Privacy Policy

Passvero is operated by Živić-elektro j.d.o.o., 204. vukovarske brigade 39, 32000 Vukovar, Croatia, OIB 90344764519. The privacy contact is contact@passvero.eu. This is the controller’s contact, not a designation of an appointed data protection officer.

We act as controller for our own business relationship, accounts, support and service protection. When an organisation determines the purpose and content of personal data in products, contacts, images or documents, it will generally be the controller and we process data on its behalf. Roles, lawful instructions and responsibilities are governed by an appropriate processing agreement. An organisation acting as a processor must be authorised to engage further processing.

An access request contains a contact name, email, organisation name and language. We retain the decision and related notification records. Accounts involve identity, email verification, password hashes, activation and verification data, sessions, memberships and permissions. Passwords are not stored in readable form.

For offers and billing we process business names, addresses, country, supplied tax and VAT identifiers, billing email, offers, acceptances, periods and payment references. We do not process payment card numbers.

We process entered products, translations, manufacturer details, images, PDFs and versions, which may contain personal data. Data comes from you or authorised people in your organisation. Correspondence includes messages and attachments you send. Use of the service creates audit, security and delivery records and technical request/session data, such as time, IP address and browser information, depending on the infrastructure involved.

We use data to handle access, accounts and permissions, provide the service, manage and publish content, handle offers and billing, support users, protect security, maintain business traceability and recover data.

Where you personally are the contracting party, processing necessary to prepare and perform the contract is based on that contract. For business communication with organisation representatives and service protection, we rely on the legitimate interest in managing and protecting the business relationship, taking account of your rights. Legal obligations apply to records subject to them. For client content, we follow lawful instructions from the relevant controller. Where consent is the basis, you may withdraw it.

Required fields are needed for the requested process or function; without them, approval, login or service provision may not be possible. Activation, verification, password reset and other transactional messages are not a newsletter. Security checks may temporarily limit attempts or require an additional check; access is approved by an authorised person. We do not use data for advertising profiling.

Account, billing and internal records are not public DPP content. Private access depends on permissions. Uploading a file does not publish it. Authorised publication makes selected published-version data and permitted images/PDFs publicly available, including through a QR code. Others may download content; withdrawal on Passvero does not remove their earlier copies.

We use Hostinger for hosting and email, Supabase for files, Backblaze B2 for backups and Cloudflare Turnstile for additional protection when requested. Banks and accounting services process relevant business data. Telegram carries technical operator alerts, not customer documents. Data may also be disclosed where required by law. We do not sell personal data.

Confirmed primary storage is in Germany for the VPS and Hostinger email, Ireland for Supabase and the Netherlands for B2; accounting software is used locally in Croatia. This does not mean all support access and processing are limited to the EEA. You may request details of recipients and applicable international transfers at contact@passvero.eu.

Supabase is used here for Storage files, not the application database or authentication. The public contracts of Hostinger, Supabase and Backblaze provide standard contractual clauses for relevant transfers outside the EEA; a storage location alone does not establish that no transfers occur. Information about specific recipients, applicable safeguards and how to obtain a copy is available at contact@passvero.eu. Telegram has a separate controller role for its own service; we do not describe it as a contracted processor for client content.

We use MER, Elektronički računi d.o.o., to deliver e-invoices to customers in Croatia, sharing the invoice and recipient data needed for that service. Customers outside Croatia receive a PDF invoice at the email address in their billing details, through the existing Hostinger email service.

The private product-data retention policy provides for 12 months after a paid package expires and 3 months after a trial ends. Public DPP availability follows separate subscription and regulatory rules. The periods below are a schedule for review, minimisation and removal of unnecessary personal data, not a promise of automatic deletion.

Undecided access requests are reviewed 90 days after receipt. Unnecessary rejected-request data are scheduled for removal 6 calendar months after the decision; redundant approved-request data 6 months after completed activation. Unactivated requests are reviewed within 30 days after activation expiry. Necessary evidence of the decision is handled separately.

Accounts and memberships are retained during the active relationship and authorised access. After closure is completed, the target is to remove unnecessary profile and credential data within 30 days. Other active memberships and necessary business records are assessed separately. For unnecessary session and token data, the target is 30 days after expiry, revocation or consumption, measured from the later applicable closing event. The current billing profile is minimised within 30 days after the business relationship has fully ended if no longer needed.

Operational audit records have a review and minimisation period of 12 calendar months from the event; delivery records 90 days from the final outcome after the last attempt; technical logs 30 days from entry; abuse-prevention records 30 days from the last attempt. Technical Telegram alerts to the operator have a 90-day target from the message. An unresolved delivery outcome does not trigger automatic resending.

Accounting documents covered by the Croatian Accounting Act are retained for at least 11 years from the relevant financial year-end. Fiscalised e-invoices have a special 6-year period from the issue year-end. Classification matters: not every PDF invoice qualifies. Offers, acceptances, payment references and correspondence are classified by evidential purpose, accounting duties and applicable claim periods, with no single period for all messages.

Unaccepted or expired offers with no other retention basis have a 6-calendar-month period from expiry or explicit rejection. Routine support and correspondence have a 12-calendar-month period from case closure; necessary financial and contractual evidence is separated into the appropriate category.

Separately retained necessary evidence of a security incident is kept for up to 6 calendar months from resolution. Minimal evidence of the response to a personal-data rights request has a 3-year period from case closure: the necessary scope of the request, decision, dates and proof of sending, without the full data export or a routine copy of an identity document. These are business-policy periods, not general statutory minimums; the end of the purpose or exercise of rights may require earlier removal.

A specific dispute, incident or legal duty may justify separate, longer retention of necessary evidence. Its reason, scope and continuing need are reviewed, normally every 30 days. Backups follow a separate schedule: deletion from the active system does not immediately erase every older copy. For category-specific information or requests, contact contact@passvero.eu.

Subject to GDPR conditions, you may request access, rectification, erasure, restriction and portability and object, particularly to processing based on legitimate interests. Where consent is the basis, you may withdraw it without affecting the lawfulness of earlier processing.

Email contact@passvero.eu with enough information to locate the relevant account or processing; do not send your password. Identity checks are proportionate to the request. We respond without undue delay, normally within one month. Where legal conditions are met, this can be extended by two further months, with notice and reasons within the first month. For client content, we involve the relevant controller.

Others’ rights and legal obligations may limit a request. You may complain to AZOP (azop.hr) or another competent supervisory authority. CSV is not a complete export of every version and file; the scope of a personal data request is assessed separately.

We apply access controls, organisation permissions, password hashing, protected sessions and file checks. These measures reduce risk but cannot guarantee an absence of incidents.

When Turnstile is activated, Cloudflare processes signals such as IP address, browser and connection information to prevent automated abuse. Under its policy, it acts as processor to provide protection and as a separate controller to improve detection. Details are in the Cloudflare Turnstile Privacy Addendum. Our Cookie Policy explains session technologies. For security and privacy enquiries, contact contact@passvero.eu.