Privacy policy

1. Data controller

The controller of the personal data collected through this website and related services is:

For any questions about the processing of personal data, you can contact us using the contact details above.

2. Personal data we collect

Depending on how you interact with our website and services, we may collect the following categories of personal data:

• Identification data – first name, surname
• Contact data – email address, phone number
• Company data – company name, position in the company, website
• Communication data (chat) – the content of messages you send through our AI text assistant (chatbot)
• Technical data – IP address, browser type, operating system, device data, data about your visit to the website (through cookies and analytics)
• Call audio recordings – recordings of telephone conversations with our AI voice assistant, if you choose to take part in a demonstration

3. Purposes of processing and legal basis

We process personal data solely for the purposes listed below and on the appropriate legal basis under the General Data Protection Regulation (GDPR):

4. AI-specific processing

4.1 AI text assistant (chatbot)

Our website offers an AI text assistant (chatbot) that runs on the OpenAI API. When you use the chatbot, your messages are sent to the servers of the provider OpenAI, Inc. (based in the USA) to generate responses. We have concluded a Data Processing Agreement (DPA) and the EU Standard Contractual Clauses (SCC) with OpenAI, which ensure an adequate level of personal data protection for transfers to the USA.

The chatbot does not keep conversation history between sessions. The data is processed solely to answer your questions and not to train artificial intelligence models.

4.2 AI voice assistant

As part of demonstrating our services, we offer the option of talking to an AI voice assistant that runs on the OpenAI Realtime API. At the start of each call, you are informed that you are talking to an AI assistant and that the call may be recorded. Audio recordings are processed solely for the purpose of the demonstration and to improve the quality of the service.

4.3 Automated decision-making

The AI assistants (text and voice) do not make automated decisions within the meaning of Article 22 GDPR that would have legal or similarly significant effects on individuals. The AI assistants serve solely as an aid to communication and to providing information.

5. Recipients and processors of data

We share personal data with the following processors and recipients, with whom we have concluded appropriate data processing agreements:

6. Transfers of data to third countries

Some of our processors are based in, or have servers in, the United States of America (USA). For transfers of personal data to third countries outside the European Economic Area (EEA), we use safeguards in accordance with Chapter V GDPR, namely:

• EU Standard Contractual Clauses (SCC) – we have concluded SCCs adopted by the European Commission with each processor in the USA
• Data Processing Agreements (DPA) – additional contractual commitments on data security and processing
• Technical measures – encryption of data in transit (TLS/HTTPS) and at rest

Data is transferred only to the extent necessary to provide the services described in this policy.

7. Data retention periods

We keep personal data only for as long as necessary to fulfil the purpose for which it was collected:

Once the retention period expires, the data is securely deleted or anonymised.

8. Data subject rights

Under Articles 15–22 GDPR, as a data subject you have the following rights in relation to your personal data:

• Right of access (Article 15) – the right to obtain confirmation as to whether your personal data is being processed, and access to that data
• Right to rectification (Article 16) – the right to request the rectification of inaccurate personal data
• Right to erasure (Article 17) – the right to request the erasure of personal data (“right to be forgotten”)
• Right to restriction of processing (Article 18) – the right to request the restriction of processing in certain cases
• Right to data portability (Article 20) – the right to receive your personal data in a structured, commonly used and machine-readable format
• Right to object (Article 21) – the right to object to processing based on legitimate interest
• Right to withdraw consent (Article 7) – where processing is based on consent, you have the right to withdraw your consent at any time, without affecting the lawfulness of processing carried out before the withdrawal

To exercise your rights, contact us at info@opti-solutions.si. We will respond to your request within the statutory period of 30 days.

9. Data security

To protect your personal data, we apply appropriate technical and organisational measures, including:

• Encrypted communication – all communication with the website takes place over the HTTPS/TLS protocol
• Restricted access – only authorised persons who need the data to carry out their tasks have access to personal data
• Access logging – we keep records of access to personal data
• Regular reviews – we regularly review and update our security measures to ensure an adequate level of protection

10. Complaint to the supervisory authority

If you believe that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the supervisory authority:

11. Changes to this privacy policy

We may update this privacy policy from time to time to reflect changes in our data processing practices, legislation or regulatory requirements. The updated version will be published on this page with the date of the last update.

In the event of material changes, we will inform you by email or with a prominent notice on our website.

We recommend that you review this page from time to time to stay informed of any changes.