Data protection

The controller is KADODiS, obrt za informatičke usluge, Stjepanova ulica 8, Hrastina Samoborska, 10430 Samobor, Croatia (info@kadodis.hr). Through the enquiry form we collect your name, email, company name, user count and message, solely to answer your enquiry and prepare a quote (legal basis: consent and steps taken at your request before entering into a contract). We do not sell or disclose personal data; it is processed only by the processors and recipients listed below, to the extent needed for their task. The data is not used for automated decision-making or profiling.

Processors and recipients

• Hosting: the website and the licence server run on a server of Hetzner Online GmbH in Germany, which processes the data on our behalf as a processor.
• Server logs: for every request the server records the IP address, time, requested address, browser details and the result of the request, for security and troubleshooting (legal basis: legitimate interest). Logs are kept for up to 30 days.
• Cloudflare, Inc. (USA): the Cloudflare Turnstile protection against automated abuse on the enquiry form and in the purchase dialog is loaded from Cloudflare’s servers and processes the IP address and technical details of the browser and device to check that the request is not sent by a bot; it sets no tracking cookies (legal basis: legitimate interest in protecting the forms). If the site’s traffic passes through Cloudflare’s network, Cloudflare also processes the visitor’s IP address. The transfer of data to the USA is based on the EU-U.S. Data Privacy Framework, in which Cloudflare participates.
• Licence server (KADODiS): during licence verification the application sends the M365 organisation identifier (tenant ID), pseudonymised (hashed) user and computer identifiers and the application version; for a purchased licence we also keep the purchaser’s email. The purpose is verifying the licence and the number of computers and supporting invoicing and renewal (legal basis: performance of a contract and legitimate interest). The data is kept for as long as the licence runs and afterwards for as long as tax and accounting rules require. Document content, file names and user names are never sent.
• Free edition: for a personal Microsoft account the licence server stores a pseudonymous account hash and a pseudonymous hash of the one computer on which the free edition is used, with the dates it was first and last seen, solely to apply the one-computer rule (legal basis: performance of a contract). These data reveal no name, email or work content; the record is replaced once the computer has not been seen for 30 days.
• Microsoft (Microsoft Ireland Operations Ltd): we send email — replies to enquiries and licence keys — through the Microsoft 365 service. When you enter a domain in the purchase dialog, the licence server checks at login.microsoftonline.com whether an organisation with that domain exists in Microsoft 365 and retrieves its identifier (tenant ID); only the domain is sent to Microsoft.
• Paddle.com Market Ltd (United Kingdom): payments are processed by Paddle as an independent controller and seller (Merchant of Record); Paddle’s privacy notice applies to that data. Paddle.js is loaded from Paddle’s servers only when a checkout is opened and may then set cookies needed for the payment. From Paddle we receive the name, email, country, company name, tax number and subscription status, for issuing and renewing the licence and for our business records (legal basis: performance of a contract and legal obligations). Card details never reach us. When you buy on this page, the domain and email you enter are sent to our licence server, which passes them to Paddle to prepare the order.

Cookies and browser storage

Cookies and browser storage: this site uses no tracking cookies and no third-party analytics, so cookie consent is not required. With your consent we store only your language choice and the consent record itself, locally in the browser (localStorage). You can withdraw consent by clearing site data in your browser.

Retention and your rights

Retention: at most 12 months from the last contact, except where tax law requires longer retention of records of concluded business. You have the right of access, rectification, erasure, restriction, portability and objection, and the right to lodge a complaint with the Croatian Personal Data Protection Agency (AZOP). Send requests to info@kadodis.hr.