Privacy Policy

Article 12 of the General Data Protection Regulation (hereinafter referred to as the GDPR)

January 29, 2025

At Ngen d.o.o., we are committed to respecting the privacy of our customers, which is why we handle your personal data responsibly, carefully, and in accordance with applicable laws and the company's internal regulations.

In line with this, Ngen will ensure that, in addition to processing personal data as required by law, we are limiting processing of the personal data necessary to provide you with the highest quality products and services. For the purposes of direct marketing, informing you about new products and services, other marketing activities, or preparing personalized offers, we will request your voluntary, informed, specific, and unambiguous consent for the processing of personal data. We will also inform you about the specific purpose for which your personal data will be used and your rights under applicable legislation when you provide us with your data.

1. Data Controller:

NGEN energetske rešitve d.o.o. (hereinafter referred to as Ngen or the Controller)
Address: Moste 101, 4274 Žirovnica, Slovenia
Phone: +386 (0)4 581 20 20
Email: [email protected]

2. Purpose, Types, and Legal Bases for Data Collection

At Ngen, we process your personal data in accordance with the legal bases defined in the GDPR: (i) implicit consent, (ii) contract performance, (iii) legal obligations, and (iv) legitimate interests pursued by the controller or a third party. Personal data is collected for lawful purposes in the minimum necessary scope and duration required to achieve the purpose or as long as a legal basis exists.

(i) Implicit Consent

Your data is processed based on consent given for specific purposes, such as:

• Subscribing to direct marketing services

• Subscribing to information about marketing activities

• Preparing personalized offers

• Applying for job positions

• Accepting cookies for displaying user-targeted advertisements

You can withdraw or modify your consent at any time. A withdrawal request can be sent to the email address Etics Point NGEN [email protected] or to the controller's headquarters, indicating the person and consent being withdrawn. Withdrawal or modification of consent only applies to the personal data processed based on that consent. The possibility of withdrawing consent does not in any form constitute a right to terminate the valid contractual relationship with us. Withdrawal does not affect the legality of processing carried out prior to the withdrawal.

(ii) Contract Performance

Ngen processes your personal data for the purpose of contract conclusion and fulfillment of contractual obligations.

For this purpose, the following processing activities are carried out: identification of the individual, acquisition and processing of authorizations needed for contract execution, preparation of offers or other necessary contractual documentation, conclusion of a new contract or modification of the contractual relationship, delivery and invoicing of services or goods under the contract, issuance and settlement of invoices, monitoring of payments and their collection, resolution of complaints and technical issues, and carrying out other actions necessary to fulfill contractual obligations.

We obtain data directly from you, but also from other sources, such as the system operator of the electricity distribution network, publicly accessible sources (e.g., the Land Register), other competent or authorized state bodies or institutions, as well as data obtained from our own records of the data controller and related companies.

The purpose of processing your personal data is to prepare offers and/or contracts, execute the contract, inform you about installation conditions, assess the post-installation status, manage overdue receivables due to unpaid obligations, and provide other information necessary for the quality execution of the contractual relationship to the satisfaction of both contracting parties. For the successful execution of the contract, we require and process the necessary data, mainly: data about the contractual relationship, which is obtained before the contract is concluded and during its execution (your identification and contact details; details of the contract or annex to the contract), tax number, bank account number, data about the metering or consumption point, data about the production facility, metering and billing data, and data about users of the justCharge and SG Connect web portals.

Personal data processed based on the conclusion or execution of a contract may be retained for the purpose of fulfilling contractual obligations as long as necessary for the conclusion or execution of the contract and the exercise of rights and obligations arising from the concluded contract, or until the expiration of the legally prescribed period for asserting legal protection of the contracting parties.

(iii) Legal Obligations

Your personal data is processed in accordance with applicable laws, such as energy Act, consumer protection, data protection, electronic communications, obligations, enforcement, tax laws, excise duties, and others that bind the controller.

