Privacy Policy

Independent service — not a government app

Croatian Citizenship Portal is a private service operated by Good Citizenship Group. It is not owned, operated, or provided by the Government of the Republic of Croatia or any Croatian government authority, and it is not an official government app or website.

The Portal helps clients organize case requirements, supporting documents, and updates. It does not submit, process, approve, or decide a citizenship application on behalf of a government authority. Users should rely on official government communications for official decisions, deadlines, and legal requirements.

Information we process

• Account information, including your email address and internal user ID.
• Authentication information, including access and refresh tokens used to keep you signed in. Native apps store sessions in iOS Keychain or Android Keystore-backed storage.
• Case information, including requirements, descriptions, statuses, progress, and update times connected to your case.
• Documents you select for a requirement, including PDFs, PNGs, JPEGs, prepared upload PDFs, filenames, file type, size, processing status, and processed PDFs.
• Notifications, including case and document messages, read status, timestamps, and the relevant requirement.
• Push delivery information, including a device notification token and delivery information when device notifications are enabled.
• Support communications sent to the public contact email address.
• Basic website technical information necessarily processed by the hosting provider to serve and protect this website.

Information we do not currently collect for these purposes

• Advertising identifiers, cross-app tracking information, advertising profiles, or analytics events and analytics SDK data in the current mobile apps.
• Personal data for sale.
• Contact lists, precise location, microphone recordings, calendar, health, or payment data.

How we use information

• To authenticate users, restore sessions, and show the correct case requirements and progress.
• To receive, verify, process, store, and provide access to supporting documents.
• To deliver in-app and optional device notifications.
• To provide support, password reset, security, fraud prevention, account deletion, maintenance, troubleshooting, and legal compliance.

Document handling

The app validates and prepares a selected file for upload. The upload is placed in private quarantine storage and the backend verifies a PDF before making it available as a processed document.

A document can be rejected or fail processing. Processed documents remain private and are accessed through short-lived links. A successful upload does not mean a document has been accepted for a citizenship case or by a government authority.

When information is shared

• Supabase for authentication, database services, private document storage, signed links, and backend processing.
• Apple Push Notification service for delivery to Apple devices when enabled.
• Firebase Cloud Messaging and Google for delivery to Android devices when enabled.
• Cloudflare for delivery and protection of the public website.
• Professional advisers, regulators, courts, authorities, or a properly managed successor operator when legally required or appropriate.

Legal bases

We process personal data only where a legal basis applies. Depending on the processing activity, this may be to perform a contract or take steps you request, pursue legitimate interests in operating and securing the service, comply with legal obligations, establish or defend legal claims, or act with consent where consent is required. You may withdraw consent at any time, without affecting processing completed before withdrawal.

Retention

We keep personal data only for as long as needed to provide and secure the Portal, support your application, meet legal obligations, and establish or defend legal claims. When data is no longer needed, we delete or de-identify it. Protected backup copies may remain temporarily until they are overwritten through the normal backup cycle.

Account and application data, uploaded documents, notifications, push tokens, support messages, security records, and backups may follow different retention periods. We review those periods and delete or de-identify data when its purpose expires, unless the law requires longer retention.

Security

The service uses HTTPS/TLS in transit. Native sessions are kept in platform-protected storage. Access to case data and document records is scoped to the authenticated user. Documents are stored privately and processed documents use short-lived access links.

No system can guarantee absolute security.

International processing

Good Citizenship Group is located in Croatia. Service providers may process personal data in other countries. Where required, transfers outside the European Economic Area use safeguards provided by applicable data-protection law.

Your choices and rights

• Correct account information or ask for access to personal data.
• Request deletion through the account-deletion page.
• Turn off general push announcements in the app or device notifications in operating-system settings.
• Exercise applicable privacy rights based on your location and lodge a complaint with an applicable data-protection authority where that right exists.

Children

The Portal is intended for adult clients and authorized adult representatives and is not directed to children. If information about a child is needed for a citizenship case, it must be provided by or under the direction of a parent, legal guardian, or other person legally authorized to act for the child. Contact us if you believe a child submitted personal data directly without appropriate authorization so we can review and, where required, delete it.

Changes to this policy

The effective date will be updated when this policy changes. Material changes will be communicated where required.

Contact

Good Citizenship Group is the operator. Privacy questions can be sent to [email protected].