Legal

Privacy Policy

Last updated: 27 August 2026

This policy explains what personal data AVENTO d.o.o. handles, why, and what you can do about it. It covers this website and our two products, aRento (property management) and EddyCross (eddy current inspection).

Who is responsible

Controller

AVENTO d.o.o. (AVENTO društvo s ograničenom odgovornošću za usluge)

Registered seat

Viganj 201, 20250 Orebić, Croatia

Office

Ulica Vilima Korajca 33, 10090 Zagreb, Croatia

OIB / VAT

47849256947 / HR47849256947

Court register

Commercial Court in Dubrovnik, MBS 090016254. Share capital €2,650.00, paid in full.

Contact

Through the contact form, or by post to the registered seat above.

Controller or processor?

The distinction matters, because it decides who you should approach about your data.

• For this website, and for the accounts of businesses that buy our software, we are the controller — we decide what is collected and why.
• For data that our customers put into aRento about their guests, tenants and suppliers, we are only the processor. The business operating the property is the controller. If you were a guest at a campsite or apartment that uses aRento, please contact that business first; we will assist them, but we cannot act on their data without their instruction.

What we collect, and why

Website visitors

This site uses Cloudflare Web Analytics, which measures page views without cookies and without building a profile of you. We do not run advertising trackers. If you email us, we keep the correspondence so we can answer it and refer back to it.

Customer accounts

For people who use our software we hold a name, email address, the role they have been given, and a record of sign-ins and significant actions. The legal basis is performance of our contract with the customer, and our legitimate interest in keeping the service secure and accountable.

Data our customers enter about other people

aRento is used to run accommodation, so our customers enter guest and business records into it. Depending on what they use, that can include names, contact details, identity document details required for guest registration, stay dates, invoices and payments. We process these strictly on our customers' instructions, under a data processing agreement.

Statutory reporting

Where a customer uses aRento's Croatian compliance features, data is transmitted to the authorities the law names: guest registrations to eVisitor (Croatian National Tourist Board) and fiscalised invoices to the Tax Administration via FINA. The legal basis is compliance with a legal obligation that rests on our customer.

Bank account information

aRento can display a customer's own bank balances and transactions. This is worth setting out plainly, because it is the part people ask about:

• Access is read-only. It can show balances and transactions. It cannot make a payment, move money, or change anything at the bank.
• We never see your bank login. You authenticate on your own bank's website. Your credentials are never sent to us and we could not store them if we wanted to.
• The connection is made through Enable Banking Oy (Finland), a payment institution licensed and supervised as an account information service provider by the Finnish Financial Supervisory Authority, under the EU PSD2 framework.
• Your consent has a fixed lifetime set by your bank — at most 180 days — after which access stops on its own unless you grant it again.
• You can withdraw consent at any time, in aRento or at your bank. Doing it in aRento revokes the consent and deletes the stored balances and transactions with it.

Who else sees the data

We keep this list short on purpose, and we do not sell data to anyone.

• Microsoft Azure — hosting and databases, in EU data centres.
• Enable Banking Oy (Finland) — bank connections, where a customer uses them.
• FINA and the Croatian Tax Administration — fiscalised invoices.
• Croatian National Tourist Board (eVisitor) — guest registrations.
• Cloudflare — website analytics and protection.

We may also disclose data where the law requires it. Our processing takes place within the European Economic Area; where a provider processes data outside it, that transfer relies on the European Commission's standard contractual clauses.

How long we keep it

• Account and customer records: for as long as the account exists, then up to one year.
• Accounting and invoicing records: eleven years, as Croatian law requires.
• Guest and stay records: for the period our customer sets, within the limits the law allows.
• Bank balances and transactions: until consent is withdrawn or the connection removed, whichever comes first.
• Security and audit logs: normally twelve months.

How we protect it

Data is encrypted in transit and at rest. Access inside aRento is governed by per-role permissions, and the parts of the application that touch money or identity documents are separately permissioned rather than bundled with general access. Credentials for external services are held in a secrets vault, never in source code.

Your rights

Under the GDPR you may ask us for access to your personal data, correction, erasure, restriction of processing, portability, and you may object to processing based on legitimate interests. Where processing rests on consent, you may withdraw it at any time without affecting what was done beforehand.

Use the contact form, or write to our registered seat, and we will respond within one month. If we are the processor rather than the controller, we will tell you promptly and point you to the business that holds the data.

You also have the right to complain to the Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb, or to the supervisory authority where you live.

Changes

If we change this policy we will update the date at the top. Where a change materially affects our customers, we will tell them directly rather than relying on them noticing.