Privacy policy – efakturia.sk

Effective from: 10 October 2026Last updated: 10 October 2026

This policy explains how IT-DK s. r. o. processes personal data when operating the efakturia.sk service and when communicating with customers. In doing so, we fulfil our duty to inform under Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council (the "GDPR"). We also take into account Act No. 18/2018 Coll. on Personal Data Protection.

1. Who the controller is

IT-DK s. r. o., Odbojárov 1957/8, 026 01 Dolný Kubín, Company ID (IČO): 57 626 472, Tax ID (DIČ): 2122858012, registered in the Commercial Register of the Žilina Municipal Court, Section Sro, Insert No. 91296/L ("we").

Data protection contacts:

• e-mail: gdpr@efakturia.sk,
• phone: +421 911 085 838,
• by post: IT-DK s. r. o., Odbojárov 1957/8, 026 01 Dolný Kubín.

We have not appointed a data protection officer (DPO). We are not required to do so under Article 37(1) GDPR. We are not a public authority, we do not monitor data subjects on a large scale and we do not process special categories of data on a large scale.

2. When we are a controller and when a processor

Controller (Article 4(7) GDPR). We process the data needed to run your account for our own purposes. This covers sign-in, identity verification, invoicing for our service, support, security and business communication. This policy applies to that data.

Processor (Article 4(8) GDPR). Data that our customer enters into the service or receives through it is processed only on the customer's behalf and according to the customer's instructions. This includes, for example, customers and suppliers on invoices, their contact persons, the accountant's e-mail and bank transactions. The controller of that data is the customer.

• If you are a customer or supplier of our customer and wish to exercise your rights, please contact them directly. If you send the request to us, we will forward it to the customer.
• The relationship with the customer is governed by the Data processing agreement.

3. Whose data we process

• customers – natural persons doing business (sole traders),
• persons acting on behalf of customers that are legal entities (e.g. a managing director who creates the account or goes through identity verification),
• users – team members whom the customer has invited to the account,
• contact persons of companies that we approach with an offer of the service,
• persons who contact us (support, bug reports, questions).

4. Purposes, data, legal bases and retention periods

4.1 Sign-up, account and sign-in

• Data: first name and surname, e-mail, password stored solely as a hash (bcrypt), two-factor authentication (2FA) data, the public key of a passkey, role in the team, time and version of the consent given to the T&C, sign-in data.
• Legal basis:
• for a customer who is a natural person doing business: performance of a contract (Article 6(1)(b) GDPR),
• for a managing director or team member who is not a party to the contract: legitimate interest (Article 6(1)(f) GDPR). Our interest, and the customer's, is to give the persons the customer has authorised secure access to the account.
• Retention period: for the lifetime of the account and 30 days after it is closed. If the customer removes a team member, we revoke their access immediately and delete their data within 30 days. Log records are an exception (point 4.7).

4.2 Identity verification before registration in the Peppol network

Electronic invoices are delivered through the Peppol network. Before registration in it, the identity of the person acting on behalf of the customer must be verified. Under Section 76a(2)(b) of Act No. 222/2004 Coll. on VAT, a certified provider of the delivery service must ensure a high level of reliability in identifying both the sender and the recipient.

• Data: first name, surname and date of birth of the acting person, the verification method (manual verification), the verification status and its date.
• Legal basis:
• for a customer who is a natural person doing business: performance of a contract (Article 6(1)(b) GDPR), because without verification we cannot provide delivery of e-invoices,
• for a person acting on behalf of a legal entity: legitimate interest (Article 6(1)(f) GDPR). The interest is to meet the requirement of reliable identification under Section 76a(2)(b) of the VAT Act and to prevent anyone fraudulently acting in another's name.
• Retention period: for the term of the contract and 4 years after it ends, so that we can prove the verification took place. This is the limitation period under Section 397 of the Commercial Code.

4.3 Company verification

We verify the customer's details (business name, registered office, Company ID (IČO), VAT ID (IČ DPH)) by querying public registers, in particular the Commercial Register of the Slovak Republic (ORSR) and the VIES system for verifying EU VAT IDs. From the query we store only the result of the verification.

