Privacy policy

1. Who we are and how to reach us

Kozolec is published by Larch & Hay Publishing LLC, a limited liability company registered in the State of Colorado, USA. For the purposes of the EU and UK General Data Protection Regulations (GDPR), Larch & Hay Publishing LLC is the controller of the personal data described in this policy.

Postal address: Larch & Hay Publishing LLC, 117 Union Blvd, Denver, CO 80221, USA. Email for privacy matters: privacy@kozolecnews.com. Telephone: +1 (720) 338-0379 (Monday to Friday, 9:00–17:00 Mountain Time).

We have not appointed a Data Protection Officer because we are not required to, but our editor handles every privacy request personally. Because we do not have an establishment in the European Union, you may also contact us directly about any GDPR matter at the address above.

2. The information we collect

We collect as little as we can. Depending on how you use the site, this may include:

• Technical data sent by your browser. When any page loads, our hosting provider automatically records your IP address, the date and time, the page requested, the referring page, and your browser and operating system type. This happens for every website and is needed to deliver pages and protect the service.
• Your cookie choice. A small record in your browser of whether you accepted or refused optional cookies, and when.
• Statistics data, only with your consent. If you allow statistics cookies, pages viewed, approximate location at country or city level, device type and visit duration, in pseudonymous form.
• Advertising data, only with your consent. If you allow advertising cookies, our advertising partners may read or set identifiers in your browser to show and measure ads.
• What you send us. If you write to us, by email or by using the contact form, which opens your own email program, we receive your name, email address, the content of your message and anything you attach.
• Corrections and tips. If you report an error or send a story tip, the details you give us, including any documents.

We do not ask for, and ask you not to send, sensitive information such as health data, religious or political beliefs, or government identification numbers. We do not knowingly collect payment card data; the site sells nothing directly.

3. Why we use it and our legal bases

We use personal information only for the purposes below. Where the GDPR applies, each purpose relies on a legal basis under Article 6:

• Delivering and securing the website: displaying pages, preventing abuse, diagnosing faults and defending against attacks. Legal basis: our legitimate interest in running a safe, working website.
• Answering you: replying to letters, handling corrections and following up on tips. Legal basis: legitimate interest, or steps you ask us to take before entering into an agreement, for example about advertising.
• Audience statistics: understanding which stories are read so we can plan coverage. Legal basis: your consent, which you can withdraw at any time.
• Advertising: showing ads that keep the site free, and measuring whether they were seen. Legal basis: your consent for any non-essential cookies or similar technologies.
• Legal obligations: keeping records required by law, responding to lawful requests from authorities, and establishing or defending legal claims. Legal basis: legal obligation and legitimate interest.

We do not use your information for automated decision-making that has legal or similarly significant effects on you, and we do not build profiles of individual readers.

4. Who we share it with

We do not sell personal information and we do not rent our readers' email addresses. We share information only with:

• Service providers that host the site, deliver email and store files for us. They act on our instructions under written contracts and may not use the data for their own purposes.
• Advertising and statistics partners, only if you allow the relevant cookies. They are independent companies and their own privacy policies apply to what they collect.
• Authorities, courts or professional advisers, when the law requires it or when needed to protect our rights, our readers or the public.
• A buyer or successor, if the publication is sold or merged, under the same protections as this policy.

Journalism needs trust: we will never reveal the identity of a person who gives us information in confidence unless a court compels us to and every legal avenue to protect the source has been exhausted.

5. International transfers

We are based in the United States, and our providers may store data in the US or other countries. When personal data of people in the European Economic Area, the United Kingdom or Switzerland is transferred to the US, we rely on the EU–US Data Privacy Framework (and its UK and Swiss extensions) where the recipient is certified, or on the European Commission's Standard Contractual Clauses together with additional safeguards where needed. You may ask us for a copy of the relevant safeguards.

6. How long we keep it

• Server logs: 30 days, then deleted automatically, unless needed to investigate a specific security incident.
• Your cookie choice: 6 months, after which we ask again.
• Statistics data: no longer than 14 months, in pseudonymous or aggregated form.
• Letters, corrections and tips: up to three years after our last exchange, then deleted, unless the story they relate to is still being updated or a legal claim is possible.
• Business records about advertising: as long as US tax and accounting law requires, generally seven years.

7. How we protect it

The site is served only over encrypted HTTPS connections. Access to our email and hosting accounts is limited to the people who need it and protected with strong passwords and two-factor authentication. Our contact form sends nothing over the internet by itself; it prepares a message in your own email program. No system is perfectly secure, but if we ever learn of a breach that is likely to put your rights at risk, we will tell you and the competent authorities without undue delay, as the law requires.

8. Your rights in the EU, EEA, UK and Switzerland

If the GDPR or a similar law applies to you, you have the right to:

• access the personal data we hold about you and receive a copy;
• have inaccurate data corrected;
• have your data erased where there is no longer a good reason to keep it;
• restrict how we use it while a question is resolved;
• object to processing based on our legitimate interests;
• receive data you gave us in a portable format;
• withdraw consent at any time, without affecting processing done before you withdrew it.

You also have the right to complain to a supervisory authority. In Slovenia this is the Information Commissioner (Informacijski pooblaščenec, Dunajska cesta 22, 1000 Ljubljana, www.ip-rs.si). You may also contact the authority in the country where you live or work.

9. Your rights in the United States

Residents of Colorado, California, Virginia, Connecticut, Oregon, Texas and other states with comprehensive privacy laws have rights to know what personal data we hold, to obtain a copy, to correct and delete it, and to opt out of the sale of personal data, targeted advertising and profiling. We do not sell personal data. You can opt out of targeted advertising at any time by leaving advertising cookies switched off in “Cookie settings”.

We honour the Global Privacy Control (GPC) signal: if your browser sends it, we treat it as a request to opt out of targeted advertising, as Colorado law requires.

California residents: in the past 12 months we have collected identifiers (such as IP address), internet activity information and the content of correspondence, for the purposes described in section 3. We have not sold or shared personal information for cross-context behavioural advertising without consent. We will not discriminate against you for exercising your rights.

If we deny a request, you may appeal by replying to our answer with the word “Appeal”. If you are not satisfied with the outcome of the appeal, you may contact your state Attorney General.

10. How to make a request

Write to privacy@kozolecnews.com or to our postal address, saying which right you want to use. We may ask for information to confirm that the request comes from you, but only as much as needed. You can also use an authorised agent, who must show written permission from you.

We answer within one month (EU and UK) or 45 days (US states). If a request is complex we may extend this once, and will tell you why. Requests are free unless they are clearly unfounded or excessive.

11. Children

Kozolec is a general-audience news site and is not directed at children under 16. We do not knowingly collect personal information from children under 13, in line with the US Children's Online Privacy Protection Act, or from children under 16 in the EU without parental consent. If you believe a child has sent us personal information, contact us and we will delete it.

12. Links to other websites

Every story links to its sources, such as Slovenian news outlets, institutions and event organisers. When you follow those links you leave our site, and the other site's privacy policy applies.

13. Changes to this policy

We review this policy at least once a year. If we change it, we update the date at the top of the page. If a change materially affects how we use information you have already given us, we will tell you before it takes effect. This version was last revised on 21 October 2026.