Privacy policy

Data Controller

General Logistics Systems d.o.o. (hereinafter: “GLS”) is a subsidiary of General Logistics Systems B.V., Amsterdam. GLS provides reliable and high‑quality parcel services as well as value‑added logistics services.
Name: General Logistics Systems d.o.o. – GLS d.o.o.
Registered address: GLS d.o.o., Cesta v Prod 84, 1129 Ljubljana, Slovenia

General contact e‑mail address: info@gls-slovenia.com
Correspondence address: GLS d.o.o., Cesta v Prod 84, 1129 Ljubljana, Slovenia
Contact details of the Data Protection Officer: Unija ETL Consulting d.o.o., dataprotection@gls-slovenia.com

Personal data

Personal data comprises information relating to the personal or factual circumstances of an identified or identifiable individual. This includes, for example, information such as a name, address, telephone number, or e‑mail address. Data that cannot be linked to a specific or identifiable individual, such as statistical data, is not considered personal data.

Data subject

A data subject is a natural person who can be identified directly or indirectly on the basis of personal data.

Data protection legislation applicable and commitment to data confidentiality

GLS Slovenia manages personal data in accordance with the applicable rules on personal data processing, in particular with due regard to the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter: GDPR), as well as the national data protection legislation and sector‑specific legislation relevant to the operations of GLS Slovenia.

Information security

We regularly, carefully, and continuously monitor all security measures. These measures are designed to ensure the confidentiality, integrity, and availability of data. They are aimed at preventing unauthorized access, loss, alteration, or misuse of data. To achieve this, we apply a range of organizational, technical, and physical security measures, including firewalls, intrusion‑prevention systems, and strict access controls.

Personal data is processed in information systems that are appropriately protected against security risks. In addition, we ensure regular training for employees to familiarize them with best practices in information security and data protection. GLS Slovenia will appropriately update and adjust security and other measures for the protection of personal data to technological developments, emerging threats, and legislative requirements whenever necessary to maintain a high level of security.

Recipients / processors / users of personal data

GLS does not sell personal data to third parties. However, there are certain circumstances in which GLS may share personal data with third parties without providing additional notification to the data subject. Such disclosures may occur solely in cases required by applicable law, when necessary for the performance of contractual obligations, or when required to protect the legitimate interests of GLS, while always ensuring appropriate legal safeguards and adherence to data protection principles.

GLS may share personal data without additional notification in the following cases:

• With GLS subsidiaries, when necessary for the performance of postal services, the delivery of shipments from the sender to the recipient, and the execution of other related activities within the GLS Group;
• With external partners lawfully engaged by the controller to perform its core activities (postal delivery services) and related operations. GLS shares personal data with such partners exclusively on the basis of a previously concluded data processing or data protection agreement ensuring an appropriate level of security;
• With other data controllers, when required for the performance of the postal service. These controllers are independently responsible for the lawfulness and security of the personal data processing carried out within the scope of their activities;
• With third parties on the basis of demonstrated legal authority, for example at the request of competent authorities or pursuant to a court order. In such cases, personal data is disclosed solely on the basis of written proof of the legal mandate granted to the competent authority.

Rights of the data subject

GLS Slovenia respects the fundamental rights and freedoms of data subjects. The GDPR expands the privacy rights of individuals whose personal data is processed. In accordance with this Regulation, you have the right to:

· To be informed about the processing of your personal data and to have access to the personal data being processed (right to be informed and right of access pursuant to Article 15 GDPR),

· to obtain the rectification of inaccurate personal data (right to rectification pursuant to Article 16 GDPR),

· to obtain the erasure of your personal data (right to erasure pursuant to Article 17 GDPR),

· to restrict the processing of your personal data (right to restriction of processing pursuant to Article 18 GDPR),

· to receive the personal data you have provided to us (right to data portability pursuant to Article 20 GDPR),

· to object, on grounds relating to your particular situation, to the processing of your personal data carried out on the basis of legitimate interests or the performance of a task carried out in the public interest (right to object pursuant to Article 21 GDPR).

You may exercise each individual right to the extent permitted by the legal basis on which we process your personal data.

Withdrawal of consent

If the processing of your personal data is based on consent, please note that you have the right to withdraw your consent at any time with effect for the future, without affecting the lawfulness of the processing carried out on the basis of your consent prior to its withdrawal.

