Effective from 23 September 2026. This English version is provided for convenience; in the event of any discrepancy, the Croatian version prevails.
1. Data controller
The controller of personal data is Digital Marketing j.d.o.o. za usluge, Otona Kučere 72, 44250 Petrinja, Croatia, OIB 27989586968, MBS 081122097, registered with the Commercial Court in Zagreb. For any data protection questions and to exercise your rights, write to [email protected].
This policy applies to the website digitalko.net and the portal portal.digitalko.net.
2. What data we process
Website visitors
- Self-assessment: the website address you enter, the scan result (publicly available data from that site) and a shortened cryptographic hash of your IP address to prevent abuse — we do not store the IP address itself. If you then sign up, the result is linked to your account.
- Technical data: IP address, browser type and time of access, recorded by servers to run and protect the website.
Portal users
- Account data: full name, email address and password (stored only in encrypted form). If you sign in with a Google or Facebook account, we receive your name and email address from that provider.
- Company data: name, OIB or VAT number, address and other details needed for invoicing. VAT identification numbers of EU companies are verified in the European Commission's VIES system.
- Content: data and materials you enter and content you generate (texts, images, videos, websites).
- Usage data: assessment results, credit usage, action history and technical login records.
- Payment data: amount, time and status of the transaction. Card details are processed exclusively by Stripe; we neither see nor store them.
- Connected profiles: if you connect social media profiles, access tokens and basic data about the pages you connect.
- CRM: contacts and companies you enter or import (name, email, phone, company, notes, deals, tasks, communication history). See section 3.
- Enquiries and sign-ups: data that visitors to your pages submit through a web form or Bait (name, email, phone, message). See section 3.
- Lead: publicly available business data of companies (name, website, business email and phone from their website or a public register) and the source of each item. Lead does not search for private individuals. See section 3.
- Agencies: the agency profile (name, description, references, country), enquiries and messages between the client and the agency, and reviews, which are visible to other users in the agency directory.
- Team: the email address of a person you invite to your organisation.
- Partner programme: the partner code, anonymised conversion data and the details needed to pay out commission.
Enquiries
When you write to us, we process your email address and the content of your message.
3. Data we process on behalf of users
When a user manages contacts in Digitalko (CRM), receives enquiries through a web form or Bait, or saves companies found by Lead, the user is the controller of that data, and Digital Marketing j.d.o.o. processes it solely on the user's instructions, as a processor (Art. 28 GDPR).
If you left your details on the website of a company that uses Digitalko, contact that company for access, rectification or erasure; we will help them do so.
Lead finds only publicly available business contacts of companies, from their websites or public registers, together with the source of each item, and does not search for private individuals. If your business contact is among them (e.g. an email address containing your name), you can object or request erasure at any time at [email protected].
4. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing the Service and managing the account | Performance of a contract, Art. 6(1)(b) |
| Billing, invoicing and fiscalisation | Performance of a contract and legal obligation, Art. 6(1)(b) and (c) |
| Website scanning in the self-assessment and abuse prevention | Legitimate interest, Art. 6(1)(f) |
| Importing the self-assessment result into your account | Your request prior to entering into a contract, Art. 6(1)(b) |
| Security and abuse prevention | Legitimate interest, Art. 6(1)(f) |
| CRM, web forms and Bait (on behalf of the user) | Processing on the instructions of the user as controller, Art. 28 |
| Lead: finding publicly available business contacts | Legitimate interest of the user, Art. 6(1)(f) |
| Agencies: enquiries, messages and reviews | Performance of a contract, Art. 6(1)(b) |
| Verifying the VAT identification number in VIES | Legal obligation, Art. 6(1)(c) |
| Partner programme and commission payouts | Performance of a contract, Art. 6(1)(b) |
| Service notices (e.g. changes to the terms) | Performance of a contract, Art. 6(1)(b) |
| Marketing messages | Consent, Art. 6(1)(a); you can withdraw it at any time |
We do not make decisions based solely on automated processing that would have legal or similarly significant effects on you. The self-assessment score is for information only.
