Terms of use

These terms of use (the “Terms”) govern the use of the duplo business software (the “Service”), provided by NIKOLA LAZIĆ PR REPSALIO (the “Provider”, “we”). By using the Service you accept these Terms. If you do not accept them, do not use the Service.

A Company is the legal entity or sole trader (preduzetnik) that opens an account and subscribes to the Service. A User is an individual who uses the Service within a Company, with their own account (sign-in by a one-time code sent to their email). The subscription applies to the Company, according to the plan chosen on the pricing page.

duplo is online business accounting software for companies, sole traders and accountants. Within the scope of the chosen plan and add-ons according to the current pricing, the Service includes: preparing business documents (quotes, proforma invoices, customer purchase orders, invoices, advance invoices, credit notes, delivery notes, work orders) and sending them by email; exchange with government systems on the Company’s instructions (e-invoices through SEF, the national e-invoicing system; e-delivery notes through the SEO system; the Central Invoice Register, CRF); lists of partners and items, received invoices, bank statements, inventory, fixed assets and business trips; payroll and other personal income with preparation of the PPP-PD payroll tax return and sick-leave records; VAT records and the VAT return; the KPO income ledger and the business overview; and bookkeeping (automatic journal entries, partner ledgers, statements of open items (IOS), books of account and financial statements) in the Accounting add-on and in the Biro plan, through which an accounting agency also runs its clients’ companies.

Features marked “coming soon” on the pricing page are not yet part of the Service. Features marked “beta” are available but are still being refined. The Service is provided “as is” and may change and improve over time.

All intellectual property rights in the duplo software (source code, design, database, documentation) belong to the Provider. The Provider grants the Company a non-exclusive, non-transferable right to use the Service for its own business needs for the duration of the subscription. Copying, decompiling, renting out or reselling the Service, or making it available to third parties outside the Company, is not permitted.

The number of users included in the subscription is determined by the chosen plan according to the current pricing; additional users are charged according to the pricing where the plan provides for it. The Company is responsible for all actions performed under its account, regardless of which User performed them, and must keep confidential the access to the email through which Users sign in.

The Provider makes reasonable efforts to keep the Service available and reliable, but does not guarantee uninterrupted or error-free operation. Planned maintenance and outages beyond the Provider’s control (force majeure, failures of the internet or of third-party services) are possible from time to time. We recommend that the Company regularly downloads PDF copies of important documents.

New companies get a 30-day free trial, with no payment card required. After that, use requires a subscription according to the current pricing, with annual or monthly billing — by proforma invoice, in the RSD equivalent at the middle exchange rate of the National Bank of Serbia (NBS) on the day the proforma invoice is issued. The subscription is activated once the payment is recorded. When the same plan is bought during the trial, the paid period starts when the trial ends (trial days are not lost); buying a different plan ends the trial and the paid period starts immediately.

Switching to a bigger plan during a paid period is charged as a prorated amount for the remaining days and takes effect once the payment is recorded, without changing the expiry date; switching to a smaller plan takes effect when the paid period expires. Add-ons (additional users, the Accounting add-on, client companies in the Biro plan) are charged according to the pricing and, when enabled mid-period, are charged pro rata for the remaining days. The Accounting add-on has its own 30-day trial, once per company. Client companies that an accounting agency opens in the Biro plan are covered by the agency’s subscription.

When the trial or the subscription expires, entering and editing data is paused (except for the subscription, settings and team), while existing data remains available for viewing, downloading documents and export. After a paid period expires, access remains for a further 7 days (time for the payment to arrive). The Company may cancel the subscription at any time — access lasts until the end of the paid period; amounts already paid are not refunded.

You agree to use the Service in accordance with the law and these Terms; not to attempt unauthorised access, not to interfere with the operation of the Service, and not to use it in a way that endangers the security or privacy of other companies and users.

