Privacy Policy

1. Scope of this policy

This policy applies to the website unitlook.com and to the UnitLook application, available as a web application and as a mobile application for Android and iOS (the "Application").

For data submitted through the forms on unitlook.com, UnitPick is the data controller. The Application is used by organisations (companies, institutions, municipalities) to manage tickets, projects and work records. For data that users enter into the Application, the data controller is the organisation that created the user's account, and UnitPick processes that data on its behalf as a processor under a data processing agreement (Art. 28 GDPR).

2. Website: data we collect

When you fill in the demo or contact form on our website, we collect the following personal data that you voluntarily provide:

• Full name — to address you personally
• Email address — to reply to your enquiry
• Company name (optional) — for business context
• Message (optional) — description of your query or need

We do not collect any other personal data on the website. We do not use tracking cookies or third-party analytics.

3. Application: data we process

The Application processes the following data:

• Account data — full name, email address, role, organisation (and partner), and a password, which is stored only in a protected (hashed) form
• Content entered by users — tickets, descriptions and comments, attachments (files and photos), projects, time entries and absences
• Settings — the Application language and saved view filters
• Device data for notifications — a push notification token, a random installation identifier, the platform (Android or iOS), the device name and the Application version; stored only if the user allows notifications
• Technical logs — for security and troubleshooting, the server may record the time and type of requests and the IP address

Camera and photos: the Application accesses them only when the user chooses to add an attachment, and the selected file is sent as an attachment to the ticket. Notifications: they are sent only with the user's permission, which can be withdrawn at any time in the device settings.

The Application does not collect device location or contacts, contains no advertising, and uses no third-party analytics or tracking.

4. Purpose and legal basis

Website. We process the data from the form solely to respond to your enquiry and, where relevant, to demonstrate the UnitLook application. The legal basis is your freely given and informed consent (Art. 6(1)(a) GDPR), expressed by voluntarily submitting the contact form.

Application. We process data in the Application solely to provide the service to the organisation that ordered it and on its instructions: signing in, working with tickets, projects, time entries and absences, and sending notifications about events on tickets. The legal basis is determined by the organisation as the data controller.

5. Retention

Data from the website form is kept only for as long as reasonably necessary to fulfil the purpose for which it was collected — typically until the business conversation is concluded or until you request deletion.

Data in the Application is kept while the organisation uses the service. The push notification token is deleted when the user signs out or turns notifications off, and is deactivated when the notification service rejects it as invalid. Deletion on request is described in section 8.

We do not sell, rent or share your data with third parties, except as described in section 6.

6. Third parties and infrastructure

• Hosting: Application data is stored on servers within the European Union.
• Push notifications: notifications are delivered through Expo and through Google Firebase Cloud Messaging (Android) and the Apple Push Notification service (iOS). The device token and the notification text pass through them: the ticket number and title, the name of the person who performed the action, and a short excerpt of the comment. These providers may process data outside the European Union with the safeguards required by the GDPR.
• Website form protection: we use Cloudflare Turnstile (cookie-free bot verification). Cloudflare Inc. may process limited technical data (IP address, user agent) in accordance with the Cloudflare Privacy Policy . Cloudflare is certified under the EU–U.S. Data Privacy Framework.

7. Your rights

Under the GDPR, you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — request correction of inaccurate data
• Erasure — request deletion of your data ("right to be forgotten")
• Restriction — request a temporary halt on processing
• Portability — receive your data in a machine-readable format
• Objection — object to processing at any time
• Withdrawal of consent — withdraw consent without negative consequences

To exercise any of these rights, contact us at: info@…. We will respond within 30 days. If your data is processed in the Application, you can also address your request to the organisation that created your account; we will assist that organisation in fulfilling it.

You also have the right to lodge a complaint with your local data protection authority. In Croatia: AZOP — azop.hr.

8. Deleting your account and data

Accounts in the Application are created by the user's organisation. You can request deletion of your account and data in either of these ways:

• Send an email to info@… with the subject "Data deletion". State the account email address and the organisation. To protect your data, we may ask you to confirm your identity.
• Contact the administrator of your organisation, who manages user accounts.

We process the request within 30 days.

What is deleted: account data (full name, email address), the push notification token and personal settings.

What may be kept: business records that the user entered on behalf of the organisation (tickets, comments, time and absence records) may be retained by the organisation as the data controller where required by law or by its legitimate interest; in that case, personal data linked to the account is removed as far as possible. Data may remain in backups until they expire in the normal course.

9. Security

We implement reasonable technical and organisational safeguards to prevent unauthorised access, loss or misuse of your personal data. All communication with our website and the Application is encrypted via HTTPS, and passwords are stored only in hashed form.

10. Changes to this policy

This Privacy Policy may be updated from time to time. The date of the last revision is always shown at the top of this page. Continued use of the website or the Application after any changes constitutes acceptance of the updated policy.

11. Contact

For any privacy-related questions, please contact us at:
info@…