Privacy Policy

1. Introduction

Semicolon d.o.o. ("we", "us", "our", "Company") operates the Operitivo platform (the "Service"). This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Service.

We are committed to protecting your personal data and respecting your privacy. This policy is compliant with the General Data Protection Regulation (EU) 2016/679 ("GDPR").

2. Data Controller

The data controller responsible for your personal data is:

3. Information We Collect

Information You Provide

• Account Information: Name, email address, password, phone number; the OIB of users who issue invoices and, where the business adds them to Minimax as cashiers, their gender
• Business Information: Business name, address, VAT number (OIB), IBAN
• Client Data: Information about your clients that you enter into the system
• Financial Data: Invoice and payment information
• Communication Data: Messages you send through the platform
• Work Photos: Photos of finished work that your team adds to a work order (at most 4 per work order); they can show your clients' premises

Client Signatures on Work Orders (optional feature)

When a business switches on client signatures, the client confirms a completed work order on the worker's device or through a single-use link sent by email. For each signature we store:

• the name typed by the signer and, for remote signing, the email address the link was sent to;
• the drawn signature as x/y coordinates of the strokes only, with no pressure, speed or timing, and not used to identify anyone automatically, so it is not processed as biometric data (GDPR Art. 9);
• an optional comment and the exact consent statement shown with its version;
• the time, IP address and browser/device of the signer, and for on-site signing the worker's device location if the worker allowed it;
• a SHA-256 fingerprint of the work order content at the moment of signing.

The purpose is to prove that the work was done and accepted (simple electronic signature, Regulation (EU) No 910/2014, Art. 25). The signed work order is emailed to the client. Signatures, signed work orders and photos are stored privately: only the business can access them through the Service and the client through their own link, and they are deleted together with the work order.

Information Collected Automatically

• Usage Data: Pages visited, features used, time spent on pages
• Device Information: Browser type, operating system, device type
• Log Data: IP address, access times, referring URLs
• Cookies: See our Cookie Policy for details

4. How We Use Your Information

We use your personal data for the following purposes:

5. Data Retention

We retain your personal data for as long as necessary to fulfill the purposes outlined in this policy, unless a longer retention period is required by law.

6. Data Sharing

We may share your data with:

Service Providers

• Cloud hosting providers (EU-based)
• Email service providers
• Payment processors

Minimax integration (Operitivo for miniMAX)

A business that uses Minimax can connect it to Operitivo in Settings. Operitivo then sends data to the business's Minimax organisation on the business's instructions. While Add cashiers to Minimax automatically is on (it is on by default), it adds the users who issue invoices to Minimax as employees: when the business connects or switches the add on, when such a user joins the business or gets a role that issues invoices, and when they enter their OIB, gender or name; and always when someone clicks Add to Minimax. It sends a single goods receipt document when an authorised user sends it. When a user asks, it finishes the issue of an invoice already in Minimax, reverses it or issues a credit note for it, also with issuing through Minimax switched off. Everything else it sends by itself while issuing invoices through Minimax, item sync or sending goods receipt documents to the Minimax Pretinac is on:

