We use cookies to ensure that our website works properly, to personalise content and ads, to enable social networking features and to analyse network traffic. We share information about your use of our website with our social media, advertising and analytics partners.
Privacy notice
1. INTRODUCTION
This privacy notice informs individuals (i.e. users of the website) about the processing of their personal data (collection, use and storage) carried out on or through the regional entry page https://www.geely-see.com/ (the "regional page"; this document is referred to as the "notice"). The regional page presents the Geely brand in South-East Europe and directs visitors to the Geely websites for the individual markets. It does not contain web forms, user accounts or online ordering.
This notice applies only to the regional page and to all of its visitors, irrespective of the country from which they access it. When you select a market, you leave the regional page. The processing of personal data on the website of a market (for example inquiries, test-drive and service bookings, newsletters, job applications and connected services) is governed by the privacy notice published on that market website, which also identifies the controllers responsible for that market.
2. CONTROLLERS OF PERSONAL DATA
The controllers of personal data collected and processed in connection with the use of the regional page are the following companies ("we" or "us"):
VCAG, zastopanje in prodaja vozil, d.o.o.
Leskoškova 2, 1000 Ljubljana, Slovenia
Registration number: 6620094000, VAT ID: SI 64875318
Telephone: +386 1828 1979, e-mail: [email protected]
KMAG d.o.o.
Leskoškova 2, 1000 Ljubljana, Slovenia
Registration number: 5860059000, VAT ID: SI 50680625
E-mail: [email protected]
These companies act as joint controllers within the meaning of Article 26 of Regulation (EU) 2016/679 (General Data Protection Regulation – "GDPR") for the processing described in this notice. Their joint controllership arrangement provides as follows:
(a) VCAG is responsible for informing individuals (Articles 13 and 14 GDPR), for determining the legal bases of processing, for receiving and handling individuals' requests and for communication with the supervisory authority;
(b) KMAG is responsible for the operation and security of the website platform, for the consent-management mechanism, for cookies and audience-measurement and advertising tools, for contracts with processors and for transfers to third countries;
(c) the companies are jointly responsible for the records of processing activities, the data protection impact assessment and the handling of personal data breaches.
Irrespective of the content of the arrangement, you may exercise your rights in respect of and against each of the joint controllers. The single contact point for exercising your rights and for all questions concerning the processing is VCAG d.o.o., Leskoškova 2, 1000 Ljubljana, Slovenia, [email protected]. The essential provisions of the arrangement are available on request addressed to the contact point.
3. CONTACT DETAILS
If you have any questions concerning this notice, wish to lodge a complaint about our processing of your personal data or wish to exercise any of your rights (see Section 10), please contact us using the details above or contact our Data Protection Officer (DPO – see Section 13):
E-mail: [email protected]
Postal address: VCAG d.o.o. – Data Protection Officer (DPO), Leskoškova 2, 1000 Ljubljana, Slovenia
4. INDIVIDUALS WHOSE PERSONAL DATA ARE PROCESSED
This notice applies to the processing of personal data of: (i) visitors of the regional page; and (ii) individuals who contact us by e-mail at the address published on the regional page.
5. CATEGORIES OF DATA, PURPOSES AND LEGAL BASES
Which personal data do we process?
The regional page does not ask you to enter any personal data. The following data are processed when you visit it or contact us:
(a) technical and connection data which your browser transmits automatically when the regional page is requested, such as the IP address, the date and time of the request, the address requested, and the type and version of the browser and operating system;
(b) information stored on, or read from, your device by means of cookies and similar technologies, including your cookie choices (see Section 6);
(c) data on the use and the technical performance of the regional page, only if you have given your consent (see Section 6);
(d) correspondence data, if you write to us by e-mail: your name, e-mail address, the content of your message and any other data you choose to provide.
For which purposes and on which legal basis do we process your data?