Exercising your rights

A data subject may submit a request to exercise their rights using one of the following contact options:
• In writing: GLS d.o.o., Cesta v Prod 84, 1129 Ljubljana
• By e‑mail: to dataprotection@gls-slovenia.com

Right to lodge a complaint

If a data subject believes that the processing of their personal data infringes the provisions of this Notice, the General Data Protection Regulation (GDPR), or the Personal Data Protection Act (ZVOP‑2), they have the right to lodge a complaint regarding such processing of personal data.
A complaint may be submitted, at the data subject’s discretion, either to the controller or to the competent supervisory authority.
The controller accepts complaints regarding the processing of personal data at the following address:

• In writing: GLS d.o.o., Cesta v Prod 84, 1129 Ljubljana
• By e‑mail: to dataprotection@gls-slovenia.com

The time limit for handling a complaint submitted to the controller at another contact address begins to run on the day it is received at the above‑mentioned address.

The supervisory authority accepts complaints regarding the processing of personal data at the following address:
Information Commissioner
Dunajska cesta 22, 1000 Ljubljana
gp-ip@ip-rs.si

Collection, processing, and use of personal data when using the Piano web analytics tool

On our website we use the Piano web analytics tool provided by Applied Technologies Internet SAS, 85 avenue Président JF Kennedy, 33700 Merignac, France.

• Purpose of personal data processing

Piano is used to analyze the use of our website, based on which we prepare reports on user activities and obtain insights to improve the website’s performance and user experience. Visitor interactions are recorded and systematically analyzed through cookies and specific visitor identifiers, which enable a more detailed understanding of website usage, optimization of functionalities, and adaptation of content to users’ needs.

· Categories of personal data processed

When using the Piano tool, the following data about website visitors is processed:

• Visitor ID,
• IP address,
• audience data, such as number of visitors, visits, page views, events, conversion rate,
• geolocation data (country, continent, region, sub‑region, browser language) – Piano Analytics does not obtain geolocation directly from the user’s device, nor does it use mapping services such as Google Maps or Microsoft Bing. Geolocation is determined based on the visitor’s IP address, which is checked against the Digital Element partner database. The IP address is first matched with a location and then anonymized.
• referrer URL (previously visited website), including data from search engines, social networks, and marketing campaign parameters,
• visited URLs with corresponding page titles and additional information about displayed content,
• technical details, such as device type, browser type and version, and operating system,
• data on interactions with our website content, including pages viewed, clicks, website navigation, content downloads, and scrolling patterns,
• data related to the use of the website’s search function, such as displayed and selected search results,
• how you contact us: initiation of filling out the contact form, progress within the form, and form submission. Please note that the content of the contact form is not analyzed,
• the method of contacting GLS, such as the start of filling in the contact form, progression through the form, and submission of the form (the form content is not analyzed),
• login status, when a user registers or logs into their account (information on whether the user is logged in or logged out).

· Additional security measures

Data collected through the use of the Piano tool is anonymized or pseudonymized within a short period of time. The IP address is truncated, and login identifiers are converted into a pseudonymized key. These procedures generally prevent the possibility of directly linking the data to a specific individual. This means that the data can no longer be associated with the visitor’s computer or other device in a way that would enable their identification.

· Legal basis for the processing of personal data

The legal basis for data processing is consent pursuant to Article 6(1)(a) of the General Data Protection Regulation (GDPR).
The data subject may withdraw their consent at any time; however, this does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal. You may withdraw your consent at any time with immediate effect by adjusting your preferences in our consent banner.

· Cookies

When you visit our website, certain cookies or similar technologies (e.g., web beacons, pixel tags, local storage) may be placed on your device. The purpose of these technologies is to ensure the proper functioning of the website, analyze its use, and improve our services and the user experience.

In accordance with applicable legislation (the GDPR and the Electronic Communications Act), cookies that are not strictly necessary for the functioning of the website may only be used on the basis of your prior consent.

Types of cookies we use:

Necessary cookies:

1. Necessary and technical cookies

These cookies are essential for the proper functioning of our website. Without them, the website will not operate correctly.

Optional cookies:

2. Functional cookies

These cookies collect information about user preferences and provide a better and more personalized experience.

3. Analytical cookies

Piano Analytics: We use cookies and user IDs to analyze your behavior on our website.

4. Marketing cookies

These cookies help us measure the effectiveness of advertising campaigns in order to improve our services.

Provision and management of consent:

Upon your first visit to the website, a notice or banner is displayed where you can:
• accept all cookies,
• reject optional cookies, or
• customize your preferences by individual categories.

You can withdraw or change your consent at any time via the cookie‑shaped icon that is permanently visible in the bottom right corner of the website.

Necessary cookies cannot be disabled.

