I. INTRODUCTORY PROVISIONS
1. Introduction
1.1 We are committed to protecting the privacy of visitors and users of our website 2mobile.si and our customers. This notice explains how we will handle your personal information.
1.2 This notice applies in all cases where we act as a controller of personal data - that is, in cases where we determine the purposes and means of processing personal data.
1.3 We may use certain cookies on our website. In cases where the use of cookies is not strictly necessary for the provision of the website, we will ask you for your consent to the use of cookies. You can read more about cookies in Chapter III of this Privacy and Cookies Notice and via the tab with an arrow at the left edge of the page (bottom left):
1.4"We", including "us", "to us", "at us", "with us" are the company 2Mobile d.o.o., Dunajska cesta 106, 1000 Ljubljana, Slovenia, registration number: 6125123000, tax number: SI 82898286. More information about the company 2Mobile d.o.o. is available at About us (2mobile.si).
1.5"You" including "you", "to you", "at you", "with you" are a visitor or user of the 2mobile.si website or a user of our services.
II. PRIVACY NOTICE
2. How do we use your personal data?
2.1 In this chapter we will introduce you to:
2.2 Messages you send us: We process the data you give us in a message sent via (i) the contact form on our website, (ii) e-mail to support@2mobile.si or (iii) telephone. We obtain the data directly from you and process it to reply to your message or enquiry. The legal basis for this processing is our legitimate interest in communicating with you and handling your enquiries. Where your enquiry relates to a possible contract, we process the data to take steps at your request before entering into a contract.
2.2a AI assistant Chuck : On our website you can chat with the AI assistant Chuck. Chuck generates his answers with a language model, based on the publicly available content of our website. His answers may be incomplete or inaccurate, so please contact us directly for binding information.
When you use the chat, we process:
(a) the content of your questions and Chuck's answers. Before storing your questions, we automatically mask telephone numbers, e-mail addresses and payment card numbers. Even so, please do not enter personal data into the chat;
(b) the address of the page on which you asked your question, the page language and your device type, for example computer, mobile phone or tablet;
(c) a pseudonymised identifier, derived from your IP address and browser data with a one-way hash function. We use it only to limit the number of questions per day and to prevent abuse. We do not store your IP address in our database; our hosting provider may log it for a short time in its system logs for security and operational purposes;
(d) if you fill in the "Let's connect" form in the chat: your name, company name, e-mail address, area of interest and message, together with your conversation with Chuck up to that point;
(e) if you ask for the conversation to be sent to your e-mail address: that e-mail address. We use it only to send you the conversation and do not store it for this purpose.
We process this data to answer your questions, pass your enquiry on to our team, keep the chat secure and prevent its misuse, and improve Chuck's answers. If Chuck cannot answer a question, or we detect an attempt at misuse, we may forward the conversation to our support team.
The legal basis for this processing is our legitimate interest in providing and improving the service and keeping it secure. Data you submit via the "Let's connect" form is processed to take steps at your request before entering into a contract.
Retention: we automatically delete conversations with Chuck (including the pseudonymised identifier stored with them) 30 days after the last message; in the record of daily limits, the pseudonymised identifier is deleted after 7 days. Data from the "Let's connect" form and conversations forwarded to our support team are kept like other messages. Details are in point 5.3.
Chuck does not make automated decisions that have legal or similarly significant effects on you.
You can delete your conversation at any time in the chat menu by choosing "Delete conversation"; it is then also deleted from our database. A copy that has already been forwarded to our support team is kept in accordance with point 5.3 (a).
2.3 Customer relationships: We may process data about our customer relationships, including contact details. The data may include your name, surname and contact details, your job title, details about the customer (your employer) and data about mutual communication. We obtain the data directly from you or the customer (your employer) and process it for the purpose of managing our customer relationship, communicating with the customer, recording communication data and presenting our services. The lawful basis for this processing is our legitimate interests.
2.4 Newsletter subscription: On our website, you can subscribe to receive the newsletter via the online form by providing us with your email address and indicating that you agree to receive the newsletter by email. You also confirm your agreement to receive the newsletter via the confirmation link that we send to your email address. In this case, we process your email address. We obtain the data directly from you and process it for the purpose of informing you about our offer and services. The legal basis for this processing is your consent. You can unsubscribe from receiving the newsletter via the unsubscribe link available at the end of each newsletter.
2.5 We may also process the personal data specified in this notice for the establishment, exercise or defence of legal claims, whether in judicial, administrative or extrajudicial proceedings. The lawful basis for this processing is our legitimate interests, namely the protection and safeguarding of our rights, your rights and the rights of third parties.
