Privacy policy

1. Controller and contact

The controller is Top Đir j.d.o.o. (full registered name: Top Đir jednostavno društvo s ograničenom odgovornošću za oglašavanje i marketing), Ulica Hermana Bužana 29, 10000 Zagreb, Republic of Croatia, Croatian tax number (OIB): 20851512243, registration number (MBS): 081728397, EUID: HRSR.081728397, registered with the Commercial Court in Zagreb. Top Đir j.d.o.o. determines the purposes and means of personal-data processing within the Top Đir platform.

The share capital is EUR 10.00 and is fully paid. The director is Branimir Lozo.

An account deletion request can be submitted in the app. The contact for other rights and questions is info@topdir.hr.

2. Data we process and why

For registration and service delivery we process email, email-confirmation and sign-in data, profile name and photo, legal-text acceptance and account-access status. Without mandatory data we cannot provide the account and contracted features.

When you choose a profile photo, we automatically check the number of detected faces in your browser and on our server. The photo is published only if exactly one face is detected. We do not store the face count as a separate record, compare it with an identity document or treat this check as identity verification. We process and retain the photo under the rules for profile content.

For listings and arrangements we process data entered by the user: listing type, origin, destination or meeting place, date and time, seat count, description, photos, offers, arrangement status and related identifiers. We do not track live movement; a user may voluntarily send an ordinary map link in chat.

For communication we process messages, replies, reactions, read receipts, private images and deletion state. For community trust we process mandatory ratings, optional comments and limited edit data. The legal basis for the core account, listing, arrangement and communication is performance of the Terms, while fraud prevention, security, moderation and audit trails rely on legitimate interests balanced against user rights.

3. Public visibility and user content

Visitors can browse listings without signing in; this view does not display the listing author's identity. Browsing listings does not grant access to private data. Signed-in users with the required access may see another person's limited profile, including profile name, profile photo, identity-verification badge, ratings and published comments. Email, private messages, private images and security data are not public.

The author controls the content of a listing, profile, message, photo or comment and is responsible for having the rights needed to publish it. Content made public or sent to another person may remain visible to that audience after the author leaves the screen, until it is removed under product, moderation or retention rules.

4. Community reputation and OG-raš

To calculate progress and benefits, we link existing completed arrangements with valid ratings received. We retain the account identifier, award time, qualifying rating reference and any reasoned revocation for as long as the account-linked entitlement is needed to provide the service, subject to general deletion and mandatory-retention rules. Other users with permitted profile access see the earned OG-raš badge, not your purchase price or private arrangement details.

5. Didit identity verification

Didit, as a specialised provider, performs document capture and checks, selfie/presence checks and related verification under its own rules. Top Đir does not store the document photo, selfie, document number or Croatian tax number (OIB) in its own database.

To link the verification result to an account and protect against abuse, Top Đir processes limited Didit data: user, person, session and process identifiers, status and decision, necessary warnings or reasons, session link and timestamps for acknowledgement, start, events, status changes and result confirmation.

A check may result in automatic approval, further review or decline and may affect access to certain features. If you believe a decision is wrong, contact info@topdir.hr; we will explain the reason, allow another attempt where permitted and review your objection.

6. Reports, moderation and security records

Top Đir does not routinely or indiscriminately read private chat. When a user reports a message, person or listing, the system may preserve the reported content, limited conversation context, reason, technical identifiers, contact voluntarily provided by a guest, processing status and audit trail. Authorised operators may access only what is needed for confidential review, safety, abuse handling, legal defence or a valid authority request.

We also process account and block status, moderation decisions, access and action logs, IP and security logs where needed, and technical signals used to detect fraud, attacks, fake accounts and ban evasion. Decisions must be proportionate, logged and subject to human review where they significantly affect a user.

7. Notifications, device and technical data

For app operation and push notifications we may process platform type, installation or push token, device and permission state, last activity, delivery attempts, delivery status and error code. We do not use this data for advertising tracking. The user controls system notifications in device settings.

For availability and protection of the service we process necessary request logs, app version, network and diagnostic data and security events. We do not use advertising analytics or a separate app-crash monitoring tool.

On the public topdir.hr website we use Cloudflare Web Analytics to measure aggregate visits, page views, referral sources, approximate country, device and browser types, and page-performance indicators. This measurement does not set analytics cookies, does not build individual visitor profiles, and is not enabled in the app at app.topdir.hr. Cloudflare processes the technical data needed to produce aggregate statistics under its privacy terms.

