Draft for comments, version 0.1 of 12 October 2026 — not the version in force. Items marked [TO BE DECIDED], [TO BE COMPLETED] or [TO BE VERIFIED] will be completed or confirmed by Digital Orchestra, s.r.o.; we recommend a legal review before publication. The Slovak version is binding; this English version is a translation provided for information only.
Privacy Policy
This policy explains how Digital Orchestra, s.r.o. processes personal data when operating the website and the Moje Účtovníctvo service (the ‘Service’), and informs data subjects of their rights under Regulation (EU) 2016/679 (the ‘GDPR’) and Act No. 18/2018 Coll. on Personal Data Protection.
1. Controller and contact
1.1 The controller is Digital Orchestra, s.r.o., with its registered office at Poľná 19, 900 27 Bernolákovo, Company ID (IČO) 47 341 068, registered in the Commercial Register of the Municipal Court Bratislava III, Section: Sro, Insert No. 92008/B (‘we’). We operate the Service on our own servers in the Digitalis data centre in Bratislava.
1.2 For matters of personal data protection, contact us by e-mail at partner@digital-orchestra.sk, by telephone at +421 904 464 579 or in writing at our registered office (see also contact). We have not appointed a data protection officer, as we are not obliged to do so under Article 37 GDPR [TO BE VERIFIED].
2. Who this policy is for
2.1 This policy concerns visitors to the website, people interested in the demo and in the Service, clients who are self-employed natural persons, and contact persons and users of our clients.
2.2 We process personal data contained in the accounts that clients keep in the Service (for example in documents and in the partner list) on behalf of the client as a processor (Article 4).
3. Purposes, legal bases and retention periods
3.1 We process personal data for the following purposes:
| Purpose and data processed | Legal basis (Article 6(1) GDPR) | Retention period |
|---|---|---|
| Operation and security of the website – server logs: IP address, time, requested address, browser information | point (f) – legitimate interest in secure and reliable operation | [TO BE COMPLETED] |
| Sending access to the demo and contacting you about the Service – e-mail address and related data (clause 3.2) | point (a) – consent; limiting the number of requests point (f) – legitimate interest in protecting the form against misuse | 48 months from the last request, or until you withdraw your consent if earlier |
| Handling enquiries and orders sent by e-mail or telephone – name, contact details, content of communication | point (b) – steps prior to entering into a contract at your request; otherwise point (f) – legitimate interest in handling the enquiry | while being handled and then [TO BE COMPLETED] |
| Trial accounting – trial company in live operation: data of its users (at most 5) and its accounting data | point (b) – steps prior to entering into a contract at your request; for contact persons of legal persons point (f) | during the trial period; if the client does not continue, we delete the trial company 30 days after it ends (backups under clause 3.5) |
| Conclusion and performance of the contract – identification and contact details of a client who is a self-employed natural person and of the client's contact persons (name, e-mail, telephone, position), communication about the Service, billing settings and referral benefits | point (b) – performance of the contract; for contact persons of legal persons point (f) – legitimate interest in performing the contract with the client | for the duration of the contract and then until limitation periods expire [TO BE DECIDED] |
| Users of the application – name, e-mail, accounting firm and companies the user can access, role (administrator, accountant, read-only), sign-in details (password only as a hash) | point (b) – performance of the contract; for users of a client that is a legal person point (f) – legitimate interest in securing access to the Service | for the duration of access, at most for the duration of the contract [TO BE COMPLETED: period after access is removed] |
| Change log – who changed data in the accounting ledgers or in the management of users and access, and who locked or unlocked a period, and when | point (f) – legitimate interest in demonstrating the origin of accounting records and in protecting the Service against misuse | [TO BE COMPLETED] |
| Invoicing of the Service and keeping our accounts – identification and billing details, payment data | point (c) – legal obligation under the Accounting Act and the VAT Act | 10 years following the year to which they relate |
| Establishment and defence of legal claims – data needed to prove a claim | point (f) – legitimate interest in protecting our rights | for the limitation period and the duration of proceedings |
3.2 Request for access to the demo. When you request access to the demo on the website, we store your e-mail address, the language of the page, the time of your first and last request, the number of requests, the time we accepted the request and sent the access, and the version of the consent text. We store the data in the Service's database in Slovakia and use it only to send you access to the demo (user name and password) and to contact you about the Service. We process it on the basis of your consent, which you give by ticking the box in the form; without consent we do not send access. We limit the number of requests from one address and the total number of requests so that the form cannot be used to send unsolicited e-mail. We delete an address from which no request has arrived for 48 months; the database does so with every request and once a day by automatic clean-up. You may withdraw your consent at any time by e-mail to partner@digital-orchestra.sk; we will then delete your address without undue delay. Withdrawal of consent does not affect the lawfulness of processing before it. We send the e-mail with the access through an e-mail sending provider [TO BE COMPLETED].