Documents (proforma invoices, invoices, credit notes…) are created by the Company, which is responsible for their accuracy, completeness and legality — including tax treatment, numbering and mandatory elements. The Service may send documents to customers by email on the Company’s instructions and on its behalf; the Company is responsible for the accuracy of the contact details and for the legal basis of such communication. The Provider is not responsible for content sent on the Company’s instructions.

duplo is a tool for preparing documents and organising business. The Service does not provide tax, accounting or legal advice and does not replace an accountant or a tax adviser. The Company is responsible for the correctness of its business and tax decisions, as well as for the accuracy of the data it enters.

Automatic calculations and journal entries in the Service (e.g. VAT on documents and the VAT return, payroll and the PPP-PD tax return, per diems and travel expenses, depreciation, automatic journal entries and financial statements) are computed from statutory parameters and the data the Company enters — they are provided as an aid to your work, not as professional advice. The Company must check every document, calculation and return, where necessary with its accountant, before issuing it, sending it to a customer or filing it with government bodies (SEF, eOtpremnica, CRF, ePorezi, eBolovanje, APR).

The Service is not an electronic archive within the meaning of the regulations on archival material and electronic documents: documents are stored in the Service’s database for as long as the Company’s account exists, without a qualified seal, timestamp or archive register. Electronic invoices are kept by the e-invoicing system (SEF) for the statutory period. The Company is responsible for keeping its other business documentation for the periods prescribed by accounting and archiving regulations — every document in the Service can be downloaded as a PDF.

For security and to prevent abuse we keep a technical record of use — sign-in time, IP address and device/browser details. The legal basis is our legitimate interest in protecting the Service. Details are in the Privacy policy.

We reserve the right to suspend or terminate an account in the event of a breach of these Terms — in particular an unpaid subscription, unlawful use or endangering the security of the Service. Where abuse is established, suspension or termination may be without compensation (refund). Where possible, we will contact you first to verify.

The Company may cancel its subscription at any time; it can export its data itself and permanently delete the company from the Service (section 13).

The processing of personal data is governed by the Serbian Personal Data Protection Act (ZZPL), the General Data Protection Regulation (GDPR) where applicable, and the Privacy policy. With regard to the data the Company enters about its customers and its business, the Company is the controller and the Provider is the processor, which processes the data solely on the Company’s documented instructions, for the purpose of providing the Service.

“Annex 1 — Personal Data Processing Agreement” forms an integral part of these Terms. By accepting these Terms when opening an account, the Company and the Provider also conclude that processing agreement (Article 45 of the ZZPL / Article 28 of the GDPR); the time of acceptance is recorded with the account.

Data the Company enters or creates by using the Service (documents, lists, financial data) remains the Company’s property. The Provider acquires no ownership of that data and uses it solely to provide the Service and on the Company’s instructions. The Company can export its data itself at any time, free of charge (XML, per module or all at once), in the Settings of the Service.

Deleting a company is initiated solely by the Company’s Super admin, is confirmed by a link from an email and is carried out immediately and irreversibly: all of the Company’s data (including attachments and signatures) is deleted. The remaining paid subscription period is not refunded on deletion (the same rule as on cancellation and on a change of plan). The Provider retains its own proforma invoices and invoices issued to the Company (accounting records, 10 years) and a minimal deletion record (name, PIB, plan, reason and date; the owner’s email address is kept for one year). A User deletes their own account on the My account page, provided they are not the Super admin of any company.

The Service is provided without warranties to the extent permitted by law. The Provider is not liable for indirect or consequential damage. The Company (within the meaning of section 1: the legal entity or sole trader using the Service — not the Provider) is responsible for the accuracy of the data entered and for the business and tax decisions made on the basis of it, as well as for damage arising from issuing, sending or filing documents, calculations and returns that it has not checked beforehand (section 9).

We may update these Terms from time to time. We will notify you of material changes, and continued use after a change constitutes acceptance of the new Terms.

These Terms are governed by the law of the Republic of Serbia. For questions, write to us at email (enable JavaScript).

