Privacy Policy
Last updated: 13 October 2026
This is an English convenience translation. In case of any discrepancy, the Slovak version is binding.
This document describes how eFaktura s. r. o. collects, uses, stores and protects the personal data of users of the eFaktúra services (hereinafter also the "Service" or "Platform"). This Policy is based on Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR) and Act No. 18/2018 Coll. on personal data protection.
1. Introduction and Scope
This Policy applies to the processing of personal data within:
- the marketing website efaktura.sk, including all its subpages,
- the web application for issuing and managing invoices fa.efaktura.sk,
- the eDoklad module (formerly eKancelária) edoklad.efaktura.sk,
- the Sklad (Inventory) module sklad.efaktura.sk,
- the developer and partner portal developers.efaktura.sk,
- the eFaktúra mobile app for iOS and Android,
- the Service's public API interfaces (api.efaktura.sk),
- e-mail communication and customer support.
By using any part of the Service, you confirm that you have read and understood this Policy.
Two processing modes. With respect to data about you as a user (account, billing data for the Service, support, website visits), we are the controller and this Policy describes that processing. With respect to personal data of third parties that you enter into the Service (your customers, suppliers, employees, business contacts), you are the controller and we are the processor under Art. 28 GDPR — this processing is governed by the Data Processing Agreement (DPA).
2. Controller and Contact
The controller within the meaning of Art. 4(7) GDPR is:
- Business name: eFaktura s. r. o.
- Registered office: Klčové 94/19, 915 01 Nové Mesto nad Váhom, Slovak Republic
- Company ID (IČO): 57 465 738
- Tax ID (DIČ): 2122749607
- VAT ID (IČ DPH): SK2122749607
- Registration: Commercial Register of the District Court Trenčín, Section: Sro, Insert No. 57413/R
- E-mail: info@efaktura.sk
- Phone: +421 915 666 607 (Mon – Fri, 8:00 AM – 5:00 PM)
The controller is not required to appoint a Data Protection Officer under Art. 37 GDPR. Please send all requests concerning the protection of personal data to info@efaktura.sk with the subject line "GDPR".
3. What Data We Process
The scope of the data we process depends on which features of the Service you use. Below is a complete overview of the categories.
3.1 Identification and Account Data
- first and last name,
- e-mail address,
- profile photo (if you upload one),
- preferred language and time zone,
- role within the organization, account status, registration time and last activity.
3.2 Contact Data
- phone number,
- correspondence and billing address.
3.3 Company and Accounting Data
- business name, address of registered office and place of business,
- Company ID (IČO), Tax ID (DIČ), VAT ID (IČ DPH), registration data from the Commercial Register,
- IBAN, BIC/SWIFT and bank name for issued invoices,
- contact details of customers and suppliers that you enter into the system (in this respect we act as a processor — see point 1 and the DPA).
3.4 Authentication and Security Data
- cryptographic password hash (we store passwords exclusively as scrypt hashes; we operate authentication on our own infrastructure),
- two-factor authentication factors – TOTP secret and backup codes (stored encrypted),
- session identifiers, login times, IP address and browser User-Agent header,
- security tokens for password recovery and e-mail verification,
- device tokens for push notifications (iOS/Android),
- when signing in via Google or Apple: identifiers and tokens provided by these services.
3.5 Billing and Payment Data
- Stripe identifiers (customer ID, subscription ID, payment method ID); we do not store the full payment card number – it is processed directly by Stripe as a PCI-DSS Level 1 provider,
- history of payments, subscriptions and credits,
- tax documents we have issued to you for use of the Service.
3.6 Document Content
- issued and received invoices, price quotes, orders, delivery notes and other documents,
- receipts and till receipts including their OCR extracts,
- attachments to documents (PDF, images), company documents and contracts,
- photographs of documents captured by the mobile app (briefly, during transfer to your account),
- notes, comments and messages in the AI assistant.
Documents may contain personal data of third parties (your customers, suppliers, employees). With respect to this data, you are the controller and we are the processor within the meaning of Art. 28 GDPR; the terms are set out in the DPA.
