Privacy policy

1. Who processes your personal data?

The controller of personal data is Epix Group d.o.o., which operates the Bambino playground in Supernova Novo mesto and the related online services. This policy explains how your data is processed when you visit the website, use the playground, place orders, book birthday parties, buy gift vouchers, arrange group visits, register for events, use Bambino Lab services, complete contact forms, use the Bambino app and communicate with the Bambino assistant. You will receive additional information about data processing in the Bambino app when you sign up for the app.

2. What data do we collect?

Depending on the service you choose, we may process:

• identification and contact details of parents or guardians (first name, surname, telephone, e-mail);
• the information required for the visit and for safely handing over the child (the child's name, age or date of birth, guardian's details, arrival and departure times, the link to the accompanying adult, and any necessary consents);
• booking details (the package chosen, date, time, number of children, extras, price, status, changes and any payments);
• details of orders and invoices, details of gift vouchers, product types and collection;
• the content of the messages and enquiries you send us;
• details of the Bambino Lab services chosen and of learning needs, where these are necessary in order to deliver them;
• CCTV recordings from the monitored areas of the playground;
• technical and security data (e.g. IP address, time of access, technical logs and language or consent settings);
• details of your newsletter subscription, if you choose to sign up;
• the content of the questions you send to the AI Bambino assistant, and the limited conversation context needed to provide an answer.

We do not ask for any data that is not needed for the service you have chosen. We take particular care with children's data.

Special categories of personal data: Information about allergies, health restrictions, special needs or learning difficulties may constitute sensitive data. We collect it only where it is necessary for a specific service and where an appropriate legal basis for the processing is in place, including explicit consent where this is required. Please do not enter medical diagnoses, document numbers or other unnecessary sensitive data in ordinary contact fields or in the chat with the AI assistant.

3. Why do we process your data and on what legal basis?

Managing your visit, booking or order: contacting you, recording your visit, handing the child over to their guardian, arranging birthday parties, orders, gift vouchers and Bambino Lab services. The legal basis is generally the performance of a contract or steps taken prior to entering into one (Article 6(1)(b) GDPR), while for children's data another appropriate basis is also assessed where necessary.

The safety of children, visitors and the premises: checking whether the conditions for an unaccompanied visit are met, monitoring the entrance, dealing with incidents and proportionate CCTV. Where appropriate, processing is based on legitimate interest (Article 6(1)(f) GDPR) and the applicable rules of ZVOP-2; certain additional data may require a different legal basis.

Legal obligations: accounting, taxes, handling claims and other prescribed procedures; the legal basis is Article 6(1)(c) GDPR.

Answering questions and managing services: dealing with enquiries and providing support; the legal basis is the contract or legitimate interest, depending on the type of question.

News and promotional messages: we send these when we have a valid legal basis under the regulations on electronic communications and data protection. Where consent is required, we obtain it separately and make it possible to withdraw.

Analytics and marketing tracking: non-essential analytics and advertising tracking is used only if appropriate consent has been given, and you can withdraw that consent at any time.

AI assistant: to prepare a reply, your question and the essential context are passed to an artificial intelligence service provider. The processing is based on your request for a reply (performance of the requested service or legitimate interest).

4. Use of the online shop and ordering

The website may allow you to place an order, after which the customer pays for the products or services at the playground. When an order is placed, we process the data needed to identify the order, prepare the products, make contact and arrange collection. Placing an order does not in itself constitute online payment. If an order is merely an enquiry that still has to be confirmed by our staff, this is clearly indicated during the ordering process.

5. Records of visits and care of children

If a parent leaves their child in the care of our staff in accordance with the playground rules, we process the data needed to verify the person authorised to collect the child, to reach the parent and to record the time of the visit. The data is used solely for organising the service, for safety and for resolving any incidents.

6. Video surveillance

Video surveillance is in operation at the Bambino playground to protect children, visitors, staff and property, and to deal with security incidents. There is no video surveillance in the toilets. Appropriate notices with information about the controller and the purpose of the recording are displayed in the recorded area.

