Privacy Policy

Vizibit d.o.o., Gradna 89F, Samobor, Croatia, Company Registration Number (OIB): 65845322221 (hereinafter: Vizibit or "us", "our" or "we"), phone: +385 1 7812 480, e-mail: [email protected]

More detailed information can be found at the following link. [link to be added]

Data Protection Officer

Phone: +385 1 7812 480, e-mail: [email protected]

1. General

About this Privacy Policy

At Vizibit, we take the privacy and security of the personal data of our users, employees, business partners and other individuals with whom we have entered into business cooperation, and whose personal data is collected and processed as part of our everyday business activities, very seriously. This Policy informs you about the personal data we collect, how we process it, how we protect it, and what your rights are regarding the processing of your data. This Policy sets out the basic principles and rules for the protection of personal data in line with Vizibit's business and security requirements, as well as statutory regulations, best practices and internationally recognised standards

To ensure fair and transparent processing, Vizibit aims to provide clear information about the processing and protection of collected and processed personal data, and to ensure simple control and management of personal data and privacy. This Privacy Policy provides an appropriate level of data protection in line with the EU General Data Protection Regulation (GDPR) and other applicable privacy laws and regulations

Principles of personal data protection

When processing personal data, we pay particular attention to the following principles:

• Lawfulness, fairness and transparency – processing must be based on a specific legal basis, and the principles of fair and transparent processing require that the individual be informed of the processing operation and its purposes, and that Vizibit provide the data subject with any additional information needed to ensure fair and transparent processing, taking into account the specific circumstances and context of the processing
• Purpose limitation – personal data is collected for specified, explicit and legitimate purposes and must not be further processed in a manner incompatible with those purposes
• Data minimisation – data must be adequate, relevant and limited to what is necessary in relation to the purposes for which it is processed
• Accuracy – data must be accurate and, where necessary, kept up to date; every reasonable step must be taken to ensure that personal data that is inaccurate, having regard to the purposes for which it is processed, is erased or rectified without delay
• Storage limitation – data must be kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which it is processed; personal data may be stored for longer periods insofar as it will be processed solely for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes, subject to implementation of the appropriate measures required by the Regulation
• Integrity and confidentiality – data must be processed in a manner that ensures appropriate security of personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage
• Accountability – Vizibit is responsible for, and must be able to demonstrate compliance with, these principles, and the burden of proof lies with Vizibit in the event of a breach

Legal basis for processing personal data

We process personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (General Data Protection Regulation, hereinafter: GDPR), the Croatian Act on the Implementation of the GDPR (Official Gazette 42/2018), and other applicable statutory regulations governing this area. For the purposes of this Privacy Policy, the natural persons whose data is processed ("data subjects" as defined in the GDPR) are referred to as Users. The legal basis for using Users' personal data depends on:

• the services the User uses (contract or pre-contractual measures, Article 6(1)(b) GDPR);
• our need to comply with a legal obligation (Article 6(1)(c) GDPR);
• consent given by the User (consent, Article 6(1)(a) GDPR); or
• legitimate interest, such as ensuring website security, or sending information about the use of our platform or products, to the extent that these are similar to products already purchased or requested from us, and such communication has not been deactivated (Article 6(1)(f) GDPR)

2. What personal data we collect and process, how it is collected, and for what purpose

In order to give you access to Vizibit products, free or paid licences and certificates, or further information, the Vizibit website and application solutions require you to provide personal data that enables identification. This information may be collected during the account registration process or later. You can review and update this personal data at any time via your application service user account. Please note that some information is required for the basic functioning of your account, while other information is optional