5. Processors and recipients
We do not sell data. We share it with service providers that process it on our behalf, under data processing agreements, and only to the extent needed for their task. Some recipients (Google or Facebook sign-in, connected social networks, VIES) receive data only when you choose that option or where required by law:
| Provider | Task |
|---|---|
| Supabase | Database, user login and portal file storage |
| Vercel | Hosting of the portal application |
| A2 Hosting | Hosting of the digitalko.net website |
| Cloudflare | DNS, attack protection and email forwarding |
| Resend | Sending email from the portal (servers in the EU) |
| Stripe Payments Europe Ltd. | Payment processing (Ireland) |
| FIRA | Issuing and fiscalising invoices (Croatia) |
| Anthropic | AI model for texts, websites and the Digitalko Assistant, and web search for Lead |
| Leonardo.ai | AI model for images and video |
| Luma AI | AI model for video |
| Google Fonts | Loading fonts on the digitalko.net website and on websites built in Digitalko (receives your IP address) |
| Sign-in with a Google account, only if you choose it | |
| Meta | Sign-in with a Facebook account, and publishing and statistics on Facebook and Instagram, only if you choose it or connect your profiles |
| TikTok, LinkedIn | Publishing and statistics, only if you connect your profiles |
| European Commission (VIES) | Verifying a company's VAT identification number |
We send AI model providers only the content needed for the action you start (e.g. a post description or image instructions). We may also disclose data to competent authorities where required by law.
6. Transfers outside the EU
Some of the providers listed have their registered office or servers outside the European Economic Area, most often in the USA. In these cases, the transfer is based on a European Commission adequacy decision (the EU–US Data Privacy Framework, for certified providers) or on the European Commission's standard contractual clauses.
7. How long we keep data
| Data | Retention period |
|---|---|
| Account data and content | While the account is active. After account deletion, the data is permanently deleted and disappears from backups within 30 days. |
| CRM, enquiries, Bait sign-ups and companies from Lead | Until the user deletes them or while the account is active. After account deletion, the same as other data (they disappear from backups within 30 days). |
| Messages and reviews in Agencies | While the account is active. |
| Invoices and payment data | 11 years, as required by the Croatian Accounting Act. |
| Self-assessment without sign-up | 30 days, then deleted automatically. |
| Self-assessment imported into an account | While the account is active. |
| Email enquiries | Until the enquiry is resolved and up to 2 years afterwards. |
| Technical server logs | Up to 90 days. |
8. Your rights
At any time, you can request access to your data, its rectification or erasure, restriction of processing and data portability, and object to processing based on legitimate interest. You can withdraw your consent without affecting the lawfulness of earlier processing.
Send your request to [email protected]. We respond without delay and within one month at the latest. If you believe the processing breaches the rules, you can lodge a complaint with the Croatian Personal Data Protection Agency (azop.hr).
9. Cookies
The digitalko.net website does not use tracking or advertising cookies and does not use web analytics tools. The portal uses the following cookies:
| Cookie | Purpose | Type |
|---|---|---|
| Supabase session | Keeps you logged in | Essential |
dm_active_workspace | Remembers the active workspace | Essential |
dk_locale | Remembers the selected language | Functional |
dk_crm_rail | Remembers whether the CRM sidebar is expanded | Functional |
dk_ref | Remembers the partner code from a referral link so the referral can be credited to the partner | Partner programme |
None of these cookies is used for advertising or to track your behaviour on other websites.
10. Security
All communication runs over an encrypted connection (HTTPS). Passwords are stored only in encrypted form, and access to data in the database is restricted by rules per user and workspace, so each user sees only the data they are allowed to access.
11. Changes to this policy
We may update this policy when our services or regulations change. The date of the last change is shown at the top of the page, and we notify portal users of material changes by email.