1. Who we are
IvyPay j.d.o.o. (“we”, “us”) is the controller of personal data processed in connection with SeasonHost.
| Seat | Zelinska ulica 7, 10000 Zagreb, Croatia |
| OIB | 76468463822 |
| Commercial Court | Zagreb · MBS 081491593 |
| Contact | sales@ivypay.biz |
For privacy requests use the same email with subject “Privacy / GDPR”.
2. What we process and why
| Purpose | Examples of data | Legal basis (GDPR) |
|---|---|---|
| Purchase & payment (Stripe) | Name, email, billing details, payment status; card data is handled by Stripe — we do not store full card numbers | Art. 6(1)(b) contract; Art. 6(1)(c) legal obligation (invoicing / tax) |
| Delivery of digital packs / order emails | Email, order ID, country pack, language (sent/received via our mail stack, including Apple iCloud Mail for sales@ivypay.biz) | Art. 6(1)(b) contract |
| Website hosting (Netlify) | IP address, request logs, pages visited, technical device data | Art. 6(1)(b) contract / Art. 6(1)(f) legitimate interest (secure hosting & delivery of the site) |
| Meta Pixel / ads measurement (only with consent) | Cookie IDs, pixel events, UTM parameters, approximate device/browser data | Art. 6(1)(a) consent |
| Support | Email content you send us | Art. 6(1)(b) or (f) |
| Waitlist — one notification when sales start | Email, language, pack country | Art. 6(1)(a) consent |
Providing your name, email and billing details is necessary to conclude and perform the purchase contract and to meet our tax obligations; without them we cannot process your order. Providing data for marketing cookies is voluntary.
We do not sell your personal data.
Meta Pixel loads only after you accept marketing cookies (or enable Marketing in Settings). It is off by default. No marketing boxes are pre-ticked.
3. Cookies (summary)
- Necessary — required for the site to work (e.g. security, load balancing, storing your cookie choice). Always on.
- Marketing — Meta Pixel and related advertising/measurement cookies. Off until you consent.
Full details: Cookie Policy (HR: /hr/kolacici).
4. Recipients and processors
We use trusted providers who process data on our instructions or as independent controllers where stated by them:
| Provider | Role | Typical location |
|---|---|---|
| Stripe | Payment processing | EU / USA (Stripe entities) |
| Apple iCloud Mail | Inbox for sales@ivypay.biz (Custom Email Domain; MX Apple; alias to the controller’s iCloud account). Used for order / support correspondence. Stripe may also send its own payment receipts | USA / global (Apple) |
| Netlify | Website hosting / CDN; storage of waitlist sign-ups (Netlify Forms) | USA / global edge |
| Meta Platforms | Advertising measurement (Pixel) — only with your consent | USA / global |
5. Transfers outside the EEA (including the USA)
Stripe, Netlify, Apple (iCloud Mail) and Meta may process data in the United States or other countries outside the EEA.
Where required, transfers rely on appropriate safeguards under GDPR Chapter V, such as the EU–US Data Privacy Framework (where the recipient is certified) and/or the European Commission’s Standard Contractual Clauses (SCCs), plus supplementary measures where needed.
You may request more information about safeguards via sales@ivypay.biz.
6. How long we keep data
| Category | Retention (indicative) |
|---|---|
| Orders, invoices, payment records | As required by Croatian tax and commercial law (often up to 11 years for accounting records) |
| Fulfilment / support email | For the contract and a reasonable period after (typically up to 3 years, unless a dispute requires longer) |
| Cookie consent records | Stored in your browser for 12 months (accept) or 6 months (reject), then you are asked again; we keep no separate server-side consent log |
| Marketing / Pixel data (consent-based) | Until you withdraw consent or the cookie expires; then stopped / deleted as far as we control |
| Server / security logs (hosting) | Short period (typically up to 90 days), unless needed for security incidents |
| Waitlist | Until we send the notification that sales have started or until you unsubscribe, and no longer than 12 months from sign-up, whichever comes first. After that we delete your email. |
7. Your rights
Under GDPR you may have the right to:
- Access your data
- Rectification of inaccurate data
- Erasure (“right to be forgotten”) where applicable
- Restriction of processing
- Portability (where processing is based on contract or consent and is automated)
- Object to processing based on legitimate interests
- Withdraw consent at any time (cookie banner / Settings, or email us) — withdrawal does not affect lawfulness before withdrawal
- Lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), azop.hr, or with the supervisory authority in your EU Member State of habitual residence, place of work or place of the alleged infringement (Art. 77 GDPR)
To exercise rights: sales@ivypay.biz. We may need to verify your identity.
8. Children
SeasonHost is aimed at hospitality businesses and adults. We do not knowingly collect data from children under 16.
9. Changes
We may update this Policy. The “Last updated” date will change. Material changes will be highlighted on the site where appropriate.
10. Contact
IvyPay j.d.o.o. · Zelinska ulica 7, 10000 Zagreb · sales@ivypay.biz