Terms of Service

Digitalni Ugovori is an online service for preparing, concluding and administering loan contracts, and for signing documents electronically. The service is operated by registered legal name of the operating company ("we"). These Terms govern your use of the service; by using it, you accept them. The service lets you manage loan projects and party details, calculate repayment and generate contracts, sign documents electronically, record instalments and payments, exchange messages with the other parties, and use an AI assistant. The interface is available in Croatian, English and French.

We are not a bank, a lender, a credit institution or a credit intermediary. We do not grant loans, we do not assess creditworthiness, we do not recommend parties to one another, and we are not a party to any contract concluded through the service. The service is a tool with which the parties prepare, sign and administer their own contracts.

We do not hold your funds and we do not execute payments. The application records agreed instalments and payments. You make the payment yourself — money moves directly between the parties' accounts, never through us.

We do not give legal, financial or tax advice. The parties are responsible for the content of their contract and for performing it. confirm the regulatory status of the service — whether publishing loan projects or the claim-transfer marketplace requires any authorisation or registration with a competent authority, and state it here

You may use the service if you are at least 18 years old and have legal capacity, acting for yourself or as an authorised representative of a legal entity. Registration of new accounts is currently closed — an administrator opens accounts on request. An account is personal: you may not share or transfer it. The roles in the system are creditor, debtor and administrator, and what you can see and change depends on your role. confirm whether the service is offered to consumers, to businesses only, or to both — this decides which mandatory consumer rules apply

You are responsible for the accuracy of the data you enter and for keeping your password safe. Your session is held by a cookie on your device. If you suspect someone else has accessed your account, change your password immediately and tell us at contact email address for users. We treat actions taken from your account as yours.

A signing link is sent to the signer's email address and can be used to sign only once; afterwards it stays valid only for downloading their signed copy, until it expires. For a simple signature, possession of that link is the main evidence of who signed — so keep it like a password and never forward it.

You may use the service only for lawful purposes. In particular, you must not: sign in someone else's name without authority, enter another person's personal data without a legal basis, upload malicious or deliberately malformed files, try to bypass access controls, load the system with automated requests, or use the service for fraud, money laundering or evading the law. We may restrict or suspend access for an account that breaks these rules.

The documents, party details and messages you enter remain yours. You warrant that you are entitled to enter them — including the other party's personal data (name, address, OIB, IBAN, email) and the email addresses of the signers you invite. If you are the one entering data about a person, you are the one who needs a legal basis for it and who must inform that person where required.

How we process that data, where we store it and what rights you have is set out in the privacy policy. confirm the GDPR controller/processor split for personal data users enter about third parties, and attach a data processing agreement if we act as processor

The service distinguishes several tiers of electronic signature. They do not carry the same legal weight, and not all of them are available.

Available today:

— Simple electronic signature (SES): the signer draws or types a mark. The document is then sealed with the platform's own certificate, so any later alteration is detectable. That certificate identifies the platform, not the signer, and is itself neither qualified nor on any EU trusted list. The signer's identity is evidenced by the signing record (possession of the one-time link, IP address, browser details, timestamps), not by a certificate. SES is not a qualified signature.

— Qualified electronic signature (QES) with an eID card: the signer signs with their Croatian eID card via Web eID. The private key never leaves the card; we never see it.

— Your own signed document: you may upload a document you signed outside this service with your own qualified certificate. Its cryptographic tier is whatever your trust service provider gave it, not something we confer. Note: in our records and on the verification page the document carries the tier fixed by the flow that created the envelope — simple (SES) for a document uploaded for signing, qualified-card (QES) for a loan contract or claim cession. That tier is not derived from your certificate and need not match it.

Announced, not yet live:

— Advanced electronic signature (AES): SES plus additional factors verifying the signer's identity, recorded in the same log. before AES goes live, confirm how the signature-creation key is held and whether the signer retains sole control of it (eIDAS Art. 26(c)), and state that here

— Remote qualified electronic signature, through a qualified trust service provider. name of the qualified trust service provider, once remote QES goes live

We warrant what we actually do technically: that once signed, the document is sealed so that any later alteration is detectable; that every milestone (created, sent, viewed, signed, declined, completed) is written to a hash-chained log which verification recomputes, so that an in-place edit of a recorded event is detectable. Note: the chain detects edits to what is recorded; on its own it does not prove the log was not re-chained wholesale or its end removed — that needs an external anchor, which is not yet in place; and that we report the result of signature validation honestly — if a signature is not cryptographically verified, that is what it says.

