Privacy Policy
Last updated: 8 October 2026
1. Data controller
The controller of personal data within the MojaDružina service is DATAFLOW, informacijske in podatkovne rešitve, d. o. o., Krpanova ulica 3, 6310 Izola – Isola, Slovenia, registration number: 7447035000, tax number: 61888630 (hereinafter: the “controller” or “we”).
For questions and requests about privacy, you can write to us at info@mojadruzina.si.
2. What data we process
Account data: name or display name, e-mail address, language and other account settings. The password is not stored in readable form but as a cryptographically protected hash.
Family content: data that users enter in the application, such as names, dates, places, family relationships, photos, stories, memories, comments and other data about people in the family tree.
Usage and activity data: invitations to family members, changes and contributions in the family, answers to questions and data needed to show family moments.
Technical and security data: IP address, time of access, device and browser type, visited address, error logs and security events, as well as data needed for login and preventing misuse.
3. Purposes and legal bases
We process account data and content to create and manage the account, display the family tree, store memories, enable collaboration of invited members and provide the requested features. The legal basis is the performance of the contract, i.e. the Terms of Use.
We process technical and security data to protect accounts, prevent misuse, detect errors and ensure stable operation. The legal basis is our legitimate interest in providing the service securely and reliably.
We send optional weekly summaries and other messages that are not essential for the service on the basis of your consent. You can withdraw consent at any time in the settings or via the link in the message, without affecting the lawfulness of prior processing.
We process data on the purchase of the family book to carry out the purchase, unlock the book and issue an invoice. The legal basis is the performance of the contract and compliance with legal obligations (tax and accounting rules).
4. Is providing data mandatory?
Providing personal data is not a statutory obligation. At least a display name and an e-mail address are required for registration; without them an account cannot be created. Other data and family content are voluntary. Some features may not work without the relevant data.
5. Data about other and living persons
A user may enter data about relatives and other persons in the private family tree. Data about living persons is not public and is accessible only to the user and to family members who have been given access.
The user must respect the privacy of others, inform them appropriately where necessary and enter only data for which they have an appropriate legal basis. Without the explicit consent of the living person or another appropriate basis, it is not permitted to enter particularly sensitive data, such as data concerning health, religion, ethnic origin, political opinions, sex life or genetic data.
A living person may request at info@mojadruzina.si access to, rectification or removal of data relating to them, even if it was entered by another family member. Before acting, to protect everyone involved, we may require verification of identity and of the link to the record concerned.
6. Minors and deceased persons
Registration is intended for adult users. Data about a minor may only be entered by a parent, guardian or other person with appropriate authorisation or legal basis, who must act in the child’s best interest and limit the entry to the necessary data.
For data about deceased persons, the user must respect the wishes of the deceased, the rights of relatives, the confidentiality of communications and applicable Slovenian law. Upon a substantiated request by an entitled person, we will review, restrict or remove the disputed data.
7. Who has access to the data
Family content is accessible only to members invited to the same family, in line with their user rights. We do not sell data, do not use it for advertising and do not pass it on to advertising networks.
We may disclose data to competent authorities if required by law or a valid decision, or if disclosure is necessary to protect the rights and safety of users.
8. Processors and processing locations
To provide the service, we use the following external providers, which process data on our instructions and for the agreed purposes:
- HITROST.COM – web and e-mail hosting, databases, technical infrastructure and backups. The provider states that the web hosting servers are located in Slovenia. For reliability, its DNS infrastructure may also be distributed in Slovenia and abroad; DNS as a rule does not contain family content.
- Defiant, Inc. / Wordfence – website security, attack detection, misuse prevention and analysis of security events. This may involve processing IP addresses, usernames, e-mail addresses, visited web addresses, technical request headers and data about detected security events.
- Google Ireland Limited (Google Drive) – storage of website backups at a separate location, outside the hosting provider’s server. Backups contain account data and family content, including photos. We use a dedicated account used only for this purpose; copies are deleted automatically by rotation (weekly file backups for at most 4 weeks, daily database backups for at most 7 days). Google may also process data outside the EEA.
