Last updated: 15 October 2026 · Applies to all users of ordo-eu.com
The General Data Protection Regulation (EU) 2016/679 (GDPR) gives you significant rights over your personal data. This page explains exactly what those rights are, how to exercise them, and what to expect when you do.
Ordo is committed to upholding your GDPR rights. We will respond to all valid requests within one month, free of charge, as required by GDPR Article 12.
For full details of how and why we process your data, see our Privacy Policy.
Obtain a copy of all personal data we hold about you, together with information on how it is processed.
Correct any inaccurate or incomplete personal data. Most data can be corrected directly in your account settings.
Request deletion of your personal data. Deleting your account removes everything at once and permanently, so download the invoices you are legally required to keep first.
Ask us to pause processing of your data while a dispute is resolved or an objection is being considered.
Receive your data in a structured, commonly used, machine-readable format: JSON from Settings → Account, CSV from the reports, or by email on request.
Object to processing based on legitimate interests or direct marketing. For direct marketing, we will stop immediately upon your objection.
The right not to be subject to solely automated decisions with significant effects. Ordo does not make such decisions - AI features only draft suggestions for your review.
Where processing is based on your consent (analytics), withdraw it at any time through Cookie Settings in the footer, or contact us directly.
If you are someone's client, not an Ordo user. You may have reached this page because a business that invoices you uses Ordo. In that case the business is the controller of your data and we are only its processor - so the rights below are exercised against them, not against us. Write to whoever invoiced you. If you cannot reach them, contact us and we will pass the request on; we cannot act on their data ourselves, but we will not leave you without a route.
To exercise any of the above rights, send us an email with the subject line “Data Subject Request”:
Email: privacy@ordo-eu.com
Subject: Data Subject Request
Include: Your full name, email address associated with your Ordo account, and the specific right(s) you wish to exercise.
We may need to verify your identity before processing the request to protect against unauthorised access to your data. We will ask for the minimum information necessary to confirm your identity.
You can do these yourself in the app:
If your trial has ended and you have not subscribed, the screen asking you to choose a plan still offers both downloads and account deletion. Subscribing is never a condition for taking or erasing your data.
| Step | Timeline | What happens |
|---|---|---|
| 1. Acknowledgement | Within 3 business days | We confirm receipt and, if needed, ask for identity verification. |
| 2. Verification | Up to 5 business days | We verify you are the account holder (e.g. confirmation from your registered email). |
| 3. Response | Within one month of the request | We fulfil the request or explain why it cannot be fulfilled (e.g. legal retention obligation). |
| 4. Extension | Up to two further months | For complex or numerous requests we may extend by two further months (Art. 12(3)); we tell you within the first month, and why. |
All responses are provided free of charge. For manifestly unfounded or excessive requests, we may charge a reasonable fee or refuse to act, and will explain why in writing.
Some personal data is processed outside the EEA by our sub-processors (Stripe, Resend, Anthropic, PostHog, ImprovMX, Cloudflare), or by US companies whose EU-hosted services we use (Supabase, Vercel). All transfers are protected by Standard Contractual Clauses (SCCs) or the EU-US Data Privacy Framework. You can request a copy of these safeguards by emailing privacy@ordo-eu.com.
Full details of our sub-processors and the safeguards in place are available in our Privacy Policy, Section 5.
Ordo is a small business and is not required to appoint a Data Protection Officer (DPO) under GDPR Article 37. All privacy matters are handled directly by the data controller:
KriPa Web, obrt za računalno programiranje, vl. Kristijan Pavlic Tumpa (trading as Ordo)
Owner: Kristijan Pavlic Tumpa
OIB: 27744574396 · MBO: 99336766
Email: privacy@ordo-eu.com
Role: Data Controller
Vankina ulica 8, 10000 Zagreb, Croatia, EU
Ordo - Data Subject Requests
Email: privacy@ordo-eu.com
Subject line: “Data Subject Request”
Response time: within one month (GDPR Art. 12)