• Legal basis: performance of a contract (Article 6(1)(b) GDPR). For legal entities, legitimate interest in correctly identifying the customer (Article 6(1)(f) GDPR).
• Retention period: for the lifetime of the account and 30 days after it is closed.

4.4 Providing the service to the customer

• Data of a customer who is a natural person doing business: business name, place of business, Company ID (IČO), Tax ID (DIČ), VAT ID (IČ DPH), bank details (IBAN), e-mail, phone, logo and invoice settings. In addition, the identifier in the Peppol network (derived from the IČO or DIČ) and records of documents sent and received (date, delivery status).
• Legal basis: performance of a contract (Article 6(1)(b) GDPR).
• Registration in the Peppol network: on registration, the participant's identifier and name are entered in the Peppol network directories. Without this, senders would not be able to deliver e-invoices to you.
• Retention period: for the lifetime of the account and 30 days after it is closed. Invoices that the customer issued or received in the service are the customer's accounting documents and the customer must archive them. We do not keep them after the account is closed.

4.5 Invoicing for our service and payments for credit

• Data: the customer's billing details, variable symbol, amount and date of payment, the payer's name and account number from the bank statement, invoices for credit top-ups, credit movements.
• Legal basis: performance of a contract (Article 6(1)(b) GDPR). For retaining accounting documents, compliance with a legal obligation (Article 6(1)(c) GDPR) under Act No. 431/2002 Coll. on Accounting.
• Retention period: accounting documents for 10 years following the year to which they relate (Section 35 of the Accounting Act). Other data for the term of the contract and until the credit is settled.

4.6 Communication, support and bug reports

• Data: e-mail correspondence, the content of the request, a screenshot attached to a bug report (it may contain data from your account), technical information about the browser.
• Legal basis: performance of a contract (Article 6(1)(b) GDPR). For persons who are not a party to the contract, legitimate interest in handling the request (Article 6(1)(f) GDPR).
• Retention period:
• screenshots up to 90 days after the bug is resolved,
• correspondence for the term of the contract and 4 years after it ends.

4.7 Service e-mails

We send notifications about low credit, delivery errors, received documents and changes to the T&C, as well as security alerts. We send them from noreply@efakturia.sk.

• Legal basis: performance of a contract (Article 6(1)(b) GDPR). This is not marketing and you cannot unsubscribe from these e-mails while you have an account.

4.8 Security and operational records (logs)

• Data: IP address, date and time of the request, browser and operating system, records of sign-ins and of API key use.
• Legal basis: legitimate interest (Article 6(1)(f) GDPR), namely protecting the service and your data against unauthorised access and misuse. Security of processing is also required of us by Article 32 GDPR.
• Retention period: 12 months from the creation of the record. If we need a record to investigate a specific incident, we keep it until the incident is closed.

4.9 Establishing and defending legal claims

• Data: data from the contract, communication and records relating to the dispute.
• Legal basis: legitimate interest (Article 6(1)(f) GDPR).
• Retention period: until the limitation period expires (Section 397 of the Commercial Code, 4 years). If proceedings are initiated, until they end.

4.10 Service news for customers

• Data: the e-mail address of the Account Administrator, name, business name.
• Legal basis: legitimate interest (Article 6(1)(f) GDPR) in informing existing customers about news and similar services.
• Unsubscribing: you can unsubscribe at any time using the link in every e-mail or by e-mail to gdpr@efakturia.sk. Unsubscribing does not affect service e-mails (point 4.7).
• Retention period: until you unsubscribe, at most for the lifetime of the account.

4.11 Approaching companies with an offer of the service

We may approach companies that are not yet our customers by e-mail with an offer of the efakturia.sk service.

• Data: business name, Company ID (IČO), registered office, work contact e-mail, or the name and position of the contact person.
• Source of data: public sources, in particular the commercial and trade registers, the register of legal entities and company websites.
• Legal basis: legitimate interest (Article 6(1)(f) GDPR) in offering the service to businesses. We approach only work contacts and only in connection with their business.
• Information and unsubscribing: the very first e-mail already states who we are, where we got the contact from and links to this policy (Article 14(3)(b) GDPR). It also contains a simple way to unsubscribe from further e-mails and to object to the processing.
• Retention period: if you do not reply, we delete the data within 12 months of the last contact. If you unsubscribe, we keep only your e-mail address on a suppression list so that we do not approach you again.

