Privacy Policy

Last updated: 7 November 2026

This policy explains what personal data OrionWP collects, why we collect it, how long we keep it and what rights you have. It applies to orionwp.com and orionwp.hr, to our web design, development, hosting and maintenance services, and to our internal business tools.

1. Who we are

The data controller is Klaudija Nikolić, trading as OrionWP, Vladimira Gortana 90, 32100 Vinkovci, Croatia. OIB / VAT ID: HR02363753189. Contact for all privacy questions: info@orionwp.com.

2. What data we collect

Contact and enquiry data – your name, e-mail, phone, company and the content of your message when you contact us, book a call or request a quote.
Client and billing data – company name, address, OIB/VAT number, contact person, ordered services, invoices and payment status.
Account data – if you buy through our online store or use the customer dashboard: login e-mail, order history and subscriptions. Card payments are processed by our payment provider; we never see or store your full card number.
Project data – website content, domain and hosting details and access credentials you share with us so we can build or maintain your website.
Technical data – IP address, browser and device type, pages visited and similar information collected through server logs and, with your consent, analytics cookies.

3. Why we use it and on what legal basis

To answer enquiries and prepare offers – steps taken at your request before a contract (GDPR Art. 6(1)(b)).
To deliver our services, host and maintain websites and provide support – performance of a contract (Art. 6(1)(b)).
To issue invoices and keep accounting records – legal obligation (Art. 6(1)(c)).
To keep our websites and systems secure, prevent abuse and improve our services – our legitimate interest (Art. 6(1)(f)).
Analytics and marketing cookies – only with your consent (Art. 6(1)(a)), which you can withdraw at any time in the cookie settings.

We do not sell personal data and we do not use it for automated decision-making or profiling.

4. Who we share it with

We share data only with service providers that help us run the business, and only as much as they need:

hosting and server providers for our websites and client websites,
payment and e-commerce providers (SureCart and its payment processors),
our invoicing system (Parra) and our external accountant,
e-mail, cloud storage and productivity services (for example Google Workspace / Google Drive),
freelance platforms such as Fiverr, when you order through them,
public authorities, when the law requires it.

Some providers are located outside the EU/EEA. In those cases the transfer is protected by an adequacy decision or by the European Commission’s Standard Contractual Clauses.

5. How long we keep it

Invoices and accounting records: as long as Croatian accounting and tax law requires (currently 11 years).
Client and project data: for the duration of our cooperation and up to 3 years after it ends, unless a longer period is needed for legal claims.
Enquiries that did not lead to cooperation: up to 12 months.
Cookies: as described in our Cookie Policy and the cookie banner.

6. Internal tools and Google user data

OrionWP uses an internal business application, AgencyFlow, available only to OrionWP staff. AgencyFlow can connect to the Google account of the staff member who signs in, to allow sign-in with Google and to save invoices into that person’s own Google Drive folders for bookkeeping. AgencyFlow only reads and creates the files and folders needed for that purpose. Data received from Google is not shared with third parties, not used for advertising and not used to train AI models. The access can be removed at any time in the Google account settings or inside AgencyFlow.

AgencyFlow’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

7. Security

We protect data with encrypted connections (HTTPS), access limited to authorised people, two-factor authentication on internal systems, encrypted backups and regular software updates. No system is completely secure, so if a breach affecting your data occurs, we will inform you and the supervisory authority as the law requires.

8. Your rights

You have the right to access your data, to have it corrected or deleted, to restrict or object to processing, to data portability and to withdraw consent at any time. To use any of these rights, write to info@orionwp.com; we will reply within 30 days. You can also lodge a complaint with the Croatian Personal Data Protection Agency (AZOP), azop.hr.

9. Changes to this policy

We may update this policy when our services or the law change. The date at the top always shows the latest version.