1. Who is the controller
The controller of the personal data described in this Policy is the Vomi Group company with which your employer, or the business entity you represent, has concluded the Accounting Services Agreement (the “Contracting Company”):
- VOMI d.o.o., Županijska ulica 42, 31000 Osijek, Croatia, OIB 36946449172, or
- VOMI CONSULTING d.o.o., Zrinjevac 4, 31000 Osijek, Croatia, OIB 54258390599.
The Vomi Board application was developed and is technically operated by Vomi d.o.o. The identity of the Contracting Company is shown in the Application and on invoices.
Data protection contact: vomi@vomi.hr, subject “Personal data protection”. Data Protection Officer: Mladen Ardalić, vomi@vomi.hr.
2. Who this Policy applies to
This Policy applies to Authorised Persons — individuals to whom a Vomi client has granted access to the Application (directors, HR managers, administrative staff, signatories) — and to Vomi Group staff who use the Application in their work.
Data of our clients' employees. Vomi processes the personal data of employees that a client enters into the Application (for social-insurance registrations, working-time records and payroll) as a processor on behalf of that client. For this data the client, as employer, is the controller and must inform its employees. The terms of that processing are set out in Annex 1 to the Terms of Use. Employees exercise their rights with their employer, whom Vomi assists.
3. What data we collect
| Category | Data | Source |
|---|---|---|
| Account data | name, business e-mail address, phone number, business entity, role and access level | the client opening the account, or you |
| Login data | username, password (stored only as a hash), multi-factor authentication data | you |
| Usage records | login and logout times, actions performed, IP address, browser and device type | automatically, by the Application |
| Electronic signature | signer identity, time of signing, IP address, device identifier, document checksum (hash) | automatically, when signing |
| Communication | messages, comments and requests sent through the Application or support | you |
| Notifications | device token for push notifications, notification settings | your device, with permission |
We do not collect data for marketing, we do not build profiles and we do not use analytics or advertising cookies.
4. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Opening and managing user accounts, assigning permissions, logging in | performance of a contract — Art. 6(1)(b); legitimate interest of the client and Vomi in organising the business relationship — Art. 6(1)(f) |
| Providing Application features (requests, records, payroll, documents, notifications) | performance of a contract — Art. 6(1)(b) |
| System security, abuse prevention, access logs (audit trail) | legitimate interest — Art. 6(1)(f); security of processing — Art. 32 |
| Evidence of electronic signing and acceptance of the Terms | legitimate interest — Art. 6(1)(f); legal obligation — Art. 6(1)(c) |
| Compliance with legal obligations (accounting rules, anti-money laundering, archiving) | legal obligation — Art. 6(1)(c) |
| User support and communication about the Application | performance of a contract — Art. 6(1)(b); legitimate interest — Art. 6(1)(f) |
| Push notifications on your device | consent given in device settings — Art. 6(1)(a); can be withdrawn at any time |
Where processing is based on legitimate interest, we have assessed that it does not override your interests and rights. You may request more information about that assessment at the contact address.
5. Recipients
We share data only to the extent necessary with:
- sub-processors providing technical services to us (hosting, e-mail, notifications, error monitoring) — listed in the List of sub-processors;
- public authorities (e.g. Tax Administration, HZMO, HZZO, FINA) where required by law or necessary for the contracted service;
- advisers bound by confidentiality (auditors, lawyers) where needed to protect our rights;
- within the Vomi Group only to the extent described in Art. 11.1.a of the Terms of Use.
We do not sell or rent data and do not use it to train artificial intelligence models.
6. Transfers outside the EEA
We store and process data within the European Economic Area. The sub-processor delivering push notifications may process limited technical data (device identifier) in the United States. Such transfers take place only under a valid mechanism under Chapter V GDPR — an adequacy decision (EU-US Data Privacy Framework) or the European Commission's standard contractual clauses. You may request a copy of the safeguards applied at the contact address.
7. How long we keep data
| Data | Retention period |
|---|---|
| Authorised Person's user account | while the authorisation lasts, and no more than 30 days after the account is closed (data export period), after which it is deleted |
| Access records and security logs | 12 months from creation, longer only if needed to resolve an incident or dispute |
| Electronic signature and Terms acceptance records | for as long as the signed document is kept, or for the duration of the contract and the limitation period for claims |
| Accounting documents, payroll, employee records | for the periods prescribed by the Accounting Act, labour and pension-insurance legislation (see Art. 17.3 of the Terms of Use) |
| Anti-money laundering documentation | 10 years, under the Anti-Money Laundering and Terrorist Financing Act |
| Support requests | 24 months from closure of the request |
8. How we protect data
We apply technical and organisational measures proportionate to the risk: encryption of data in transit and at rest, individual accounts and multi-factor authentication, least-privilege access, access logging, regular backups and separation of each client's data. All staff with access to data are bound by confidentiality. A detailed description of the measures forms part of Annex 1 to the Terms of Use.
9. Automated decision-making
We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.
10. Your rights
In relation to data we process as controller, you have the right to:
- access your data and obtain a copy (Art. 15);
- rectification of inaccurate or incomplete data (Art. 16);
- erasure, where there is no longer a basis for processing (Art. 17);
- restriction of processing (Art. 18);
- data portability for data you provided (Art. 20);
- object to processing based on legitimate interest (Art. 21);
- withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
Send your request to vomi@vomi.hr. We will reply without undue delay and within 30 days at the latest; in complex cases this may be extended by two further months, of which we will inform you. We may ask you to confirm your identity to protect your data.
11. Right to lodge a complaint
If you believe the processing infringes data protection law, you may lodge a complaint with the supervisory authority: Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, azop@azop.hr, www.azop.hr. We encourage you to contact us first so we can try to resolve the matter.
12. Is providing data mandatory
Account and login data are necessary to use the Application; without them access is not possible. Providing other data is voluntary or depends on the feature you use.
13. Cookies
The Application uses only strictly necessary cookies for login and session security. Details are in the Cookie Policy.
14. Changes to this Policy
We may amend this Policy to reflect legal requirements or changes to the Application. We will notify you of material changes in the Application or by e-mail before they apply. The version and date are always shown at the top of the document.