2.6 We may also process the personal data specified in this notice for the purpose of risk management or obtaining professional advice. The lawful basis for this processing is our legitimate interests, namely protecting our business from risks.
2.7 In addition to the processing purposes explicitly set out in this section, we may also process your personal data where this is necessary to comply with our legal obligation.
3. Transfer of personal data to third parties
3.1 We may disclose your personal information to our professional advisors where reasonably necessary to obtain their professional opinion or for risk management purposes.
3.2 We may also disclose your personal data to our contractors or contractual partners who perform individual processing tasks for us, such as the development and maintenance of software and IT systems, hosting services, accounting and other administrative services, website hosting, and providing infrastructure for mass sending of emails and newsletters, when these tasks involve the processing of personal data to the necessary extent and the provision of artificial-intelligence services and technical infrastructure for the AI assistant Chuck. For the AI assistant Chuck and the 2Mobile statistics we use the following processors: Anthropic PBC (the Claude language model, which generates the answers), Vercel Inc. (hosting of the chat application and the 2Mobile statistics, and storage of screenshots of our public pages), Supabase Inc. (database; data is stored on servers in the EU) and Plus Five Five, Inc., doing business as Resend (sending e-mails). For website analytics, if you consent to it, we use Google Analytics (Google Ireland Limited).
3.3. We may also disclose your personal data to third parties where this is necessary to comply with our legal obligation or where this is necessary to assert, exercise or defend legal claims, in judicial, administrative or extrajudicial proceedings.
4. Export of personal data to third countries
4.1 In the event of processing personal data in third countries, i.e. countries outside the European Economic Area (EEA), we will ensure that the legal basis for the transfer of personal data is provided as specified in applicable regulations, namely:
- European Commission implementing act on the adequacy of protection in a third country;
- Binding Corporate Rules, in accordance with the General Data Protection Regulation, if they are duly approved;
- standard data protection clauses;
- another mechanism permitted by the General Data Protection Regulation.
4.2 Anthropic PBC, Vercel Inc. and Plus Five Five, Inc. (Resend) are based in the United States, so personal data connected with your use of the AI assistant Chuck and the 2Mobile statistics may also be processed in the USA. Where required, such transfers rely on an appropriate transfer mechanism, in particular the European Commission's Standard Contractual Clauses or the provider's valid certification under the EU-U.S. Data Privacy Framework. Google Ireland Limited may also process data collected with Google Analytics at Google LLC in the USA; the transfer relies on the EU-U.S. Data Privacy Framework certification and Standard Contractual Clauses.
By default, Anthropic does not use data submitted through its commercial services to train its models. Such use may occur only in cases Anthropic specifically defines, for example where the user or customer has expressly agreed to it, or where Anthropic receives the content as feedback.
5. Storage and deletion of personal data
5.1 In this section, we inform you of our personal data retention and deletion policy, which ensures that the retention of personal data is in accordance with applicable regulations.
5.2 We store personal data for no longer than necessary to fulfill the purpose of their processing.
5.3 Personal data retention periods:
(a) Data from messages: maximum 5 years after the end of the year in which the message was sent.
(b) Customer relationship data: for the entire duration of the relationship and for 5 years after the end of the year in which the relationship ended.
(c) Data from newsletter subscriptions: for the entire duration of your newsletter subscription and for 3 months after we stop sending you the newsletter or immediately if you withdraw your consent.
(d) Data from chats with the AI assistant Chuck: we automatically delete conversations from our database 30 days after the last message, or immediately when you delete the conversation in the chat menu. The pseudonymised identifier we use to limit daily questions and prevent abuse is stored with the conversation and deleted together with it; in the record of daily limits it is deleted after 7 days. Individual infrastructure providers may keep data for a limited further period under their contractual retention periods, security procedures or legal obligations. Data from the "Let's connect" form and conversations forwarded to our support team are kept as data from messages, in accordance with point (a).
(e) 2Mobile statistics: we keep clicks for 90 days, visits and page views for 13 months, the results of network-block lookups for 30 days, screenshots of public pages for 90 days, and a recognised company's record for as long as at least one stored visit is linked to it. After that, the data is deleted automatically. Details are in point 11.5.
After the period specified above, your personal data will be deleted.
5.4 Notwithstanding the above provisions on retention periods, we may retain personal data for a longer period of time where this is necessary to comply with our legal obligation.
6. Your rights
6.1 In this section, we inform you of the rights you have under applicable personal data protection regulations.
6.2 Your rights are:
(a) right of access;
(b) the right to rectification;
(c) the right to erasure;
(d) the right to restriction of processing;
(e) the right to object;
(f) the right to portability;
(g) the right to lodge a complaint with the Information Commissioner; and
(h) the right to withdraw consent.