8. Purchases and Đirevi

During the free promotional period, purchase, allocation and spending of paid Đirevi are disabled. When payment is enabled through Google Play Billing or Apple's In-App Purchase system, Top Đir will not receive the full card number, CVV or direct-payment credentials.

If purchases are enabled, Top Đir will process product, store and account data, a purchase or transaction identifier, store-provided price and currency, verification status, and necessary timestamps and technical data to verify purchases, grant Đirevi, restore entitlements, process refunds or charge reversals, support users and meet accounting duties. We will tell users about any changes to this processing before enabling payments.

9. Sources, recipients and transfers

We receive data from the user, the user's device, other users who enter an arrangement or file a report, and identity, hosting, storage, push-delivery and, when enabled, app-store providers.

We do not sell personal data or share it for third-party direct marketing. Where necessary, data may be processed by contracted technical processors, Didit, hosting and storage providers such as Supabase, Cloudflare for aggregate public-website analytics, notification providers, Zoho Mail for business mail and support, Google and, when their features are enabled, ZeptoMail for transactional email and app stores. Data is shared with professional advisers and competent authorities where a valid legal basis exists.

Sign-in and account-security email passes through the delivery provider connected to the authentication system. That provider may process the recipient address, message content and technical delivery data. Signing up to use the app is not by itself a subscription to marketing email.

We do not promise that every provider or subprocessor is located exclusively in the EU/EEA. Transfers outside the EEA must have documented processing locations and roles, an adequacy decision or another appropriate transfer mechanism and, where required, supplementary safeguards; this also applies to processing existing users' data.

10. Retention

We retain data only for as long as needed for the stated purpose, safety, dispute handling and legal obligations. A listing stops being publicly visible after its scheduled time, cancellation or closure under the platform rules; a record may remain in history and linked arrangements. Messages, images and reviews have separate retention rules. After a message is deleted, only a technical deletion marker may remain, without its content.

We keep report evidence and associated reported message or image context for up to 180 days, unless an open investigation, security incident, legal obligation or claim requires longer preservation. A notification identifier remains while a device is active and is revoked or removed after logout, disabling notifications or a permanent delivery error.

Didit metadata, security and audit logs, purchase receipts, user content, backups and anonymised records do not necessarily share one retention period. The report-evidence period does not automatically apply to all email, support cases, notes or contact and deadline records. We delete or anonymise data when it is no longer needed for its purpose, unless the law requires longer retention or it is needed to protect rights.

11. Account deactivation and deletion

An in-app deletion request enters the handling process immediately and may restrict account access. Before data is deleted or anonymised, we review open arrangements, reports, legal duties, private files, Didit verification data and records that need to be retained.

We delete or irreversibly anonymise data without undue delay after review, except for elements we must or may retain for law, accounting, security, prevention of repeat abuse, an open dispute or protection of other users' rights. The statutory deadline for responding to a GDPR request is not a promise that every copy of every data category will be physically erased in exactly 30 days. Backups expire under controlled rotation and are not returned to ordinary use.

12. User rights

Depending on the circumstances, a user may request access and a copy, rectification, erasure, restriction, data portability, object to processing based on legitimate interests and withdraw consent where consent is the basis. Withdrawal does not affect the lawfulness of earlier processing.

A user may request human review and contest a decision made solely by automated means that produces legal or similarly significant effects. If the user believes their rights were infringed, they may contact Top Đir and lodge a complaint with the Croatian Personal Data Protection Agency (AZOP) or another competent supervisory authority.

13. Security and incidents

We use TLS in transit, private storage, limited server-signed access to private objects, access control, RLS, audit logs, operator multi-factor authentication, encrypted backups and recovery testing. No system is absolutely secure, but we review safeguards and limit access according to actual need.

Suspected incidents or abuse should be reported through the official channel. Where an incident creates a risk to people's rights and freedoms, Top Đir follows applicable rules for notifying the supervisory authority and affected people.

14. Children, changes and effective date

Top Đir is intended for people aged 18 or over. Minors may not open an account, publish listings or send offers. If we learn that a minor has opened an account, we will restrict access and handle the data in accordance with applicable rules and requests protecting that person's rights.

This Privacy Policy takes effect on 21 September 2026. We will explain material changes clearly and request renewed acknowledgement where required by the nature of the change or the legal basis.