5. Bank connection (optional)

If the customer switches on the bank connection themselves, we read the transactions from their account through the licensed account information service provider Enable Banking Oy (Finland). The customer grants consent to access the account and accepts the terms of this service directly with their bank and with Enable Banking Oy. We use the transactions only to match payments with invoices. For this data we act as the customer's processor (point 2).

6. Recipients of personal data

We disclose data only to the extent necessary:

We only read data from public registers (ORSR, the register of legal entities, VIES, ARES, lists of the Financial Administration of the Slovak Republic (Finančná správa SR)). We do not send your data to them.

With processors that process personal data for us, we conclude agreements under Article 28 GDPR. The bank and the Financial Directorate of the Slovak Republic are independent controllers. If you request access to your data (Article 15 GDPR), we will also tell you the specific identity of the recipients to whom we have disclosed your data.

7. Transfers to third countries

We process data only in the European Union. All our suppliers listed in point 6 have their registered offices and servers in the EU.

The exception is when the customer sends an invoice through the Peppol network to a recipient whose delivery service provider operates outside the European Economic Area. The invoice data then reaches the recipient's country. The transfer takes place on the instruction of the customer, who chooses the recipient. If we ourselves began using a supplier outside the EEA, we would put in place safeguards under Article 45 or 46 GDPR and update this policy in advance.

8. Is providing the data mandatory?

The data required for sign-up (e-mail, password, identification of the business) is a contractual requirement. Without it we cannot set up an account. Identity verification (point 4.2) is a condition for registration in the Peppol network. Without it, invoices cannot be sent or received through the Peppol network. Other data (phone, logo, bank connection) is voluntary.

9. Automated decision-making

We do not make decisions based solely on automated processing that would produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR). Nor do we carry out profiling. Identity verification is performed by a human.

10. Your rights

You have the right:

• of access to your data and to a copy of it (Article 15 GDPR),
• to rectification of inaccurate or incomplete data (Article 16 GDPR),
• to erasure (Article 17 GDPR). This does not apply where we need the data to comply with a legal obligation (e.g. accounting documents) or for legal claims,
• to restriction of processing (Article 18 GDPR),
• to portability of the data you provided to us on the basis of a contract (Article 20 GDPR). You can also export invoices yourself at any time (ZIP, CSV, UBL 2.1, ISDOC, PDF),
• to object to processing based on legitimate interest (Article 21(1) GDPR) and, at any time, to direct marketing (Article 21(2) GDPR),
• to lodge a complaint with the supervisory authority, which is the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov Slovenskej republiky), Hraničná 12, 820 07 Bratislava 27, dataprotection.gov.sk.

How to exercise your rights: write to gdpr@efakturia.sk. If we have doubts about who is sending the request, we may verify your identity (Article 12(6) GDPR), for example by a reply from the e-mail address you have in your account. We will reply without undue delay, within one month at the latest. For complex or numerous requests we may extend the period by a further two months and will inform you of this (Article 12(3) GDPR). Handling a request is free of charge.

11. Cookies

We use only strictly necessary cookies. We do not use analytics, marketing or profiling cookies and we do not track your behaviour. Under Section 109(8) of Act No. 452/2021 Coll. on Electronic Communications, strictly necessary cookies do not require consent.

If we deploy analytics in the future, we will ask for your consent to it and update this policy in advance.

12. How we protect your data

• all communication is encrypted (TLS/HTTPS),
• we store passwords only as a hash (bcrypt) and support two-factor authentication and passkeys,
• encryption keys and access passwords to the systems are stored outside the database and outside the backups,
• only the operator's managing director has access to the service administration, through a single administrator account,
• we back up the entire database daily. We keep backups for 14 days on the production server in France and a copy of them on the IT-DK server in Germany, to which they are transferred through an encrypted tunnel (VPN). After 14 days they are deleted automatically,
• we keep operational records for 12 months.

A detailed overview of the technical and organisational measures is in the Data processing agreement.

13. Changes to this policy

We update this policy when the way we process data or the law changes. We inform customers of material changes in advance by e-mail. The current version with its effective date is always available at efakturia.sk/sukromie.