In force from 2 October 2026
1. Who is the controller
The controller is DIA DIGITAL j.d.o.o., Stankovićeva 31, 52100 Pula, Croatia, Croatia, company ID (OIB) 69987267634. For any question about data processing, write to info@izzylio.com. We are not required to appoint a data protection officer.
2. Data of service users
If you open an account on izzylio.com, we process the following:
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| E-mail address, name, password (stored only as a cryptographic hash, never in readable form) | Running your account and signing you in | Performance of a contract — Art. 6(1)(b) GDPR | Until the account is deleted |
| The content of your sites: text, images and contact details you enter yourself | Providing the service — building and publishing your site | Performance of a contract — Art. 6(1)(b) | Until the site or account is deleted |
| Plan and billing data: Stripe customer identifier, subscription status and period | Charging and activating your plan | Performance of a contract — Art. 6(1)(b) | Until the account is deleted |
| Invoice details: name, address, tax ID | Issuing and fiscalising invoices | Legal obligation — Art. 6(1)(c) | 11 years (Croatian Accounting Act, Art. 10) |
| IP address and browser details when signing in and submitting forms | Security, abuse prevention and rate limiting | Legitimate interest — Art. 6(1)(f) | No more than 12 months |
| Record of subscription cancellation and account deletion (without e-mail address or name) | Proof that an erasure request was carried out, and when | Legal obligation — Art. 6(1)(c) | 5 years |
| E-mail address of a person you invite to edit or take over your site | Sending the invitation and checking that it is accepted by that very person | Performance of a contract — Art. 6(1)(b) | Until accepted or declined, and no longer than 14 days |
| Record of support access to your account: who accessed it, when and for how long | Oversight of support access, and evidence of it | Legitimate interest — Art. 6(1)(f) | 24 months |
Site language. When you open izzylio.com and have not chosen a language yourself, we pick it from the country your IP address comes from: Croatian for Croatia, Bosnia and Herzegovina, Serbia and Montenegro, English everywhere else. The country is estimated on our own server, from a database we host ourselves — your IP address is not sent to anyone and is not stored. This applies to all visitors, including those without an account (legitimate interest — Art. 6(1)(f): showing the site in a language the visitor understands). You can change the language at any time; your choice is then remembered in a cookie. Country data: IP Geolocation by DB-IP (CC BY 4.0 licence).
3. Data of visitors to your site
When someone sends an enquiry through the contact form on a site you built with us, we forward their name, e-mail address, phone number and message to you, and store them so that delivery can be evidenced. For that data you are the controller and we are the processor — we process it solely on your instructions. The terms are set out in the Data Processing Agreement, which forms part of our contract with you.
We keep enquiries for 24 months and then delete them. Deleting your account also deletes every enquiry received through your sites.
4. Data from the commercial register
From time to time we approach newly incorporated companies with an offer of a free trial website. The data we use for this — company name, company ID, activity, registered address and publicly listed e-mail address — is taken from the Croatian commercial register, which is public. The legal basis is our legitimate interest in direct marketing towards legal persons (Art. 6(1)(f) GDPR).
Such a message is sent once and contains an opt-out link. If you opt out, we delete all of your data immediately and add the company ID to a permanent exclusion list so that you are never contacted again. If you do not reply at all, we delete your data and the trial site automatically and permanently no later than 30 days after the message was sent.
If you click the link confirming your interest, you thereby consent to further processing for the purpose of building and maintaining that site (Art. 6(1)(a)). You may withdraw that consent at any time, without giving reasons.
5. Who we share data with
We do not sell data and do not pass it to third parties for their own purposes. We use the following processors:
| Processor | What it processes | Where |
|---|---|---|
| Hetzner Online GmbH | Servers, database, file storage and e-mail | Finland and Germany (EU) |
| Stripe Payments Europe Ltd. | Card payment processing. We never see or store card details — they are entered directly with Stripe. | Ireland (EU), with possible access from the USA |
| binidex (language model) | Generating and refining site text from the description you enter | Germany (EU) — our own infrastructure |
Apart from transfers within the Stripe group, personal data is not transferred outside the European Economic Area. For that transfer Stripe applies the European Commission's standard contractual clauses.
6. Cookies
We use no tracking, advertising or analytics cookies, and we have no tools such as Google Analytics. We set only two strictly necessary cookies, described in our Cookie Policy.
7. Your rights
In respect of your personal data you have the right to:
- request access to the data we hold about you (Art. 15)
- request rectification of inaccurate data (Art. 16)
- request erasure (Art. 17) — you can also delete your account yourself, in account settings
- request restriction of processing (Art. 18)
- request portability of your data in a machine-readable format (Art. 20)
- object to processing based on legitimate interest (Art. 21) — including direct marketing, where we always accept the objection without examining your reasons
- withdraw consent at any time, without affecting the lawfulness of processing before withdrawal
Send your request to info@izzylio.com. We reply within one month at the latest, free of charge.
If you believe our processing breaches the law, you have the right to lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, azop.hr, or with the supervisory authority in your own country of residence.
8. What happens when you delete your account
Deleting your account permanently deletes your account, all your sites and their content, enquiries received and sign-in records. Published sites stop working immediately.
A free account is renewed once a year with one click. If it is not renewed, the site stops being public on the expiry date, and 30 days after expiry the account and all its data are deleted in the same way as if you had deleted it yourself. We send three reminders before that. The account of an invited editor of someone else's site renews itself while that access lasts.
The data remains for a while in backups, which are used solely to recover from a failure; backups kept away from the server are encrypted. It disappears from all backups no later than 30 days after deletion.
We do not delete invoices already issued for paid services. The obligation to retain them follows from the Croatian Accounting Act and is not overridden by the right to erasure (Art. 17(3)(b) GDPR). Those documents contain only the data required for an invoice and are used for nothing else.
9. Security
Traffic is protected with TLS. Passwords are stored only as Argon2 hashes and cannot be read by us. Access to the administration interface is protected by two-factor sign-in. Server access is restricted to cryptographic keys, and database backups are taken daily and held within the EU.
If a personal data breach occurs that is likely to present a risk to your rights, we will notify AZOP within 72 hours, and you without undue delay where the risk is high.
10. Support access to your account
If you ask for help, a member of our support team may temporarily access your account to resolve the issue — they see and may change what you would see and change in the interface, to the extent needed to resolve your request. The following always applies:
- you are notified by e-mail immediately, every time
- access lasts at most one hour and then ends automatically
- in this mode support cannot change billing or your subscription, your password or e-mail address, and cannot delete your account or sites — those decisions are yours
- every access is logged (who, when and for how long) and the record is kept for 24 months
The legal basis is performance of a contract (Art. 6(1)(b) GDPR) where you asked for help, or our legitimate interest (Art. 6(1)(f)) where a technical fault or abuse of the service must be dealt with. You are notified in that case as well.
Trial websites we built ourselves (Article 4) have no owner until the company claims them, so no notice is sent when they are accessed; the access is logged all the same.
If you received a notice but did not ask for help, please contact us at info@izzylio.com.
11. Changes
We may amend this policy. We will notify you of significant changes by e-mail at least 15 days in advance. The date from which the current version applies is shown at the top of this document.
This is a translation provided for convenience. In case of any discrepancy between this English text and the Croatian original, the Croatian version prevails.