Privacy & Cookies Policy

The data controller is PAUMAS, obrt za digitalna rješenja, vl. Thomas Divjak, OIB: 65558723959, Flengi 17a, 52450 Vrsar. For any data-protection questions contact: info@adriaerp.com.

• Account data: name, email address and password (stored encrypted).
• Company and business data you enter: company, client, product, invoice, employee and document data.
• Terms-acceptance data: date and time of acceptance, user identifier and the version accepted.
• Technical data: IP address, browser and device type, and access/error logs.
• Billing data: processed via our payment provider (Stripe); we do not store your card details.

• Providing the Service and performing the contract (Art. 6(1)(b) GDPR).
• Complying with legal obligations, including fiscalization and invoice issuance (Art. 6(1)(c)).
• Legitimate interest in system security, abuse prevention and evidencing the contract (Art. 6(1)(f)).
• Consent, where applicable (e.g. non-essential cookies or marketing) — Art. 6(1)(a).

We apply reasonable organizational and technical measures to protect the confidentiality, integrity and availability of data, including encryption in transit and at rest and restricting access to authorized persons only. We will never ask for your password by email.

To provide the Service we use carefully selected processors who are contractually bound to protect data:

• Clerk — authentication and user-account management;
• Convex — database and server infrastructure;
• Stripe — subscription and payment processing;
• Resend — sending transactional email;
• Upstash — rate limiting and caching;
• Sentry — error and performance monitoring;
• Vercel — application hosting.

We do not sell data to third parties. Any transfers outside the EU are carried out with appropriate safeguards under the GDPR.

The Application uses essential cookies for operation and security and, with consent, non-essential cookies. Essential cookies include:

• __session, __client_uat (Clerk) — sign-in and session maintenance;
• __stripe_mid, __stripe_sid (Stripe) — payment security and fraud prevention;
• error-monitoring cookies (Sentry) — technical stability.

You can change cookie settings in your browser at any time. Disabling essential cookies may prevent the Application from working.

We keep personal data for as long as necessary for the processing purpose, i.e. for the duration of the contractual relationship. Data forming part of accounting and tax records is kept for the statutory periods. Terms-acceptance records are kept for up to five years after the relationship ends. After a deletion request, data is permanently deleted within 30 days, except for data we are legally required to retain.

Under the GDPR you have the right to:

• access your data and rectify inaccurate data;
• erase data and restrict processing;
• data portability;
• object to processing based on legitimate interest;
• withdraw consent at any time;
• lodge a complaint with the supervisory authority — the Croatian Personal Data Protection Agency (AZOP).

Submit requests to info@adriaerp.com; we respond within the periods prescribed by the GDPR.

PAUMAS, obrt za digitalna rješenja, vl. Thomas Divjak — OIB: 65558723959, MBO: 98820516, Flengi 17a, 52450 Vrsar — email: info@adriaerp.com.