3.3 We obtain data directly from you, from clients (data of contact persons and users) and from the demo form on the website.
3.4 Providing the data necessary to conclude the contract and to use the application is a contractual requirement; without it we cannot conclude the contract or provide the Service. Providing an e-mail address in the demo form is voluntary. When the stated periods expire, we delete or anonymise the data.
3.5 Backups. We back up the Service's database every 30 minutes. Backups may also contain the personal data listed above; we keep them in Slovakia for at least 10 years, and after 2 years from the end of the contract they may also be deleted earlier. Backups are used to restore the Service and data after a failure (Article 6(1)(f) GDPR – legitimate interest in the availability and restoration of data).
4. Clients' accounting data – processing on behalf of the client
4.1 For personal data in the accounts that a client keeps in the Service (for example names and addresses of business partners in documents and in the partner list, bank details), the client is the controller and we act as its processor. The terms of this processing are set out in Article 11 of the Terms and Conditions.
4.2 If you appear in the accounts of a client that uses the Service, exercise your rights with that client; we will assist it in handling your request.
4.3 We do not use data from clients' accounts for our own purposes, in particular not for marketing, profiling or training machine learning models.
5. Recipients
5.1 We disclose personal data only to the extent necessary for the purpose concerned, to the following recipients:
- the e-mail sending provider [TO BE COMPLETED] as a processor – for e-mails with access to the demo and other e-mail communication;
- for eFaktúra, which is included in the price of the Service, Verteco digital services, s. r. o. and other recipients under the eFaktúra privacy policy;
- legal, tax and accounting advisers and auditors bound by confidentiality, and public authorities where required by law.
5.2 We operate the servers of the Service ourselves; the Digitalis data centre provides us with space, power and connectivity [TO BE VERIFIED: whether the data centre operator has access to the data].
5.3 We do not sell personal data or provide it to third parties for their marketing purposes.
6. Transfers outside the EU and EEA
6.1 We process personal data in Slovakia and do not transfer it to third countries [TO BE VERIFIED: registered office and servers of the e-mail sending provider].
7. Cookies
7.1 The Service's website uses no cookies and no analytics or advertising tools.
7.2 The application uses only a strictly necessary session cookie (with the __Host- prefix and the Secure, HttpOnly and SameSite=Strict attributes), which keeps you signed in; the session ends when you sign out or after 2 hours of inactivity. This is storage strictly necessary to provide a service explicitly requested by the user, so consent is not required (Section 109(8) of Act No. 452/2021 Coll. on Electronic Communications).
7.3 The interface may remember display settings of the application in your browser's local storage; this data is not sent to our server [TO BE VERIFIED].
8. Automated decision-making
8.1 We do not carry out automated individual decision-making, including profiling, that would produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR).
9. Your rights
9.1 To the extent and under the conditions of the GDPR, you have the right:
- of access to your personal data (Article 15) and to rectification (Article 16);
- to erasure (Article 17) and to restriction of processing (Article 18);
- to portability of data that we process by automated means on the basis of a contract or consent (Article 20);
- to object at any time to processing based on legitimate interest (Article 21);
- to withdraw consent at any time (for example to the processing of your e-mail address from the demo form), without affecting the lawfulness of processing before its withdrawal;
- to lodge a complaint with a supervisory authority.
9.2 Send requests to partner@digital-orchestra.sk. We handle them without undue delay, as a rule within one month; for complex or numerous requests we may extend the period by a further two months and will inform you of this. Before handling a request, we may ask you to verify your identity. Some rights may be limited by our legal obligations, for example the obligation to retain accounting documents.
9.3 The supervisory authority is the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27, https://dataprotection.gov.sk.
10. Changes to this policy
10.1 We update this policy when the processing or the legal regulations change. We publish the current version with its date on this page; we also inform clients of material changes by e-mail.