Working version — legal review in progress
Privacy policy
This sets out how Kolektro processes data today — with no clauses we cannot stand behind. Where something is not settled yet (retention periods, the complete sub-processor list), it says so instead of inventing an answer.
Last updated:
1. Who is controller and who is processor
Kolektro is provided by MCODE, obrt za računalno programiranje, vl. Matko Setnik, a sole proprietorship registered in Croatia. The accounting firm using Kolektro is the controller of its clients’ data; MCODE is the processor and processes that data only on the firm’s instructions. We sign a data processing agreement (DPA) with the firm on request, before any real client data is entered.
2. What data we collect
Firm user data needed to sign in (name and email address), the client data the firm enters itself (name, email address, mobile number), the contents of the documents clients send, and technical logs of reminders sent and upload links opened. We do not enrich client data from outside sources, do not sell it and do not use it for advertising. The public pages carry no tracking cookies and no third-party analytics.
3. Why we process it and on what basis
Firm user data is processed to perform the contract for the service. Technical send and access logs are processed for security and abuse prevention, which is our legitimate interest. The firm’s client data is processed solely on the firm’s instructions, in order to send a reminder and receive a document. Reminders currently go by email; the WhatsApp channel is not live yet and, when it is, will require the client’s consent.
4. Where the data lives and for how long
The application, database and document storage run on Google Cloud / Firebase infrastructure in the europe-west1 region (Belgium), so inside the European Union. Fixed retention periods are not settled yet: data and documents are kept while the account is active, and we delete them earlier at the firm’s request. The actual periods go into this section after legal review — we would rather leave them out than publish a number that does not bind us.
5. Sub-processors
The service uses Google (Firebase and Google Cloud — hosting, database and document storage, European Union) and Stripe (subscription billing). Email is sent through an SMTP provider, and the WhatsApp channel (Bird) is not live yet. The complete, current list of sub-processors with their processing locations and the basis for any transfer outside the EU is provided in writing on request, before a data processing agreement is signed.
6. Your rights
You have the right of access, rectification, erasure, restriction of processing, portability and objection. Send your request to the contact address at the bottom of this page. If you are a client of an accounting firm, address your request to that firm — it is the controller and we act on its instructions. You may also lodge a complaint with your competent supervisory authority; in Croatia that is the Personal Data Protection Agency (AZOP).
Contact
MCODE, obrt za računalno programiranje, vl. Matko Setnik
Questions about this document, and any data requests: hello@mcode.hr