Retention period:

Cookies are stored for as long as necessary to fulfil their intended purpose:

• Session cookies – until the browser is closed;
• Persistent cookies – until the expiration of a predefined period or until consent is withdrawn.

Collection, processing, and use of personal data in the context of customer satisfaction measurement (NPS)

· Processing of data related to surveys for recipients

Purpose of data processing: The evaluation of the delivery process by the recipient is carried out for the purpose of continuously improving the quality of GLS services. Linking the feedback to the parcel number enables the data controller to perform a more precise analysis of service quality based on geographical, temporal, and other characteristics. Based on this information, the controller may implement targeted measures to optimize services or, if necessary, contact the recipient (e.g., in cases where lower delivery performance is detected in a specific area).
The service is provided by QuestionPro GmbH, Friedrichstraße 171, 10117 Berlin, Germany.

Legal basis for processing: legitimate interest pursuant to Article 6(1)(f) of the General Data Protection Regulation (GDPR).

Scope of personal data processed: e‑mail address, parcel number.
Retention period: until the individual objects to the processing.
Note: The processing is not anonymous, as the recipient is identified through the parcel number. The link between the parcel number and the response is used exclusively for quality assurance and service improvement. Individuals will not be discriminated against based on their feedback (including negative feedback).

· Processing of data related to ratings on the parcel tracking page

Purpose of data processing: The evaluation of the ordering process by the sender and the assessment of the overall delivery process by both the sender and the recipient are carried out for the purpose of continuously improving the quality of GLS services. Linking the feedback to the parcel number enables the data controller to perform a detailed analysis of service quality based on geographical, temporal, and other characteristics. Based on this information, the controller may implement targeted measures to optimize services or, if necessary, contact the recipient (e.g., in cases where lower delivery performance is detected in a specific area).

Legal basis for processing: legitimate interest pursuant to Article 6(1)(f) of the General Data Protection Regulation (GDPR).

Scope of personal data processed: parcel number (postal code).

Retention period: until the individual objects to the processing.

Note: The processing is not anonymous, as the recipient is identified through the parcel number. The link between the parcel number and the response is used exclusively for quality assurance and service improvement. Individuals will not be discriminated against based on their feedback (including negative feedback).

· Justification of legitimate interest

Measuring customer satisfaction represents a standard and reasonably expected practice, as users legitimately expect a company to assess their experience and use feedback to improve processes and services. The processing is carried out to a limited extent, does not involve sensitive data, and does not have any significant impact on the rights or freedoms of individuals. The data is used exclusively for analytical purposes and to enhance the user experience, and it is appropriately protected. After balancing the interests, we assess that our interest in monitoring service quality and addressing shortcomings does not override the rights and interests of individuals. Participation is always voluntary, and the individual may decline to take part in the survey at any time, which further ensures proportionality and voluntariness.

Sending Newsletters (e-newsletters)

· Purpose of processing

GLS Slovenia processes personal data for the purpose of sending newsletters (e‑newsletters) to individuals who have provided their explicit consent.
The e‑newsletters include information about services, updates, offers, and other content related to the company’s operations. The newsletter database is used solely for the purpose of distributing e‑newsletters.

· Scope od data processed

For the purpose of sending newsletters, we process the following personal data:

· first and last name (if provided),

· e‑mail address,

· date of consent,

· date of withdrawal of consent (if applicable).

These data are stored in a dedicated newsletter recipient database.

· Retention period

Personal data is stored:
• for as long as the consent remains valid, or
• until the consent is withdrawn, after which the data is deleted or appropriately anonymized no later than within a reasonable technical period following receipt of the withdrawal.

An individual may withdraw their consent to receive the newsletter at any time, without any negative consequences. The withdrawal does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

Consent may be withdrawn in any of the following ways:
• by clicking the unsubscribe link included in every newsletter sent,
• by sending an e‑mail to: dataprotection@gls-slovenia.com,
• by sending a written request to: GLS Slovenia d.o.o., Cesta v Prod 84, 1129 Ljubljana.

Use of live chat via chatbot on the GLS website

If a user wishes to contact GLS Slovenia, they may do so via the live chat function available on the GLS website. Our chatbot uses artificial intelligence (AI) technologies to understand and process user messages and to provide appropriate responses. AI models help identify the intent of the query, retrieve relevant information, and automate certain support processes. Despite the use of artificial intelligence, these interactions do not involve automated decision‑making that would produce legal or similarly significant effects for the individual; in the case of more complex inquiries, the communication can be forwarded to our support team.

