Exevio

1. Introduction #

This Privacy Policy explains how Exevio d.o.o. (“Exevio”, “we”, “us” or “our”) collects, uses, shares and protects information when you use the Exevio website — the exevio.com website and the small web services and apps Exevio operates, available on Web browser and at exevio.com (together, the “Service”).

It also describes the choices you have and the rights you may exercise. By using the Service you acknowledge that you have read this Privacy Policy. If you do not agree with it, please do not use the Service.

Capitalised terms not defined here have the meaning given in our Terms of Service.

2. Summary of key points #

This summary is for convenience; the full sections below control.

• What we collect: identity & contact data, account & activity data and device & technical data — only what is needed to run the Service.
• Why: provide, operate and maintain the service, analytics & product improvement, service communications, security, fraud prevention & abuse detection and comply with legal obligations.
• Sharing: we do not sell your personal data; we work with 3 third-party services listed in this policy.
• Your rights: access, correct, delete or export your data, object to processing and withdraw consent — write to contact@exevio.com.
• Deletion: you can delete your data by e-mailing contact@exevio.com.
• Age: the Service is not intended for anyone under 16.

3. Who we are (data controller) #

The data controller responsible for your personal data is:

Exevio d.o.o.
Vukovarska 6, 51000 Rijeka, Croatia
contact@exevio.com
+385 95 222 1110
Registration / VAT: HR53022148424
exevio.com

4. Information we collect #

We collect only the information necessary for the purposes described in this policy. Depending on how you use the Service, this may include:

• Identity & contact: name, e-mail address, phone number and company / job title.
• Account & activity: usage & interaction data and support conversations.
• Device & technical: ip address and os / browser & version.

How we obtain it:

• Information you give us. When you fill in a form, contact support or otherwise interact with us, we collect what you provide.
• Information collected automatically. When you use the Service we and our service providers automatically record technical and usage data such as your IP address, device and browser characteristics, operating system, language, time zone, app version, crash reports and how you interact with the Service.

5. How we use your information #

We use the information we collect for the following purposes and, where the GDPR or UK GDPR applies, on the legal bases indicated:

We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you.

6. Third-party services and SDKs #

We rely on carefully selected third-party providers to run the Service. They process data on our behalf as processors or, where indicated, as independent controllers under their own privacy policies. We list them here so you know exactly who may receive your data:

E-mail & marketing

• Postmark — e-mail address, message content, delivery data.

Hosting, cloud & infrastructure

• Hetzner Online — all data stored or processed by the Service (hosting, EU).
• Cloudflare — IP address, request metadata (CDN, DNS, DDoS protection).

Each provider is bound by a data processing agreement or equivalent contractual terms, receives only the data needed for its purpose, and may not use it for anything else. Their policies may change; the links above lead to the current version.

7. How we share information #

We do not sell your personal data and we do not rent it to marketers. We share it only in these situations:

• Service providers that host, secure, analyse, support or otherwise help us operate the Service (see the list above), under contracts that restrict their use of your data.
• Authorities and other parties when legally required — to comply with law, court orders or lawful requests, to enforce our terms, or to protect the rights, property or safety of Exevio, our users or the public.
• A successor in a business transaction — if we are involved in a merger, acquisition, financing or sale of assets, your data may be transferred as part of that transaction; this policy will continue to apply until you are notified otherwise.
• Anyone else only with your consent or at your direction.

We may also share aggregated or de-identified information that cannot reasonably be used to identify you.

8. International data transfers #

Exevio is established in Croatia and hosts data in the European Union (Germany and Croatia).

Some of our service providers are located outside the European Economic Area, the United Kingdom and Switzerland, including in the United States. When we transfer personal data to such countries we rely on adequacy decisions of the European Commission (and UK/Swiss equivalents), the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions) for certified recipients and the European Commission’s Standard Contractual Clauses (with the UK Addendum where relevant), supplemented by transfer impact assessments. You may request a copy of the relevant safeguards by contacting us.

9. Cookies and similar technologies #

We use cookies and similar technologies (such as local storage, pixels and SDK identifiers) that are strictly necessary to operate the Service (for example to keep you signed in and to protect against abuse). No consent is required for strictly necessary cookies.

Full details, including a table of the cookies used and how to control them, are in our Cookie Policy.

We honour the Global Privacy Control (GPC) and Do Not Track signals: when your browser sends one, we treat it as an opt-out of non-essential cookies and of the sale or sharing of personal data.

