top of page

Privacy and cookie policy

Last updated: 15 July 2026

​

1. Who controls your personal data?

The controller is:

Karierno svetovanje, Darija Meško, Thrive Through Human Resources, s.p.
Trading as Thrive Through HR
Email: hello@thrive-through-hr.com

​

2. Scope of this policy

This policy explains how we collect and use personal data when you:

  • visit the website;

  • create an account;

  • join the mailing list;

  • submit a form;

  • upload a CV or cover letter;

  • book or purchase a service;

  • attend a webinar, workshop or coaching session;

  • buy or access an e-book or recording;

  • apply for a vacancy;

  • represent a company client; or

  • contact us.

 

3. Personal data we collect

Depending on your interaction with us, we may collect:

  • Name and contact details

  • Email address

  • Postal or billing address

  • Account and login information

  • Booking details

  • Payment status, transaction reference and invoice information

  • Purchase history

  • CVs, cover letters and professional profiles

  • Employment, education, salary and career information

  • Messages, forms and consultation notes

  • Workshop responses and assessment results

  • Job application information

  • Newsletter preferences

  • Technical data, such as IP address, browser, device and security logs

  • Cookie preferences

  • AI-generated meeting notes or transcripts where agreed

  • Any information you voluntarily provide

Stripe processes full card details. Thrive Through HR normally receives payment confirmation and limited transaction information rather than the complete card number.

Please avoid including unnecessary sensitive personal data in CVs, forms or messages.

 

4. Why we use your data and our legal basis

To provide products and services

We use contact, booking, account, payment and professional information to fulfil the contract with you or take steps at your request before entering into a contract.

To manage accounts and digital access

We process account details to provide access to purchased e-books, recordings and other protected content. The legal basis is performance of the contract and our legitimate interest in securing paid content.

Payments, invoices and accounting

We process transaction and invoice information to fulfil the contract and comply with tax, accounting and other legal duties.

Career coaching and document review

We process CVs, cover letters, job descriptions and career information to provide the requested service. The legal basis is performance of the contract.

Company workshops and HR services

We process client contact details, participant information and workshop materials to perform the contract with the company and organise the service.

Where the company provides participant data, the company is responsible for having an appropriate legal basis and giving participants the required information.

Newsletter and marketing emails

We send marketing emails where you have provided consent or where another legal basis permits this.

You may unsubscribe at any time by using the link in an email or contacting us. Withdrawal of consent does not affect processing that took place before withdrawal.

Enquiries and complaints

We process messages to respond to requests, manage complaints and protect our legal interests. The legal basis may be pre-contractual steps, performance of a contract or legitimate interests.

Job applications

We process application documents to assess a candidate and communicate about a vacancy. The legal basis is taking steps at the applicant’s request before a possible employment contract and compliance with employment law.

Separate consent will be requested if we want to retain an unsuccessful application for future opportunities beyond the original recruitment process.

Security and legal claims

We may process information to prevent misuse, protect accounts, maintain security, enforce agreements and establish or defend legal claims. The legal basis is legitimate interests and, where applicable, legal obligation.

AI note-taking

Arsio AI may process audio and meeting content to generate notes or a transcript. Participants will be informed beforehand.

The legal basis will normally be consent. Refusing AI note-taking does not prevent participation in the underlying service.

 

5. Special-category data

CVs and conversations may sometimes reveal health information, disability, ethnicity, religious beliefs, trade union membership or other special-category data.

We do not request this information unless it is necessary for the agreed service.

Where you voluntarily provide relevant special-category data, we will process it only where a valid GDPR condition applies, such as explicit consent or the establishment, exercise or defence of legal claims.

 

6. Where data comes from

Most data comes directly from you.

We may also receive information from:

  • a company purchasing a workshop or service;

  • a person making a booking for another participant;

  • payment and booking providers;

  • publicly available professional sources, such as LinkedIn;

  • recruitment clients or business contacts; and

  • technical and security systems used by the website.

 

7. Service providers

We use providers that may process personal data on our behalf or as separate controllers, including:

  • Wix, for website hosting, forms, accounts, mailing functions, digital content and website administration

  • Stripe, for payment processing

  • Calendly, for scheduling

  • Google Meet and Google Workspace, for online meetings, email and related communication

  • MailerLite, for newsletters and mailing lists

  • Arsio AI, for agreed AI meeting notes or transcripts

  • Professional accounting, legal, IT or administrative providers where required

Each provider processes data under its own contractual and privacy arrangements.