• Name (mandatory) – information used in notification e-mails identifies you to the intended recipients. Your name is also recorded on your visual signature representation, application profile settings, and in in-app reports. Additionally, this information is used within our marketing and e-mail platform to inform you about product updates, informational blogs and newsletters. If you wish to unsubscribe from our marketing e-mails, use the link provided
• E-mail (mandatory) – your e-mail address serves as the unique identifier for your application service user account, required for login. Please note this information cannot be changed once submitted, except by deleting the account and creating a new one with a different e-mail address. In addition, your e-mail address is used to send notifications from the application service and is shared with our marketing and e-mail platform. If you wish to unsubscribe from our marketing e-mails, use the link provided
• Password/Password confirmation (mandatory) – this enables your authentication before granting access to your application service user account. The password is processed and stored using hashing and salting methods
• Phone (optional) – we may use your phone number for authentication when carrying out secure remote signing
• Job title (optional) – this information may be entered into your application service user account and is used in the visual signature representation. If entered, this information will be shared in workflows that use your signature image. You can always delete this information in your signing account settings for future use
• Company name (optional) – used in the context of Business plans on our application services to identify your organisation. This information may be entered into your application service user account and is used in the visual signature representation. If entered, this information will be shared in workflows that use your signature image. You can always delete this information in your signing account settings for future use
• Image of your handwritten signature (optional) – this information may be uploaded to your application service user account and is used in the visual signature representation. If entered, this information will be shared in workflows that use your signature image. You can always delete this information in your signing account settings for future use
• Billing information – this information may be used to enable you to become a User of our application solutions and to allow us to bill you for the use of certain functionalities and services of the application solutions:
  • Name (mandatory)
  • E-mail address (mandatory)
  • Country (mandatory)
  • Company name (optional for individuals, mandatory for companies)
  • Address (optional)
  • Tax/VAT number (for companies) (optional)
  • City (for companies) (optional)
  • Postal code (for companies) (optional)

We use Stripe, an external payment service provider (Stripe Inc, 354 Oyster Point Boulevard, San Francisco, California, 94103, United States – link to Stripe's Privacy Policy to be added), to process payments. If you pay via Stripe, the data you enter will be transmitted to Stripe. Your data is transferred on the basis of Article 6(1)(b) GDPR (contract). Your data is forwarded solely for the purpose of processing your payment and only to the extent necessary for that purpose

Documents – when using certain versions of our application solutions and uploading documents to be signed through them, the uploaded documents often contain information relating to the User or third parties that may constitute personal data. The User is the Data Controller of the uploaded documents. Processing of such personal data is not necessary for the provision of the services. Personal data uploaded with documents may include personal data relating to the User or third parties contained in the uploaded documents. Our processing of this personal data is limited to the minimum storage necessary in our systems to provide our services, and only when certain versions of our application solutions that offer Users storage options using AES encryption are used. This personal data is never processed for any other purpose

Miscellaneous data – as part of the application services, you can configure various sets of data based on your business needs. This may include:

• Contacts with whom documents are shared (e-mail)
• Your handwritten signature image and company logo image. If you choose to, this information is embedded in your signed document(s)
• Document drive – centrally stored documents made available to you by your company's administrator, documents in workflows involving you, or documents you have uploaded yourself
• Any comments you add
• Any form field data you enter into the document
• Custom e-mail content that you (or your administrator) have set up to notify recipients. Please note that the sole purpose of e-mail content is to send reminders for various events. At Vizibit we neither expect nor require you to enter sensitive data in the e-mail content configured in your profile, and we will not be responsible for its security; clients must therefore avoid providing such information in e-mail content
• Any comments you add for document recipients
• Any document metadata you specify

For certain authentication services, the user must provide a phone number to Vizibit before initiating the login/signing process. These authentication services may include: Nevis, Futurae, Mobile ID, Infobip OTP

"Contact us" form

This information is used when you contact us regarding the provision of our services to you via our Contact page. The contact form requires you to provide basic mandatory information such as your Name, E-mail, Company name and website, and Country. If submitted, this information is also shared with our marketing and CRM platforms to enable our sales team to contact you accordingly and resolve your request. If you wish to unsubscribe from our marketing e-mails, use the link provided

Usage data – we may collect information on how our application solutions are accessed and used. This usage data may include information such as your IP address, device ID, browser type, browser version, the time and date of your visit, time spent on those pages, unique device identifiers and other diagnostic data

Logs – we collect information on how our application solutions are accessed and used. This usage data includes information such as your IP address, browser type, browser version, the time and date of your visit, time spent on those pages, and other diagnostic data. This information can only be linked to individuals indirectly. We will not combine this data with other data sources. We reserve the right to review this data subsequently if we become aware of specific indications of unlawful use