- Stripe Payments Europe, Ltd. (Ireland) – payment processing for the family book. Stripe receives the buyer’s e-mail address, the amount and payment details as well as technical data for fraud prevention; payment card details are processed exclusively by Stripe and we do not receive them. For some purposes (e.g. fraud prevention and compliance with legal obligations) Stripe acts as an independent controller. Stripe may also process data outside the EEA on the basis of appropriate safeguards.
If a processor processes technical data outside the European Economic Area, we ensure an appropriate legal basis and safeguards, such as the European Commission’s standard contractual clauses or another valid mechanism. According to the provider, the main hosting of accounts and family content is in Slovenia. Backups are additionally stored in Google Drive; any transfer outside the EEA relies on the European Commission’s adequacy decision (EU–US Data Privacy Framework) or standard contractual clauses.
9. Retention and deletion
We keep account data and family content for as long as the account or family is active. After the account is deleted or a deletion request is confirmed, we remove it from the active system within 30 days at the latest. Remaining copies are deleted through the regular rotation of backups, as a rule within a further 30 days, unless longer retention is necessary for technical recovery, a security incident or a legal obligation.
As a rule, we keep ordinary technical and security logs for no longer than 90 days. In the event of a detected incident or legal claim, we may keep the related data until the review or proceedings are concluded. Data that we are required to keep by law is kept only to the extent and for the period prescribed.
We keep purchase data (amount, date, buyer’s e-mail address, confirmation of consent and related invoices) for as long as required by tax and accounting rules, as a rule 10 years after the end of the year in which the purchase was made.
Deleting an individual user account does not necessarily mean deleting all shared family content that other members have also created or completed. Before deletion, we enable the user to export their data and explain which shared content will remain accessible to the family.
10. Cookies, local storage and analytics
We use necessary cookies and similar technologies to enable login, security, user sessions and storage of the selected language. These technologies are necessary for the service requested by the user and generally do not require prior consent.
We use Google Analytics 4 (Google Ireland Limited) to measure visits to the public pages of the website. Analytics is activated only after explicit consent to the analytics-cookie category through the Complianz banner. The legal basis is consent under Article 6(1)(a) GDPR. Google Analytics may process information about pages visited, device and browser type, approximate location and basic usage events so that we can understand and improve the public part of the website.
We do not intentionally send family-tree content, photographs, memories, names or other data from the private family area to Google Analytics. Site Kit is configured to exclude all logged-in users from measurement. We do not use advertising cookies or profiling for personalised advertising.
You can refuse or withdraw consent at any time through the consent-management option on the website. Withdrawal does not affect the lawfulness of processing carried out before withdrawal. Details of individual cookies, their purposes and duration are provided in the Cookie Policy managed by Complianz.
The exact names and duration of technical cookies may change when WordPress, security components or the analytics service are updated. We will update this document when material changes occur.
11. Automated decision-making
We do not use personal data for automated decision-making or profiling that would have legal or similarly significant effects on an individual.
12. Your rights
In accordance with applicable law, you have the right of access, rectification, erasure, restriction of processing, data portability, objection to processing based on legitimate interest and withdrawal of consent. The application may offer export of content as a ZIP file and import or export of the family tree in GEDCOM format.
Send your request to info@mojadruzina.si. We will respond without undue delay and as a rule within one month at the latest. Before responding, we may request additional information to verify identity securely.
If you believe that we process your data unlawfully, you may lodge a complaint with the Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec), Dunajska cesta 22, 1000 Ljubljana, or with the supervisory authority of the country where you habitually reside.
13. Security
We use reasonable technical and organisational measures, including an encrypted HTTPS connection, access control, login protection, security monitoring and backups. We limit access to persons and providers who need it for operation or support. As no information system is completely secure, we recommend that users use a strong and unique password and protect access to their e-mail account.
14. How we inform you
The privacy policy is available before registration and on the website. Confirming that the user has read the policy does not constitute consent to the processing necessary to provide the service. Where consent is required, we will request it separately, freely and clearly.
15. Changes to the policy
We may update the policy from time to time because of changes to the service, providers or legislation. The date of the last change is stated at the top. We will inform users of material changes in the application or by e-mail before they take effect, where necessary. This text is a translation of the Slovenian version; in case of any discrepancy, the Slovenian version prevails.
16. Contact
Questions and requests regarding privacy: info@mojadruzina.si.