In accordance with energy Act, we are obligated to process your personal data for the purpose of executing the supply contract and for the purpose of preparing operational forecasts.

(iv) Legitimate Interest

Your personal data may be processed based on our legitimate interest, which is determined by a careful assessment that your interests, rights, and freedoms do not override the legitimate interests of the data controller.

In line with this we carry out the following processing activities:

Video surveillance: We conduct video surveillance to ensure the safety of people and property, protect data and trade secrets, secure office spaces, and monitor entry and exit in areas where the aforementioned interests need to be safeguarded. During video surveillance, your personal data is processed to the necessary extent, and surveillance is conducted only in areas deemed potentially at risk. Notifications of the video surveillance system are placed before you enter monitored area. Detailed information about video surveillance is available on www.ngen-group.eu.

Visitor data: We maintain visitor data to ensure the safety of people and property, track visitor movements, and protect trade secrets. We record information such as name, surname, date and time of arrival and departure, company name, and host's name. This data is stored for a maximum of 2 years from the time of entry into the records.

3. Categories of Individuals Whose Data We Process

We process personal data of various categories of individuals based on different legal grounds:

• Visitors to the Ngen company

• Potential customers

• Contractual parties

• Individuals involved in contract execution

• Individuals who have given consent for specific data processing purposes

• Users of online portals and applications such as Restavracija & Lounge Bar MANU, JustCharge, and SG Connect

4. Cookie Policy

Website: ngen-group.eu Last updated: 25 September 2026

4.1 About this policy

This policy explains how NGEN uses cookies and similar technologies on ngen-group.eu, what each category does, and how you can control them at any time.

It should be read together with our Privacy Policy, which explains how we process personal data more generally.

4.2 What cookies are

A cookie is a small text file placed on your device when you visit a website. Cookies allow a site to recognise your device, remember your choices and understand how the site is used.

We also use technologies with a similar function, such as local storage and pixels. Where this policy refers to cookies, it covers these technologies too.

Cookies set by ngen-group.eu are first-party cookies. Cookies set by other organisations whose services we use are third-party cookies.

4.3 Your choices

When you first visit our website, a cookie banner asks for your decision. You can:

• Accept All — allow all categories described below

• Accept my choices — allow only the categories you select

• Decline All — allow only strictly necessary cookies

No analytics or targeting cookies are placed before you make a choice. Closing the banner without choosing is not treated as consent.

You can change your decision at any time by selecting Cookie Settings in the footer of any page.

4.4 Categories of cookies we use

4.4.1 Necessary / Essential cookies

These cookies are required for the website to function and cannot be switched off in our systems. They are usually set only in response to actions you take, such as setting your privacy preferences, logging in or completing forms.

Legal basis: these cookies are strictly necessary to provide the service you have requested, so they do not require your consent.

4.4.2 Performance cookies (Analytics)

These cookies and similar technologies help us measure website traffic and understand how visitors use the site. Google Analytics records interactions such as page views and events. Microsoft Clarity records website interactions, including clicks, scrolling and session recordings. We use this information to improve the website and produce performance reports.

If you do not allow these cookies, we will not use them to analyse your visits. Limited measurements without cookies may still be sent to Google, as explained in section 4.5.

Legal basis: your consent.

4.4.3 Targeting cookies (Marketing)

These cookies are set by our advertising partners: Google (Google Ads), LinkedIn (LinkedIn Insight Tag) and Meta (Meta Pixel). Those companies may use them to build a profile of your interests and to show you relevant adverts on other websites, and to measure whether our adverts led to a visit or an enquiry. They work by uniquely identifying your browser and device.

If you do not allow these cookies, you will experience less targeted advertising.

Legal basis: your consent.

4.5 Google Consent Mode

We use Google Tag Manager to manage the tags on our website, Google Analytics to measure how it is used, and Google Ads to measure the results of our advertising.