· Purpose of personal data processing

The data provided through the chatbot is processed exclusively for the following purposes:
• communicating with the user,
• providing support and responding to received inquiries,
• delivering relevant information related to the user’s query,
• resolving potential issues and providing the necessary information for successfully completing processes,
• ensuring security, stability, and improving the overall user experience,
• analyzing the performance of the chatbot and optimizing our services based on identified usage patterns.

· Categories of personal data processed

When using our chatbot, we process the data that the user voluntarily provides during the conversation (e.g., tracking number, first name, last name, telephone number, e‑mail address, postal address), as well as certain technical data that is recorded automatically (e.g., IP address and its approximate location, browser type and version, operating system, referring website URL, chat duration, and time of access).
Some of this technical information is also collected through cookies and other similar technologies. The processing of technical data is intended to ensure the proper functioning of the chatbot, improve the user experience, and enable more effective handling of user inquiries.

· Additional security measures

Users may request the anonymisation of their chat conversations at any time by contacting us at dataprotection@gls-slovenia.com .

Anonymisation is permissible only in cases where the content of the conversation does not include personal data or information that may be relevant for the establishment or defence of legal claims in the future (e.g., information related to complaints, claims, requests for rectification of irregularities, information connected to contractual relationships, evidence or statements that may be important in legal proceedings, claims related to financial or billing data, invoice complaints, etc.).

· Legal basis fort he processing of personal data

The legal basis for data processing is legitimate interest pursuant to Article 6(1)(f) of the General Data Protection Regulation (GDPR).

Justification of legitimate interest: The chatbot requires only essential technical and functional data for its basic operation (e.g., technical logs for establishing a connection and preventing misuse). All other data is shared with us solely by the user — voluntarily and only to the extent chosen by the user. Where data is not needed for legal, security, or evidentiary purposes, it may — at data subject request — be appropriately anonymised, further reducing any impact on your privacy. The Legitimate Interest Assessment (LIA) has shown that such processing does not disproportionately interfere with data subject rights, as the scope of data is limited and you retain primary control over the information data subject choose to disclose.

· Retention period

These data are stored for a maximum of 5 years and are then deleted in accordance with the applicable data protection regulations.

· Additonal note

Personal data may be disclosed to service providers who provide technical support and manage the chatbot on our behalf and who act as processors in accordance with our instructions and the applicable data protection legislation. These providers are contractually obligated to ensure an appropriate level of security and to protect the confidentiality of personal data.

Use of the parcel tracking function on the GLS website

The parcel tracking functionality on the GLS Slovenia website enables senders and recipients to quickly and easily view the current status of their shipment. For the proper functioning of this service, certain data entered by the user—such as the parcel number—are processed in order to display information regarding the shipment’s route and delivery status.
The processing is designed to include only the minimum amount of data necessary for displaying the shipment status, and personal data is processed securely and in compliance with applicable data protection legislation.

• Purpose of personal data processing

When using the parcel tracking functionality on the GLS Slovenia website, personal data is processed for the following purposes:

• to enable the display of the current status of the parcel (e.g., information received, in transit, destination parcel centre, out for delivery, delivered);
• to provide additional delivery information when the user enters the postal code of the delivery address (e.g., more detailed shipment statuses);
• to ensure proper functioning of the tracking service;
• to enable communication with the sender or the recipient in the event of operational requirements (e.g., clarification of delivery location);
• to improve logistics processes and enhance the overall user experience.

• Categories of personal data processed

When using the parcel tracking function, the user provides the following personal data:

• parcel number,
• postal code of the delivery address (if the user optionally provides it),
• technical data related to the visit of the website (as defined above), processed solely to ensure website functionality and security.

Entering the postal code is optional but allows the system to display more detailed delivery status information.

• Legal basis for the processing of personal data

The processing of personal data for the purpose of providing the parcel tracking functionality is based on the legitimate interest of the controller pursuant to Article 6(1)(f) GDPR, as parcel tracking is an expected and essential feature for both senders and recipients.

The legitimate interest is justified by the operational needs of providing delivery services and by the reasonable expectation of users that they can check the status of their parcel.

• Retention period

Data displayed within the parcel tracking function is retained only for as long as necessary:

• to display the status of the parcel,
• to perform delivery and resolve any operational issues,
• to comply with legal obligations (e.g., sector-specific postal legislation or financial regulations).

The data is no longer accessible after the expiry of the legally prescribed retention period and is subsequently deleted or anonymised.

General remarks:

GLS Slovenia does not use personal data for profiling purposes or for automated decision‑making in any of the processing activities described above.

This information was last updated on 03 March 2026.