3.7 Banking Data
- encrypted access tokens for bank connections via PSD2 interfaces (e.g. Tatra banka Premium API),
- list of transactions, IBANs, balances and transaction metadata (including counterparty details and masked card numbers) to the extent needed to match them with documents,
- content of bank statements and payment gateway statements that you upload to the Service.
3.8 Technical and Operational Data
- IP address, device type, operating system and browser version,
- API request logs (endpoint, status code, duration),
- error reports and diagnostic data (Sentry, EU data center),
- audit logs of important actions (who changed what, when, and from which IP address),
- records of e-mail and notification delivery, including open and click information (transactional e-mails).
3.9 Product and Analytics Data
- usage events (PostHog, EU data center only) – in the invoicing app on the basis of legitimate interest in improving the Service and without storing browser-stored identifiers; on the website only with consent,
- data from measurement tools on the efaktura.sk website (Google Analytics 4, Google Ads, Meta Pixel) – exclusively with your consent (see the Cookie Policy).
We do not deliberately process special categories of personal data (Art. 9 GDPR) such as health data, political opinions or biometric data. If you enter such data into a document or message yourself, we recommend avoiding this.
4. Purposes of Processing and Legal Bases
| Purpose of processing | Legal basis (Art. 6 GDPR) | Data category |
|---|---|---|
| Creation and management of a user account, provision of the Service | Performance of a contract – Art. 6(1)(b) | 3.1, 3.2, 3.4 |
| Time-limited retention of data from an incomplete registration (an account with no company created and no company membership), sending a notice before deletion and subsequent automatic deletion of the account | Performance of a contract – Art. 6(1)(b); deletion is also a fulfilment of the storage limitation principle – Art. 5(1)(e) GDPR (see point 7) | 3.1, 3.4 |
| Issuing and receiving documents, storing documents, integrations with banks and registers, Peppol e-invoicing | Performance of a contract – Art. 6(1)(b) | 3.3, 3.5, 3.6, 3.7 |
| Archiving eFaktura s. r. o.'s own accounting and tax documents (e.g. invoices issued to customers for use of the Service) for 10 years | Statutory obligation of the controller – Art. 6(1)(c); Act No. 431/2002 Coll. on Accounting, Act No. 222/2004 Coll. on VAT | 3.5 |
| Storage of documents that the customer enters into the Service (e.g. invoices issued or received by the customer, receipts, company documents) | Performance of a contract – Art. 6(1)(b), on the customer's instructions as controller; the scope and retention period are governed by the customer's instructions and the DPA, not eFaktura's own archiving obligation | 3.3, 3.6 |
| Keeping the controller's own tax and accounting records | Statutory obligation – Art. 6(1)(c) | 3.1, 3.3, 3.5 |
| Account and infrastructure security, protection against misuse, rate limiting, anti-bot protection (Cloudflare Turnstile) | Legitimate interest – Art. 6(1)(f) | 3.4, 3.8 |
| Error and performance monitoring, detecting and fixing defects | Legitimate interest – Art. 6(1)(f) | 3.8 |
| Customer support and answering inquiries | Performance of a contract / legitimate interest – Art. 6(1)(b), (f) | 3.1, 3.2, 3.6 |
| Sending transactional e-mails and notifications (documents, alerts, security, password reset) | Performance of a contract / legitimate interest – Art. 6(1)(b), (f) | 3.1, 3.2 |
| In-app product analytics (improving the Service's features) | Legitimate interest – Art. 6(1)(f); you may object (point 8) | 3.9 |
| Website traffic analytics, marketing and campaign measurement (GA4, Google Ads, Meta Pixel) | Consent – Art. 6(1)(a) | 3.9 |
| Sending commercial communications (newsletter) | Consent – Art. 6(1)(a); § 116 of Act No. 452/2021 Coll. on Electronic Communications | 3.1, 3.2 |
| Handling inquiries from the contact/lead form | Consent / pre-contractual relations – Art. 6(1)(a), (b) | 3.1, 3.2, 3.3 |
| Asserting and defending legal claims | Legitimate interest – Art. 6(1)(f) | 3.1–3.8 |
5. Recipients and Processors
In providing the Service, we use trusted processors (Art. 28 GDPR). We have a data processing agreement in place with each of them. Below is their full list, purpose and country of processing. This list also serves as the list of sub-processors for the purposes of the DPA.
