Privacy Policy
Effective from 29 October 2026
This policy explains which personal data Gumoteka processes, why, for how long, and what your rights are. It follows Articles 13 and 14 of the General Data Protection Regulation (GDPR) and the Croatian Act on the Implementation of the GDPR (NN 42/2018).
1. Who we are
Gumoteka is an application for running a tyre storage business (tyre hotel). The service is provided by ByteMe, obrt za računalno programiranje i ostale usluge, Hermanova 18D, 10000 Zagreb, Croatia, OIB 62629762140 ("we" or "Gumoteka").
For any privacy question, write to hello@gumoteka.app. We have not appointed a data protection officer, because it is not required for our type and scale of processing (Art. 37 GDPR).
2. Two roles: controller and processor
Gumoteka processes two kinds of data, in two different roles:
- Data about the shops' customers. When a tyre shop enters its customers, their vehicles and tyres into Gumoteka, the shop is the controller and we are the processor. We process this data only on the shop's instructions, under the Data Processing Agreement. If you are a customer of a shop and have a question about your data, contact the shop where you left your tyres.
- Data about user accounts, our business relationship and website visitors. For this data we are the controller, and this policy applies to it.
3. What we process as controller, why, and on what basis
| Data | From whom | Purpose | Legal basis (Art. 6 GDPR) | How long |
|---|---|---|---|---|
| Full name, email, role (owner or worker), assigned locations, password in irreversibly protected (hashed) form, interface language | The shop owner enters themselves and their workers | Opening and running the user account, sign-in, permissions | Owner: performance of a contract (b). Workers: legitimate interest in providing the agreed service to the shop (f) | While the account exists, then deleted together with the shop's data (see 6) |
| Session data: IP address, browser and device (user agent), sign-in time | Automatically at sign-in | Keeping you signed in and account security | Performance of a contract (b) and legitimate interest in security (f) | Until sign-out or session expiry, then deleted |
| Records of sign-in and sign-up attempts (email or IP address, number of attempts, time) | Automatically | Protection against password guessing and abuse | Legitimate interest in security (f) | Up to 24 hours |
| Record of who moved, released or received a tyre set and when | Automatically, while a worker uses the app | The shop sees the history of every set | Legitimate interest of the shop and ours (f) | While the set or the shop account exists |
| Data about the shop as our customer: name, OIB, address, contact person, email, subscription, date the Terms were accepted, invoices and payments | Shop owner | Contract, invoicing, collection | Performance of a contract (b) and legal obligation (c) | Invoices and accounting records as long as tax law requires, usually 11 years; the rest until the end of the contract + 1 year |
| Messages you send us by email (support, enquiries) | You | Reply and support | Performance of a contract or steps before entering into one (b), legitimate interest (f) | Up to 2 years from the last message |
| Website form data: name, shop, email, phone, city, message | You | Replying to your enquiry and arranging a pilot | Steps before entering into a contract (b) | Up to 12 months if no contract is signed |
| Server technical logs: IP address, time, requested page, browser | Automatically, when visiting the website and the app | Operation, security and troubleshooting | Legitimate interest (f) | Briefly, according to the hosting provider's settings, at most 30 days |
We do not make decisions based solely on automated processing and do not create profiles. We do not sell data or use it for advertising.
Where we rely on legitimate interest, we have weighed it against your interests: this is data you expect a business tool to record, and without it we could not protect accounts. You can object to such processing (see 8).
4. Cookies and local storage
We use only cookies that are necessary for the service to work, which do not require consent:
| Name | Purpose | Duration |
|---|---|---|
| Session cookie (Better Auth) | Keeps you signed in | Until sign-out or session expiry |
| NEXT_LOCALE | Remembers the interface language | 1 year |
| nav-slim | Remembers whether the app's side menu is collapsed | 1 year |
| Browser local storage | Remembers light or dark theme | Until you clear it in your browser |
We use no analytics, third-party cookies or marketing cookies. If we ever introduce them, we will ask for your consent first and update this policy.
5. Who we share data with
We do not share data with third parties, except with providers who help us deliver the service and process the data only on our instructions:
| Provider | Service | Where the data is |
|---|---|---|
| Neon (Databricks, Inc.) | Database | EU: Frankfurt, Germany (Amazon Web Services) |
| Cloudflare, Inc. | Hosting of the app and website, database connection (Hyperdrive), email forwarding (Email Routing) | Requests are handled in the data centre closest to the visitor, inside or outside the EU; data is stored permanently only in the database in Frankfurt |
| Google LLC (Gmail) | Mailbox that receives messages to hello@gumoteka.app and contact form enquiries | Google data centres, including the USA |
The full and current list is in Annex 3 of the Data Processing Agreement. We may also disclose data to public authorities when the law requires it.
6. Transfers outside the EU and deletion periods
We store data in the European Union. Some providers are based in the USA. Cloudflare handles requests in the data centre closest to the visitor, which may be outside the EU, and messages sent to hello@gumoteka.app are stored with Google, including in the USA. Such transfers rely on the EU-U.S. Data Privacy Framework or on the European Commission's standard contractual clauses (Art. 45 and 46 GDPR).
When a shop cancels its subscription, it has 30 days to export its data. After that, we delete the shop account, its workers' user accounts and all customer data within 30 days. Data disappears from backups within 7 days after that. Invoices we issued to the shop are kept as long as tax law requires.
7. How we protect data
Traffic is encrypted (HTTPS), passwords are stored only in hashed form, and the database is encrypted by the provider. Each shop's data is separated from other shops, and workers see only the locations assigned to them. Sign-in is protected by limiting the number of attempts. A detailed list of measures is in Annex 2 of the Data Processing Agreement.
8. Your rights
You have the right:
- to access your data and get a copy (Art. 15),
- to rectification of inaccurate data (Art. 16),
- to erasure (Art. 17) and restriction of processing (Art. 18),
- to portability of data you gave us (Art. 20),
- to object to processing based on legitimate interest (Art. 21).
Send your request to hello@gumoteka.app. We will reply within one month. We may ask you to confirm your identity. If you are a shop worker, your shop owner can correct your name or email fastest.
If you believe we are breaking the rules, you can lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, azop.hr, or with the supervisory authority of the country where you live or work.
9. Children
The service is intended for business users. Only adults can have a user account.
10. Changes
We may change this policy when the service or the law changes. We will notify shop owners of material changes in the app or by email at least 15 days in advance. The date from which the policy applies is always shown at the top of the page.
This is a translation. If it differs from the Croatian version, the Croatian version prevails.