Intermediary system and e-Invoice applications

Through the Intermediary System and e-Invoice applications, personal data contained in electronic invoices (e-Invoices) is exchanged, processed, delivered and archived for the purpose of:

• sending and receiving e-Invoices
• exchanging invoices between business entities
• validating structured invoices
• electronic signing and sealing
• maintaining delivery records
• accounting and tax compliance
• ensuring security and an audit trail
• long-term storage and archiving

for the following categories of personal data:

• Identification data – first and last name, OIB (Croatian personal ID number), user identifier, customer/partner number, function or job position, data on sole traders or natural persons carrying out an activity
• Contact data
  • e-mail address
  • phone number
  • business address
  • registered office or residential address
  • contact persons for accounting or administration
• Financial and accounting data
  • account number
  • IBAN
  • payment data
  • transaction data
  • invoice amount
  • tax data
  • VAT identifiers
  • cost and service data

If the customer is a natural person, the invoice may contain: the customer's address, OIB, and data on the goods or services purchased

Data contained in the e-Invoice itself – depending on the business process:

• description of the service or goods
• delivery date
• order data
• contract data
• reference numbers
• user notes

In certain cases, this may indirectly reveal the business activities, location, habits or professional relationships of a natural person

• Technical and security data
  • IP address
  • access time
  • audit logs
  • user identifiers
  • device and browser data
  • delivery and receipt records
  • invoice processing status
• Authentication and authorisation data
  • username
  • password hash
  • MFA data
  • authentication certificates
  • access rights
  • login and activity records
• Electronic signature and seal data – electronic signature, electronic seal, timestamp; the following may also be processed: certificate data, signer identity, certificate serial number, timestamp data, validation logs

Legal basis	Application
GDPR Art. 6(1)(b)	performance of a contract
GDPR Art. 6(1)(c)	legal obligation (accounting, tax regulations)
GDPR Art. 6(1)(f)	legitimate interest in security and audit
eIDAS / fiscal regulations	electronic signature and document retention

Organisational and technical security measures used:

• TLS encryption
• storage encryption
• RBAC access control
• audit logging
• SIEM monitoring
• backup and disaster recovery
• DLP (Data Loss Prevention) controls
• system segmentation
• MFA authentication
• document signing and validation

Recipients of data in the exchange:

• invoice issuer
• invoice recipient
• accounting services
• ERP systems
• tax authorities
• infrastructure providers
• QTSP trust service providers
• auditors and supervisory bodies

Other Vizibit application solutions (add-ins)

Vizibit provides other application solutions that operate within third-party applications. These third-party applications are: Microsoft tools and Google Workspace. Here we define which personal information is shared from these external applications through the use of our application, and vice versa:

• The following personal information may be visible within the add-ins: document owner, e-mail, e-mail of the next signer
• Your contacts or user information (name, e-mail, phone number) may be forwarded to Vizibit as contacts
• Documents may be forwarded to Vizibit application solutions, and updated documents may be returned

Processing your support requests

When you contact our Support Centre, we process your support requests and manage your user data. These requests include your Name and e-mail, as well as any optional personal information you provide in the message field of the request form

Third-party service providers for support requests

Crisp IM SARL – we use Crisp, a service provided by Crisp IM SARL headquartered in France, to enable real-time communication (Live Chat), manage customer support enquiries, and send occasional service-related e-mail communications

Purpose of data collection: providing timely customer support, improving the user experience, and managing service-related communications

Categories of personal data processed: when interacting with our chat widget, Crisp may automatically collect contact information (name, e-mail address – if provided by the user) and usage data (IP address – used to infer approximate geographic location, browser type, operating system, pages visited on our website, and chat transcripts)

Legal basis for processing (GDPR): processing is based on legitimate interest (communicating with users and providing support) or performance of a contract (if the chat is used to manage an ongoing service agreement)

Potential privacy consideration (as an intermediary): since Crisp is an intermediary service, users should be aware that their chat history and some session data are stored on Crisp's servers. Users retain the right to request deletion of their chat transcripts directly from us