Your choice in the cookie banner is passed to Google's services through Google Consent Mode v2. Where consent for analytics or targeting cookies is denied, Google's tags do not read or write cookies. They may still send limited measurements without cookies, as described below. When you accept a category, the corresponding permissions are granted.

Specifically, your choices control the following Google consent signals:

Where consent is refused, Google still receives limited measurement information without cookies. This information may include the page visited and the consent state. It is used for measurement and modelling without storing or accessing advertising or analytics cookies on your device.

Tags from other providers (Microsoft Clarity, LinkedIn Insight Tag and Meta Pixel) are loaded only after you accept the relevant category, and are not loaded if you decline it.

4.6 Third parties

Some cookies are set by third parties whose services we use. These providers process data under their own privacy terms:

• Google Ireland Limited — Google Tag Manager, Google Analytics and Google Ads. See Google's Privacy Policy and how Google uses data from sites that use its services.

• Microsoft Ireland Operations Limited — Microsoft Clarity. See the Microsoft Privacy Statement.

• LinkedIn Ireland Unlimited Company — LinkedIn Insight Tag and LinkedIn Ads. See the LinkedIn Privacy Policy and LinkedIn Cookie Policy.

• Meta Platforms Ireland Limited — Meta Pixel and Meta Ads (Facebook, Instagram). See the Meta Privacy Policy and Meta Cookies Policy.

Some of these providers may transfer data outside the European Economic Area. Where this happens, transfers are made on the basis of the European Commission's Standard Contractual Clauses or an adequacy decision.

4.7 How long your choice is stored

Your cookie preferences are stored for up to 12 months. After that period, or if you clear your browser storage, the banner will appear again so you can make a fresh decision.

4.8 Controlling cookies in your browser

Independently of our banner, most browsers let you view, block and delete cookies. These controls are usually found under Settings, Privacy or Security. Blocking all cookies may prevent parts of this website from working correctly.

Instructions are available for Chrome, Firefox, Safari and Edge.

You can also install the Google Analytics Opt-out Browser Add-on to prevent your data being used by Google Analytics on any website.

4.9 Your rights

Where cookies process personal data, you have the rights set out in the GDPR, including the right of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent at any time. Withdrawing consent does not affect processing carried out before withdrawal.

You also have the right to lodge a complaint with your national data protection authority.

Full details are set out in our Privacy Policy.

4.10 Changes to this policy

We may update this policy to reflect changes to the cookies we use or to legal requirements. The date at the top of this page shows when it was last revised. Material changes will be signalled through the cookie banner.

4.11 Contact

NGEN energetske rešitve d.o.o.

Moste 101, 4274 Žirovnica, Slovenia

Phone: +386 (0)4 581 20 20

Email: [email protected]

Requests concerning consent and personal data: [email protected]

5. Users and Processors of Personal Data

Users of your personal data include:

• Banks and other payment facilitators, to the extent necessary for payment transactions

• Financial administrations and other supervisory authorities during inspections

• Audit firms, competent courts in dispute resolution procedures

• Government and other competent authorities, such as the system operator of the electricity distribution network, local electricity distribution companies, Eco Sklad, Borzen

• Other users based on an explicit request, a legal basis, personal consent, contract execution, or legitimate interests of the controller.

• Our contractual processors may also process your personal data, such as service providers for IT support, document printing and mailing services, debt collection services, etc.

Personal data is processed by employees of the controller who are responsible for processing in a specific work area and in accordance with the assigned authorizations. The individuals processing your personal data are professionally trained in the field of data protection. We use personal data within the parent company Ngen and its subsidiaries, listed on the website www.ngen-group.eu, if it is consistent with the purpose of the processing.

6. Technical and Sales Support Provided by Third Parties

We may utilize services provided by third parties to enhance user experience and facilitate customer or sales support (the Third-Party Support). The Third-Party Support can be provided either by humans or automated tools, including artificial intelligence.