| Service / processor | Purpose | Country / region of processing | Reference |
|---|---|---|---|
| Neon, Inc. | Hosting of the primary PostgreSQL database | EU (AWS eu-central-1, Frankfurt) | neon.tech/privacy-policy |
| Railway Corp. | Hosting of the API backend, job processing (queue/Redis) and the Peppol access point | USA / EU (depending on the service region) | railway.com/legal/privacy |
| Vercel, Inc. | Hosting of web applications, static media (Vercel Blob) and anonymous performance measurement (Speed Insights) | USA / EU (edge) | vercel.com/legal/privacy-policy |
| Cloudflare, Inc. | R2 object storage (documents, attachments, exports), Turnstile (bot protection), CDN | EU / global | cloudflare.com/privacypolicy |
| Stripe Payments Europe, Ltd. | Payment and subscription processing | Ireland / USA | stripe.com/privacy |
| Resend, Inc. | Sending transactional e-mails, receiving documents by e-mail (inbox.efaktura.sk) and e-mail helpdesk | Sent from the EU region (AWS eu-west-1, Ireland); message content, delivery records and webhook events are stored by the provider for 30 days in the USA (SCC + EU-US DPF) | resend.com/legal/privacy-policy |
| Google Cloud EMEA Ltd. / Google Ireland Ltd. | Vertex AI – Gemini (document OCR, AI assistant, categorization; EU region, see point 6), Document AI (OCR, EU region), Google Maps (address suggestions), Google Workspace (company support mailboxes); Google Analytics 4 and Google Ads on the website only with consent | EU / Ireland / USA | policies.google.com/privacy |
| OpenAI, LLC | Selected AI features: invoice-creation assistant, fallback expense categorization, text vector representations (embeddings), inventory AI features (forecasts, recognition from photographs); AI assistant for software development and error diagnostics (Codex), with access to data only to the extent strictly necessary to resolve an incident or a support request | USA | openai.com/policies/privacy-policy |
| Anthropic, PBC | AI assistant for software development, error diagnostics and technical support (Claude), with access to data only to the extent strictly necessary to resolve an incident or a support request; this processor does not provide the AI features in the application | USA | anthropic.com/legal/privacy |
| Functional Software, Inc. (Sentry) | Error and performance monitoring; session replay only on error, with text and media masking | EU data center (Germany); US provider | sentry.io/privacy |
| PostHog, Inc. | Product analytics (EU endpoint eu.i.posthog.com); on the website only with consent | EU | posthog.com/privacy |
| Meta Platforms Ireland Ltd. | Meta Pixel – measurement of marketing campaigns on the website, only with consent | Ireland / USA | facebook.com/privacy/policy |
| eFirma (efirma.sk) – operated by Black Holding s. r. o., Company ID (IČO) 55460399 | Search for and verification of Slovak companies by Company ID (IČO) / name; measurement of traffic on the efaktura.sk website using the eRadar tool (only with consent and only for visitors who are not logged in) | Slovakia / EU | efirma.sk |
| Merk.cz (Imper CZ, s.r.o.) | Search for Czech companies | Czechia | merk.cz |
| Overtoken (overtoken.sk) | Verification of the Financial Administration of the Slovak Republic's authorization token when registering for the Peppol network (the Tax ID (DIČ) and the token being verified are sent) | Slovakia / EU | overtoken.sk |
| Expo (650 Industries, Inc.) | Delivery of push notifications to the mobile app | USA | expo.dev/privacy |
| Slack Technologies Limited | Internal operational alerts for the controller's team (may contain the customer's company name) | EU / USA | slack.com/privacy-policy |
In addition to processors, data may also be provided to independent controllers and other recipients:
- banks and payment institutions – when connecting a bank account via a PSD2 interface (e.g. Tatra banka, a.s.), based on the consent you grant directly within your bank,
- the Peppol network and its participants – when an e-invoice is sent, the document content is delivered to the recipient's access point; routing metadata is recorded in Peppol network registries (OpenPeppol, the Financial Administration of the Slovak Republic's SMP),
- the Financial Administration of the Slovak Republic – registration of Peppol participants (SMP), verification of authorization tokens and verification of receipts in the eKasa system,
- public registers – ARES (Ministry of Finance of the Czech Republic) when searching for Czech companies,
- third-party integrations that you activate yourself – e.g. connecting your online store (WooCommerce, Shopify, PrestaShop, Shoptet, Upgates, Wix) or webhooks to addresses you designate,
- public authorities (tax administration, police, courts) – in justified cases based on applicable law.