Ordinary recordings are kept for 30 days. A recording required because of a specific incident may be secured and processed for longer, but only where this is lawful, necessary and documented. Only authorised persons have access, and any viewing or disclosure is duly logged. Video surveillance does not replace the presence and responsibility of our staff.

7. Online forms, email and newsletters

We use the data from contact forms to reply to you or to provide the service. We send confirmations and notifications by email. Adding you to the marketing list must be based on an appropriate legal basis; signing up for the newsletter is not a condition for a purchase or a visit. You can unsubscribe via the unsubscribe link or by sending a message to our contact address.

8. Bambino Lab

To organise lessons and professional support, we process the guardian's contact details and the essential information about the child, their school year, learning goals and the agreed appointment. We process data on health conditions or special needs only to the extent strictly necessary and with an appropriate additional legal basis. Access to this data is limited to those who need it in order to deliver the specific service.

9. Bambino AI assistant

When you use the digital assistant, the system may process the content of your question, a limited context of previous messages and the technical data required to protect the service. Questions are forwarded via a Netlify server function to the provider Anthropic; access keys are stored on the server only, never in your browser. Data needed to display the conversation may be stored locally in your browser for the duration of the session. The assistant is intended for general information about the playground and not for handling sensitive personal data about children. We do not store the assistant's questions in a database of our own; the conversation content is stored in your browser only for the duration of the session.

10. Who is the data shared with?

Where necessary, your data may also be processed by our contractual processors and technology service providers:

• Netlify: website hosting, server functions and receiving web forms (submitted forms are stored in Netlify Forms);
• Resend: sending email confirmations, replies and event reminders;
• Supabase: the database for the Bambino app and the booking system (loyalty card, bookings, visit registrations, push notifications);
• Anthropic: responses from the AI Bambino assistant;
• accounting and other professional service providers, where this is required in order to provide our services or by law.

Where necessary, we conclude appropriate data processing agreements. Any transfers outside the European Economic Area are permitted only where the conditions of the GDPR are met.

11. How long do we keep your data?

We keep personal data only for as long as is necessary for each individual purpose, or for as long as the law requires:

• details of visits, consents and bookings for a maximum of four years after the last visit or the completion of the service, except where the law prescribes a longer period;
• accounting and tax documents for as long as applicable regulations require;
• data for the newsletter until consent is withdrawn or until the legal basis ceases to apply, and proof of consent for as long as is necessary to demonstrate compliance;
• ordinary CCTV recordings as a rule for 30 days, and longer where necessary in the case of documented incidents, in accordance with the law;
• technical logs of server functions for a maximum of 30 days; submitted web forms until they have been dealt with, or for a maximum of 12 months; the content of your chat with the AI assistant only for the duration of the session in your browser.

Once the retention period expires, we delete or anonymise the data, or keep it only if there is another lawful basis for doing so.

12. Your rights as a data subject

Under the GDPR you have the right, where the conditions are met, to access, rectification, erasure, restriction of processing, data portability, objection and withdrawal of consent. Withdrawing consent does not affect the lawfulness of processing carried out beforehand. Please send your request to info@igralnica-bambino.si. We reply within the statutory deadline, as a rule within one month, with the possibility of a lawful extension.

If you believe your rights have not been respected, you may lodge a complaint with the Information Commissioner of the Republic of Slovenia, Dunajska cesta 22, 1000 Ljubljana (www.ip-rs.si).

13. Data security

We apply appropriate organisational and technical measures, such as restricted access, suitable user permissions, secure connections, incident logging and care in the safe processing of children's data. No system is entirely free of risk; in the event of an incident, we act in accordance with the applicable legal requirements.

14. Children, photographs and posts

We only use photographs and videos in which children are identifiable for public promotion where there is an appropriate legal basis and the necessary permissions. Consent to public publication is not a condition for an ordinary visit to the playground. In our posts we respect the child's privacy and the rights of their guardians.

15. Cookies

Details about the use of cookies, similar technologies and consent management can be found on the Cookies page.

16. Changes to this policy

We may update this policy because of changes in legislation, in our services or in our technical procedures. The current version, with the date of the last update, is always published on the website. Where the law requires it, we will also notify users separately of any material changes.