Further information: for detailed information on Crisp's data handling and security measures, link to be added

Supademo, Inc. – we use Supademo, Inc., a service headquartered in the United States, to create and embed interactive product demonstrations and guides on our website and in communication materials

Purpose of data collection: to visually and interactively educate users about our product's features and functionality without requiring access to our core systems

Categories of personal data processed: Supademo primarily collects anonymous usage data and analytics related to interaction with embedded demos – demo analytics (number of views, completed steps, time spent on the demo, and general user navigation flow within the demo content) and device/session data (IP address, browser information and device type – for optimisation purposes). Note: Supademo does not process client data from our production environment

Legal basis for processing (GDPR): processing is based on legitimate interest (understanding user engagement with our educational content and improving product clarity)

Potential privacy consideration (data location): since Supademo is headquartered in the US, data may be transferred outside the European Economic Area (EEA). We rely on Standard Contractual Clauses (SCCs) or other lawful transfer mechanisms to ensure an adequate level of data protection

Further information: for more details on Supademo's data privacy and security, link to be added

3. Cookies

This website uses cookies, text files stored by the browser on the operating system, for the purpose of generating and tracking visitor statistics and customising the user experience. Cookies may be persistent, meaning they remain stored on the user's computer after the website visit, or temporary, meaning they are stored only for the duration of the website visit

Cookies used on this website

• Google Analytics (_ga) – registers a unique ID used to generate statistical data on how the visitor uses the website
• Google Analytics (ga#) – used by Google Analytics to collect data on how many times a user has visited the website, as well as the dates of the first and last visit
• Elementor – used in the context of the website's WordPress theme. This cookie enables the website owner to implement or change website content in real time
• Google captcha
• Cookiebot.com – used to detect whether the visitor has accepted the marketing category in the cookie banner. This cookie is necessary for the website's GDPR compliance. Description: stores the user's video player settings using an embedded YouTube video, registers a unique ID to keep statistics on which YouTube videos the user has seen, and attempts to estimate the user's bandwidth on pages with embedded YouTube videos

How to manage cookies

If you block all cookies in your browser settings (including essential cookies), you may significantly reduce the functionality of certain websites. Once you give us your consent for cookies, we will store a cookie on your device to be used for your future visits to this website. If at any time you wish to withdraw your consent for cookies, you will need to manually delete cookies via your browser's settings

Instructions for managing cookies may differ depending on the browser you use (Google Chrome, Mozilla Firefox, Internet Explorer, Android Browser, Opera, Opera Mobile, Safari for desktop and Safari for mobile) - links to instructions to be added

More information on the use of cookies can be found at www.allaboutcookies.org

4. Your data protection rights

Users' rights as data subjects under the GDPR, in relation to the processing of personal data, are as follows:

• Right of access – the data subject has the right to obtain confirmation from Vizibit as to whether personal data concerning them is being processed, and, where that is the case, access to the personal data and information on the purposes of processing, the categories of personal data concerned, the possible recipients to whom the personal data has been or will be disclosed, etc
• Right to erasure ("right to be forgotten") – the data subject has the right to obtain from Vizibit the erasure of personal data concerning them without undue delay, and Vizibit has an obligation to erase personal data without undue delay where one of the following grounds applies: the personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed; the data subject withdraws consent on which the processing is based and there is no other legal ground for the processing; the data subject objects to the processing, and there are no overriding legitimate grounds for Vizibit's processing and/or storage of the personal data; the personal data has been unlawfully processed; the personal data must be erased for compliance with a legal obligation
• Right to rectification – the data subject has the right to obtain from Vizibit, without undue delay, the rectification of inaccurate personal data concerning them. Taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed, including by means of providing a supplementary statement
• Right to data portability – the data subject has the right to receive personal data concerning them which they have provided to Vizibit, in a structured, commonly used and machine-readable format, and has the right to transmit that data to another controller. Note that the right to data portability applies exclusively to the data subject's own personal data
• Right to object – the data subject has the right to object, on grounds relating to their particular situation, at any time to the processing of personal data concerning them. Vizibit shall no longer process the personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims. Furthermore, where personal data is processed for direct marketing purposes, the data subject has the right to object at any time to the processing of their personal data for such marketing, which includes profiling to the extent it is related to such direct marketing
• Right to restriction of processing – the data subject has the right to obtain from Vizibit restriction of processing where the data subject contests the accuracy of the personal data, where the processing is unlawful and the data subject opposes erasure and requests restriction of use instead, and where the data subject has objected to processing and is awaiting verification of whether the controller's legitimate grounds override those of the data subject
• Withdrawal of consent – the data subject has the right to withdraw consent regarding processing at any time, in which case the personal data collected on the basis of such consent will no longer be used for the stated purposes