The Third-Party Support providers may collect, process, and store personal data that You provide during Your interactions. The processing of this data is governed by the GDPR and the following conditions apply:

Data Collection: The information collected through the Third-Party Support may include, but is not limited to, your name, email address, chat history, and any other personal data you choose to provide. This data is necessary to offer you personalized assistance and improve the services we offer.

Purpose of Processing: The data collected by the Third-Party Support may be used for customer and sales support, responding to inquiries, improving our services, and for other purposes specified in this Privacy Policy. The Third-Party may also process Your data to enhance the functionality and performance of the service.

Legal Basis for Processing: The legal basis for the processing of Your Personal Data by the Third-Party Support is either your consent, which you provide by interacting with the Third-Party Support, or our legitimate interest in providing efficient customer service and improving our offerings.

Data Sharing and Transfer: The data processed by the Third-Party Support provider may be transferred to, processed, and stored in, countries outside the European Economic Area (EEA). In such cases, we ensure that appropriate safeguards are in place to protect your data.

Third-Party Accountability: The Third-Party Support providers are data processors under GDPR, and they are contractually obligated to process your data only in accordance with our instructions, to maintain confidentiality, and to implement adequate security measures to protect your data.

Data Retention: The data collected by the Third-Party Support may be retained for as long as necessary to fulfill the purposes outlined in this Privacy Policy, unless a longer retention period is required or permitted by law. You have the right to request the deletion of your data at any time, subject to legal or contractual obligations.

Your Rights: Under the GDPR, you have the right to access, rectify, or erase your Personal Data, restrict or object to its processing, and the right to data portability. If you wish to exercise any of these rights in relation to the data processed by the Third-Party Support, please contact us.

Withdrawal of Consent: If the processing of your data by the Third-Party Support is based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing based on consent before its withdrawal.

7. Joint Controllers

NGEN and its subsidiaries may act as joint controllers of personal data. If you provide your personal data to one of the Ngen group companies, both the subsidiary and the parent company may process your data based on a joint data management agreement.

8. Data Transfers Outside the EU

NGEN will not transfer your personal data to third countries outside the EU or to international organizations.

If such a transfer is necessary, it will be done after careful consideration of legal bases and protective measures. Any transfer of personal data to third countries will be carried out by the controller with careful consideration and due diligence, in accordance with the principle of accountability. Information about the intended data transfer and the specific security mechanism will be provided to you in advance.

9. Automated Decision-Making

NGEN does not use automated decision-making in relation to contract execution or any other decision-making processes.

10. Your Rights

NGEN recognizes your rights concerning personal data protection, including:

• The right to be informed about the processing of your personal data

• The right to access your personal data. This means that you have the right to request information about whether your personal data is being processed and, if so, to gain access to your personal data and additional information (purposes of processing, types of data, data users, existence of rights and information about the possibility of lodging a complaint, sources of data, potential automated decision-making, or specific profiling)

• The right to obtain a copy of your processed personal data

• The right to rectification of inaccurate personal data upon your request

• The right to erasure ('right to be forgotten') This entitles you to have your personal data deleted without undue delay if the legitimate conditions are met (the data is no longer necessary, consent has been withdrawn and no other legal basis exists, a legitimate objection, unlawful processing, deletion is required by applicable regulations, etc.).

• The right to restrict processing This means the right to have the processing of your data restricted if you dispute the accuracy of the data, if you have filed an objection, if the processing is unlawful, or if the data is no longer needed by the controller but is required for the establishment, exercise, or defense of your legal claims.

• The right to be informed about correction, deletion or restriction of data processing

• The right to data portability This means that you have the right to obtain your personal data in structured, generally applicable and machine readable form, including the right to forward this data to other controller (applicable for data, which are processed in automated way based on consent or contract)

• The right to object to certain types of processing (public interest, legal interest, marketing interest). The Controller has to justify legal requirements for data processing or stop with data processing if it cannot justify legitimate reasons for data processing.

• The right to lodge a complaint with the supervisory authority.

• The right to withdraw consent, where applicable, without affecting the lawfulness of processing based on consent before its withdrawal.