6.3 Within the framework of the right of access, you may request from us confirmation as to whether we are processing personal data concerning you and, if so, to provide you with access to your personal data and certain additional information about the processing of personal data, such as information on the purposes of the processing; the categories of personal data that we process and the recipients of the personal data. Provided that this does not prejudice the rights and freedoms of other persons, we will provide you with a copy of your personal data. We will provide you with the first copy free of charge, and for any additional copies we will charge you a reasonable fee.
6.4 Within the framework of the right to rectification, you can request the correction of incorrect or inaccurate personal data relating to you or the completion of incomplete data, where the completion is consistent with the purpose of their processing.
6.5 In certain circumstances, you may request that we erase your personal data without undue delay. These circumstances include, for example: the personal data are no longer necessary for the purposes for which they were collected or processed; you have withdrawn your consent to the processing, where consent was the lawful basis for the processing; you object to the processing and there are no overriding legitimate grounds for the processing; where the processing is carried out for the purpose of direct marketing; your personal data have been processed unlawfully. There are certain exceptions to the right to erasure. Erasure is not possible, among other things, where the processing of personal data is necessary: to exercise the right to freedom of expression and information; to comply with a legal obligation; to assert, exercise or defend legal claims.
6.6 In certain circumstances, you have the right to request the restriction of the processing of your personal data. These circumstances include, for example: you contest the accuracy of the data, for a period enabling us to verify the accuracy of your personal data; the processing is unlawful and you oppose the erasure of the personal data and instead request the restriction of their use; we no longer need your personal data for the purposes of the processing, but you need them for the establishment, exercise or defence of legal claims; you have objected to the processing and we are verifying whether our legitimate grounds override your grounds. In the event of restriction of processing, we may continue to store your personal data. We may otherwise process them only: with your consent; where this is necessary for the establishment, exercise or defence of legal claims; where this is necessary to protect the rights of another natural or legal person; for reasons of important public interest.
6.7 You have the right to object to the processing of your personal data on grounds relating to your particular situation where the processing is based on our legitimate interests or the legitimate interests of a third party. In this case, the right is not absolute. We are obliged to stop the processing unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms or where the processing is necessary for the establishment, exercise or defence of legal claims.
6.8 In any case, you may object to processing (including profiling) for direct marketing purposes. If we receive an objection, we are obliged to immediately cease processing for direct marketing purposes.
6.9 In cases where the lawful basis for processing your personal data is:
(a) your consent; or
(b) the performance of a contract between you and us or the taking of steps, at your request, prior to entering into a contract,
and the processing is carried out by automated means and we have received the data directly from you, you have the right to request that we provide you with your personal data in a structured, commonly used and machine-readable format. However, you cannot exercise this right if this could have negative consequences for the rights and freedoms of other persons.
6.10 If you believe that our processing of your personal data infringes data protection regulations, you have the right to lodge a complaint with the Information Commissioner. You can lodge a complaint in the EU Member State in which you reside or work or in which the infringement occurred.
6.11 Where the lawful basis for processing your personal data is your consent, you have the right to withdraw your consent at any time. Withdrawal of consent will not affect the lawfulness of the processing of your personal data carried out by us prior to its withdrawal.
6.12 You may exercise any of your rights by notifying us in writing. In all cases, we have the right to verify your identity and will use reasonable measures to do so.
6.13 We will respond to your requests regarding the exercise of your rights as soon as possible, and at the latest within the deadlines set by regulations in the field of personal data protection.
7. Third-party websites and applications
7.1 Our website may contain links to or information about websites or applications operated by third parties. Access to and use of third party websites or applications are subject to the terms and conditions set out by the provider of the individual website or application.
7.2 We are not aware of, and have no control over, the privacy policies and practices of such third parties. We encourage you to review the privacy policies and practices of such third parties before visiting such websites or using their applications.
8. Personal data of minors
8.1 Our website and our services are intended for persons over the age of 18, and under no circumstances do we knowingly process personal data of persons under the age of 18.
8.2 If you have reason to believe that we are processing data about a person under the age of 18, please inform us.
9. Updating personal data
9.1 Please notify us if any of your personal information changes. Upon receipt of your notification, we will amend the personal information in our records accordingly.
III. COOKIES
10. About cookies
10.1 A cookie is a file containing an identifier (a sequence of letters and numbers) that a web server sends to a web browser and the browser stores it. The identifier is sent back to the server whenever the browser requests access to a page on the server.
