Privacy Policy

The controller of your personal data, meaning the entity that determines the purposes and means of processing, is:

Controller

MODELITY društvo s ograničenom odgovornošću za informatičke usluge (Modelity d.o.o.)

Brand

Phonos, a product of Aiva (aiva.hr)

Registered office

Trg dr. Žarka Dolinara 18, Koprivnica

OIB (company tax number)

33666234446

Data protection contact

alen@aiva.hr

We have not appointed a data protection officer, as this is not mandatory under Article 37 GDPR given our activities and the scale of our processing. For any data protection matter, please write to the email address above.

We collect only the data we genuinely need for a specific purpose. It falls into the following categories:

Contact form data

You provide this voluntarily when you send us an enquiry through the form:

• full name
• email address
• company name (optional)
• indicative budget (optional)
• the content of the message you send us

Intro call booking data

Appointments are booked through Calendly, which opens on its own website. The data you enter there (name, email address, chosen time slot and any note) is collected by Calendly and passed to us so we can arrange and hold the meeting.

AI assistant conversation data

A chat widget is available on the site. If you use it, the content of the messages you type and technical data about the chat session are processed. Please do not enter sensitive personal data or confidential business information into the chat.

Technical data and server logs

Collected automatically on every visit to the site:

• IP address
• browser and operating system type and version
• date and time of access and the pages viewed
• the source you arrived from

Display preferences

Your choice of dark or light mode is stored in your browser's local storage. It stays on your device and is not transmitted to us or to any third party.

Voice demo data

The AI recepcija page offers a voice demonstration that starts only on your explicit action. If you start it, your browser will ask for microphone access, and your speech together with the agent's replies is processed by ElevenLabs Inc. in the United States. If you do not start it, the microphone is never used and no voice data is created. Please do not speak sensitive personal data or confidential business information during the demonstration.

Please note that your IP address is also used to rate-limit form submissions as protection against abuse, and appears in the internal notification email we receive when an enquiry comes in.

Every processing operation rests on a clearly identified legal basis under Article 6 GDPR:

• Responding to enquiries sent through the contact form

  Legitimate interest (Art. 6(1)(f))

  Our legitimate interest is to reply to someone who has contacted us of their own accord. If the enquiry moves towards an engagement, the basis shifts to steps taken at the data subject's request prior to entering into a contract (Art. 6(1)(b)).

• Arranging and holding an intro call

  Pre-contractual steps (Art. 6(1)(b))

  Processing is necessary so that we can arrange a time at your request and prepare for the conversation.

• Delivering our services and performing client contracts

  Performance of a contract (Art. 6(1)(b))

  Processing of client contact persons' data in order to carry out the agreed engagement.

• Operating the AI chat assistant on the site

  Consent (Art. 6(1)(a))

  The widget loads only after you accept cookies for that purpose in the consent banner. If you do not consent, the widget does not load and no conversation content is created.

• Site security and abuse prevention

  Legitimate interest (Art. 6(1)(f))

  Rate limiting, spam protection and server logging so that incidents can be detected.

• Measuring traffic and improving the site

  Consent (Art. 6(1)(a))

  Analytics runs only where enabled. The solution we use works without cookies and does not track individual visitors.

• Meeting legal obligations

  Legal obligation (Art. 6(1)(c))

  Obligations arising from accounting, tax and other applicable legislation.

• Voice demonstration of the AI receptionist

  Consent (Art. 6(1)(a))

  You start the demonstration by an explicit action, after being told that it uses your microphone and that your speech is processed by a provider in the USA. You can withdraw consent by ending the call and leaving the page; data already processed is deleted within the periods set out below.

We keep data only for as long as it is needed for the purpose it was collected for, or for as long as the law requires:

Contact form enquiries that do not lead to an engagement

12 months from the last communication

Client data and contractual documentation

For the duration of the engagement, and thereafter for the periods prescribed by accounting and tax legislation

Server logs and security logs

Up to 12 months

AI assistant conversation history

In line with the provider's settings and retention periods, as a rule up to 12 months

Appointment booking data

Up to 12 months after the appointment is held or cancelled

Voice demo recordings and transcripts

In line with ElevenLabs' settings and retention periods, as a rule up to 30 days

Once these periods expire, data is deleted or irreversibly anonymised. You may request deletion earlier, except where we are required to retain the data to meet a legal obligation or for the establishment, exercise or defence of legal claims.

We do not sell, rent or trade your personal data to third parties for their own purposes. We share it only with service providers who process it on our behalf and on our instructions (processors), with whom we have concluded, or are in the process of concluding, data processing agreements under Article 28 GDPR:

• Vercel Inc.

  Website hosting and server logs

  Processing location: EU / USA

• Resend

  Delivery of contact form emails

  Processing location: USA

• Chatbase

  AI chat assistant on the site

  Processing location: USA

• Calendly LLC

  Intro call scheduling

  Processing location: USA

• Plausible Insights OÜ

  Cookieless traffic statistics

  Processing location: EU (Estonia)

• Usercentrics A/S (Cookiebot)

  Cookie consent management

  Processing location: EU (Denmark)

• Sanity AS

  Content management system for the site

  Processing location: EU / Norway

• ElevenLabs Inc.

