Privacy Policy

Kinta Labs d.o.o., Zagreb, is the controller of personal data (the "Controller") collected through the "Kinta" application (the "Application") and the website www.kinta.co (the "Site"). Respecting your right to privacy, this Privacy Policy, in accordance with the Personal Data Protection Act ("Official Gazette of RS", No. 87/2018), as well as European Union laws and standards, informs you of the following: the types of personal data we collect and process; the purpose of data collection and processing; the legal basis for processing; the data retention period; data security; the rights of data subjects; transfer of data to third parties; cookies and tracking technologies; the Controller's contact details; and changes to this Privacy Policy. This Privacy Policy is an integral part of the Terms of Use for our Application and Site. Definitions used in this document have the same meaning as in the Terms of Use. This Privacy Policy applies to all persons who download the Application to their devices, as well as all persons who access our Site.

Types of personal data we collect and process

Technical and usage data. Simply by accessing the Site or downloading the Application, the following data is automatically collected: the device used to access the service, operating system and its version, device brand and type, data about the internet network used, location data (IP address), duration of Application use, as well as settings and performance data, collected via cookies and tracking technologies. Technical and usage data enables the functionality, stability and security of the Application and the Site.

Personal data collected upon newsletter subscription. If you subscribe to the Newsletter on our Site, we collect your first name, last name and email address.

Personal data collected when creating a user account. When creating a user account, we collect your first name, last name and email address. Each account is automatically assigned a randomly generated 6-character ID code, used for internal identification within the Application. In this way we apply a pseudonymization measure, significantly increasing the level of protection of your privacy and data security.

Fiscal receipt data. When you scan a fiscal receipt in the Application, the data contained on the receipt is retrieved and securely stored in a Firebase database. The Application requests camera access solely for the purpose of scanning QR codes and the contents of fiscal receipts. Images are not used to identify users, nor are they shared with third parties for advertising purposes — they are used solely to provide the services you requested from us.

Data on interactions with Penny AI. The Application uses artificial-intelligence technology to provide interactive analysis on request and real-time answers to queries. When using Penny AI, the content of the messages you send, as well as basic session data, is collected solely for the purpose of providing the services you requested from us.

User behavior data during use of the Application and Site. To improve the performance of the Application and Site, as well as to personalize and enhance the user experience, we collect data on user behavior during use. We collect this type of data only with your explicit consent. We use Google Analytics for Firebase to collect analytical data in the Application.

Note: if you wish to use additional features of our Application that are subject to a separate fee, payment service providers collect the information necessary to process payment for our services. We do not process your credit or debit card data, since payment is made through the App Store or Google Play platform. The Application uses automated analysis (profiling) via Penny AI to give you insight into your spending, while we use Google Analytics to analyze use of the Application itself. This processing is carried out solely to improve your user experience.

Purpose of collecting and processing data

Kinta Labs d.o.o., Zagreb, as controller of personal data, collects and processes personal data solely for the following purposes: providing the services you requested in connection with using the Application; enabling the functionality, stability and security of the Application and Site; sending the Newsletter (if you are subscribed); creating a user account; and improving and personalizing the user experience.

Legal basis for data processing

The legal basis for processing your personal data is: your consent; performance of a contractual obligation; pursuit of the Controller's legitimate interests; and compliance with legal obligations we are subject to.

Data retention period

Your data may be processed for as long as the purpose of processing exists, or until consent or approval for processing is withdrawn, a contractual obligation is fulfilled, or an objection is raised in cases where the legal basis is the Controller's legitimate interest. All data you have provided to us during use of the Application or Site will also be deleted at your request, by exercising the right to erasure (see "Rights of data subjects" below). In the event the company ceases operations or discontinues the service, your data will be permanently deleted. Receipt data is retained until deleted by the user or until the user account is deleted. Analytical data is retained in aggregated, de-identified form for up to 14 months.

Data security

Kinta Labs d.o.o., as controller of personal data, applies appropriate technical and organizational security measures to ensure the security of your data. These measures include encryption of data in transit, secure storage of data in our databases, restricting access to personal data to authorized personnel only, and regularly monitoring and improving our security procedures to maintain a high standard of data protection. Should any compromise of your personal data occur, the Controller will notify you in accordance with applicable regulations.

Rights of data subjects

As a User, in accordance with the Personal Data Protection Act and the EU General Data Protection Regulation (GDPR), you have the following rights: the right to request information from the Controller on whether it processes your personal data, and to access that data; the right to request correction of inaccurate personal data without undue delay, as well as the right to have personal data completed and the right to erasure of data; the right to restrict the processing of your personal data; the right to receive from the Controller the personal data you previously provided to it, in a structured, commonly used and machine-readable format, and the right to transmit that data to another controller; the right to object at any time to the processing of your personal data, after which processing will be suspended unless there are compelling legitimate grounds that override your interests; the right to withdraw consent where data is processed on the basis of consent, provided that withdrawal does not affect the lawfulness of processing carried out before the withdrawal; and the right to lodge a complaint with the competent supervisory authority. The supervisory authority in the Republic of Serbia is the Commissioner for Information of Public Importance and Personal Data Protection.

Transfer of data to third parties

In processing data, we also use the support of external processors, who may have access to your data solely on the basis of our authorization and in accordance with our instructions. We only engage processors who provide sufficient guarantees of implementing appropriate technical and organizational data-protection measures. Your data may also be transferred to other countries and international organizations. Google LLC (Google Cloud, Firebase, Google Gemini), as our processor, is among the organizations certified under the Data Privacy Framework. In the case of transfers of data to other processors in the USA, Standard Contractual Clauses on data protection will apply.

Cookies and tracking technologies

Our Site and Application use cookies and tracking technologies adapted for mobile platforms. These technologies enable recognition of your device, as well as tracking and analysis of your behavior. For the purpose of continuous improvement, we collect information about how you use the Site, your interests, the pages you have visited, data about the logged-in user, interaction with content, measurement of certain aspects of Site performance, information about the device used to access the Site, the location from which the Site is accessed, and the operating system. Our Site and Application use Google Analytics and Google Analytics for Firebase. These technologies enable analysis of how you use the Site and Application, as well as the creation of reports and the provision of additional services related to their use. For more details on how Google processes and uses data, visit policies.google.com/technologies/partner-sites.

We use various sets of cookies, categorized as follows:

Aside from necessary cookies, we use analytical and marketing cookies only with your explicit consent, given via a banner on the Site or after creating a user account in the Application. You can manage your preferences at any time via the settings available in the Application, under "Settings."

Controller's contact details

The controller of your personal data is Kinta Labs d.o.o., Zagreb. Registered address: Savska cesta 32, Zagreb, Republic of Croatia. Legal representative: Tijana Gvozdenović. Any questions regarding the processing of your personal data and the exercise of your rights can be sent to Show email.

Changes to the Privacy Policy

This Privacy Policy may be amended and adapted to align with applicable regulations, as well as in the event of changes to business practices in the area of personal data protection. We will notify you of any significant changes via a prominent notice on our Site and within the Application.