6. Transfers to Third Countries
We primarily process data within the European Economic Area (both the database and document storage are located in the EU). With some processors (Stripe, Resend, OpenAI, Anthropic, Sentry, Cloudflare, Google, Meta, Vercel, Railway, Expo, Slack), data may be transferred to the United States of America. For such transfers, we apply one or more of the following mechanisms:
- certification of the processor under the EU–US Data Privacy Framework (Commission Implementing Decision 2023/1795),
- standard contractual clauses under Commission Implementing Decision 2021/914,
- additional technical and organizational measures (encryption at rest and in transit, pseudonymization, access control).
You can verify the list of current certifications at dataprivacyframework.gov.
Note on AI processing: AI features run on Google Vertex AI in the EU – Gemini 3 models in the EU multi-region, where both data storage and model processing take place in EU Member States, and older models in the europe-west1 region. If Vertex AI capacity in the EU is temporarily exhausted, a request may exceptionally be processed via the Gemini API fallback interface – still under the same data processing agreement with Google, but without a guarantee of processing exclusively in the EU.
7. Retention Period
| Data category | Retention period | Legal basis / justification |
|---|---|---|
| Account data (name, e-mail, profile) | For the duration of the contract + a 30-day grace period after a deletion request | Performance of a contract; ability to cancel a mistakenly submitted request |
| Incomplete registration — an account in which you have not created any company or become a member of one (name, e-mail, sign-in method identifier) | 30 days from registration; deletion takes place no earlier than 7 days after the e-mail notice is sent and only if it was not returned as undeliverable (details below and in Art. 3 and 15 of the Terms of Service) | Performance of a contract; storage limitation principle – Art. 5(1)(e) GDPR |
| Invoices, receipts and other customer documents stored in their archive in the app | For the duration of the contract, according to the customer's instructions; after termination of the contract, or after the expiry of the 30-day grace period, they are deleted under Article 10 of the DPA (the customer, as the accounting entity, fulfils its archiving obligation from the export – generally 10 years from the end of the accounting period) | § 35 of Act No. 431/2002 Coll.; § 76 of Act No. 222/2004 Coll. on VAT — this is a statutory obligation of the customer; in this respect we act as a processor under the DPA |
| Tax documents we have issued to you for the Service | 10 years | Statutory obligation |
| Login sessions | 7 days from login (renewed on activity) | Legitimate interest – security |
| API logs (endpoint, status code, duration) | 90 days; request and response content 30 days | Legitimate interest – security and stability |
| Error records and diagnostics | generally 30–90 days | Legitimate interest – security and stability |
| Logs of the e-mail inbox for receiving documents | 90 days | Legitimate interest – delivery diagnostics |
| In-app notifications and their delivery records | up to 90 days | Technical necessity |
| Photographs from mobile document capture (temporary transfer storage) | until processed, at most until the capture session expires | Technical necessity |
| Audit logs of important actions | for the duration of the account and subsequently for the limitation periods | Legitimate interest – security, evidencing and defense of claims |
| Conversations with the AI assistant | for the duration of the account; you may request earlier deletion | Performance of a contract / legitimate interest |
| Customer support records (tickets) | for the duration of the account + for the limitation periods | Legitimate interest |
| Encrypted database backups | point-in-time recovery and daily backups 7 days, weekly snapshots 30 days, monthly recovery points 3 months | Legitimate interest – disaster recovery |
| Backup copy of documents with another provider in the EU | deletion from the primary storage is reflected in it within 30 days | Legitimate interest – protection against data loss and ransomware |
| Cookie consent | 180 days; consent is then requested again | Demonstrability of consent |
| Data from marketing tools | according to the settings of the particular tool (usually 14–26 months) | Consent – until withdrawn |
| Data retained for asserting legal claims | until the limitation periods expire (generally max. 4 years after termination of the contract) | Legitimate interest |
After the relevant period expires, data is permanently deleted or anonymized so that it can no longer be attributed to a specific person. After the organization is deleted, or after the expiry of the 30-day grace period, we delete the customer's documents — the customer, as the accounting entity, fulfils its archiving obligation from the export that is automatically generated when the deletion request is submitted. Only our own accounting and tax documents (10 years), evidence of the sending, receipt and delivery of documents in the Peppol network without the content of the document (10 years from the end of the year of the event) and the necessary security and operational records remain, to the extent and for the periods set out in this table; details are governed by Article 10 of the DPA.
