Who is responsible for your data?
LEILA d.o.o. (full legal name: LEILA, IZOBRAŽEVANJE IN RAZISKOVANJE, D.O.O.), Mencingerjeva ulica 7, 1000 Ljubljana, Slovenia, is the controller of personal data processed through the Mala Akademija website. For questions or to exercise your rights, contact info@leila.si or +386 41 595 597.
Enquiries and visits
The enquiry form collects your name, email address, optional phone number and message, which you provide directly. Name, email and message are required so that we can respond and understand your request; you do not have to provide a phone number. Please do not send unnecessary health information, identity documents or other sensitive information about yourself or a child. We use enquiries only to answer parents’ questions and organise visits to the kindergarten. We do not send marketing newsletters or transfer enquiries into a separate CRM or spreadsheet. Providing these details is voluntary, but without the required information we cannot handle your enquiry through the form. We do not use enquiries for automated decision-making or profiling.
Legal bases
Where you ask us to take steps before entering into an enrolment contract, the necessary processing is based on Article 6(1)(b) GDPR. Responding to other enquiries is based on our legitimate interest in communicating with people who contact us, Article 6(1)(f). We also rely on legitimate interests to protect the website and prevent abuse. Optional analytics and embedded maps are based on consent under Article 6(1)(a), together with the applicable rules on cookies and similar technologies. Necessary storage supports security and remembers your privacy choice. Sending an enquiry does not require marketing consent.
Who can access the information?
Enquiries are delivered to info@leila.si, accessible to two authorised persons for handling enquiries and visits. Hosting and email are provided by Neoserv, operated by AVANT.SI d.o.o., Poslovna cona A 49, 4208 Šenčur, Slovenia. We use Neoserv website hosting and the Email M2 email service. The provider processes technical data and email as needed to deliver these services, including backups. Google receives data when you allow the relevant optional services described below. Information may also be disclosed where required by law. We do not sell enquiry data.
How long do we keep enquiries?
Enquiries that do not lead to enrolment are kept for no longer than 12 months after the last communication. The mailbox is periodically cleaned manually, including removal of correspondence that has reached this limit. Deleted messages may remain in the provider’s backups until those backups expire. Neoserv backs up both the website and email and has confirmed a maximum backup retention of six months. Records relating to enrolled children are subject to separate retention rules and information notices; the enquiry retention period does not replace those rules.
Security and technical records
Our enquiry form sends your message to the mailbox rather than creating an additional message archive in the website database or the theme’s files. This does not exclude copies held by email services, backups or other components of the installed website. Abuse prevention uses temporary protected identifiers and attempt counts; checks are valid for 15 minutes, and duplicate-message checks for five minutes. Technical access records may include IP address, request information and timestamps. Archived cPanel Raw Access logs are configured for up to 60 days. Neoserv also has Track Delivery technical email logs; their exact retention period has not yet been confirmed. Please contact us for further information about these records. Access is restricted to persons and providers who need it for the relevant purpose.
Cookies and your choices
Necessary functions are separate from optional analytics and external maps. Your browser remembers your choice for 180 days, using browser storage without a cross-site tracking identifier. The choice applies to both language versions on the same website. Optional categories are not selected in advance. Accept and Reject are equally accessible, and Settings lets you choose categories separately. You can change or withdraw consent at any time through Cookie settings in the footer. If your choice cannot be saved, optional services remain disabled. Signing in to WordPress uses necessary authentication cookies. Optional Google services may use the cookies described below. Withdrawal does not affect the lawfulness of processing before withdrawal.
Google Analytics 4
When enabled on the public website, Google Analytics 4 helps us understand website use, only after you agree to analytics. It may process a pseudonymous browser identifier, device and browser information, pages visited and interactions such as scrolling, link clicks, searches, video activity and downloads. A connection to Google also discloses network information, including your IP address. This information is not treated as anonymous. Google Signals is disabled. The configured retention is two months for event data and 14 months for user data; new activity resets the user-data retention period. These settings do not determine how long all aggregated reports are retained. Analytics cookies (_ga and _ga_*) in our integration are set for 180 days without renewal on each visit. No analytics library is loaded before consent, on the test site, or on contact pages and pages with forms. Pages whose URL contains query parameters or a fragment are also excluded. We do not send enquiry names, email addresses, phone numbers or message contents as analytics events. Although automatic form measurement is enabled in the resource, our integration does not load Analytics on enquiry-form pages. Withdrawing consent stops this integration and removes accessible first-party analytics cookies.
Google Maps and external links
An embedded Google map loads only after you allow external content and choose to load the map. Google then receives technical information such as your IP address and browser information and may use its own cookies. You can withdraw permission through Cookie settings; the embedded map is then removed. Our website cannot delete cookies on Google’s own domains. If you follow an external map link, you open Google directly. Email, telephone and WhatsApp links open the corresponding service when you select them. The relevant provider’s privacy terms apply to its processing. You can contact us without enabling Analytics or an embedded map.
International processing
According to Neoserv’s information, processing takes place mainly within the EU or in countries recognised by the EU as providing adequate protection. Some international transfers may take place with GDPR safeguards. Google services may also involve processing outside the European Economic Area. We do not claim that all data remains within the EEA. Where a transfer occurs, it must be covered by an applicable adequacy decision or appropriate safeguards, such as standard contractual clauses and any necessary supplementary measures. Contact info@leila.si to request information about applicable destinations and safeguards, or a copy of the relevant safeguards. Google’s privacy information is linked below.
Your rights
Subject to the conditions in the GDPR, you may request access to your data, correction, erasure, restriction of processing and portability of data you provided where processing is based on consent or contract and carried out by automated means. You may object, on grounds relating to your situation, to processing based on legitimate interests. You may withdraw consent for optional services at any time without affecting earlier lawful processing. Send requests to info@leila.si or the controller’s postal address above. We may ask for information necessary to verify your identity. We normally respond within one month; where the GDPR permits an extension because of complexity or the number of requests, we will inform you within that month and explain why. You may lodge a complaint with Informacijski pooblaščenec, Slovenia’s supervisory authority, at www.ip-rs.si, or with another competent EU supervisory authority. You do not have to contact us first to make a complaint.
Changes to this notice
We update this notice when the processing or services change. The current notice is available on this page in Slovenian and English. Where a change requires new consent, optional processing will depend on that consent.