What Slovenian Law Requires on Your Website

Most website owners handle the legal part by copying the "legal pages" from someone else's site. The result describes processing the site never does, plus a cookie banner nobody needs. This guide covers what Slovenian law actually requires on a business website. It is practical guidance, not legal advice; have a lawyer review web-shop terms before you publish them.

Which business details must appear on the website?

Under the Zakon o elektronskem poslovanju na trgu (ZEPT, the e-commerce act) a website counts as an information-society service, so visitors must be able to find the provider's basic details without searching:

full name or registered company name as entered in the register (for a sole trader that means "Računalničar, Sebastijan Bandur s.p.", not only the brand),
registered address,
e-mail address for direct contact,
registration number (matična številka) and the register the business is entered in (AJPES),
tax number; if you are VAT-registered, the VAT ID, otherwise a note that you are not.

The Zakon o gospodarskih družbah (ZGD-1, the companies act) requires the same details on business letters and order forms, and for a d.o.o. or d.d. adds the share capital and any unpaid contributions. Since websites and e-mail now do the job of a business letter, include those details there too. It costs you one line in the footer.

On this site those details sit in the footer of every page and in the terms. "Segentic" appears in headings; the legal entity always appears with its full name.

Where on the site do these details belong?

The law does not prescribe a location, but it requires the details to be "easily, directly and permanently accessible". In practice:

A footer with all identification details on every page.
A contact page with the full address and e-mail.
Legal pages with the specifics, linked from the footer.

Hiding the details in a PDF or behind a login does not qualify. The same goes for companies that show only a brand name and a form.

Do I need a privacy policy if I only have a contact form?

Yes. A form with a name and e-mail already means you process personal data, and the GDPR together with ZVOP-2 (the Slovenian data protection act) require you to tell the person, at the moment of collection:

who the controller is (full name, address, e-mail),
which data you collect and for what purpose,
the legal basis for each purpose (an inquiry = pre-contractual steps),
who receives the data (processors, e.g. Cloudflare for hosting, Resend for sending e-mail),
how long you keep it (concretely: "inquiries that do not lead to a project are deleted after 12 months"),
the person's rights and the option to complain to the Information Commissioner (Informacijski pooblaščenec RS).

Write what is true, not what is possible. If the site runs no analytics, say so in one sentence. That sentence builds more trust than ten paragraphs of copied text. Our example: the privacy policy, which also states that we store the IP address from form submissions only as a hash.

Do I need a cookie banner?

That depends on what the site actually loads. The Zakon o elektronskih komunikacijah (ZEKom-2, article 225) and the 2023 guidelines of the Information Commissioner set out the rules:

Essential cookies (bot protection on the form, Cloudflare security cookies, the cookie storing your choice) need no consent, but you must list them in the policy.
Non-essential cookies (analytics with identifiers, advertising pixels) may load only after explicit consent. Rejecting must be as easy as accepting: two equal buttons, no pre-ticked boxes, no coloured "accept" with "reject" hidden behind settings.
If there are no non-essential cookies, there must be no banner. A banner on a site that does not track anyone is noise and a sign the owner copied the text.

This site is built without tracking cookies and therefore without a banner. We measure traffic from Cloudflare's server-side data, which sets no cookies. That is part of the design, not an afterthought, and we offer the same to clients who want secure websites. If you later add Google Ads or Meta Pixel, you need the banner and must update the policy.

Do I need terms and conditions?

For a site that only presents services and takes inquiries, the law does not require terms. They are still worth having, because they settle price, deadline, handover and ownership in advance. Write them in two parts: one for consumers, one for businesses. The Zakon o varstvu potrošnikov (ZVPot-1, the consumer protection act) protects only private individuals acting outside their trade; sole traders and companies buying from you fall under the Obligacijski zakonik (the code of obligations), where warranty can be limited by contract.

If you conclude contracts with consumers on the site, terms are mandatory and must include:

the right to withdraw within 14 days without giving a reason, with a withdrawal form,
the two-year conformity warranty on new goods (at least one year on used goods, but only by express agreement on the invoice),
the complaints procedure and response deadline,
a statement on out-of-court consumer dispute resolution (IRPS). The statement is mandatory even when you recognise no IRPS provider; in that case you say so.

What applies only to web shops?

A shop has extra obligations before the purchase. For every product the buyer must see the final price including VAT, delivery costs, payment methods and delivery time. After the order you send a confirmation with the terms and the withdrawal form. Technical goods also carry a manufacturer's guarantee of at least one year. Do not write these clauses from memory; have a lawyer check shop terms, since the review costs less than one mishandled complaint. See how we design online stores to show this information automatically.

What is not required, even though you see it everywhere?

A link to the European Online Dispute Resolution (ODR) platform. The platform was shut down on 20 July 2025. If your site still mentions it, remove the link; a reference to a platform that no longer exists shows nobody reads the terms.
A cookie banner on a site without tracking (see above).
A data protection officer (DPO) for a small business that does not process data at scale.
"Secure site" and "SSL protected" badges. An encrypted connection is the baseline and the browser shows it; the badge adds nothing.

How we handle this when building a site

Every site we hand over has a footer with the full company details, a privacy policy describing only the processing that actually happens, a cookie policy without a banner (until tracking is added) and terms split between consumers and businesses. We write the texts to the current state of the law and date them, and we record a lawyer's review as an open item at handover, because the final word is theirs. All of this is part of the standard handover, not a separate line in the quote.

If you are not sure whether your current site meets this minimum, send us its address. Checking the footer and legal pages takes a few minutes and you get the answer the same working day.