Privacy Policy

1. Introduction

This Privacy Policy explains how Reputation Systems d.o.o. collects, uses, stores, and protects personal data of visitors and users of the review-advisor.com website (“Service”, “Platform”).

By using our website and services, you agree to the practices described in this Privacy Policy. If you disagree with any part of this Policy, please do not use our website.

Our processing of personal data complies with the General Data Protection Regulation (EU) 2016/679 (“GDPR”) and applicable Croatian data protection law (the Act on the Implementation of the General Data Protection Regulation, NN 42/2018).

2. Data Controller

The data controller for personal data collected through review-advisor.com is:

Reputation Systems d.o.o.
Company registration number (OIB): 58841524654
Ulica Đure Crnatka 24, 10000 Zagreb, Croatia
Privacy contact email: hi@review-advisor.com

We have not appointed a Data Protection Officer (DPO). Should one be appointed in the future, their contact details will be listed here.

3. What Data We Collect

3.1 Information You Provide Directly

Depending on how you use the Platform, we may collect:

• first and last name
• email address
• phone number
• company name and job title
• login credentials (username, password)
• content you submit via contact forms, enquiries, or support requests
• information provided when subscribing to our newsletter

3.2 Account and Subscription Information

If you register as a business user of the Platform (e.g. a hotel, restaurant, or other company monitoring its online reputation), we may process account information, subscription history, and billing records. Payment card details are processed by our payment service providers and are not stored on our own servers.

3.3 Review and Feedback Data

Where our business customers use the Platform to collect and manage reviews from their guests or clients, the Platform may process:

• the name of the person who left the review
• the content and rating of the review
• publicly available review content from external platforms (e.g. Google, TripAdvisor, Booking.com, Facebook)

For this category of data, our business customer (e.g. the hotel or company using the Platform) is generally the data controller for its guests’ data, while Reputation Systems d.o.o. acts as a data processor, processing such data solely on that customer’s instructions and in accordance with a data processing agreement (DPA).

3.4 Technical and Usage Information

When you visit our website, we automatically collect:

• IP address
• browser type and version
• operating system
• pages visited and time spent on them
• click and interaction data
• the referring website you arrived from

3.5 Information from Third-Party Platforms

When our customers connect external services (e.g. Google Business Profile, Facebook, TripAdvisor) to the Platform, we may collect publicly available data from those platforms as necessary to provide our services (e.g. reviews, ratings, basic account identifiers).

4. Purposes and Legal Bases for Processing

We process personal data on the following legal bases under Article 6 GDPR:

5. Cookies

Our website uses cookies and similar tracking technologies to enable core functionality, improve user experience, and analyse how the site is used.

• Necessary cookies — required for basic site functionality (e.g. security, authentication, remembering consent preferences). These do not require consent.
• Analytics cookies — used to understand how visitors use the site (e.g. Google Analytics or similar). Used only with your consent.
• Marketing cookies — used to measure advertising effectiveness and for any remarketing. Used only with your consent.

This site currently uses the following non-essential cookies, each of which is only set with your consent:

A cookie consent banner is implemented on the site, allowing visitors to accept or reject non-essential cookies before they are set. You can change your consent preferences at any time through the cookie management tool on the site or through your browser settings.

6. Artificial Intelligence and Automated Tools

The Platform may use automated tools, including artificial intelligence, to support certain features, such as sentiment analysis of reviews or suggested replies to reviews. These tools are intended solely to assist Platform users and do not make automated decisions producing legal or similarly significant effects on individuals. Review data is not used to train external AI models without explicit permission.

7. Data Retention

We retain personal data only for as long as necessary to fulfil the purposes for which it was collected, including:

• account data — for as long as the account remains active, and for 5 years after account closure
• financial and accounting records — in accordance with statutory retention periods (generally 11 years under Croatian accounting regulations, or as otherwise required by applicable law)
• data collected on the basis of consent (newsletter, marketing) — until consent is withdrawn
• review data processed on behalf of our business customers — in accordance with that customer’s instructions as data controller, or the terms of the applicable data processing agreement

8. Recipients of Data and Service Providers

We may share personal data with trusted service providers who support the operation of the Platform, for example:

• cloud hosting and infrastructure providers
• email service providers
• analytics tool providers
• payment service providers (for subscription billing)
• third-party review platforms with which the Platform integrates (e.g. Google, TripAdvisor, Facebook)

The service providers we currently use include:

• Hetzner Online GmbH (Germany) — server hosting and infrastructure; our servers are located in the European Union (Finland)
• Postmark (ActiveCampaign, LLC) — transactional email (account, billing and report emails) and newsletters
• Mailchimp (Intuit Inc.) — email communications and newsletters
• Teya — payment processing for subscription billing (Croatia)
• Google Analytics — website analytics
• Meta (Facebook) Pixel — advertising measurement and remarketing

All our service providers are contractually required to implement appropriate technical and organisational measures to protect personal data. We do not sell personal data to third parties.

9. International Data Transfers

Where personal data is transferred outside the European Economic Area (EEA) — for example due to the use of service providers based in the United States — we rely on appropriate safeguards, such as:

• European Commission adequacy decisions
• Standard Contractual Clauses (SCCs)
• the provider’s participation in the EU–US Data Privacy Framework, where applicable

10. Data Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, or alteration, including data encryption, access controls, and regular monitoring of system security. While we take reasonable precautions, no method of transmission over the internet is completely secure.

11. Your Rights as a Data Subject

Under the GDPR, you have the right to:

• request access to your personal data
• request correction of inaccurate data
• request erasure of your data (“right to be forgotten”)
• request restriction of processing
• object to processing based on legitimate interest
• request data portability
• withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal

Requests can be submitted to: hi@review-advisor.com

If you believe our processing of your data does not comply with applicable law, you have the right to lodge a complaint with the Croatian Data Protection Agency (Agencija za zaštitu osobnih podataka, AZOP), Selska cesta 136, 10 000 Zagreb, Croatia, www.azop.hr, or with the supervisory authority in your country of residence.

12. Children’s Data

Our Service is not directed at individuals under the age of 16, and we do not knowingly collect personal data from children of that age. If we become aware that we have collected a child’s data without appropriate parental or guardian consent, we will take steps to delete that data.

13. Links to Other Websites

Our site may contain links to third-party websites. We are not responsible for the privacy practices of those sites and encourage you to review their privacy policies.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on this page and updating the “Last updated” date.

15. Contact

For any questions about this Privacy Policy or the processing of your personal data, please contact:

Reputation Systems d.o.o.
Ulica Đure Crnatka 24, 10000 Zagreb, Croatia
Email: hi@review-advisor.com