10. How long we keep your data #

We keep your personal data for as long as we need it to provide the Service to you. When you ask us to delete your data, we delete or anonymise it within 30 days, except for copies in encrypted backups that are overwritten on their regular rotation cycle.

We may retain some data for longer where we must (for example invoices and tax records for statutory periods), to resolve disputes, enforce our agreements or protect legal rights — always limited to what is necessary for that purpose. Aggregated statistics that cannot identify you may be kept indefinitely.

Correspondence is kept for as long as the conversation is relevant plus any period required by law. Invoices and accounting records are kept for 11 years as required by Croatian accounting law.

11. How we protect your data #

We apply technical and organisational measures appropriate to the risk, including encryption of data in transit (TLS/HTTPS), encryption of data at rest, role-based access controls and the principle of least privilege, multi-factor authentication for staff access, regular, encrypted backups, logging and monitoring for suspicious activity, an information-security management system certified to ISO/IEC 27001 and regular staff security training.

No method of transmission or storage is completely secure, so we cannot guarantee absolute security. If we become aware of a personal-data breach that is likely to result in a high risk to your rights, we will notify you and the competent supervisory authority as required by law.

12. Your rights and choices #

Wherever you live, you can ask us to:

• Access the personal data we hold about you and receive a copy;
• Correct inaccurate or incomplete data;
• Delete your data (“right to be forgotten”), subject to legal retention duties;
• Export your data in a structured, machine-readable format (data portability);
• Restrict or object to processing, including processing for direct marketing at any time;
• Withdraw consent where processing is based on consent, without affecting processing already carried out;
• Not be discriminated against for exercising any of these rights.

To exercise a right, e-mail contact@exevio.com. We may need to verify your identity before acting on a request. We respond within 30 days (extendable where the law allows for complex requests) and free of charge unless requests are manifestly unfounded or excessive. You may also authorise an agent to act on your behalf.

Deleting your account and data

You can request deletion of your data at any time by e-mailing contact@exevio.com. Deletion is permanent and completed within 30 days; we keep only what the law requires us to retain (such as invoices) and de-identified statistics. You can also request a copy of your data before deleting.

If you believe we have not handled your data lawfully, you have the right to lodge a complaint with a supervisory authority — in our case Croatian Personal Data Protection Agency (AZOP), https://azop.hr — or with the authority in the country where you live or work. We would appreciate the chance to address your concern first.

13. Additional information for the EEA, UK and Switzerland #

If you are in the European Economic Area, the United Kingdom or Switzerland, we process your personal data under the EU General Data Protection Regulation (GDPR), the UK GDPR and Data Protection Act 2018 and the Swiss Federal Act on Data Protection (FADP). Our legal bases are set out in “How we use your information”. Where we rely on legitimate interests, we have balanced them against your rights and you may object at any time. Where we rely on consent, you can withdraw it at any time.

You have all the rights listed above, including the right to lodge a complaint with your local supervisory authority or with our lead authority, Croatian Personal Data Protection Agency (AZOP), https://azop.hr; in the UK this is the Information Commissioner’s Office (ico.org.uk) — under the Data (Use and Access) Act 2025 you may also complain to us directly and we will acknowledge within 30 days and respond without undue delay; in Switzerland the Federal Data Protection and Information Commissioner (edoeb.admin.ch).

Providing personal data is generally voluntary; however, without certain data (for example an e-mail address for an account) we may be unable to provide parts of the Service.

14. Your California and US state privacy rights #

This section applies to residents of California and other US states with comprehensive privacy laws (including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, Iowa, Delaware, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Indiana, Kentucky, Rhode Island and Nebraska) and supplements the rest of this policy.

Categories of personal information

In the last 12 months we have collected the categories listed under “Information we collect”, which correspond to the following categories under the California Consumer Privacy Act (CCPA/CPRA): identifiers, customer records (Cal. Civ. Code §1798.80(e)), internet or other network activity and professional or employment-related information. We collect them from the sources and for the purposes described above and disclose them for business purposes to the service providers and third parties listed in this policy.

Sale and sharing

We do not sell personal information and we do not share it for cross-context behavioural advertising, and we have not done so in the preceding 12 months. We do not knowingly sell or share the personal information of consumers under 16.