Incomplete registration. If, after registering, you do not create any company or become a member of one, your account contains no documents at all — only your name, e-mail address and sign-in method identifier. We will delete such an account completely and irreversibly (including login credentials), no earlier than 30 days from registration and no earlier than 7 days after we send a notice of the planned deletion to your registration e-mail address; if the notice fails to be delivered (for example, it is returned as undeliverable), we will not automatically delete the account. You can prevent deletion at any time by creating a company or accepting an invitation to join one, and you may re-register with the same e-mail address at any time. We will never delete an account this way if it is a member of a company or has founded one, has any subscription record (including a terminated one), a pending company invitation, communication with our support, or a special role within the Service. This is a deletion on our own initiative under Art. 15 of the Terms of Service — do not confuse it with the deletion of an account at your request under point 8 of this Policy, for which the 30-day grace period applies.
8. Your Rights
As a data subject, you have the following rights under the GDPR (Art. 15 – 22) and Act No. 18/2018 Coll.:
- Right of access to the data being processed and to a copy of it – in the app you can generate an export of your account at any time (CSV, PDF, ISDOC, complete archive).
- Right to rectification of inaccurate or incomplete data – directly in your account settings or by e-mail.
- Right to erasure ("the right to be forgotten") – you can initiate account deletion in your settings; this starts a 30-day grace period during which you may cancel the request. After it expires, your personal data is deleted, except for data we are legally required to retain — in particular our own accounting and tax documents (10 years). Documents in your archive in the app (your invoices and other documents) are retained by us as a processor according to your instructions and the DPA, not on the basis of eFaktura's own statutory obligation. Deletion at your request should be distinguished from the automatic deletion of an incomplete registration on our own initiative (point 7): the 30-day grace period does not apply to it — instead, we notify you by e-mail at least 7 days before deletion, and deletion takes place only if the notice was successfully delivered to you.
- Right to restriction of processing – you may request the temporary suspension of processing, e.g. while a complaint is being resolved.
- Right to data portability – we will provide the data in a structured, commonly used, machine-readable format (CSV, ISDOC, XML).
- Right to object to processing based on legitimate interest (Art. 21 GDPR), including product analytics and direct marketing – send your objection to info@efaktura.sk.
- Right to withdraw consent – you may withdraw your consent to analytical or marketing cookies and the newsletter at any time, without affecting the lawfulness of processing carried out before the withdrawal.
- Right not to be subject to automated decision-making with legal effects (Art. 22 GDPR) – see point 10.
- Right to lodge a complaint with the supervisory authority: Office for Personal Data Protection of the Slovak Republic, Hraničná 4826/12, 820 07 Bratislava 27, tel. +421 2 3231 3214, e-mail statny.dozor@pdp.gov.sk, web dataprotection.gov.sk.
We handle requests free of charge and without undue delay, no later than 30 days from receipt. For complex or repeated requests, we may extend this period by a further 60 days, and we will inform you accordingly. For manifestly unfounded or excessive requests, we may charge a reasonable administrative fee or refuse the request. Before fulfilling a request, we may ask you to verify your identity, to avoid disclosing data to the wrong person.
9. Cookies and Similar Technologies
On the efaktura.sk website we use four categories of cookies and similar technologies: necessary (website functionality and login – no consent required), analytical, traffic measurement, and marketing (only with your explicit consent given via the cookie banner). In the apps, once logged in, we use only necessary and functional cookies. Marketing and analytical tools on the website default to "rejected" (Google Consent Mode v2) and are activated only after you give consent; if you reject a category, cookies already stored for that category are deleted.