We process your personal data only for the purposes described below and only where a legal basis under Article 6 GDPR exists:
(a) delivering the regional page to your device and ensuring its proper technical operation – legitimate interest (Article 6(1)(f) GDPR);
(b) ensuring information and network security, including protection against attacks and misuse – legitimate interest (Article 6(1)(f) GDPR);
(c) respecting and documenting your cookie choices – legitimate interest (Article 6(1)(f) GDPR) in connection with our obligation to be able to demonstrate consent (Article 7(1) GDPR);
(d) monitoring the technical performance and errors of the regional page – your consent (Article 6(1)(a) GDPR);
(e) analysing the use of the regional page (statistics) – your consent (Article 6(1)(a) GDPR);
(f) measuring the effectiveness of our marketing communication and tailoring it to your interests – your consent (Article 6(1)(a) GDPR);
(g) replying to your e-mail and handling your request – steps taken at your request prior to entering into a contract (Article 6(1)(b) GDPR) or our legitimate interest in handling communication addressed to us (Article 6(1)(f) GDPR);
(h) establishing, exercising or defending legal claims – legitimate interest (Article 6(1)(f) GDPR).
Where we rely on legitimate interest, those interests are: making the regional page available and keeping it secure; preventing misuse; respecting your choices; handling communication addressed to us; and protecting our legal position. Before relying on legitimate interest we carry out a balancing test to ensure that our interests are not overridden by your rights and freedoms; you may object to such processing (see Section 10).
Are you obliged to provide the data?
The processing of technical and connection data is necessary for the regional page to be delivered to your device; without it the page cannot be displayed. Giving consent to cookies and similar technologies that are not strictly necessary is voluntary and is not a condition for using the regional page. Providing data by e-mail is voluntary.
6. COOKIES, SIMILAR TECHNOLOGIES AND EMBEDDED CONTENT
We store information on your device, or gain access to information already stored there, without your consent only where this is strictly necessary to provide the regional page you have requested or solely for carrying out the transmission of a communication (Article 5(3) of Directive 2002/58/EC; in Slovenia Article 225 of the Electronic Communications Act – ZEKom-2). For all other cookies and similar technologies (such as the local storage of your browser) we ask for your prior consent in the cookie banner; they are not activated before you have made your choice.
We use the following categories:
(a) Strictly necessary cookies – they maintain the session, protect the regional page against automated attacks (security service provided by Cloudflare) and remember your cookie choices. They are always active.
(b) Performance cookies – they allow us to monitor the technical performance and errors of the regional page (New Relic; a session identifier is stored in the local storage of your browser). They are used only with your consent.
(c) Functional cookies – they enable additional functionality and personalisation. They are used only with your consent.
(d) Statistics cookies – they allow us to analyse how the regional page is used (Google Analytics). They are used only with your consent.
(e) Targeting and advertising cookies – they allow us to measure the effectiveness of our marketing communication and to tailor it to your interests (Salesforce Marketing Cloud). They are used only with your consent.
The complete and current list of the cookies and similar technologies in use, with their provider, purpose and duration, is available at any time in the cookie settings, which you can open through the "Consent to cookies" link at the bottom of the regional page. There you can also change or withdraw your consent at any time, with effect for the future; withdrawal does not affect the lawfulness of processing carried out before it.
Links to other websites. The regional page contains links to the Geely market websites and to our LinkedIn profile. No data are transmitted to LinkedIn merely by visiting the regional page; once you follow a link, the privacy notice of the destination website applies.
7. RECIPIENTS OR CATEGORIES OF RECIPIENTS
Access to your personal data is limited to those persons who need to know them in order to perform their work or contractual obligations. We may disclose your data to the following categories of recipients:
(i) authorised employees of VCAG and KMAG;
(ii) our contractual processors, which may process the data solely on our instructions: providers of hosting and maintenance of the website platform; Cloudflare (content delivery and protection against attacks); and, only if you have given your consent, New Relic (performance and error monitoring), Google (Google Analytics) and Salesforce (Marketing Cloud);
(iv) companies of our group responsible for an individual market, if you send us an e-mail concerning that market; the company to which we forward your message acts as controller for its further handling;
(v) other third parties where this is required by law, by a request of a competent authority or by a court order, or where it is necessary to establish, exercise or defend legal claims.