Your rights

You have the right to know what personal information we collect, use, disclose, sell or share; to access, correct and delete it; to opt out of sale/sharing and of certain profiling; to limit the use of sensitive personal information; and not to be discriminated against for exercising these rights. Submit requests to contact@exevio.com. We will verify your request (usually by confirming control of the e-mail address associated with your data) and respond within 45 days, extendable once by a further 45 days with notice. Authorised agents may submit requests with proof of authority. Appeals. If we decline a request you may appeal by replying to our decision; we will respond within 45 days, and if the appeal is denied you may contact your state Attorney General.

Notice at collection and financial incentives. We do not offer financial incentives in exchange for personal information. Retention: see “How long we keep your data”. Shine the Light: California residents may request a list of third parties to whom we have disclosed personal information for their direct marketing — we do not do so.

15. Additional information for Brazil (LGPD) #

If you are in Brazil, we process your personal data under the Lei Geral de Proteção de Dados (Law 13.709/2018). Exevio d.o.o. is the controller. In addition to the rights above, you may request confirmation of processing, anonymisation or blocking of unnecessary data, information about the entities we share data with, and information about the consequences of refusing consent. Requests go to contact@exevio.com. You may also complain to the Autoridade Nacional de Proteção de Dados (ANPD).

16. Additional information for Canada #

We comply with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable provincial laws (including Québec’s Law 25). We collect, use and disclose personal information only with your knowledge and consent, except where permitted or required by law. You may withdraw consent, access and correct your information, and complain to the Office of the Privacy Commissioner of Canada or your provincial commissioner. Your data may be processed outside Canada and be subject to the laws of those jurisdictions.

17. Additional information for Australia #

We comply with the Privacy Act 1988 (Cth) and the Australian Privacy Principles. You may access and correct your personal information and complain to us; if you are not satisfied with our response you may complain to the Office of the Australian Information Commissioner (oaic.gov.au). We may disclose personal information to recipients overseas (including the EU and USA) and take reasonable steps to ensure they handle it in line with the APPs.

18. Children’s privacy #

Exevio is not directed at children under 16 and we do not knowingly collect personal data from them. If you are a parent or guardian and believe your child has provided us with personal data, contact contact@exevio.com and we will delete it promptly.

19. Links to other sites and services #

The Service may contain links to, or integrate with, websites and services we do not operate. We are not responsible for their content or privacy practices; please read their policies. This policy applies only to Exevio.

20. Changes to this policy #

We may update this Privacy Policy from time to time. The “Last updated” date at the top shows when it was last revised. For material changes we will give you reasonable advance notice — for example by e-mail, an in-website notice or a prominent notice on this page — and, where the law requires, ask for your consent. Continued use of the Service after the effective date means the updated policy applies. Previous versions are available on request.

21. Contact us #

Questions, requests or complaints about this policy or your personal data:

Exevio d.o.o.
Vukovarska 6, 51000 Rijeka, Croatia
contact@exevio.com
+385 95 222 1110

1. Agreement to these Terms #

These Terms of Service (“Terms”) are a legally binding agreement between you and Exevio d.o.o. (“Exevio”, “we”, “us”), Vukovarska 6, 51000 Rijeka, Croatia, governing your access to and use of Exevio — the exevio.com website and the small web services and apps Exevio operates, available on Web browser and at exevio.com, including all related features, content and updates (the “Service”).

By accessing or using the Service, you agree to these Terms and acknowledge our Privacy Policy. If you do not agree, do not use the Service.

You must be at least 16 years old (or the age of digital consent in your country, if higher) and, if you are under 18, have permission from a parent or guardian who agrees to these Terms on your behalf to use the Service.

If you use the Service on behalf of a company or other organisation, you represent that you have authority to bind it, and “you” refers to that organisation as well.

2. The Service #

We grant you a limited, personal, non-exclusive, non-transferable, revocable licence to access and use the Service for your personal, non-commercial use in accordance with these Terms. The Service is licensed, not sold, to you.

We are constantly improving the Service and may add, change or remove features, or discontinue the Service entirely, at any time. Where a change materially reduces core functionality you have paid for, we will tell you in advance and, where required by law, offer a refund for the unused period.

We aim to keep the Service available at all times but cannot guarantee uninterrupted or error-free operation. Maintenance, updates and events outside our control may cause temporary interruptions.

