Privacy

Controller

The controller for the provjera.hr website is VIRTO, obrt za informatičke i digitalne usluge, vl. Tomislav Vorih, Podgora Krapinska 94, Krapina, Croatia. The contact for privacy, enquiries and corrections is info@provjera.hr. More about the operator is on the Impressum page (in Croatian).

Data we process

• technical data about the visit: IP address, browser, page address and time;
• what you type into the search box or a form;
• messages and suggestions you send us, including suggested contacts for a profile;
• data about people listed in public registers, for example management board members, founders, representatives or liquidators.

People in public registers

We show names and roles only as the source register publishes them and only with the company or association they relate to. The entry itself is changed by the body that keeps the register.

Contacts on profiles

Phone numbers, e-mail addresses and websites come from Sudski registar, from the company's or association's own website, from public lists or from the owner who sent them through the form on the profile. We check suggestions before publishing them.

If a published number or e-mail address is your personal contact, write to us through the contact form or at info@provjera.hr and give the profile address and the item to remove. We remove it without delay, and within one month at the latest.

API key

When you request or buy an API key, we keep the e-mail address, the plan, the start and fingerprint of the key and the monthly number of lookups and searches, and for 90 days the IP address the key is called from. We send the key to that address and at most two service messages: 7 days (monthly plan) or 14 days (longer plan) before the paid plan ends, and 30 days before we delete or revoke the key for lack of use. We do not send advertising or newsletters.

Company alerts

When you ask for alerts about a company, we keep the e-mail address, the companies you follow and the time of sign-up, confirmation and unsubscribe. We send alerts only after you confirm the sign-up with the link in the e-mail, and every alert has an unsubscribe link.

The list of companies you follow is used only for those alerts. We do not publish it, sell it or give it to third parties, and we send no advertising or newsletters to that address. The data is on a Netcup server, Resend sends the e-mail, and Cloudflare only carries the form to the server. The form gives the same answer whether or not the address already follows the company.

Legal bases

• legitimate interest: operation and security of the website and display of public register data;
• consent: analytics cookies and alerts about companies you follow;
• contract: when you buy access to data, request an API key or another service;
• legal obligation: when a regulation or a competent authority requires it.

Analytics and cookies

We use Google Analytics for visit statistics. Until you give consent, no analytics cookies are set and Google receives only a basic page view, without what you typed into the search box. You give or withdraw consent through Google's consent message. More on the Cookies page (in Croatian).

How Google uses data is explained on the page How Google uses information from sites or apps that use our services.

Recipients

Data is processed for us by Netcup (server), Cloudflare (page delivery and abuse protection), Google (analytics and consent message), Resend (sending e-mail) and, when you buy something, Stripe (payment) and Parra (issuing and fiscalising receipts; it receives the e-mail address, the items bought and, if entered, the buyer's name, tax ID or VAT number and address). We do not see or keep payment card data. We give data to competent authorities only when a regulation requires it.

Cloudflare, Google, Resend and Stripe may also process data outside the European Economic Area. Such transfers rely on GDPR safeguards: a European Commission adequacy decision (EU-U.S. Data Privacy Framework) or standard contractual clauses.

Retention

We keep technical logs for a limited time, as long as the security of the website requires. We delete form messages and the sender's e-mail address 24 months after the enquiry is closed. We delete a free API key and its usage data 12 months after last use, and revoke a purchased key 12 months after the plan ends or after last use. We keep the IP address an API key is called from for 90 days to prevent abuse. We delete the usage record of a budget payments code (pages opened, number of views and refused views, no IP address) 12 months after the code expires. We delete a company alert sign-up 30 days after unsubscribe, and an unconfirmed sign-up 30 days after the link was sent; until then we keep it to prevent abuse of the form. We keep purchase data as long as accounting regulations require. We show public register data while it is relevant or until the source changes it.

Your rights

You can ask for access to your data, rectification, erasure, restriction of processing and portability, object to processing based on legitimate interest and withdraw consent. Write to info@provjera.hr and give enough detail for us to find the record.

Complaint to the supervisory authority

If you believe personal data is processed against the regulations, you can contact the Croatian Personal Data Protection Agency (Agencija za zaštitu osobnih podataka, AZOP), Selska cesta 136, 10000 Zagreb, azop.hr.