EN
Draft for legal review. Not yet in force.

Privacy Policy

Last updated:
The Polish version is binding. This English version is a translation.

Draft. This document is a draft for review by a lawyer and is not yet the binding privacy policy. The Polish version is binding; this English version is a translation.

For the lawyer: All provider details in square brackets are placeholders. The whole document needs review against the GDPR and the Polish act on providing services by electronic means.

§ 1. Who is who

Fiskora (the websites fiskora.com and app.fiskora.com) is a web app for issuing, sending to KSeF, receiving and emailing VAT invoices. It is run by [FIRMA], [ADRES], NIP [NIP], REGON [REGON] (“Fiskora”, “we”). Contact for data protection: [EMAIL: support@fiskora.com].

We act in two roles:

  1. Controller. We decide why and how we process data of people who create an account, visit the website, write to support or log in as accountants. See sections 2 to 9.
  2. Processor. Invoice data in a customer’s account (for example the customer’s buyers and sellers) belongs to the customer. The customer is the controller and we process it only on their instructions under the data processing agreement. See section 10.

For the lawyer: Is the split of roles right, especially for accountants (accountant login data as our controller data, access to the customer’s invoices as processing under the DPA)? Is Fiskora a joint controller of anything?

§ 2. What data, why, and on what basis (as controller)

Purpose Data Legal basis (GDPR) Retention
Creating and running your account, providing the service email address, password hash, name or company name, company details (NIP), settings, 2FA (TOTP) secret Art. 6(1)(b) (contract) until account deletion, see section 6
Managing your subscription subscription status and period, Stripe/Link customer ID; we do not see full card data Art. 6(1)(b) contract term; accounting records for the statutory period
Support and complaints content of your messages to support@, sender address, account data needed to help Art. 6(1)(b) or (f) (handling enquiries) up to 3 years after the case is closed
Accountant login (read-only) accountant’s email and name, link to the customer’s company, login logs Art. 6(1)(f) (our interest in providing the service to the customer who invited the accountant) until access is revoked or the account is deleted
Security and abuse prevention IP address, login and error logs, 2FA events Art. 6(1)(f) up to 90 days, longer in case of an incident
Preventing repeat free invoices link between a NIP and the free invoice Art. 6(1)(f) (abuse prevention) while the account exists and up to 12 months after deletion
Website statistics aggregated visit data, no cookies and no personal data, see section 8 Art. 6(1)(f) aggregated
Legal, tax and accounting duties data on invoices we issue or receive ourselves Art. 6(1)(c) as long as the law requires
Establishing and defending legal claims data necessary for a dispute Art. 6(1)(f) until claims expire

Giving us the data needed to open an account is voluntary, but without it we cannot provide the service. We do not make decisions about you by solely automated means, including profiling, that have legal effects.

We do not send marketing newsletters. We send only service messages (account verification, password reset, payment and account notices, warnings before an inactive account is deleted).

For the lawyer: Please check the chosen bases and periods, especially 3 years for support, 90 days for logs and 12 months after deletion for free-invoice abuse prevention. Is keeping the NIP link after account deletion proportionate?

§ 3. Payments

You buy the subscription from Link, LLC (USA, a Stripe affiliate), which acts as the merchant of record under Stripe Managed Payments. Link, LLC issues the sales document, handles tax, refunds and payments (card, Apple Pay, Google Pay, Link). You give payment details to Link/Stripe, not to us. Link/Stripe is a separate controller of that data and has its own privacy policy. From them we receive only what we need to switch the paid plan on or off.

For the lawyer: Does this description match the Stripe Managed Payments terms (who is the controller, what data reaches us)? Does Fiskora have its own information duty towards customers here?

§ 4. Recipients (processors)

We entrust controller data to providers who act on our instructions:

  • Hetzner Online GmbH (Germany): server hosting, EU.
  • Cloudflare, Inc. (USA): CDN and tunnel, sending email (account and invoice emails), forwarding mail sent to support@.
  • Backblaze, Inc. (USA): encrypted backups, EU region [to be confirmed].
  • An encrypted backup copy is also kept on a server run by the provider in Poland.
  • Better Stack: uptime monitoring. We do not send customer data there.
  • Umami (analytics): software hosted on Fiskora’s own server, not an external recipient.

The following are separate controllers, not our processors: Link, LLC / Stripe (payments) and the Polish Ministry of Finance (KSeF). We send invoices to KSeF on your instruction, and the data reaches the Ministry as the KSeF controller.