3. Acceptable use #

You agree not to, and not to allow anyone else to:

• use the Service in any way that violates applicable law or regulation, or for any unlawful, harmful, fraudulent or deceptive purpose;
• infringe the intellectual-property, privacy or other rights of anyone;
• upload or transmit malware, or attempt to gain unauthorised access to the Service, other accounts, or the systems or networks connected to it;
• interfere with or disrupt the Service, including by overloading it, scraping it at scale, or bypassing rate limits, security or access controls;
• copy, modify, distribute, sell, rent, lease, sublicense or create derivative works of the Service, or reverse-engineer, decompile or disassemble it, except to the extent applicable law expressly permits;
• remove or alter any proprietary notices, or use our name, logos or trademarks without permission;
• use automated means (bots, crawlers) to access the Service other than through documented interfaces we provide;
• harass, threaten, defame or abuse others, or post content that is hateful, obscene, violent or exploits minors;
• send spam or unsolicited communications, or misrepresent your identity or affiliation;

We may investigate violations and take any action we consider appropriate, including removing content, limiting features, suspending or terminating access, and reporting to law enforcement.

4. Intellectual property #

The Service — including software, design, text, graphics, logos, trademarks and all related intellectual-property rights — is owned by Exevio d.o.o. or its licensors and protected by copyright, trademark and other laws. Except for the limited licence granted above, no rights are granted to you. All rights not expressly granted are reserved.

Feedback. If you send us ideas, suggestions or feedback, you grant us a perpetual, irrevocable, royalty-free licence to use them without obligation to you.

5. Third-party services and links #

The Service may integrate with or link to third-party services (such as Postmark, Hetzner Online and Cloudflare). We do not control them and are not responsible for their content, availability or practices. Your use of them is governed by their own terms and policies.

6. Privacy #

Our Privacy Policy explains what personal data we collect, why, and your rights. By using the Service you acknowledge that we process personal data as described there.

7. Termination #

You may stop using the Service at any time. We may suspend or terminate your access, with notice where reasonably possible, if you materially breach these Terms, if required by law, if continuing poses a security or legal risk, or if we discontinue the Service. Where you have prepaid for a period and we terminate without cause, we will refund the unused portion.

Upon termination your licence ends and you must stop using the Service. Sections which by their nature should survive (including intellectual property, disclaimers, limitation of liability, indemnification, governing law) will survive.

8. Disclaimer of warranties #

To the maximum extent permitted by law, the Service is provided “as is” and “as available”, without warranties of any kind, express or implied, including implied warranties of merchantability, fitness for a particular purpose, title and non-infringement. We do not warrant that the Service will be uninterrupted, secure or error-free, that defects will be corrected, or that any content or results will be accurate or reliable. You use the Service at your own risk.

Some jurisdictions do not allow the exclusion of certain warranties, so some of the above may not apply to you. Nothing in these Terms limits any statutory rights you have as a consumer that cannot be waived.

9. Limitation of liability #

To the maximum extent permitted by law, Exevio d.o.o., its affiliates, officers, employees, contractors and licensors will not be liable for any indirect, incidental, special, consequential or punitive damages, or for loss of profits, revenue, data, goodwill or business opportunity, arising out of or related to the Service or these Terms, whether in contract, tort (including negligence), statute or otherwise, even if advised of the possibility of such damages.

Our total aggregate liability for all claims relating to the Service will not exceed the greater of the amounts you paid us for the Service in the twelve months before the event giving rise to the claim and €100.

Nothing in these Terms excludes or limits liability that cannot be excluded or limited by law — including liability for death or personal injury caused by negligence, for fraud or fraudulent misrepresentation, for gross negligence or wilful misconduct, or under mandatory consumer-protection or product-liability law.

10. Indemnification #

To the extent permitted by law and except where you are a consumer, you agree to indemnify and hold harmless Exevio d.o.o. and its affiliates, officers, employees and agents from any claims, damages, liabilities and expenses (including reasonable legal fees) arising from your breach of these Terms, your misuse of the Service, or your violation of any law or third-party right. We may assume the exclusive defence of any matter subject to indemnification, and you agree to cooperate.

11. Consumer rights #

If you are a consumer in the European Union, EEA or United Kingdom, nothing in these Terms affects the mandatory rights you have under the laws of your country of residence, including rights concerning digital content and services, unfair terms and dispute resolution. Where these Terms conflict with such rights, your rights prevail.

In case of a dispute we encourage you to contact us first at contact@exevio.com. You may also turn to the consumer-protection authority or an accredited alternative-dispute-resolution body in your country. In Croatia this includes the Court of Honour of the Croatian Chamber of Economy and the Conciliation Centre of the Croatian Chamber of Economy. Participation in ADR is voluntary for us unless the law provides otherwise; we will let you know within a reasonable time whether we agree to take part.