10.2 Cookies can be either "persistent" or "session": a persistent cookie is stored by the web browser and remains valid until the set validity period expires, unless the user deletes it beforehand; a session cookie remains valid only until the end of the individual user session, until the user closes the browser.
10.3 Cookies do not include information that would allow the identification of individuals; however, the personal information we hold about you may be linked to information obtained from cookies.
11. Types of cookies
11.1 Strictly necessary cookies and local storage
Strictly necessary cookies and data in your browser's local storage are needed for the website and for the services you use yourself. We do not need your consent for them, and we do not use them for tracking or advertising:
(a) cookie choice(2Mobile d.o.o.): your choice on the cookie banner and a random identifier of that decision, in your browser's local storage, for 12 months;
(b) accessibility settings(2Mobile d.o.o.): the settings you choose in the accessibility tool (for example bigger text or paused animations), in your browser's local storage, until you reset them;
(c) AI assistant Chuck(2Mobile d.o.o.): as described in point 11.4;
(d) Google reCAPTCHA(Google Ireland Limited): protects the website's forms from abuse, only when you use a form;
(e) Duda platform(Duda Inc.): hosting and running the website.
11.2 Analytics cookies
Analytics cookies help us understand how the website is used, which content is useful and how to improve it. We use them only if you consent:
(a) Google Analytics(Google Ireland Limited): website visit statistics; cookies _ga
and _ga_<ID>
, up to 2 years. We load Google Analytics only after you consent; before that, no data is sent to Google;
(b) Duda statistics(Duda Inc.): visit statistics and recognising returning visits; cookies dm_*
, up to 12 months. The Duda platform sends a record of each page view for basic visit statistics; without your consent, we delete the dm_*
cookies straight away;
(c) 2Mobile statistics(2Mobile d.o.o.): our own visit statistics (page views, clicks and scroll depth) and recognising companies from the network a visit comes from, as described in point 11.5; a random visit ID in your browser's session storage (sessionStorage), until the tab is closed. It uses no cookies.
11.3 Marketing cookies
We currently do not use marketing or advertising cookies.
11.4 Local storage for the AI assistant Chuck
The chat with the AI assistant Chuck uses local and session storage in your browser (localStorage and sessionStorage). It stores the course of your conversation and a conversation key, so that you can continue the conversation as you move between pages of our website, as well as display settings, for example whether the greeting has already been shown or whether you have hidden the tips.
The conversation is kept in local storage for up to 30 days, and data in session storage usually until the tab or browser session is closed. This data is strictly necessary for the chat you use, and we do not use it for tracking or advertising.
11.5 2Mobile statistics and company recognition
If you consent to analytics cookies on the cookie banner, the website also loads our own visit statistics ("2Mobile statistics"). We run them ourselves, with our own software, and do not pass the data to analytics or advertising providers. Before you consent, the statistics are not loaded and nothing is collected. When you withdraw your consent, collection stops at once and the visit ID is deleted from your browser.
Visit ID. On the first page view in a browser tab, a random visit ID is created, stored in that tab's session storage (sessionStorage) and deleted when you close the tab. We use no cookies or local storage (localStorage) for the statistics, so on your next visit we do not recognise you as the same visitor, and we do not link your visits on different days.
What we record:
(a) for each page view: the page address without extra parameters (we keep only the campaign tags utm_source
, utm_medium
and utm_campaign
), the page language, the domain of the page you came from (for example google.com, not that page's full address), the device type (computer, tablet or phone, from the width of the browser window), the time the page was visible and the maximum scroll depth in per cent;
(b) for each click, at most 200 per page view: where you clicked (across as a share of the page width, down in pixels from the top of the page), the page height and a label of what was clicked, that is the text or name of the link or button or the heading of the page section, cut to 60 characters. E-mail addresses and phone numbers in the label are masked. We never record what is in form fields;
(c) the country the visit comes from, as our hosting provider Vercel determines it from the IP address.
What we do not record: we do not store your IP address. We do not record mouse movements, keystrokes or anything you type (in forms or in the chat with Chuck), we do not record session replays, and we do not store the full addresses of the pages you come from.
