Privacy
Privacy Policy
This notice describes how VSN j.d.o.o. processes personal data in connection with CRAB, based on actual product data flows.
Data controller
VSN jednostavno društvo s ograničenom odgovornošću za trgovinu i proizvodnju (VSN j.d.o.o.)
Ulica jablanova 31, 31000 Osijek, Republic of Croatia
Email: office@vsn.hr
Data categories
Depending on how you use CRAB, we may process:
- business contact name and business email address;
- company name and, where provided for billing, company address and VAT ID;
- submitted merchant URL, domain, optional product URL and request notes;
- inspection-request status and service communications;
- operator authentication and security/session information on the operator console;
- server logs (such as IP address, timestamp, user agent and request metadata) where logged by hosting infrastructure;
- technical inspection evidence generated from publicly accessible merchant surfaces (URLs, page states, structured data, cart/checkout observations, timestamps, assertions and results);
- screenshots or similar artefacts where the inspection engine records them as evidence;
- billing and payment metadata when a paid service is purchased (payment card credentials are not stored by CRAB when processed by a payment provider).
CRAB does not intentionally collect private customer records from merchant websites. Incidental personal data may appear in publicly accessible page content; such data is processed only as part of technical evidence.
Payment data
A free readiness check has no payment. Paid checkout, when enabled, is processed by Stripe; CRAB does not store raw card credentials. Study participation is voluntary. Study publication is anonymous unless separate naming permission exists. CRAB only inspects stores whose operator or owner has authorised the check.
Legal bases
- Contract / pre-contractual steps — to process inspection requests, deliver services and manage billing.
- Legal obligation — accounting, tax and record-keeping where required.
- Legitimate interests — to secure the service, prevent abuse, maintain operational logs and improve reliability, balanced against data subject rights.
- Consent — only where genuinely relied upon (for example, optional marketing if separately requested in future).
Purposes
Processing purposes include: handling inspection requests; performing and reporting inspections; billing and invoicing; customer communication; securing operator and public surfaces; preventing abuse; and maintaining records required by law.
Recipients and processors
Data may be processed by infrastructure and service providers engaged by VSN j.d.o.o., including hosting providers, email providers where used, and Stripe for payment processing when online pilot checkout is enabled.
International transfers
Where a provider processes data outside the EEA, transfers take place only with appropriate safeguards required by applicable law.
Retention
Data is retained for as long as necessary to provide the service, meet legal obligations and resolve disputes. Exact retention periods for all categories are being formalised in internal records; operational data is not kept longer than reasonably required for these purposes.
Your rights
Under GDPR you may have the right to access, rectification, erasure, restriction, objection and data portability where applicable. Where processing relies on consent, you may withdraw consent. You may lodge a complaint with the Croatian supervisory authority:
Agencija za zaštitu osobnih podataka (AZOP)
https://azop.hr/
Automated decision-making
CRAB produces technical inspection outputs and report classifications. These are not automated decisions with legal or similarly significant effects on natural persons within the meaning of Article 22 GDPR.
Contact
Privacy enquiries: office@vsn.hr