The data subject has the right to request the exercise of the above rights at any time

If you believe that our processing of personal data is contrary to applicable privacy regulations, please notify us in writing or by e-mail at: [email protected]. If you believe that Vizibit is processing your data unlawfully and this cannot be resolved in cooperation with us, you have the right to lodge a complaint with the Supervisory Authority (Croatian Personal Data Protection Agency – AZOP)

5. Disclosure to third parties

We may share your personal data with the following types of recipients:

With our Trust Service Providers:

• Swisscom (Switzerland) Ltd Enterprise Customers Identification Services, Pfingstweidstrasse 51, CH-8005 Zurich
• IDnow GmbH HQ, Auenstraße 100, 80469 Munich, Germany
• Nect GmbH, Großer Burstah 21, 20457 Hamburg, Germany
• AKD d.o.o., Savska 31, HR-10000 Zagreb, Croatia
• Financial Agency (FINA), Ulica grada Vukovara 70, HR-10000 Zagreb, Croatia
• A-Trust GmbH, Landstraßer Hauptstraße 1b, E02, 1030 Vienna, Austria

(links to the privacy policies of the above providers to be added)

• With companies within our group of Trust Service Providers, our corporate group, subcontractors, third-party service providers and partners who provide us with data processing services, such as, but not limited to, payment processing, other payment and withdrawal matters, legal and financial advisory services, IT support, etc. All such parties are required to use your personal data in accordance with this Privacy Policy and applicable privacy legislation
• With any competent law enforcement authority, regulatory body, government agency, court or other third party where we believe disclosure is necessary: (i) under applicable law or regulation, (ii) to exercise, establish or defend our legal rights, or (iii) to protect your vital interests or those of any other person
• With a potential or actual buyer (and its agents and advisors) in connection with any proposed or actual purchase, merger or acquisition of any part of our business, provided that we inform the buyer that it must use your personal data solely for the purposes set out in this Privacy Policy
• With any other person with your consent to such disclosure

Note: unless otherwise stated in this Privacy Policy, we do not sell, trade, rent or share the personal data we collect with third parties, except where we have your consent to do so

Transfers of your personal data to other countries

Our operations are supported by computer networks, cloud-based servers and other infrastructure and information technology, including, but not limited to, third-party service providers and trust service providers. We and our third-party service providers store and process your personal data in the EEA and/or Switzerland. We will protect your data as described in this Privacy Policy if your personal data is transferred to other countries

6. Security of personal data

We actively maintain technical, physical and administrative security measures designed to provide a high level of protection for Users' personal data against loss, misuse, unauthorised access, disclosure and alteration. Security measures include firewalls, data encryption, physical access controls at our data centres, and information access authorisation controls. While we are committed to securing our systems and services, Users are responsible for securing and maintaining the privacy of their passwords and account/profile registration information, and for verifying that the personal data we hold about them is accurate and up to date

7. How long we retain your personal data

We process your personal data until the purpose of the processing has been fulfilled. After the purpose for which it was collected has been fulfilled, we no longer use your personal data; it remains in our storage system and we retain it for as long as we are legally required to retain archival material

8. Changes to our Privacy Policy

Our company regularly reviews its privacy policy and publishes any updates on this website. This Privacy Policy was last updated on 15 December 2025

9. Contact information

If you have any comments or questions regarding the processing of your personal data, please e-mail us at: [email protected]