR’s conditions, you may request access to your data and a copy, correction of inaccurate data, erasure and restriction of processing. You also have a right to data portability where processing is automated and based on consent or a contract.

You may object to processing based on legitimate interests on grounds relating to your particular situation. We will stop that processing unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or the processing is necessary to establish, exercise or defend legal claims. Where consent is the basis, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.

Send your request to me@matejtomazin.com or by post. We respond without undue delay and no later than one month after receiving your request. Depending on complexity or the number of requests, this may be extended by up to two further months; we will explain the extension within the first month. If there are reasonable doubts about your identity, we may request only additional information necessary to confirm it. Requests are normally free of charge, subject to the exceptions for manifestly unfounded or excessive requests under Article 12(5) GDPR.

You may lodge a complaint with the Information Commissioner of the Republic of Slovenia, including without contacting the controller first. The website does not carry out automated decision-making producing legal or similarly significant effects and does not profile individuals.

10. Security and policy updates

Access to data is limited according to responsibilities. We use editorial account protection, software updates and backups. Security incidents are addressed in accordance with the GDPR, including notifying the supervisory authority and affected individuals where the legal conditions are met.

This policy is updated when actual processing or legislation changes. The current version is published here with its revision date. A change to the text does not itself constitute your consent to new processing purposes; consent is obtained separately where required.

11. Website accessibility

We develop this website to make its content and features accessible to as many people as possible, including people with disabilities. Our accessibility improvements are guided by the Web Content Accessibility Guidelines (WCAG 2.2), Level AA.

Accessibility features

• Keyboard access: links and controls can be reached using a keyboard, with visible indicators for focus, the current page and language, and the current gallery thumbnail. The contact panel, cookie settings and gallery can be closed using the Escape key.
• Clear structure: headings, links and content regions are marked up to support navigation with screen readers. This page includes a table of contents for direct access to each section.
• Images: photographs have text descriptions.
• Zoom and contrast: content adapts to browser zoom. The interface respects system colours in high contrast mode when the browser makes that setting available.

Motion and automatic playback

The Reduce motion option stops automatic video playback and turns off animations across the website. Your preference is saved in this browser and applies to future visits. If reduced motion is enabled in your device settings, it is applied automatically and takes precedence over the website preference.

Accessibility review

Last reviewed: 16 October 2026. The review of the Slovenian and English versions covered keyboard navigation, visible focus, contrast, system colours, reduced motion, and image descriptions. The website was also checked in Chrome at 200% and 400% zoom. The issues identified have been addressed.

The review does not constitute a comprehensive confirmation of conformance with all WCAG criteria. The accessibility of linked PDF documents and external websites is outside the scope of this review.

Help and feedback

If you encounter a barrier when using this website or need content in a more accessible format, email me@matejtomazin.com. Include the page address, a description of the problem and, where possible, the browser or assistive technology you use. We will review your message and respond.