Privacy Policy and Personal Data Protection

Last updated: 8 October 2026

At LMM Tilia d.o.o. we respect the privacy of candidates, website visitors, mobile app users, callers, business partners and other individuals. We process personal data transparently, to the minimum extent necessary and in line with the General Data Protection Regulation (GDPR), the Slovenian Personal Data Protection Act (ZVOP-2) and other applicable law.

This policy explains which data we process, why we use it, how long we keep it, to whom we may disclose it and what rights you have. For the Avtošola Tilia mobile app, the separate app privacy policy also applies. If the Slovenian and English versions differ, the Slovenian version prevails.

1. Controller

LMM Tilia, avtošola, turizem in trgovina, d.o.o.
Gerbičeva ulica 44, 1000 Ljubljana
VAT number: SI52280888
Phone: 01 429 20 29
E-mail: info@lmmtilia.si

2. Who and what this policy covers

The policy applies in particular to:

• visits to avtosolatilia.si and related pages and subdomains;
• online or in-person sign-up for the CPP course, driving lessons, tutoring or other services;
• use of the mobile app, Tilia Hub, the e-classroom, CPP tests, the AI tutor and other digital tools;
• communication by phone, e-mail, forms, social media or in person;
• payments, invoicing, records of completed and paid lessons and the performance of contracted services;
• use of the AI phone assistant, the AI e-mail assistant and other support automations;
• receiving notices, newsletters or requests for feedback where there is a proper legal basis.

3. Personal data we may process

Depending on the service and how you deal with us, we may process:

• identification data: first name, surname, date of birth, EMŠO (personal identification number) and other data required by law for driver training (we need EMŠO to enter the candidate in the prescribed register and to register them for the exam);
• contact data: address, town, phone number and e-mail address;
• candidate and training data: category, enrolment, completed obligations, driving lessons, driving instructor, progress, dates, attendance and exams;
• CPP test data: the e-mail address used to sign in, nickname, completed papers and results, points, level, league, streak, friends you add yourself, and Tilia Plus subscription data;
• payer and payment data: name of the payer, address, tax number of a legal entity, chosen services, amounts, payment method and status, and data needed for invoicing;
• communication data: the content of messages, enquiries, e-mails, support requests and arrangements;
• phone call data: phone number, time and duration of the call, purpose of the call and, where enabled and disclosed, the audio recording or transcript;
• technical data: IP address, device and browser type, access logs, session identifiers, usage data and cookie settings;
• photos and videos: where created during our activities and where we have a proper legal basis for their use;
• other data you give us voluntarily or that we must process to provide the service or meet a legal obligation.

Please do not send us special categories of personal data, such as detailed health data, through ordinary forms, AI assistants or e-mail, unless this is necessary for the service or required by law and a proper legal basis exists.

4. Purposes and legal bases

• performance of a contract and steps before entering into one: sign-up, enrolment, organising the CPP course, scheduling driving lessons, training, candidate support, payments and documentation;
• legal obligations: keeping prescribed records, accounting, tax obligations, proof of attendance and other obligations of a driving school;
• legitimate interests: system security, fraud prevention, organising our work, improving services, basic statistics, establishing or defending legal claims and communicating with existing customers;
• consent: newsletters, certain analytics and advertising cookies, use of photos or videos and other purposes that require consent;
• protection of vital interests or tasks in the public interest, where exceptionally necessary and lawful.

Where processing is based on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing before it.

5. Use of artificial intelligence and automation

We use AI and automation to give candidates information faster, reduce administrative delays, make our services more accessible and give our staff more time for personal support and good teaching. Technology supports our work; it does not replace the judgement of driving instructors, lecturers or the office.

We may use AI and automated tools in particular for:

• answering general questions about the CPP course, the process, prices, dates and services;
• the AI tutor, explaining study material, exercises and help with self-study;
• the phone assistant and summaries of calls for follow-up;
• translation and language adaptation of communication;
• sorting e-mail, documents, payment confirmations and administrative tasks;
• matching payments to internal records and preparing accounting documents;
• optimising schedules and reducing unnecessary administrative delays;
• improving digital learning tools, simulators and candidate support;
• drafting texts, summaries and replies;
• creating or editing visual and video content where we have a proper legal basis for the material used.

We use the minimum data needed, limit or pseudonymise it where possible and do not enter data the task does not need. AI output can be inaccurate, so for important administrative, financial or professional matters we do not rely on an automated answer alone.

We do not take decisions with legal or similarly significant effects solely by automated means. Decisions on eligibility, the course of training, payments, disputes or other important matters are always checked, or can be checked, by a responsible person.

6. AI phone and e-mail assistants

To be easier to reach, part of our phone calls may be handled by an AI phone assistant. Callers are told at the start of the call when an automated assistant answers. To understand the request, the system may process your voice, phone number, the time and length of the call, the content of the conversation and a technical transcript. The data is used to answer your question, pass your request to a responsible person, support you and organise our work.

When a call is recorded, the caller is told about the recording and its purpose beforehand. If you do not want to talk to the AI assistant, you can ask for a member of staff, e-mail us, or call during office hours.

AI e-mail assistant. When the office is closed, e-mails sent to info@lmmtilia.si may be answered automatically by our AI e-mail assistant, Jaka. The footer of such a reply says that it may have been written with the help of artificial intelligence. Jaka answers general questions, can let you know that we received your call and can prepare a pro-forma invoice (predračun) if you ask for one. Jaka does not issue invoices, does not confirm payments and does not decide on enrolment, refunds or exceptions; a member of staff always handles those. To answer, Jaka uses the content of your message and basic data about your sign-up (for example the course date and payment status); we do not pass your EMŠO, address or date of birth to the language model. If you would like a reply from a person, say so in your message.