Company recognition. On the first page view of a visit, we use your IP address once, in our server's memory, without storing it: (i) we work out the network block it belongs to (a /24 block for IPv4, a /48 block for IPv6) and check in the public network register of RIPE NCC to whom that block is assigned; we send the register only the network block, not your IP address; (ii) through the internet's public name system (reverse DNS) we look up the name recorded for that IP address (for example mail.company.com). If the network belongs to a company, we link the visit to that company (its name and, if known, its domain). Networks of internet providers, mobile networks, hosting and cloud services do not count as companies, so a visit from home or over a mobile network is usually not linked to any company. We never store sole traders (s.p.) as companies, as their name is a person's name. Visits from 2Mobile's own network are marked internal and left out of the statistics. We store only the visit's link to a company; the IP address is discarded after the lookup and never written anywhere. So that we do not look up the same network block on every visit, we keep the result for a block (company or provider) for 30 days. RIPE NCC runs the public register we query and is not our processor; it does not receive your IP address.
Purposes. We use the data to understand how the website is used and to improve it (number of visits, most visited pages, where visits come from, heatmaps of clicks and scroll depth), and for sales follow-up: 2Mobile staff who subscribe receive an e-mail every morning listing the companies recognised the day before and the pages viewed from those companies' networks (time, source and length of the visit and the order of the pages). The e-mail is about companies (legal entities); we do not identify individual visitors and do not try to.
Screenshots. To show the heatmaps, we automatically take screenshots of our public pages (on computer, tablet and phone). They show only the pages' public content and contain no data about visitors. We keep them with Vercel for 90 days.
Retention. We keep clicks for 90 days, visits and page views for 13 months, the results of network-block lookups for 30 days, screenshots for 90 days, and a company record for as long as at least one stored visit is linked to it. After that, the data is deleted automatically.
Processors. We run the statistics with processors already listed in point 3.2: Vercel Inc. (hosting of the software that receives the statistics, and storage of the screenshots), Supabase Inc. (database; data is stored on servers in the EU) and Plus Five Five, Inc., doing business as Resend (sending the daily e-mail to staff).
The legal basis is your consent (Article 6(1)(a) GDPR) and, for storing the visit ID in your browser, consent under the applicable electronic communications act (ZEKom-2), as for Google Analytics. You can withdraw your consent at any time as described in point 12.2; withdrawal does not affect the lawfulness of processing before it. Because the visit ID is deleted when you withdraw and is not linked to you, data collected before the withdrawal can no longer be linked to your browser; we delete it under the retention periods above.
12. Managing your cookie consent
12.1 On your first visit, a cookie banner appears. You can choose "Accept all", "Reject all" or "Settings", where you can switch analytics cookies on or off individually. "Accept all" and "Reject all" are equal choices. Until you choose, we do not use analytics cookies.
12.2 You can change your choice or withdraw your consent at any time via the tab with an arrow at the left edge of the page (bottom left): when you point at it or tap it, the "Cookie settings" and "Accessibility" buttons appear. You can also open the cookie settings with the " Cookie settings" link in the page footer. Withdrawing is as easy as consenting. When you withdraw, we delete the analytics cookies, and the 2Mobile statistics stop and delete the visit ID from your browser. Withdrawal does not affect the lawfulness of processing before it.
12.3 We keep your choice in your browser for 12 months and then ask you again. We also ask again if we materially change the list of services or this notice.
12.4 So that we can prove whether you consented to cookies, for each decision we store a random identifier of the decision, your choice, the banner version, the page on which you chose, the language and the time. We do not store your IP address or other data that would identify you directly. We keep this proof for 3 years and then delete it automatically. The legal basis is our legal obligation to be able to demonstrate consent.
12.5 The legal basis for strictly necessary cookies is the exemption under the applicable electronic communications act (ZEKom-2); for analytics cookies, it is your consent.
12.6 You can also restrict or delete cookies in your browser settings. If you block strictly necessary cookies or local storage, some parts of the website (for example the chat with Chuck or saved accessibility settings) may not work properly.
13. Our data
13.1 The owner and operator of the website www.2mobile.si is the company 2Mobile, svetovanje in posredovanje, d.o.o.
13.2 The company 2Mobile d.o.o is registered in Slovenia, with registration number 6125123000 and its registered office is at Dunajska cesta 106, 1000 Ljubljana.
13.3 You can contact us:
(a) by post to the address specified in the previous point;
(b) by email to support@2mobile.si;
(c) via chat on our website;
(d) via an online form on our website.
14. Language
14.1 These terms and conditions are drawn up in Slovenian and English. In the event of any inconsistency between the versions, the Slovenian version shall prevail and shall be deemed to be the original.
15. Changes
15.1 We may change this Privacy and Cookie Notice by posting a new or amended notice on the 2mobile.si website.
15.2 We suggest that you periodically check the content of the notice to be aware of any changes.
15.3 This Privacy and Cookie Notice is effective from 5 October 2026 and fully replaces the Personal Data Protection Regulations of 30.9.2022.
2Mobile d.o.o.