We do not warrant that any tier of signature is sufficient for your particular purpose. Some transactions are required by law to be in writing, to have a notarised signature, or to carry a qualified electronic signature; SES and AES do not meet those requirements. We do not claim that SES is equivalent to a handwritten signature.

Judging whether the tier you chose is appropriate for your contract, and whether a court, a bank or another authority will accept it, is your responsibility — take legal advice if you need it. We do not give legal advice; neither the contract templates, nor the AI assistant's answers, nor any text in the interface is legal advice.

For every signed document we keep a signing record: the signer's email and name, per-signer status, a BLAKE3 hash of the one-time token (not the raw token), the IP address and browser details captured at signing, and — for card signatures — the details read from your certificate (subject, issuer, serial number; the subject contains your OIB). If an invitation is sent by e-mail, the full link separately passes through the outbound notification queue and mail provider.

We retain signed documents and that record even when you request erasure. This is a legal hold under Article 17(3)(b) and (e) GDPR: deleting them would destroy the evidence of a legally significant act and break the chain of evidence for the other parties to the same document. Everything else about you is anonymised in that case — the procedure is described in the privacy policy. retention period for signed documents and the signing evidence record

The service includes an AI assistant. When you use it, your chat messages are sent to an external large language model provider — that is why we ask for a separate consent for this feature. confirm whether the ai_chat_external consent is enforced as a hard gate on the send path, or is recorded as a checkbox — and state whichever is true Before any tool result reaches the model, we mask personal identifiers (OIB, IBAN) in it. The assistant's answers can be wrong or incomplete and are not legal advice; check them before you rely on them. You can withdraw the consent for this feature at any time. name of the large language model provider, the country where it processes data, a link to its terms, and whether it uses submitted content for model training

We work to keep the service available, but we do not offer it with a guaranteed level of availability. From time to time we have to stop it for maintenance or upgrades. Features may change, be added or be withdrawn; if withdrawing a feature materially affects you, we will tell you in advance. We also depend on outside services — email delivery, public time-stamping authorities and the EU trusted lists — and an outage there can temporarily prevent messages being sent or signatures being validated. availability commitment (SLA), if any, and how planned maintenance is announced

fee schedule — which features are free, which are charged, prices including VAT, billing period, payment methods, refunds

A fee you agree with the other party — for example the commission set in a loan project — is not our fee. The parties agree it and pay it between themselves; we do not charge it, do not receive it and do not intermediate it. if the service is charged to consumers, describe the 14-day right of withdrawal and how to exercise it

For damage caused intentionally or by gross negligence, and for damage to life or health, we are liable in full and these Terms do not limit that liability. Otherwise: liability cap and the exclusion of indirect damage and lost profit — set the figures and scope with a lawyer

We are not liable for the content of the contracts you conclude or for the other party's performance, for whether a third party or an authority accepts a given tier of signature, for the consequences of your forwarding a one-time signing link to someone else, or for outages at the outside services we depend on. whether professional indemnity insurance is held, and its details

You can close your account at any time. A deletion request has a 30-day grace period; after it, a nightly job anonymises your personal data across all tables, except the signing record described above. Before closing, you can request an export of your data.

We may restrict or end your access if you seriously or repeatedly breach these Terms, if the law or a decision of a competent authority requires it, or if we stop providing the service. We will notify you and leave a reasonable window to export your data, except where that is not possible. Ending your use does not affect contracts you have already concluded or documents you have already signed. notice period before an account is suspended or closed, and the window in which the user can export their data

We may change these Terms. We will tell you about material changes by email or by a notice in the application before they take effect. If you do not agree with a change, you can close your account before it takes effect; continuing to use the service after that means you accept it. Each version carries a label and a date, and your consents are recorded together with the version of the terms they relate to. notice period for changes to these terms (for example 15 or 30 days before they take effect) effective date and version label of these terms

These Terms and your use of the service are governed by Croatian law. If you are a consumer habitually resident in another EU Member State, the mandatory protective rules of that state still apply to you. The competent court is the court with subject-matter and territorial jurisdiction. Before starting a dispute, write to us directly at contact email address for users — most things are settled faster that way. the out-of-court consumer dispute resolution body we participate in, if any

These Terms were drawn up in Croatian. The Croatian version is authoritative; the English and French translations are provided for convenience.

The service is provided by registered legal name of the operating company, with its registered seat at registered seat address, OIB company OIB, entered in the court register: registry court and court register number (MBS). Share capital: share capital amount and whether it is paid in full. Board members: names of the board members. Contact: contact email address for users.