Traffic measurement (eRadar). With your consent to the "Traffic measurement" category, the efaktura.sk website loads the eRadar measurement script of the eFirma service (efirma.sk), operated by Black Holding s. r. o., Company ID (IČO) 55460399. The script sends to eFirma's server the address of the page visited, the domain you arrived from, and a random session identifier stored in browser storage (sessionStorage _eradar_s, which expires when the tab is closed); your IP address is also technically transmitted with the request. The script does not load without consent, for logged-in users, in the apps once logged in, or when your browser sends a Global Privacy Control signal. The legal basis is your consent (Art. 6(1)(a) GDPR and § 109(8) of Act No. 452/2021 Coll. on Electronic Communications), which you may withdraw at any time via the "Cookie settings" link in the website footer.
You can find the full list of cookies used, their validity, and how to change your settings in the separate Cookie Policy. You may change your choice at any time via the "Cookie settings" link in the website footer.
10. Automated Processing and Profiling
The Service carries out the following automated processing:
- OCR text extraction from receipts and invoices (Google Vertex AI – Gemini; fallback: Google Document AI in the EU region and local Tesseract),
- AI categorization of documents and transactions (Google Vertex AI – Gemini; fallback: OpenAI),
- AI assistant and search using text vector representations (Google Vertex AI, OpenAI),
- automatic matching of payments to documents by variable symbol, amount and IBAN,
- protective mechanisms – bot detection (Cloudflare Turnstile) and rate limiting.
None of this processing has legal effects for the data subject and none constitutes automated decision-making within the meaning of Art. 22 GDPR. AI results serve only as recommendations – the user always makes the final decision. We do not carry out targeted behavioral profiling of visitors or scoring of individuals.
11. Security Measures
We take appropriate technical and organizational measures to ensure data protection (Art. 32 GDPR):
- Encryption in transit – TLS for all communications, security headers (CSP, HSTS),
- Encryption at rest – both the database and object storage are encrypted; bank access tokens and 2FA secrets are also encrypted at the application level,
- Isolation of customer data – multi-layer tenant separation, including Row-Level Security directly at the database level (a query outside the context of your own organization returns no data),
- Password hashing – the scrypt algorithm; we never see passwords in plain text,
- Two-factor authentication (TOTP) – optional for all users, mandatory for the controller's administrative team,
- Cloudflare Turnstile on critical forms (e.g. password recovery),
- rate limiting by IP address and e-mail hash,
- separate private document storage (documents are never publicly accessible; access is via short-lived signed links),
- masking of content in diagnostic records (Sentry – masking of text and media),
- the principle of least privilege for team members' access to production data, audit logs of administrative actions,
- regular backups and a disaster recovery plan,
- incident response plan – in the event of a personal data breach, we notify the supervisory authority within 72 hours and, in the case of high risk, also the affected data subjects.
12. Children and Minors
The Service is intended exclusively for entrepreneurs and legal entities. It is not intended for persons under 16 years of age. If we discover that we have obtained a child's personal data without the consent of the holder of parental responsibility, we will delete it without undue delay.
13. Newsletter and Marketing Communications
We send commercial communications (product news, tips, training) only on the basis of your explicit consent. You may withdraw your consent at any time:
- by clicking the "Unsubscribe" link at the bottom of a marketing e-mail,
- in your account settings, in the "Notifications" section,
- by sending a request to info@efaktura.sk.
Under § 116 of Act No. 452/2021 Coll. on Electronic Communications, we may send existing customers information about our own similar products even without consent, always with the option of one-click unsubscribing directly in the e-mail. Transactional e-mails (documents, security alerts, service changes) are not marketing communications and we send them on the basis of performance of a contract and legitimate interest.
14. Changes to this Policy
We update this Policy on an ongoing basis to reflect changes in the product, the law, or the list of processors. We will notify you of every material change:
- by a notice in the app after login,
- by e-mail at least 14 days before the change takes effect, if the change affects your rights or the scope of processing.
The current version can always be found at efaktura.sk/privacy. You may request previous versions at info@efaktura.sk.
15. Effective Date
Document version: 2026-10-17-v3. This document is valid and effective from 17 October 2026 and supersedes the previous version; you may request previous versions at info@efaktura.sk. Slovak is the governing language for interpretation; any translations are provided for information purposes only.
If you have any questions regarding the protection of personal data, please contact us at info@efaktura.sk.