• Recipient: Seyfor d.o.o., the provider of Minimax, with which the business has its own contract for using Minimax.
• Purpose: issuing and fiscalizing invoices, sending eInvoices (eRačun) and tracking payments in the business's Minimax, the same items and services in Operitivo and in Minimax, booking received invoices from goods receipt documents, showing the eInvoices received in Minimax on the Incoming Invoices page, and viewing the invoices the business issued directly in Minimax. Minimax fiscalizes the invoices with the Croatian Tax Administration and sends eInvoices through its own information intermediary.
• Data: the customer's name, OIB or VAT number, address and email address; invoice lines, amounts, dates, payment method and note; signed work orders attached to the invoice (the signer's name and signature and work photos). Operitivo enters the users who issue invoices in Minimax's employee list (Djelatnici, which is also the payroll register) as cashiers, because a fiscalized invoice carries the operator's OIB: the user's first name, surname, OIB and gender, with employee as the employment type and Croatia as the country of residence. The accountant can change these there. With item sync it sends the name, code, unit, sell price, VAT rate, KPD and active status of items and services. With goods receipts it sends the supplier's invoice document (the image or PDF) with the supplier's name or OIB and the invoice number and date. To sign in to Minimax we use the username and external application password the business entered, and we store the password encrypted. From Minimax we receive the catalogue of items and services, the employee list (name and OIB), in which we look for each user's cashier, the number and PDF of issued invoices and their payment status. While the business receives eInvoices in Minimax, from the Minimax Pretinac za dokumente we receive the eInvoices it received (the XML with the supplier's name, OIB, address and contact, the lines, amounts and dates) and their status in Minimax (approved, rejected, cancelled). For invoices the business issued directly in Minimax, from the day it switched on issuing through Minimax, Operitivo also keeps the invoice header: number, customer (company name or first name and surname, and its Minimax customer id), dates, amount, amount paid, status and payment status, and the PDF only once someone opens it. It shows them for viewing only and does not count them in reports.
• Roles and legal basis: for its customers' data, the business is the controller and decides the legal basis (usually performance of its contract with the customer and the legal obligation to issue and fiscalize invoices, GDPR Art. 6(1)(b) and (c)). The business is also the controller for the data of its users who issue invoices and for its suppliers' documents (usually the legal obligation to name the operator on a fiscalized invoice and to book received invoices, GDPR Art. 6(1)(c)). Operitivo processes this data as a processor, only on the business's instructions (GDPR Art. 28). Seyfor processes it under the business's own contract with Seyfor. For data about the business itself, the legal basis is performance of our contract (Art. 6(1)(b)).

The business can switch off each of these switches, and Operitivo then no longer sends that data by itself. It can also disconnect (Settings > Integrations > Operitivo for miniMAX > Disconnect) once no invoice is still on its way to Minimax or started there; the disconnect dialog lists what to settle first. Operitivo then sends nothing more to Minimax and deletes the stored password. Data already sent stays in the business's Minimax and is covered by its contract with Seyfor.

Legal Requirements

• Croatian Tax Administration (for fiscalization)
• FINA (for eRačun processing)
• Law enforcement when required by law

Business Transfers

In the event of a merger, acquisition, or sale, your data may be transferred.

We do NOT sell your personal data to third parties.

7. International Data Transfers

Your data is primarily stored within the European Union. If we transfer data outside the EU, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs)
• Adequacy decisions by the European Commission

8. Your Rights (GDPR Articles 15-22)

You have the following rights regarding your personal data:

1. Right of Access (Art. 15): Request a copy of your personal data
2. Right to Rectification (Art. 16): Request correction of inaccurate data
3. Right to Erasure (Art. 17): Request deletion of your data ("right to be forgotten")
4. Right to Restriction (Art. 18): Request limitation of processing
5. Right to Data Portability (Art. 20): Receive your data in a structured format
6. Right to Object (Art. 21): Object to processing based on legitimate interests
7. Right to Withdraw Consent (Art. 7): Withdraw consent at any time

To exercise these rights, contact us at: info@operitivo.com

We will respond within 30 days of receiving your request.

9. Data Security

We implement appropriate technical and organizational measures to protect your data:

• Encryption in transit (TLS/SSL)
• Encryption at rest
• Access controls and authentication
• Regular security assessments
• Employee training on data protection

10. Cookies

We use cookies and similar technologies. For detailed information, please see our Cookie Policy.

11. Children's Privacy

Our Service is not intended for individuals under the age of 16. We do not knowingly collect personal data from children.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on this page and updating the "Last updated" date.

13. Supervisory Authority

If you believe we have violated your data protection rights, you have the right to lodge a complaint with the Croatian Personal Data Protection Agency (AZOP):

14. Contact Us

For questions about this Privacy Policy or to exercise your rights: