1. Controller and contact
The controller is EndoVia Therapeutics d.o.o., Ulica škofa Maksimilijana Držečnika 6, 2000 Maribor, Slovenia, registration number 9944389000, VAT ID SI75836688. For privacy questions and rights requests, email info@endovia.eu.
2. Scope
This policy covers visits to EndoVia’s information website, email enquiries and correspondence. We apply the GDPR, Slovenia’s ZVOP-2 and, where relevant, ZEKom-2.
This website is not a patient portal and does not accept medical records. Research projects, recruitment and other purposes outside this policy require separate privacy information.
This policy applies to www.endovia.eu and endovia.eu.
3. Data we process
- Correspondence: your email address, name and any information you choose to include in your message.
- Operation and security: the hosting service may process technical information such as IP address, request time, requested page and browser information to deliver and protect the website.
The website uses email links rather than a submission form. Clicking an email link opens your email application; the website does not submit or store your message or record a terms-acceptance checkbox. There is no website form database or CAPTCHA service.
We normally obtain data from you or through use of the website. Do not include health, genetic or other sensitive data, third-party personal data or confidential research material in messages. If received unintentionally, we restrict access and assess secure deletion or another lawful response.
4. Purposes and legal bases
- General and business enquiries: our legitimate interest in business communication and handling enquiries, Article 6(1)(f) GDPR. We assess necessity and the impact on your rights before relying on this basis.
- Pre-contractual steps at your request: Article 6(1)(b) GDPR where you personally are the prospective contracting party. Correspondence with a company representative normally relies on legitimate interests instead.
- Security and abuse prevention: the legitimate interest in secure, reliable operation, Article 6(1)(f) GDPR, limited to what is necessary and proportionate.
- Legal duties: Article 6(1)(c) GDPR where a specific duty requires processing or disclosure.
An enquiry does not subscribe you to a mailing list. Any future consent-based marketing requires separate, optional, withdrawable consent.
5. Recipients, hosting and transfers
Authorised team members handle enquiries. The website is hosted by NEOSERV (Avant.Si d.o.o.). Email correspondence is handled through Microsoft 365 (Microsoft Ireland Operations Ltd). Email links use your own email application and provider before your message reaches EndoVia.
Data may be disclosed to competent authorities where legally required. Where providers process personal data on our behalf, applicable data-processing arrangements govern that processing.
For information about processing locations, recipients and safeguards applicable to your correspondence, contact info@endovia.eu.
6. Retention
We retain correspondence for as long as it is needed to handle your enquiry and any resulting collaboration. Retention depends on whether discussions remain active, whether an agreement is concluded, and whether legal obligations or a dispute require continued retention.
The website does not store form submissions. Hosting logs and backups are managed through the hosting service. For information about the retention applicable to your data, contact info@endovia.eu.
Where a dispute or legal duty requires continued retention, access to the necessary data is restricted until that reason ends.
8. Your rights
Subject to GDPR conditions, you may request access, rectification, erasure or restriction. Portability applies to automated processing based on consent or contract. You may object to legitimate-interest processing on grounds relating to your situation, and to direct marketing at any time. Where consent applies, you may withdraw it without affecting earlier lawful processing.
Email info@endovia.eu to exercise rights. We respond without undue delay, normally within one month. Complex or numerous requests may justify an extension of up to two further months; we explain the reasons within the first month. Identity checks are limited to what is necessary.
You may complain to the Information Commissioner of the Republic of Slovenia or the competent authority where you habitually live, work or believe an infringement occurred, without prejudice to judicial remedies.
9. Required data, automation and changes
Contacting us is voluntary. We need a reply address and enough information to understand your enquiry. Without these, we may be unable to respond.
The website does not use a submission form, a CAPTCHA or visitor profiling. Scientific descriptions of modeling do not mean website visitors are profiled.
New purposes or material changes require updated information and, where necessary, fresh consent.
Last updated: 19 October 2026.