 

8. International data transfers

Some providers may process data outside Slovenia or the European Economic Area.

Where required, transfers are protected through an adequacy decision, Standard Contractual Clauses or another lawful transfer mechanism under GDPR.

You may contact us for more information about the safeguards relevant to your data.

 

9. Retention periods

We keep personal data only for as long as needed for its purpose, including:

  • CVs, cover letters and client working documents: normally six months after the service ends

  • AI notes and transcripts: normally three months after the engagement ends

  • Notes needed for a future workshop: until the workshop ends and then for up to three months

  • General coaching and project records: normally up to two years after the engagement, unless needed for a complaint or legal claim

  • Account and purchase records: while the account or digital access remains active and as needed to prove the purchase

  • Newsletter data: until consent is withdrawn or the address remains inactive for an extended period

  • Unsuccessful job applications: until the recruitment process and any reasonable complaint period have ended, unless the applicant consents to longer retention

  • Contracts, invoices and accounting records: for the period required by Slovenian tax, accounting and commercial law

  • Complaint and legal claim records: until the relevant limitation period has expired

Data may be retained longer where required by law or necessary for legal proceedings.

 

10. Automated decision-making

We do not make decisions producing legal or similarly significant effects based solely on automated processing.

AI tools may assist with notes or administrative work, but important professional decisions are reviewed by a person.

 

11. Your rights

Subject to the GDPR and applicable exceptions, you may request:

  • access to your personal data;

  • correction of inaccurate data;

  • deletion;

  • restriction of processing;

  • data portability;

  • objection to processing based on legitimate interests;

  • withdrawal of consent; and

  • information about applicable international transfer safeguards.

Send requests to hello@thrive-through-hr.com.

We may ask for reasonable identity verification. We normally respond within one month, although GDPR permits an extension for complex or numerous requests.

 

12. Complaints to the supervisory authority

You may complain to:

Information Commissioner of the Republic of Slovenia
Dunajska cesta 22
1000 Ljubljana
Slovenia
Website: www.ip-rs.si

You may also contact the supervisory authority in the EU or EEA country where you live or work.

 

13. Security

We use reasonable organisational and technical safeguards, including controlled access, account protection and reputable service providers.

No online system is completely secure. Customers should use strong passwords, protect their devices and avoid sending unnecessary sensitive information through unsecured channels.

 

14. Children

People under 18 may use paid services with the permission and supervision of a parent or legal guardian.

Where consent is the legal basis for an online service offered directly to a child, we will obtain parental or guardian authorisation where required by applicable law.

 

15. Cookies and similar technologies

The website may use:

  • Essential cookies, required for website security, login, checkout, account access and saved preferences

  • Functional cookies, used for features such as embedded scheduling or video

  • Analytics cookies, used only where enabled and legally permitted

  • Marketing cookies, used only where enabled and the visitor has provided valid consent

Wix, Stripe, Calendly and embedded services may place their own cookies or use similar technologies.

Non-essential cookies must remain disabled until the visitor provides consent. Refusing non-essential cookies must not block basic access to the website.

Visitors must be able to change or withdraw their cookie choices as easily as they gave them.

The exact cookie list should be generated from a current scan of the published website and displayed in the Wix cookie settings. This policy should be updated if new integrations, analytics or advertising tools are added.

 

16. External links and embedded services

The website may contain links to LinkedIn, social media, payment, booking or other external services.

Those providers control their own websites and data processing. Their privacy policies apply when you use their services.

 

17. Changes to this policy

We may update this policy following legal, technical or service changes. The current version and effective date will be published on this page.

Model withdrawal form

Complete and send this form only if you wish to withdraw from an eligible contract.

To:
Karierno svetovanje, Darija Meško, Thrive Through Human Resources, s.p.
Ljubljanska cesta 38
1360 Vrhnika
Slovenia
hello@thrive-through-hr.com

I hereby give notice that I withdraw from my contract for the following service or digital product:

Product or service:
Order date:
Order number:
Consumer’s name:
Consumer’s address:
Email used for the order:
Date:
Signature, only if submitted on paper:

​

​

The main legal sources used were the GDPR, Slovenia’s Information Commissioner, the Slovenian Consumer Protection Act, ZVPot-1 and the Slovenian government’s information on consumer dispute resolution.

bottom of page