12. Governing law and disputes #

These Terms are governed by the laws of the Republic of Croatia and applicable European Union law, without regard to conflict-of-law rules and excluding the UN Convention on Contracts for the International Sale of Goods. If you are a consumer, you also enjoy the protection of the mandatory provisions of the law of your country of residence.

Talk to us first. If you have a problem, e-mail contact@exevio.com and we will try to resolve it informally within 30 days.

Any dispute that cannot be resolved informally will be subject to the exclusive jurisdiction of the competent court in Rijeka, Croatia, except that consumers may bring or defend proceedings in the courts of their country of residence where the law gives them that right.

13. Changes to these Terms #

We may modify these Terms from time to time. If a change is material we will give you at least 14 days’ notice — by e-mail, an in-website notice or a prominent notice on this page — before it takes effect. If you do not agree, stop using the Service before the change takes effect. Continued use afterwards means you accept the updated Terms. The “Last updated” date at the top shows the current version.

14. General provisions #

• Export control and sanctions. You may not use or export the Service in violation of EU, US or other applicable export-control and sanctions laws, and you represent that you are not on any sanctions list.
• Force majeure. We are not liable for delays or failures caused by events beyond our reasonable control, including natural disasters, war, terrorism, labour disputes, government action, internet or utility failures, or failures of third-party providers.
• Assignment. You may not assign or transfer these Terms without our written consent. We may assign them to an affiliate or a successor in connection with a merger, acquisition or sale of assets, with notice to you.
• Severability and waiver. If any provision is held invalid, the rest remains in effect and the provision will be enforced to the maximum extent permitted. Our failure to enforce a right is not a waiver of it.
• Entire agreement. These Terms, together with the Privacy Policy, are the entire agreement between you and us about the Service and supersede prior agreements. Headings are for convenience only.
• Electronic communications. By using the Service you consent to receive communications from us electronically and agree that electronic agreements, notices and records satisfy any legal requirement that they be in writing.
• California users. Under California Civil Code §1789.3, California residents may report complaints to the Complaint Assistance Unit of the Division of Consumer Services of the California Department of Consumer Affairs, 1625 North Market Blvd., Suite N 112, Sacramento, CA 95834, or by telephone at (800) 952-5210.
• Notices. We may notify you by e-mail, in the Service or by posting on this page. Notices to us should be sent to contact@exevio.com. Language. These Terms are written in English; translations are provided for convenience and the English version prevails to the extent permitted by law.

15. Contact us #

Questions about these Terms?

Exevio d.o.o.
Vukovarska 6, 51000 Rijeka, Croatia
contact@exevio.com
+385 95 222 1110

1. About this policy #

This Cookie Policy explains how Exevio d.o.o. (“Exevio”, “we”) uses cookies and similar technologies on Exevio (exevio.com). It is part of our Privacy Policy and should be read together with it.

What are cookies? Cookies are small text files that a website or app stores on your device when you visit. They let the site recognise your device on later visits, remember your settings and understand how the site is used. Cookies set by us are “first-party”; cookies set by other companies whose features we embed are “third-party”. Similar technologies — such as local storage, pixels/web beacons, SDK identifiers and device fingerprints — work in comparable ways and are covered by this policy too.

Session cookies expire when you close your browser; persistent cookies stay until they expire or you delete them.

2. Cookies we use #

We use the following categories of cookies and similar technologies:

• Strictly necessary cookies are required for the Service to work — for example to keep you signed in, remember items in a form, balance load between servers and protect against attacks. They cannot be switched off in our systems, and no consent is needed for them.

3. Cookie table #

The table below lists the cookies and similar technologies currently in use. Third-party cookies are controlled by the named provider; the linked policies describe them in detail.

4. Your choices #

Consent. We use only strictly necessary cookies, for which no consent is required.

Browser settings. Most browsers let you refuse or delete cookies. Instructions: Chrome, Firefox, Safari and Edge. Blocking all cookies may make parts of the Service unusable.

Global Privacy Control and Do Not Track. We honour the GPC signal and Do Not Track: when your browser sends either, we treat it as an opt-out of non-essential cookies and of any sale or sharing of personal data.

5. Changes and contact #

We may update this Cookie Policy when our practices or the technologies we use change; the “Last updated” date shows the current version. Questions? Write to contact@exevio.com.