Privacy Policy

1. Data Controller

We act as the data controller for your personal data - meaning we determine how and why it is processed. Our details are:

As a controller established in the European Union, Ordo is subject to the General Data Protection Regulation (EU) 2016/679 (GDPR), the Croatian Act on Implementation of the General Data Protection Regulation, and all applicable EU data protection law.

Where you are the controller and we are the processor

The paragraph above covers your data - your account, your billing, your use of Ordo. Your clients' data is a different relationship. When you record a client, write an invoice or send a reminder, you decide whose data goes in and why. For that data you are the controller and Ordo is your processor within the meaning of Article 28 GDPR.

In that role we undertake that we:

• process client data only on your documented instructions - what you enter, and what you ask us to send;
• never use it for our own purposes, never sell it, and never use it to train AI models;
• engage only the sub-processors listed in section 5, under equivalent obligations;
• keep it confidential and secured as described in section 9;
• help you answer a request from one of your clients exercising their own rights;
• return or delete it when you close your account, subject to the statutory retention periods in section 7.

What we cannot do for you: you remain responsible for having a lawful basis to hold your clients' data, for telling them you do, and for the accuracy of what you enter. Ordo gives you the tools; the relationship with your client is yours.

These terms serve as our processing agreement under Article 28(3). If your own compliance requires a separately signed DPA, write to us and we will provide one.

2. Data We Collect

Account & Profile Data

• Name, email address, and password (hashed)
• If you sign in with Google: the name, email address and profile picture Google shares with us. Google acts as its own controller for that sign-in.
• A profile picture, if you upload one; your team members see it
• Company name, VAT number, and registered address
• Your national tax or registration number (for Croatian users, the OIB). Collected separately from the VAT number because a business outside the VAT system has one and not the other, and fiscalization is filed under it.
• Legal form (sole trader or company) and, optionally, last year's turnover. Used for one purpose only: working out whether a national e-invoicing mandate applies to you yet. Never used to calculate tax, never shared.
• Details printed on your invoices: bank account (IBAN), logo, invoice language and payment terms
• Profile preferences and settings, including the interface language
• If you turn on two-factor authentication: a record that an authenticator app is set up for your account. The secret that generates your codes is held by our authentication provider, Supabase, not in the Ordo database.
• Which version of these Terms and this Privacy Policy you accepted when you created your account, and when

Business & Invoice Data

• Client information you enter - names, addresses, VAT numbers, national tax numbers (OIB), emails and contact details. A client may be a company or a private individual; where you record an individual, that record is personal data about them and you are its controller - see section 1.
• Invoice data (amounts, dates, line items, payment status, date of supply)
• Delivery details where you add them - the name and address of a recipient other than the client
• Private notes you attach to an invoice. These are stored for you alone: they are never printed on the invoice, never included in the e-invoice, and never sent to your client.
• Saved item templates (descriptions, prices, units, classification codes)
• Documents and PDFs generated through the service
• Incoming eRačuni your suppliers send you, where you use Croatian eRačun - including the supplier's details as they appear on the invoice

Certificates and Signing Credentials

• Where you set them up: your fiscalization certificate, the certificate you seal PDF invoices with, or the credentials for a remote signing service, and the address of a timestamping service. A certificate normally names you or your business. Private keys, passwords and PINs are stored encrypted (AES-256-GCM), are never shown back to you or to anyone else, and are used only to sign your own documents.

Payment Data

• Billing email, billing interval and number of seats
• Stripe customer and subscription identifiers, so a payment can be matched to your account
• Payment method details are processed directly by Stripe, Inc. - Ordo does not store full card numbers

Usage & Technical Data

• IP address, browser type, and operating system
• Pages visited, features used, and session duration
• Error logs and diagnostic data
• A history of changes in your workspace - who created, edited or deleted an invoice, client or setting, and when - shown to the account owner in the app
• Short-lived counters that limit how often a request can be repeated. For the pages your clients open (the online invoice and quote) and the contact form, the counter is keyed on the visitor's IP address.

Cookie Consent Records

• When you answer the cookie banner on ordo-eu.com, we record your choice with the date, your IP address and your browser's user agent, as proof of consent (Art. 7(1)).

Communications

• Emails you send to our support address
• Feedback and responses to surveys

3. How We Use Your Data

4. Legal Basis for Processing

We rely on the following legal bases under GDPR Article 6:

• Contract (Art. 6(1)(b)): Processing necessary to provide the service you signed up for.
• Legitimate Interest (Art. 6(1)(f)): Service improvement, security, fraud prevention. We always balance our interests against your rights.
• Legal Obligation (Art. 6(1)(c)): Where required by EU or Croatian law (e.g. tax record-keeping).
• Consent (Art. 6(1)(a)): Analytics and other non-essential cookies. You may withdraw consent at any time. We do not send marketing emails or newsletters; if that ever changes, we will ask first.

5. Sub-processors & Recipients

We do not sell your personal data. Two kinds of organisation receive some of it. Sub-processors handle data on our behalf, under contract, to run the service. Recipients are public bodies and services that receive data because you asked us to send it to them, and that process it under their own rules as independent controllers.

Sub-processors

Recipients

We may disclose data to public authorities or law enforcement where legally required.

6. International Data Transfers

Some of our sub-processors are based outside the European Economic Area (EEA), primarily in the United States. All transfers are protected by one or more of the following mechanisms:

• Standard Contractual Clauses (SCCs) approved by the European Commission
• EU-US Data Privacy Framework certification
• Adequacy decisions where applicable

You can request a copy of the relevant transfer mechanisms by contacting us at privacy@ordo-eu.com.

7. Data Retention

8. Your Rights Under GDPR

As a data subject under GDPR, you have the following rights. To exercise any of them, contact us at privacy@ordo-eu.com. We will respond within one month, which the GDPR lets us extend by two further months for complex requests - we will tell you if we need to.

You also have the right to lodge a complaint with the Croatian supervisory authority:

9. Security

We implement appropriate technical and organisational measures to protect your data, including:

• Encryption in transit (TLS 1.2+) and at rest (AES-256 via Supabase)
• Password hashing using bcrypt
• Optional two-factor authentication with an authenticator app, enforced by the application and by the database
• Rate limits, daily sending limits and a bot check on sign-in forms against automated abuse
• Certificates, private keys and signing credentials encrypted separately (AES-256-GCM), readable only by our servers
• Role-based access control - staff can only access data necessary for their role
• Regular security reviews and dependency updates

In the event of a personal data breach that poses a risk to your rights, we will notify the AZOP within 72 hours and you directly without undue delay, as required by GDPR Article 33-34.

10. Children

Ordo is a business tool for users aged 18+. We do not knowingly process the data of anyone under 16 (the GDPR digital-consent age in Croatia). If you believe a minor has provided us with personal data, please contact us immediately at privacy@ordo-eu.com.

11. Changes to This Policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you by email (to the address associated with your account) and update the “Last updated” date at the top of this page at least 14 days before changes take effect. Continued use of Ordo after that date constitutes acceptance of the updated policy.

12. Contact

For any questions, requests to exercise your rights, or concerns about this Privacy Policy: