Privacy policy.

The controller of personal data is CAUTUS SISTEMI d.o.o., Hribarov prilaz 2, 10000 Zagreb, VAT ID HR65960598095. For any privacy questions contact privatnost@getpatrono.com.

Registration and service usage data: first and last name, email address, phone number, venue name and VAT ID, user role within the venue, password (stored hashed).

Business data: data about turnover, menu, staff, shifts and HACCP records the Customer enters in the service. This data remains the property of the Customer.

Technical data: IP address, browser type, access time, pages visited. We use this for security and diagnostics.

Usage analytics: internal user and organization identifiers and data on how the service is used. Details are in section 5.

Ad measurement (with your consent): data about the visit to getpatrono.com and, when you sign up, the hashed email address, phone number and internal identifier of the user account. Details are in section 11.

Form requests: when you send a demo, contact or partnership form, we receive the details as you entered them (first and last name, email address, message and, depending on the form, phone number, venue name, number of locations, current POS or the topic of the request), plus the page you sent the form from, the first page of the visit (if you accepted analytics) and the source of the visit (the campaign UTM tag or the domain of the site you came from). The request arrives as an email in our business mailbox. We use this data to answer your request and to know which channels bring requests.

Health data: a sick-leave certificate, if the employee or the Customer attaches it to an absence request. This is a special category of personal data: only that employee, the owner and the venue managers can see it, and it is sent to the Customer's accountant only if the Customer turns this on.

We process data to provide the service (legal basis: contract performance), to meet statutory obligations (legal basis: legal obligation), and to improve the service and communication with customers (legal basis: legitimate interest of the controller). For cookie-based analytics on getpatrono.com, for documents you request on getpatrono.com and for tips by email, the legal basis is your consent (sections 4, 5 and 10). For ad measurement (Meta, Google), the legal basis is your consent (section 11). For answering a demo, contact or partnership request, the legal basis is taking steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR). For the anonymous count of received forms, the error reports and the source of the visit attached to a request, the legal basis is our legitimate interest (Art. 6(1)(f) GDPR) in knowing which channels bring requests and in being able to fix errors (sections 2, 4 and 5). We may anonymise and aggregate data about the venue's business (revenue, receipt lines, supplier invoices and recipes) to develop and improve the service, including training models. Anonymised data contains no personal data. The legal basis for the anonymisation itself is our legitimate interest in developing the service.

When you request a document on getpatrono.com (the HACCP PDF, the recipe costing template, a HACCP form or the starter HACCP pack), we process your email address as follows:

• Purpose: we use the address only to send you the document you requested.
• Legal basis: your consent (Art. 6(1)(a) GDPR). By requesting the document you agree that we send you that one email.
• A copy of the request (address, document, number of locations and POS if you chose them, page, first page of the visit and source of the visit, time and whether you ticked the box in section 10) stays in our business mailbox as the record of the request.
• Processor: Resend (Plus Five Five, Inc., USA), the service we send the email with. Transfers of data to the USA are based on the EU Standard Contractual Clauses.
• Retention: we delete the copy of the request when you ask us to, and at the latest when it is no longer needed.
• Deletion: you can ask us to delete the copy of your request at any time by emailing privatnost@getpatrono.com.

We use PostHog for usage analytics. It shows us which parts of the service and which pages people use, so we can improve the service.

• Processor: PostHog Inc., USA. The data is stored in PostHog's cloud in the USA.
• In the application (app.getpatrono.com) we record: the internal user ID and internal organization ID, the user's role and interface language; for the organization, its subscription status, whether a POS is connected and which one, the number of locations, the staff count range and the month of registration; which screens and modules you open; specific actions (registration and onboarding steps, connecting a POS, subscription status changes, staff invitations, entering supplier invoices and using OCR, exports, publishing a schedule, shift swaps, completed checklists, saving dishes); page load speed measurements; and technical data about the browser and device (type, operating system, screen size).
• We do not record names, email addresses, phone numbers, VAT IDs (OIB), venue or organization names, amounts or revenue. In the application and the mobile app we do not derive location from the IP address. In the application after sign-up and in the mobile app we do not record sessions and do not capture clicks automatically.
• In the application, analytics works without cookies and without browser storage: the data exists only in memory while the page is open. The legal basis is legitimate interest (Art. 6(1)(f) GDPR) in improving the service based on how it is actually used. You can object to this processing by writing to privatnost@getpatrono.com.
• In the mobile app we record the same data, plus device type, operating system and app version, and only after sign-in.
• On getpatrono.com, except on our US pages (getpatrono.com/us), PostHog does not load in the browser until you answer the cookie notice. For the US pages, the privacy policy at getpatrono.com/us/privacy applies. Separately, and regardless of your answer, our server records the anonymous count of received forms and the error reports, as described further down in this section. If you accept analytics, we record the pages visited, time on page and how far you scrolled, the source of the visit (previous page and campaign UTM tags), clicks on the sign-up, login and demo buttons, billing and POS choices on the pricing page, started and sent demo, contact and partnership forms, requests for the HACCP PDF and other documents (which document, without the email address), language changes, blog articles read, pages not found and page load speed measurements, together with an anonymous browser identifier and technical data about the browser and device. PostHog derives an approximate location (country, city) from the IP address for visit statistics and does not store the IP address itself. The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw consent at any time through the “Cookie settings” link in the page footer. The cookies and records PostHog then sets are listed in the cookie policy.
• By accepting analytics cookies, you also agree to the logging of how visits unfold on getpatrono.com and in the sign-up steps on app.getpatrono.com, for the purpose of improving the service.
• If you decline analytics, we only count visits anonymously and in aggregate, without cookies and without browser storage. We record the same kinds of events, but without a browser identifier: on its server, PostHog computes a one-way identifier for that day from the IP address, browser, domain and a random value that changes every day, and does not store the IP address. Such a visit is not linked to other days and no location is derived for it. The legal basis is legitimate interest (Art. 6(1)(f) GDPR) in knowing how many visits the site gets. You can object to this processing by writing to privatnost@getpatrono.com.
• When you click a sign-up or login link, we pass the source of the visit to the application (app.getpatrono.com) in the address: the campaign UTM tags and the path of the page you first landed on. With a form (demo, contact, partnership or document request) we send our server the page you send it from, the domain of the site you came from, the campaign UTM source and the path of the page you first landed on. If you accepted analytics, we keep the first source of the visit in the browser until you close the tab (sessionStorage) and send it with links and forms; if not, we only pass what is in the address of the current page, plus, with a form, the domain of the site you came from.
• When you send a form (demo, contact or partnership), our server records anonymously that the request was received, with the type of form, the page and the source of the visit (for example Google or Instagram), without your personal data and without cookies.
• When an error happens in the Patrono application in the browser (app.getpatrono.com) or on getpatrono.com, we record a technical error report in PostHog (the type of error, the page or function, a shortened message without the content you entered, and technical details such as the browser, the device and where in our code the error happened) so we can fix it, and we keep it as long as our other analytics data, 1 year. When you are signed in to the application, a report of an error in your browser is linked to your user account and company, so we can help you.
• Retention: PostHog keeps events for 1 year (the retention period of our PostHog plan).
• Transfer to the USA: PostHog Inc. is certified under the EU-U.S. Data Privacy Framework (the certification is public at https://www.dataprivacyframework.gov/list), so the transfer relies on the European Commission's adequacy decision (Art. 45 GDPR).
• Google Firebase in the mobile app: besides PostHog, the mobile app uses Google Firebase (Google, servers including in the USA): Firebase Cloud Messaging for push notifications (device token), Crashlytics for crash reports (device model, system and app version, error log) and Firebase Analytics for usage statistics, for example sign-in, opening Home, switching location and opening a push notification. After sign-in we link the statistics to the internal identifier of your user account, and crash reports are not linked to the account. We do not send names or email addresses. Crash reports are kept for 90 days, and user-level analytics data for at most 14 months. The transfer to the USA relies on the EU-U.S. Data Privacy Framework, under which Google is certified.

We do not sell or rent personal data. We share data with the following categories of processors acting on behalf of the controller:

• Cloud infrastructure provider (service hosting)
• Email delivery service provider
• Accounting and audit services as required by law
• Usage analytics provider

We have a data processing agreement with every processor in line with GDPR. With your consent to marketing, Meta Platforms Ireland Limited and Google Ireland Limited also receive data, as described in section 11.

We retain user account data while the account is active. After service cancellation, the data remains available to the Customer for export for the next 30 days, then is deleted. Tax and accounting records are retained for statutory periods (at least 11 years). Requests sent through the demo, contact and partnership forms are kept for 2 years from our last contact with you and then deleted. If a request leads to a contract, the retention periods for account data apply to that data.

As a data subject you have the right to access, rectification, erasure, restriction of processing, data portability and objection to processing. You exercise these rights by writing to privatnost@getpatrono.com. We respond within 30 days.

If you believe your data is being processed contrary to regulations, you have the right to lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb.

Data is transmitted encrypted (HTTPS/TLS). Passwords are stored hashed. Access to production data is limited to team members who need it to operate the service. Backups are run regularly.

With a document request you can also tick the box “Also send me new templates and tips for hospitality businesses, at most once a month.” The box stays empty until you tick it yourself.

• Purpose: sending new templates and tips for hospitality businesses, at most once a month. An address given only for a document is not used for this.
• Legal basis: your consent (Art. 6(1)(a) GDPR), which you give by ticking the box.
• With your consent we store the address on a recipient list at Resend (Plus Five Five, Inc., USA). Transfers to the USA are based on the EU Standard Contractual Clauses.
• Withdrawal: at any time, with the unsubscribe link in every such email or by emailing privatnost@getpatrono.com. Withdrawal does not affect the lawfulness of the emails sent before it.
• Retention: we keep the address on the list until you withdraw your consent. On request we delete it from the list.

If you accept marketing in the cookie notice on getpatrono.com, we measure which of our ads lead to demo requests and sign-ups.

• On getpatrono.com we then load Google Tag Manager and, through it, the Meta Pixel and the Google Ads tags. They record the pages visited, clicks on the sign-up button and sent demo, contact and quote requests as well as requests for documents (without the form content), and set the cookies listed in the cookie policy. Meta and Google also receive the IP address and browser data in the process.
• When you then sign up in the application (app.getpatrono.com), our server notifies Meta that the sign-up is complete. We send the email address, phone number and internal identifier of the user account, all one-way hashed (SHA-256), plus the IP address, browser data and Meta's _fbp and _fbc cookies. In addition, we send a random technical sign-up identifier so that Meta does not count the same event twice. We do not send the name, VAT ID (OIB), venue name, revenue data or the content of your records.
• Purpose: measuring and improving our ads on Facebook, Instagram and Google, including showing ads to people who have visited getpatrono.com.
• Legal basis: your consent (Art. 6(1)(a) GDPR). Without it we do not load the Meta Pixel or the Google Ads tags, and we do not report the sign-up to Meta.
• Recipients: Meta Platforms Ireland Limited and Google Ireland Limited. For the collection of data on getpatrono.com and its transfer to Meta, we are joint controllers with Meta. Meta and Google carry out further processing as independent controllers, under their own privacy policies (https://www.facebook.com/privacy/policy and https://policies.google.com/privacy).
• Transfer to the USA: Meta Platforms, Inc. and Google LLC are certified under the EU-U.S. Data Privacy Framework, so the transfer relies on the European Commission's adequacy decision (Art. 45 GDPR).
• Withdrawal: at any time, through the “Cookie settings” link in the footer of getpatrono.com. We then delete the Meta and Google cookies from the browser and no longer report the sign-up to Meta. Withdrawal does not affect the lawfulness of processing before it.
• Retention: the cookies last at most 90 days. Meta and Google keep the data they receive under their own policies.

This policy may be updated periodically. We notify customers of material changes by email and through in-app notifications.