Last updated: 27 October 2026
This policy explains how Solo & Booked processes personal data when you visit this website, contact us, buy a product or use our courses.
Who is responsible for your data?
The data controller is Maja Ojsteršek s.p., operating Solo & Booked.
Business address: Ljubljanska cesta 38, 1360 Vrhnika, Slovenia
Registration number: 6719724000
Email: [email protected]
We process personal data under the General Data Protection Regulation (GDPR) and applicable Slovenian law. Visiting this website does not, by itself, constitute consent to marketing or optional tracking.
What data we process and why
- Enquiries and support: your name, email, message and information you provide, to answer your request. The legal basis is taking steps at your request before a contract, performing our contract, or our legitimate interest in responding to general enquiries.
- Purchases: contact and billing details, business and tax details where relevant, order information and payment status, to fulfil orders, provide access and handle refunds. The legal basis is performance of our contract. Accounting and tax records are processed to meet legal obligations.
- Accounts and courses: account identifiers, login information, purchased access and course activity, such as progress and quiz results where used, to deliver your purchased content and manage your account under our contract.
- Newsletters and resources: your email, name if provided, preferences and consent records, to deliver the resource or subscription you request. Ongoing marketing normally relies on consent. A purchase does not automatically subscribe you to marketing.
- Security and operation: technical data such as IP address, browser information, request times and security logs may be processed for our legitimate interests in keeping the service reliable and preventing spam, fraud and unauthorised access. Optional tracking requires consent where applicable.
Required checkout and account fields are necessary to complete your purchase or provide access. Without them, we may be unable to supply the service. Optional information is voluntary. Do not send passwords, full payment card details or sensitive personal information in messages.
Newsletters on Substack
Our newsletter is available at getsoloandbooked.substack.com. When you subscribe, Substack processes your information through its platform and we use the subscriber information available to us to manage and send the newsletter. Substack also processes data for its own platform purposes, including technical and engagement data, as described in its Privacy Policy.
You can unsubscribe using the link in a newsletter or contact us. Unsubscribing from marketing does not stop essential messages about your existing order or account. Withdrawing consent does not affect processing that was lawful before withdrawal.
Cookies and external websites
Strictly necessary cookies support functions such as login, shopping carts and privacy choices. Optional analytics, advertising cookies and similar technologies require your consent where required by law. Continuing to browse is not consent. You can review and change your choices through the cookie settings where available, or manage cookies in your browser. Blocking essential cookies may affect login or checkout.
For details about the cookies and similar technologies used on this website, including their purposes, providers and durations, please see our Cookie Policy. External links, including Substack and YouTube, lead to services with their own privacy policies. Embedded external content may also send technical data to its provider; embeds using tracking that requires consent must remain blocked until consent is given.
We use Google Analytics to understand how visitors use our website and improve its content. We use Meta Pixel to measure the effectiveness of our advertising and show relevant ads on Facebook and Instagram. These tools may collect information such as your IP address, device and browser details, pages visited and actions taken on our website. They are enabled only after you consent to the relevant cookie category. You can withdraw your consent at any time through Cookie settings. For further information, see Google’s Privacy Policy in Meta’s Privacy Policy.
Who receives your data?
Where needed to provide the service, data may be accessed by hosting and maintenance providers, email delivery services, payment providers, accounting support, security and spam prevention services, and course delivery providers. Access must be limited to the relevant purpose. Data may also be disclosed when legally required or necessary to establish, exercise or defend legal claims. We do not sell personal data.
This website uses WordPress, WooCommerce for orders and LearnPress for courses. These are software components; their use does not by itself mean all customer data is sent to their developers. The payment provider for the method you select processes the data needed for that payment and may act as an independent controller for its legal and fraud-prevention duties.
International transfers
External platforms, including Substack, may process data outside the European Economic Area. Transfers for which we are responsible must have a valid GDPR transfer mechanism, such as an applicable adequacy decision or appropriate safeguards, including standard contractual clauses where relevant. Contact us for details of the safeguards for a particular transfer and how to obtain a copy. External providers explain transfers for their own purposes in their privacy notices.
How long data is kept
- Enquiries and support messages: for as long as needed to resolve the request and related follow-up or disputes.
- Account and course records: for as long as needed to provide access and manage the contractual relationship.
- Orders, invoices and accounting records: for the periods required by applicable tax and accounting law.
- Newsletter data: while the subscription is active. Limited unsubscribe records may be kept to respect your choice, and consent records where needed to demonstrate compliance.
- Security logs and backups: for the period necessary for security, recovery and investigation. Deleted data may remain in backups until the relevant backup cycle expires.
- Cookie data: for the duration stated in the relevant cookie information or provider notice.
Records needed for legal claims may be retained until the claim and relevant legal retention or limitation period have ended. Data should then be deleted or irreversibly anonymised. Closing an account does not remove records we must retain under another legal basis.
Your rights
Depending on the circumstances, you can request access, correction, erasure, restriction of processing and data portability. You can object to processing based on legitimate interests, including related profiling, and object to direct marketing at any time. Where processing relies on consent, you can withdraw it at any time. These rights are subject to the conditions and exceptions in applicable law.
Email [email protected] to exercise your rights. We may ask for proportionate information to verify your identity. We respond without undue delay and normally within one month. For complex or numerous requests, the period may be extended by up to two further months; we will explain this within the first month.
You can complain to the Slovenian Information Commissioner at www.ip-rs.si, or the supervisory authority in your country of habitual residence, place of work or the alleged infringement.
Security and updates
Personal data must be protected with appropriate technical and organisational measures, including access controls and suitable storage and maintenance safeguards. No online system can guarantee absolute security. Keep your login details private and contact us if you suspect unauthorised access.
We may update this policy when our services, processing or legal requirements change. The date above identifies the latest revision. Updating this policy does not replace consent where consent is required. For privacy questions, contact [email protected].