7. Processors and technology providers

We use vetted external providers who may process data on our instructions and only to the extent needed for their service. A provider receives data only when its service is actually used. Providers we may use include:

• NEOSERV or the hosting provider: hosting of websites, databases and e-mail, backups and technical protection;
• Google Ireland Limited and affiliates: Google Workspace, e-mail, calendar, Google Meet, file storage, analytics, maps and other business services;
• Meta Platforms Ireland Limited: Facebook, Instagram, Meta Pixel and advertising services, only in line with your consent settings where required;
• MailerLite and Zapier: automated notices, communication, feedback requests and connecting business processes;
• Stripe Payments Europe, Limited: card payments for online sign-up, orders and Tilia Plus; we do not store card data ourselves;
• other payment providers: card payments, Apple Pay, Google Pay or other methods shown at checkout;
• Minimax: online accounting software for issuing pro-forma invoices and invoices;
• OpenAI Ireland Ltd. and affiliates: language models, AI assistance (including the AI e-mail assistant), sorting and preparing content or summaries;
• Anthropic PBC: Claude language models for processing, understanding, translating and preparing texts;
• Perplexity AI, Inc.: AI-assisted research and checking of publicly available information; we do not normally pass candidates' documents to it;
• Z.ai or JINGSHENG HENGXING TECHNOLOGY PTE. LTD.: GLM models for technical, research and language support; personal data only where necessary and properly protected;
• CustomGPT.ai: private AI assistants answering from our controlled knowledge base;
• Retell AI, Inc.: technology for the AI phone assistant, speech processing and transcripts;
• Twilio Inc., Twilio Ireland Limited and affiliates: telephone infrastructure, call routing, messages and related communication services;
• Higgsfield Inc.: creating or editing creative video and visual content; personal photos or recordings only with a proper legal basis;
• other accounting, legal, IT, communication and business contractors: only as far as needed for the service, legal obligations or protecting our rights.

Some AI tools are used only for general research, development, technical help or drafting, and we do not routinely give them candidates' personal data. The list may change as our services develop; we will include material changes in this policy.

8. Transfers outside the European Economic Area

Some providers or their subcontractors have infrastructure or offices outside the EEA, in particular in the USA, the United Kingdom, Singapore or other countries, so data may also be processed outside the EEA. Where needed, transfers rely on a European Commission adequacy decision, standard contractual clauses, binding corporate rules or another lawful mechanism.

9. Cookies, analytics and advertising

The website uses strictly necessary cookies for secure and correct operation, sign-up forms, sessions and your settings. Analytics, functional and advertising cookies are used only in line with the law and your choices in the consent manager. Depending on your consent we may use Google Analytics, Meta Pixel and other measurement or advertising technologies. You can change or withdraw consent at any time in the cookie settings. Strictly necessary cookies cannot be switched off.

10. How long we keep data

• candidate, training and register data: for the periods set by rules on drivers, driving schools and archiving;
• contract documents: for the term of the contract and as long as needed for limitation periods and evidence;
• invoices and accounting records: as a rule ten years, or as tax and accounting rules require;
• enquiries that do not lead to a contract: as a rule up to 24 months;
• CPP test accounts and results: until you ask for deletion at info@lmmtilia.si or delete the account in the app;
• direct marketing data: until you withdraw consent or object, or the purpose ends;
• technical logs: for a limited period needed for security, troubleshooting and fraud prevention;
• call recordings or transcripts, where they exist: only as long as needed to handle the request, check quality, prove an arrangement or meet legal obligations;
• photos and videos: until the purpose ends or consent is withdrawn, taking into account material already lawfully published.

After that, data is deleted, anonymised or securely destroyed unless further storage is needed for a legal obligation, an open procedure or legal claims.

11. Security

We use appropriate organisational and technical measures such as access control, limited permissions, backups, system updates, protected communication, logging of important events, staff training and data processing agreements with providers. No system is completely secure, but we adapt our measures to the risks and to technical developments.

12. Disclosure to others

We may disclose data to: staff and associates who need it for their work; the processors and providers listed in this policy; public authorities, courts, supervisory bodies or other entitled persons where the law or a valid order requires it; advisers, insurers or others where needed to establish or defend legal claims; and others where you have expressly consented or asked for it.

Public CPP test leaderboards show only your nickname, level, points and streak. Your name, surname and e-mail address are not shown.

We do not sell personal data.

13. Your rights

Under the conditions of the law you may request: access to your data and a copy; correction or completion; erasure; restriction of processing; data portability; to object to processing based on legitimate interest; to object to direct marketing; withdrawal of consent; information on safeguards for transfers to third countries; and human review if you believe an automated process affected you.

Send your request to info@lmmtilia.si or by post to the controller. To protect your data we may ask you to confirm your identity. We reply without undue delay and as a rule within one month.

14. Complaints

If you believe we process your data unlawfully, please contact us first so we can resolve it together. You also have the right to lodge a complaint with the Information Commissioner of the Republic of Slovenia, Dunajska cesta 22, 1000 Ljubljana, e-mail gp.ip@ip-rs.si, www.ip-rs.si.

15. Minors

Driving school services are also used by minors. We process their data only as needed for the service and our legal obligations. Where the law requires consent of a parent or legal guardian for a purpose, we obtain it first.

16. External links and social media

Our website may link to other websites, app stores, social networks and services. Their own privacy policies apply there.

17. Changes

We may update this policy when our services, providers, technology or the law change. The current version is always published on this page with the date of the last update at the top. We will inform you of important changes in an appropriate way.

18. Contact

For privacy questions or to exercise your rights, write to info@lmmtilia.si, call 01 429 20 29 or write to LMM Tilia d.o.o., Gerbičeva ulica 44, 1000 Ljubljana.