  Voice AI agent in the on-site demo (speech processing)

  Processing location: USA

Typefaces are served from our own server, because fonts are bundled into the application at build time. As a result, visiting the site sends no requests to Google's servers and your IP address is never disclosed to Google.

We may also disclose data to competent authorities where we are required to do so by applicable law, or where it is necessary to protect our legal interests.

Some of the processors listed above are based in the United States. In those cases the transfer relies on the European Commission's Standard Contractual Clauses under Article 46 GDPR and/or on the recipient's participation in the EU-U.S. Data Privacy Framework under the European Commission's adequacy decision pursuant to Article 45 GDPR, together with supplementary technical and organisational safeguards.

You may request a copy of the safeguards we rely on at our data protection address: alen@aiva.hr

In relation to your personal data, you have the following rights:

Right of access

To obtain confirmation as to whether we process your personal data, and to be given access to that data and a copy of it.

Right to rectification

To have inaccurate data corrected and incomplete data completed.

Right to erasure

To have your data deleted where it is no longer necessary for the purpose it was collected for, or where you withdraw your consent.

Right to restriction of processing

To have processing temporarily suspended, for example while the accuracy of the data is verified or your objection is resolved.

Right to data portability

To receive the data you provided to us in a structured, commonly used and machine-readable format, and to transmit it to another controller.

Right to object

To object to processing based on our legitimate interest, in which case we will stop processing unless we can demonstrate compelling legitimate grounds to continue.

Right to withdraw consent

To withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.

Right to lodge a complaint

To lodge a complaint with the supervisory authority for personal data protection.

You can exercise any of these rights by writing to our data protection address. We will respond without undue delay and at the latest within one month of receiving your request. That period may be extended in justified cases, and we will tell you if it is. To protect your data we may ask you to confirm your identity. Exercising your rights is free of charge.

Cookies are small text files stored on your device when you visit a website. We use them as sparingly as possible, in the following categories:

Strictly necessary cookies

Required for the basic operation and security of the site. They are set without consent because the site cannot function properly without them.

Consent management cookies

Record your choice in the consent banner so that you are not asked again on every visit.

Analytics cookies

Set only with your consent. The analytics solution we use operates without cookies and does not track individual visitors or build profiles of them.

Chat assistant cookies

The chat widget may set cookies or use local storage in order to maintain the continuity of your conversation.

You can change or withdraw your consent at any time through the consent banner on the site. You can also delete all cookies yourself and block them in advance in your browser settings. Please note that disabling strictly necessary cookies may affect how the site works.

Your display mode preference is saved in your browser's local storage rather than in a cookie, and remains solely on your device.

We apply appropriate technical and organisational security measures: all traffic to the site is encrypted using HTTPS/TLS, access to data is limited to those who need it to do their job, the contact form is protected by rate limiting and a spam detection mechanism, and credentials and keys are held in a protected environment separate from the source code.

No security measure can guarantee absolute safety when data is transmitted over the internet, but we review and improve our measures regularly. In the event of a personal data breach likely to result in a high risk to your rights and freedoms, we will notify you and the supervisory authority within the periods prescribed by the GDPR.

We do not carry out automated decision-making that produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 GDPR. The AI assistant available on the site provides informational answers only and does not make decisions about you.

Our services are intended for business users and are not directed at people under the age of 16. We do not knowingly collect children's personal data. If you believe a child has provided us with their personal data, please contact us and we will remove it without delay.

We may update this policy from time to time to reflect changes in our services, technology or applicable law. The date of the last revision is shown at the top of this page. We will notify you of material changes by appropriate means, and we recommend reviewing the policy periodically.

For any question about this policy, about how we process your personal data, or to exercise your rights, please contact us at: alen@aiva.hr

If you believe that our processing of your personal data infringes data protection law, you have the right to lodge a complaint with the supervisory authority:

Address

Croatian Personal Data Protection Agency (AZOP), Selska cesta 136, 10000 Zagreb

Email

azop@azop.hr

Web

azop.hr

By accessing this website you agree to use it lawfully and in good faith. You may not use the site to transmit harmful, unlawful or offensive content, to collect data without authorisation, or in any manner that jeopardises its operation, availability or security. We reserve the right to restrict or deny access to the site at our discretion.

All content on this website, including text, graphics, logos, photographs and source code, is the property of Modelity d.o.o. or its licensors and is protected by copyright and intellectual property law. Reproduction, distribution, communication to the public or modification of the content without our prior written consent is not permitted.

The content of the site is published for information purposes and constitutes neither a binding offer nor professional advice. To the extent permitted by applicable law, we accept no liability for damage arising from the use of, or inability to use, the site. All relations arising from use of the site are governed by the law of the Republic of Croatia, and the competent court in Koprivnica shall have jurisdiction over any disputes.