NIKOLA LAZIĆ PR REPSALIO · Mišeluk 3 11, 21208 Sremska Kamenica · email (enable JavaScript)

The processor processes personal data on behalf of the controller solely for the purpose of providing the Service (preparing, sending and exchanging business documents, keeping lists and records, payroll and other personal income, sick-leave and business-trip records, journal entries and reports, the KPO income ledger and the business overview — to the extent of the features the controller uses). Processing is carried out solely on the controller’s documented instructions, and these Terms are deemed to constitute such instructions.

Categories of data subjects: the Company’s customers, suppliers and other business partners (including sole traders and contact persons of legal entities), employees and other persons to whom the Company pays income (e.g. under a service contract or a copyright contract) and Users within the Company. Types of data: identification and contact details (name, address, PIB, company registration number, email, telephone), business and financial data contained in documents and records (line items, amounts, payment terms, turnover), and, for employees and income recipients, also the JMBG (personal identification number), bank account and details of length of service, salaries, deductions and business trips.

Of the data that may constitute special categories of data (Article 17 of the ZZPL / Article 9 of the GDPR), the Service processes only data on employees’ temporary incapacity for work that the controller imports from the eBolovanje portal in order to calculate salary compensation: the period, the cause (e.g. illness or injury at work) and the status of the sick leave. The Service does not read or store the diagnosis or other medical data, or the health insurance card number, from that export. The controller does not enter other special categories of data.

Processing lasts for as long as the controller uses the Service, that is, until the controller itself deletes the company in the Service (section 13 of the Terms). After use ends, section P9 (deletion/return of data) applies.

The processor: (a) processes data only on the controller’s documented instructions; (b) ensures that persons authorised to process the data have committed themselves to confidentiality; (c) does not use the data for its own purposes; (d) informs the controller without delay if it considers that an instruction infringes data protection regulations.

The processor applies appropriate technical and organisational measures: encrypted data transfer (HTTPS/TLS), sign-in by a one-time code sent to email (codes are stored hashed and are valid only briefly), strict isolation of data per company (multi-tenant — every query is limited to the company), private file storage without public addresses, encrypted storage of access keys for government systems, role-based access assigned by the Company (salary and sick-leave data are visible only to the Super admin, Administrator and Accountant roles) and the hosting provider’s regular security practices.

The controller gives general consent to the engagement of sub-processors for the provision of the Service: the hosting and application execution provider (Vercel, EU region — Frankfurt), the database (Neon — PostgreSQL, Frankfurt, EU), file storage (Vercel Blob, Frankfurt, EU) and the email delivery provider (Resend). The processor agrees with its sub-processors data protection obligations corresponding to this Agreement, informs the controller of intended changes and gives it the opportunity to object. For any transfers outside the EEA (e.g. sending email), appropriate safeguards (standard contractual clauses) apply.

To the extent possible, the processor assists the controller in responding to requests from data subjects exercising their rights (access, rectification, erasure, restriction, portability), including data export, as well as in fulfilling the obligations under Articles 32–36 of the GDPR (security, breach notification, data protection impact assessment).

The processor notifies the controller without undue delay of any personal data breach it becomes aware of, with the information the controller needs in order to meet its obligations to notify the competent authority and to inform the data subjects.

When the provision of the Service ends, the processor, at the controller’s choice, deletes or returns all personal data and deletes existing copies, unless a regulation requires their retention (e.g. accounting regulations on keeping documentation). The controller exports its data (XML) and deletes it itself in the Service, at any time and free of charge; deletion is immediate and permanent. Copies in the backups of the database sub-processor disappear when their retention period expires (up to 7 days). The processor retains its own accounting records (proforma invoices and invoices issued to the controller) for the statutory period of 10 years.

The processor makes available to the controller the information necessary to demonstrate compliance with the obligations under this Agreement and allows audits (including inspections) to a reasonable extent and with prior notice.

Data is primarily stored and processed in the European Union (Frankfurt, Germany). This Agreement is governed by the law of the Republic of Serbia; in the event of a conflict with the other provisions of the Terms regarding data processing, the provisions of this Annex prevail.