Draft for comments, version 0.2 of 12 October 2026 — not the version in force. Items marked [TO BE DECIDED], [TO BE CONFIRMED], [TO BE COMPLETED] or [TO BE VERIFIED] will be completed or confirmed by Digital Orchestra, s.r.o.; we recommend a legal review before publication. The Slovak version is binding; this English version is a translation provided for information only.
Privacy Policy
This policy explains how Digital Orchestra, s.r.o. processes personal data when operating the website and the Moja eFaktúra service (the ‘Service’), and informs data subjects of their rights under Regulation (EU) 2016/679 (the ‘GDPR’) and Act No. 18/2018 Coll. on Personal Data Protection.
1. Controller and contact details
1.1 The controller is Digital Orchestra, s.r.o., with its registered office at Poľná 19, 900 27 Bernolákovo, Company ID (IČO) 47 341 068, registered in the Commercial Register of the Municipal Court Bratislava III, Section: Sro, Insert No. 92008/B (‘we’ or ‘us’).
1.2 For data protection matters, please contact us by e-mail at partner@digital-orchestra.sk, by telephone on +421 904 464 579 or in writing at our registered office (see also contact). We have not appointed a data protection officer, as we are not required to do so under Article 37 GDPR [TO BE VERIFIED].
2. Who this policy applies to
2.1 This policy concerns visitors to the website, prospective clients of the Service, clients who are sole traders, and contact persons and users of our clients.
2.2 We process personal data in electronic invoices and other documents that clients send and receive through the Service on behalf of the client, as a processor (Article 4).
3. Purposes, legal bases and retention periods
3.1 We process personal data for the following purposes:
| Purpose and data processed | Legal basis (Article 6(1) GDPR) | Retention period |
|---|---|---|
| Operation and security of the website – server logs: IP address, time, requested address, browser data | point (f) – legitimate interest in secure and reliable operation | 90 days [TO BE CONFIRMED] |
| Handling enquiries sent by e-mail or telephone – name, contact details, content of the communication | point (b) – steps taken at your request prior to entering into a contract; otherwise point (f) – legitimate interest in handling the enquiry | while the enquiry is being handled and for 1 year thereafter; if a contract is concluded, as contract data [TO BE CONFIRMED] |
| Selection of Moja eFaktúra on the portal of the Financial Administration of the Slovak Republic – business name, DIČ, contact e-mail and telephone of the entity and verification data, which the Financial Directorate of the Slovak Republic passes on to us after the selection; verification of the entity, contact for concluding the contract and activation in the Peppol network | point (b) – steps prior to entering into a contract; for contact persons of legal entities, point (f) – legitimate interest in concluding the contract and verifying authority | for the term of the contract and 5 years after the provision of the Service ends; if no contract is concluded, 1 year from the selection [TO BE CONFIRMED] |
| Conclusion and performance of the contract – identification and contact data of a client who is a sole trader and of the client’s contact persons (name, e-mail, telephone, position), communication about the Service, billing settings and referral benefits | point (b) – performance of the contract; for contact persons of legal entities, point (f) – legitimate interest in performing the contract with the client | for the term of the contract and 5 years after the provision of the Service ends |
| Users of the client zone and API – name, e-mail, telephone, the accounting office and companies to which the user has access, role (admin, accountant, view-only), login credentials (password stored only as a hash), data on issued API keys and notification settings | point (b) – performance of the contract; for users of a client that is a legal entity, point (f) – legitimate interest in providing access to the Service | for the term of the contract and 5 years after the provision of the Service ends |
| Records of who created and sent a document (user or API key, time, action) and of other actions in the client zone and API | point (f) – legitimate interest in complying with obligations under the rules of the Peppol network and the contract with the certified provider, and in proving the origin of documents | for the term of the contract and 5 years after its termination |
| Invoicing for the Service and bookkeeping – identification and billing data, payment data | point (c) – legal obligation under the Accounting Act and the VAT Act | 10 years following the year to which they relate |
| Security of the Service – IP address, time, logins and failed login attempts, changes to settings and access rights | point (f) – legitimate interest in protecting the Service and data against misuse | 12 months [TO BE CONFIRMED] |
| Establishment, exercise and defence of legal claims – data needed to prove a claim | point (f) – legitimate interest in protecting our rights | for the limitation period and the duration of any proceedings |
3.2 You sign in to the client zone with a Moja eFaktúra account, which we set up after receiving your selection on the portal of the Financial Administration of the Slovak Republic, or with an account for the Moje Účtovníctvo service, which we also operate; with a Moje Účtovníctvo account, we take from it the user’s assignment to the accounting office and companies, as well as the user’s role.
3.3 We obtain data directly from you, from clients (data of contact persons and users), from the Financial Directorate of the Slovak Republic (data from the selection of a provider on the portal of the Financial Administration of the Slovak Republic) and from the Peppol network (documents and delivery receipts).
