Privacy Policy
Effective date: 20.01.2026
Scope: This Privacy Policy applies to the personal data processed in connection with your use of this website and your contact with the operators of CIVIC INFLUENCE LAB.
1. Controllers
The joint data controllers within the meaning of the GDPR are the two natural persons listed below, operating under the brand CIVIC INFLUENCE LAB prior to incorporation:
Anja Kosir — Email: info@civicinfluencelab.com
Leonard Brütt— Email: info@civicinfluencelab.com
If a legal entity is later formed, controller details will be updated on the website.
2. Data protection contact
For privacy questions or to exercise your rights, contact info@civicinfluencelab.com.
You also have the right to lodge a complaint with the Information Commissioner of the Republic of Slovenia: https://www.ip‑rs.si
3. What personal data we collect
This website only collects the following personal data when you use the contact/collaboration inquiry form:
Full name (as provided by you)
Email address (as provided by you)
Any message or attachments you include in the contact form
No other personal data is collected for analytics or tracking purposes. We do not use third‑party analytics tools or marketing trackers on this site.
4. Purpose and legal basis for processing
We process the personal data you provide in the contact form for the following purposes:
To respond to and manage collaboration inquiries — Legal basis: legitimate interest (GDPR Art. 6(1)(f)) and, where applicable, to perform pre‑contractual steps at your request (GDPR Art. 6(1)(b)).
To comply with legal obligations (e.g. if data must be kept for tax or legal reasons) — Legal basis: legal obligation (GDPR Art. 6(1)(c)).
We do not use the contact data for marketing or profiling unless we obtain your explicit consent in a separate, unbundled form.
5. How long we keep your data
Personal data submitted via the contact form is retained only as long as necessary to respond to your inquiry and for a reasonable follow‑up period.
Contact form enquiries: up to 12 months from the date of submission, unless you request earlier deletion or a longer retention period is required for legal reasons.
Message attachments or records required for legal obligations: retained as required by applicable law.
6. Data recipients and processors
We do not routinely share your personal data with third parties except to the limited extent necessary to operate the website or comply with legal obligations. Possible recipients include:
Website hosting provider (acting as processor) under a Data Processing Agreement.
Legal authorities if required by law.
We do not transfer your personal data outside the EEA. If a transfer outside the EEA is necessary, it will only occur with appropriate safeguards (e.g. Standard Contractual Clauses).
7. Cookies and tracking
This website uses only strictly necessary technical cookies required for the operation of the contact form and basic site functionality. No analytics, marketing or tracking cookies are used or set by this site.
If you encounter any cookie prompt on the site, it is limited to necessary session cookies and will not track you or share data with third parties.
8. Your rights
Under the GDPR you have the following rights in relation to your personal data:
Right of access (you may request a copy of the personal data we hold about you)
Right to rectification (ask us to correct inaccurate data)
Right to erasure (ask us to delete your personal data in certain circumstances)
Right to restriction of processing
Right to object to processing based on legitimate interests
Right to data portability (where applicable)
Right to withdraw consent at any time (where processing is based on consent)
To exercise any of the above rights, contact [privacy@yourdomain.com]. We will respond within the time limits required by GDPR.
9. Security
We implement appropriate technical and organisational measures to protect personal data (access controls, encrypted backups, secure hosting). Access to contact form data is limited to the operators named above.
10. Special rules for political clients and sensitive data
We may work with political institutions, NGOs and political individuals. Political opinions are a special category of personal data requiring additional safeguards under GDPR. We will not process special‑category data (including political opinions) unless:
We receive documented written instructions from a client and enter into a Data Processing Agreement (DPA); and
The client confirms a lawful basis for processing (e.g. explicit consent of data subjects where required); and
Appropriate technical and organisational safeguards are in place (encryption, access restrictions, DPIA if required).
If you are a prospective client whose brief involves processing political opinions, contact us at info.civicinfluencelab.com before submitting any data.
11. Automated decision‑making and profiling
We do not perform any automated decision‑making or profiling based on the contact form data collected on this website.
12. Changes to this policy
We may update this Privacy Policy from time to time. The latest version with the effective date will be available on this website.
13. Contact and complaints
Data protection contact: info@civicinfluencelab.com
You may also lodge a complaint with the Information Commissioner of the Republic of Slovenia: https://www.ip‑rs.si