8. TRANSFERS OF DATA TO THIRD COUNTRIES
Your personal data are, as a rule, stored in the European Economic Area (EEA). Some of our processors (in particular Cloudflare, New Relic, Google and Salesforce) may process personal data outside the EEA, primarily in the United States of America. In such cases we ensure that the transfer is based on one of the safeguards under Chapter V GDPR: the European Commission's adequacy decision for the EU-US Data Privacy Framework (decision of 10 July 2023) for recipients certified under that framework – if that decision ceases to apply or is annulled, the transfers continue on the basis of the European Commission's standard contractual clauses and supplementary measures; or the standard contractual clauses adopted by the European Commission.
A copy of the safeguards used, or information on where they are available, may be obtained from our Data Protection Officer ([email protected]).
9. RETENTION PERIODS
We retain your personal data only for as long as necessary for the purposes for which they are processed:
(a) cookies and similar technologies: for the duration stated for each of them in the cookie settings; your cookie choices are stored for 365 days;
(b) data processed on the basis of your consent: until you withdraw your consent, but no longer than the duration stated in the cookie settings;
(c) correspondence: for the time needed to handle your message and for up to two years after our last communication, unless a business relationship is established or the data are needed to establish, exercise or defend legal claims.
When processing is no longer necessary, the data are effectively and permanently erased or anonymised.
10. YOUR RIGHTS
If you have given consent, you may withdraw it at any time – for cookies and similar technologies through the "Consent to cookies" link at the bottom of the regional page, and otherwise by a statement sent to [email protected]. Withdrawal does not affect the lawfulness of processing carried out before it.
You have the right of access to your personal data and to information about the processing, including a copy of the data; the right to rectification and completion; the right to erasure (under certain conditions); the right to restriction of processing; the right to data portability (under certain conditions); and the right to object, on grounds relating to your particular situation, to processing based on legitimate interest – where data are processed for direct marketing, you may object at any time, including to related profiling. To exercise your rights, contact the Data Protection Officer (see Section 3). We will reply within one month of receipt of your request; that period may be extended by two further months where necessary (Article 12(3) GDPR).
If you believe that the processing of your personal data does not comply with the GDPR or other applicable legislation, you have the right to lodge a complaint with the competent supervisory authority: Informacijski pooblaščenec Republike Slovenije (Information Commissioner of the Republic of Slovenia), Dunajska cesta 22, 1000 Ljubljana, Slovenia, [email protected]. You may also lodge a complaint with the supervisory authority of the EU Member State of your habitual residence, place of work or place of the alleged infringement.
11. PROFILING AND AUTOMATED DECISION-MAKING
We do not make decisions based solely on automated processing, including profiling, which would produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR). If you allow "Targeting and advertising cookies", data on your use of the regional page may be used to tailor marketing communication to your interests; this takes place only on the basis of your consent, which you may withdraw at any time.
12. PROTECTION OF CHILDREN
The regional page is not intended for children. Under Article 8 of the Slovenian Personal Data Protection Act (ZVOP-2), a child's consent in relation to information society services is valid if the child is at least 15 years old; for younger children consent is valid only if given or authorised by the holder of parental responsibility. We do not knowingly collect personal data of children under the age of 15 without such consent.
13. DATA PROTECTION OFFICER – DPO
The Data Protection Officer independently ensures that VCAG and KMAG correctly apply the personal data protection legislation. The DPO's tasks include: informing and advising the controllers, processors and employees of their obligations; monitoring compliance with the applicable legislation and internal policies, including awareness-raising, staff training and related audits; advising on data protection impact assessments and monitoring their performance; and cooperating with, and acting as the contact point for, the supervisory authority. The DPO's contact details are set out in Section 3 of this notice.
14. SECURITY OF YOUR PERSONAL DATA
We apply technical and organisational security measures to protect your personal data against unlawful or unauthorised access or use, as well as against accidental loss or impairment of integrity. The measures are designed taking into account our IT infrastructure, the possible impact on your privacy and the costs involved, and in line with current industry standards and practice. We require the same from our processors.
15. FINAL PROVISIONS
This notice applies to all visitors of the regional page. Due to legislative changes, the implementation of new technologies or changes to the regional page, this notice may be amended or supplemented; all changes will be published on the regional page.
This notice applies from 10. 10. 2026.
VCAG d.o.o. and KMAG d.o.o.