We may also disclose data to lawyers, advisers and public authorities where the law requires it or where we need it to defend claims.

The current list of processors for invoice data is in Annex IV of the data processing agreement.

For the lawyer: Does Better Stack really receive no personal data (apart from perhaps the provider’s own alert email)? Better Stack’s seat and transfer basis to be confirmed. Does Cloudflare Email Routing process correspondence with customers as our processor?

§ 5. Transfers outside the EEA

Our main servers are in Germany. We do use US providers (Cloudflare, Backblaze, Stripe/Link). Data reaches them on one of these bases:

  • the European Commission’s adequacy decision for the EU-US Data Privacy Framework, where the provider is certified, or
  • the European Commission’s standard contractual clauses (Decision 2021/914).

You can ask for a copy of the safeguards at [EMAIL: support@fiskora.com].

For the lawyer: Please confirm each provider’s current DPF status and that SCCs are in their DPAs. Is a transfer impact assessment needed? Does Backblaze really store data in the EU region?

§ 6. How long we keep data

  • Active accounts, and accounts with an unpaid or cancelled subscription: data stays and the account is read-only (view, download, export) until you delete the account.
  • Export: before deletion we offer a ZIP export (PDF, XML, CSV).
  • Account deletion: we delete data within 30 days of your request. Backups age out within a further 30 days.
  • Accounts that never issued a real invoice (KSeF PROD) and are inactive for 12 months: we send two warning emails, then delete the account.
  • Accounting records of our own sales: as long as tax and accounting law requires.
  • Other periods: see the table in section 2.

Important: Fiskora is not a substitute for an invoice archive. You have your own statutory duty to keep invoices. KSeF keeps invoices for 10 years, but keep your own copy too.

For the lawyer: Is indefinite storage in a read-only account compatible with storage limitation (Art. 5(1)(e) GDPR), given it is customer data and we are the processor? Should there be a reminder before deletion?

§ 7. Your rights

You have the right to access your data, rectify it, erase it, restrict processing, receive it in a portable form, and object to processing based on legitimate interests (Art. 15 to 21 GDPR). Write to [EMAIL: support@fiskora.com]. We reply within one month. We may ask you to confirm your identity.

You can also complain to the supervisory authority: the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl. If you live in another EU country, you can complain to the authority there.

If your data is on an invoice of one of our customers (you are their business contact), please contact that customer, because they are the controller. If you write to us, we will pass your request on to them.

§ 8. Cookies and analytics

  • The website fiskora.com sets no cookies or similar identifiers in your browser.
  • The app app.fiskora.com uses only one strictly necessary session cookie that keeps you logged in. It is not used for tracking or advertising and does not need consent (Art. 173(3) of the Polish Telecommunications Law, exemption for necessary cookies).
  • Analytics: we use Umami installed on our own server. It works without cookies, stores nothing on your device, creates no user identifiers and collects no personal data. The data is aggregate (for example, the number of page views).
  • We use no ads, tracking pixels or third-party analytics.

For this reason we show no cookie banner.

For the lawyer: Does Umami really process no personal data (for example truncated IP, user agent)? Are any external resources (fonts, scripts) loaded? Is the “no consent needed” statement correct under Art. 173 of the Telecommunications Law? Technical verification needed before publication.

§ 9. Security

Among other things we use: TLS encryption, isolation of each company’s data in the database (Postgres row-level security), encryption of customers’ KSeF certificates with per-customer keys wrapped by a master key held only on the server, mandatory two-factor authentication (TOTP) before KSeF can be connected, encrypted backups and continuous archiving of transaction logs. Details for invoice data are in Annex III of the data processing agreement.

§ 10. Invoice data in your account (Fiskora as processor)

If you use Fiskora to issue and receive invoices, your account holds data of your buyers, sellers, employees and other people (names, addresses, NIP, emails, bank accounts, invoice content). You are the controller of that data and we are the processor. We process it only to provide the service (storage, sending to KSeF, sending by email, export) and under the data processing agreement, which you conclude with us electronically by accepting the terms. You are responsible for complying with the GDPR towards your own contacts (information duty, legal basis).

§ 11. Changes

We may change this policy. We will tell you about material changes by email or in the app in advance. The date of the last update is at the top of the document.

Parts adapted from Basecamp’s open-source policies, CC BY 4.0 (github.com/basecamp/policies).