3.4 Providing the data necessary to conclude the contract, to verify identity and authority to act for a company and to use the client zone is a contractual requirement; without these data we cannot conclude the contract or provide the Service. The rules of the Peppol network also require the identity of the end user to be verified. Once the periods stated have expired, we delete or anonymise the data.
4. Document content – processing on behalf of the client
4.1 With regard to personal data in documents that the client sends, receives and stores through the Service (for example names and contact details of persons named on an invoice), the client is the controller and we act as its processor; the certified provider Verteco digital services, s. r. o. is a further processor. The terms of this processing are set out in Article 9 of the Terms and Conditions.
4.2 If you are named in a document sent or received through the Service, please exercise your rights with the company that issued or received the document; we will assist it in handling your request.
4.3 We do not use data from documents for our own purposes, in particular not for marketing, profiling or training machine learning models.
5. Recipients
5.1 We disclose personal data only to the extent necessary for the purpose concerned, to the following recipients:
- Verteco digital services, s. r. o., Company ID (IČO) 53 412 834 – the certified delivery service provider, which technically ensures delivery in the Peppol network and the transmission of data to the Financial Administration of the Slovak Republic; for activation purposes, we also pass on to it the data from the selection on the portal of the Financial Administration of the Slovak Republic. With regard to document content it acts as a further processor, and with regard to tax reports and records under the rules of the Peppol network as an independent controller (its privacy policy);
- the Financial Administration of the Slovak Republic (the Financial Directorate of the Slovak Republic, also as the Peppol Authority) – invoice data transmitted to it by the certified provider under the VAT Act, and data necessary for registration in the central SMP and for supervision;
- the Peppol service providers of the client’s business partners – to the extent necessary to deliver the document;
- the public, through the directories of the Peppol network – a company’s registration and identifier can be publicly verified in the Peppol network, and its business card (business name, country, identifier) is published in the Peppol Directory, in the case of a sole trader only on their instruction;
- systems designated by the client (e-mail addresses for notifications, a webhook to its information system);
- legal, tax and accounting advisers and auditors bound by confidentiality, and public authorities where required by law.
5.2 We provide the hosting of the Service and e-mail delivery ourselves, on our own infrastructure, without further processors. We do not sell personal data or provide it to third parties for their marketing purposes.
6. Transfers outside the EU and EEA
6.1 We process personal data on our own infrastructure in the European Union and do not transfer it to third countries [TO BE VERIFIED: location of the infrastructure].
6.2 The certified provider stores data in the European Union, but under its policy it may also use further processors established outside the EU and EEA (in particular in the USA); such transfers are then based on an adequacy decision of the European Commission or on standard contractual clauses. Details are available at https://peppol.verteco.digital/gdpr.
6.3 If a client sends a document to a recipient whose Peppol service provider operates outside the EU and EEA, the document data reach that provider on the client’s instruction, to the extent necessary for delivery.
7. Cookies
7.1 The public website of the Service does not use cookies or any analytics or advertising tools.
7.2 The client zone uses only a strictly necessary session cookie, __Host-efaktura-sessId (with the Secure, HttpOnly and SameSite=Strict attributes), which keeps you logged in; the session ends when you log out or after 30 minutes of inactivity. As this storage is strictly necessary to provide a service explicitly requested by the user, consent is not required (Section 109(8) of Act No. 452/2021 Coll. on Electronic Communications).
7.3 The client zone interface remembers saved searches and the state of tables in your browser’s local storage. These data are not sent to our server, and you can remove them by clearing the site data in your browser.
8. Automated decision-making
8.1 We do not carry out automated individual decision-making, including profiling, which produces legal effects concerning you or similarly significantly affects you (Article 22 GDPR).
9. Your rights
9.1 To the extent and under the conditions laid down in the GDPR, you have the right:
- of access to your personal data (Article 15) and to their rectification (Article 16);
- to erasure (Article 17) and to restriction of processing (Article 18);
- to portability of data that we process by automated means on the basis of a contract or consent (Article 20);
- to object at any time to processing based on legitimate interest (Article 21);
- to withdraw consent, where processing is based on consent, without affecting the lawfulness of processing before its withdrawal;
- to lodge a complaint with the supervisory authority.
9.2 Please send requests to partner@digital-orchestra.sk. We will handle them without undue delay, as a rule within one month; for complex or numerous requests, we may extend this period by a further two months and will inform you accordingly. Before handling a request, we may ask you to verify your identity. Some rights may be limited by our legal obligations, for example the obligation to keep accounting records.
9.3 The supervisory authority is the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27, https://dataprotection.gov.sk.
10. Changes to this policy
10.1 We update this policy when our processing or the law changes. We publish the current version with its date on this page and also inform clients of material changes by e-mail.