Privacy Statement

Version 2026-09-21 · effective from 21. 9. 2026.

This statement describes how personal data are processed on the ais.eposlovanje.hr service (the Service), in accordance with the General Data Protection Regulation (EU) 2016/679 (the GDPR) and the Croatian Act on the Implementation of the GDPR.

1. Who processes the data

The controller is PONDI d.o.o., Ostravska 8, 21000 Split, Croatia, OIB (tax ID) 62781739468, MBS 060121488 (Commercial Court in Split). For any data protection question and to exercise your rights, contact us at podrska@eposlovanje.hr or by post at the address above.

2. Who this statement applies to

  • Users — business entities that have registered a user account, and persons using the Service on their behalf. For these data we are the controller.
  • Visitors of the Service's public pages.
  • Bank account holders whose accounts a User has connected to the Service (typically the User's clients). We process these data on behalf of and on the instructions of the User, as a processor; the controller is the User — the business that asked you to approve access to your account. Contact them for information about the processing and to exercise your rights; we will assist them in doing so. You can also withdraw access to your account at any time directly at your bank.

3. In short: what we store and what we do not

We do not store:

  • bank account balances and transactions — we pass them on to the User at the moment of retrieval and do not keep them;
  • the credentials the account holder uses to sign in to the bank — sign-in takes place directly at the bank and we never see it;
  • payment card numbers or other card data — card payments are made on the payment intermediary's pages;
  • passwords and API keys in readable form — we keep only their cryptographic hash.

We store only what is necessary for the operation, billing and security of the Service — see section 4 for details.

4. What data we process, why and for how long

Data Purpose Legal basis Retention
User account: email address, password hash, name, OIB and address of the business entity, notification settings; when signing in with Google, also the Google account identifier; time and version of the accepted Terms Opening and maintaining the user account, sign-in, communication about the Service Performance of a contract (Art. 6(1)(b) GDPR) For the duration of the contract, and thereafter until statutory retention periods and limitation periods for possible claims expire
Billing: top-ups and consumption of Credits, amounts, payment reference, payment transaction identifiers, issued invoices Charging for the Service, invoicing, bookkeeping Performance of a contract; legal obligation (Art. 6(1)(c)) — accounting and tax regulations At least 11 years, in accordance with accounting regulations
Payment intermediary notifications about completed payments (may contain the payer's email address and the last four digits of the card) Reliable booking of payments Performance of a contract; legitimate interest (Art. 6(1)(f)) — billing accuracy 90 days after processing
Security records: sign-up and sign-in attempts (email address, IP address, country derived from the IP address, browser identifier, outcome); API calls (key, time, method, path, status, IP address, country); IP address of the last use of an API key Protection against misuse and unauthorised access, troubleshooting, evidence of use Legitimate interest — security of the Service and its users 90 days
Record of sent email: recipient's email address, subject, delivery status Reliable delivery of Service notifications Legitimate interest — proof of delivery 90 days
Connected bank accounts (as a processor): IBAN, name of the account holder, currency, bank, technical account details as delivered by the bank, consent identifiers and status Establishing and maintaining the connection with the account, showing connected accounts to the User, billing On the instructions of the User as controller (Art. 28 GDPR) Until the User deletes the bank connection (requisition) — deleting the connection permanently removes these data. A connection that was only deactivated by the system (e.g. due to insufficient balance) keeps the data until the User deletes it.
Account balances and transactions Passing on to the User at its request On the instructions of the User as controller Not stored

The data for opening a user account and for billing must be provided because without them we cannot conclude or perform the contract. We do not use data for advertising, do not sell them and do not build user profiles.

5. Who we disclose data to

We provide data only to recipients necessary for the operation of the Service and only to the extent required:

  • the external bank data provider through which the connection with the bank is established — the selected bank, technical request identifiers and the return address; as our sub-processor it also processes the account data delivered by the bank;
  • banks at which the account holder gives consent;
  • the payment intermediary Stripe — the amount and reference of the top-up; you enter card data directly with Stripe, which processes them as an independent controller;
  • Google — only if you sign in with a Google account (we then receive the account identifier, email address and name from Google), and when the sign-up form is submitted, when Google reCAPTCHA is used to protect against automated sign-ups; the font used by the pages is loaded from Google's servers, which see the IP address and browser identifier in the process;
  • the Tax Administration and other competent authorities when required by law (e.g. fiscalisation of invoices);
  • legal and accounting advisers bound by confidentiality, where necessary.

We issue invoices and send email using our own systems. We do not use analytics or visitor tracking tools.

6. Transfers to third countries

We store data on servers we operate ourselves, located in a data centre in the European Union, and do not transfer them outside the European Economic Area. Some of the recipients in section 5 (Stripe, Google) may also process data in the United States or other third countries; such transfers are based on a European Commission adequacy decision (the EU–US Data Privacy Framework) or on standard contractual clauses.

7. Cookies

We use only cookies that are necessary for the operation of the Service, for which consent is not required under the law: to keep you signed in, to remember the selected interface language, and to protect forms and the sign-in flow against forged requests. We do not use analytics or advertising cookies.

Google reCAPTCHA is loaded when the sign-up form is submitted, and the payment intermediary's page opens for card payments; these services may set their own cookies, necessary for protection against misuse and for carrying out the payment.

8. How we protect data

PONDI d.o.o. holds a certified information security management system under HRN EN ISO/IEC 27001:2023 and a quality management system under HRN EN ISO 9001:2015. Conformity is regularly audited by an independent certification body. The measures we apply include:

  • all traffic uses an encrypted connection (HTTPS, with HSTS);
  • data on the servers are stored encrypted;
  • passwords and API keys are kept exclusively as cryptographic hashes; an API key is displayed only once;
  • API keys can be restricted to IP addresses, ranges or countries, and have an expiry date and can be revoked;
  • rate limiting, automatic blocking of suspicious IP addresses and account lockout after repeated failed sign-ins;
  • only authorised persons of the Provider, bound by confidentiality, have access to the data, to the extent needed for operation and support.

No system is completely secure. We will notify you and the supervisory authority of a personal data breach likely to endanger your rights, in accordance with the GDPR.

9. Your rights

Under the GDPR you have the right to:

  • obtain confirmation of whether we process your data, and access them;
  • request rectification of inaccurate data or completion of incomplete data;
  • request erasure of data where there is no longer a legal basis for keeping them;
  • request restriction of processing;
  • request portability of the data you have provided to us, in a structured, machine-readable format;
  • object to processing based on our legitimate interest.

Send your request to podrska@eposlovanje.hr. We will respond within one month; in complex cases this period may be extended by up to two further months, of which we will inform you. Before acting we may ask you to confirm your identity. Data we are required by law to retain (e.g. invoices) cannot be erased before the prescribed period expires.

If you believe the processing of your data infringes the law, you may lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, azop.hr.

10. Automated decision-making

We do not make decisions based solely on automated processing that produce legal effects for an individual. The security system may automatically and temporarily block an IP address from which suspicious traffic originates; if you think you have been blocked by mistake, contact us.

11. Changes to this statement

We may amend this statement when the way we process data or the law changes. The current version is always published on this page, and we notify registered users of material changes by email. Use of the Service is governed by the Terms of Use.