Privacy Policy

Version 2026-11-13, effective from 13 Nov 2026. The Croatian version is legally binding; this translation is provided for convenience.

This policy explains how [NAZIV TVRTKE], OIB [OIB], [ADRESA] ("we") processes personal data of users of the PencilCRM service, people who contact us through the expression-of-interest form on our website, and visitors of our websites.

Data our customers enter into the service (e.g. enquiries and contacts of their own clients) is not covered by this policy. The customer who entered it is the controller of that data, and we process it only on that customer's instructions under the Data Processing Agreement. That customer informs you about the processing.

1. Data we process

• Account data: name, business email, phone (if entered), organisation name, role, chosen language, password (stored only as a cryptographic hash).
• Subscription data: chosen plan, subscription status and identifiers at the payment provider. Card details are processed only by Paddle; we never see them.
• Technical data: IP address, login times, browser details and error logs needed for security and operation.
• Communication: the content of messages you send us for support.
• Expressions of interest: if you fill in the form on our website, we process your name, email address, company name and team size (if entered), your message, IP address and time of submission. This also covers people who are not (yet) customers of the service.

2. Purposes and legal bases

• Providing the service, managing accounts and support: performance of a contract (Art. 6(1)(b) GDPR).
• Billing and bookkeeping: legal obligation (Art. 6(1)(c)).
• Security, abuse prevention and fixing errors: legitimate interest (Art. 6(1)(f)).
• Notices about changes to the service and terms: performance of a contract.
• Replying to your expression of interest and informing you when the service launches: steps taken at your request before entering into a contract (Art. 6(1)(b)). The IP address and time of submission are kept to protect the form from abuse (legitimate interest, point (f)). We do not use form data for other marketing messages without your consent.

We do not use your data for advertising and we do not sell it.

3. Recipients

We share data only with service providers that help us run the service and are contractually bound to protect it:

We may also disclose data to authorities where the law requires it.

4. Transfers outside the EU/EEA

The service runs on servers in the European Union. Where a provider listed above processes data outside the EU/EEA, the transfer is based on an adequacy decision or the European Commission's standard contractual clauses.

5. Retention

• Account data for the duration of the contract and up to 30 days after it ends (for export), then deleted.
• Data needed for accounting for as long as the law requires (usually 11 years).
• Expression-of-interest data for up to 12 months after the last contact, unless you become a customer in the meantime or ask us to delete it earlier.
• Technical logs for up to 90 days, backups for up to 14 days.

6. Your rights

You have the right to access, rectify, erase and restrict processing of your data, the right to data portability and the right to object to processing based on legitimate interest. Send requests to vas@email.com. We reply within one month.

If you believe the processing is unlawful, you may lodge a complaint with the Croatian Personal Data Protection Agency (azop.hr) or the supervisory authority in your country.

7. Cookies

We only use cookies necessary for the service: the session cookie (login), CSRF protection and your chosen language. We do not use analytics or advertising cookies, so we do not ask for consent.

8. Security

Traffic is encrypted (HTTPS), passwords and integration credentials are stored encrypted, each customer's data is separated from others, and backups are encrypted.

9. Changes

We will inform you of material changes to this policy by email or in the service.

10. Contact

[NAZIV TVRTKE], [ADRESA], vas@email.com