Privacy Policy

The controller of personal data processed in connection with the Kontevia website and service is Eucalypt 4 s.r.o., identified above. Questions about personal data and requests to exercise your rights can be sent to hello@kontevia.com.

This policy applies to visitors of kontevia.com and its country versions, to users of the Kontevia service and to persons who contact us. It is written from an EU-wide perspective; where national law adds requirements, they apply in addition.

For the data of users of the Service (registration, contact, billing and usage data) Eucalypt 4 s.r.o. is the controller and this policy applies in full.

For the personal data contained in the accounting documents that a user uploads (names, addresses, VAT IDs and bank details of the user's customers and suppliers, employee data in payroll documents) the user is the controller and Eucalypt 4 s.r.o. acts as a processor on the user's instructions. That processing is governed by the Data Processing Agreement. If you are a customer or supplier of one of our users and have questions about your data, please contact that business first.

Website visitors

• Technical data needed to deliver the pages (IP address, browser, requested URL) is processed for the operation and security of the website on the basis of our legitimate interest (Art. 6(1)(f) GDPR) and kept in server logs for a short period.
• Google Analytics 4 (visit statistics) runs on the website and in the advisers directory only after you accept analytics cookies in the cookie banner (Art. 6(1)(a) GDPR). Microsoft Clarity and Google Ads conversion measurement are not deployed at the moment; if we deploy them, they will also run only with your consent. Details are in the Cookie Policy.
• Attribution of advertising campaigns (the source and the advertising click identifier you came from) is stored in the db_attr cookie for up to 90 days only if you accept marketing cookies (Art. 6(1)(a) GDPR); without consent nothing is stored. If you then register, the attribution is saved with your account to evaluate the effectiveness of campaigns.

Enquiries

• If you write to hello@kontevia.com or contact us through WhatsApp, we process your e-mail address or phone number, your name and the content of the message solely to answer you (Art. 6(1)(b) and (f) GDPR). WhatsApp messages are processed by Meta Platforms Ireland Ltd. under its own terms.
• Newsletter subscriptions are based on your consent and can be withdrawn with the unsubscribe link in every e-mail.

Users of the Service

• Identification and contact data (name, company, e-mail, phone number, address, VAT ID) to create and manage the account and to communicate with you: performance of the contract (Art. 6(1)(b)).
• Billing data (invoices, payment status, plan, usage) to charge the subscription and meet accounting obligations: performance of the contract and legal obligation (Art. 6(1)(b) and (c)). Card details are processed by Comgate, a.s. and never reach our servers.
• Login and security data (password hash, sign-in provider identifier, WhatsApp phone number used for the chat channel, IP address and time of login, device type, activity log) to secure the account and detect abuse: performance of the contract and legitimate interest.
• Usage data (number of documents processed, functions used, error reports) to operate, support and improve the Service: legitimate interest (Art. 6(1)(f)).
• Content of documents you upload, on your instructions, to provide the Service: performance of the contract; for the data of third parties in those documents we act as processor as described in Article 2.
• Communication with support (e-mails, chat messages) to resolve your requests: performance of the contract.

• Account and usage data: for the duration of the contract and 90 days after termination to allow export, after which it is deleted or anonymised.
• Documents uploaded to the Service: for the duration of the contract; after termination for 90 days for export, unless you delete them earlier or ask us to keep them for a longer archive period.
• Billing records: for the period required by tax and accounting law of the Czech Republic, currently ten years.
• Support communication: for the duration of the contract and one year after.
• Data needed to establish, exercise or defend legal claims: until the applicable limitation periods expire.
• Enquiries from non-users: as long as needed to handle them, at most one year.
• Consent records (cookie choices, terms acceptance): for the period during which we must be able to prove the consent.

We share personal data only with providers that help us operate the Service and only to the extent necessary: hosting, database and storage providers, e-mail delivery, payment processing, the WhatsApp messaging platform, document extraction and assistant models, and bank connection providers when you connect a bank account. Analytics tools would be added only with your consent. Each provider is bound by a data processing agreement.

The current list of sub-processors, with the purpose and the location of each, is published on the Sub-processors page. Public authorities receive data only where the law requires it.

Some providers are established outside the European Economic Area, mainly in the United States. Transfers to them are protected by the EU-US Data Privacy Framework where the provider is certified, or by the standard contractual clauses adopted by the European Commission, together with supplementary measures where needed. You may request a copy of the safeguards.

We apply technical and organisational measures appropriate to the risk: encryption in transit (TLS 1.2 or higher) and at rest (AES-256), access on a need-to-know basis with multi-factor authentication for administrative access, logging of access to personal data, regular backups with tested restoration, monitoring and an incident response procedure.

In case of a personal data breach that is likely to result in a risk to your rights, we notify the competent supervisory authority within 72 hours and, where the risk is high, the affected persons without undue delay.

If you connect your Kontevia account to an assistant such as ChatGPT or Claude through our connector, only the data the assistant requests on your instruction is transmitted: lists and details of documents, VAT summaries, reports and account status. Access is tied to an API key that you can revoke at any time in the account settings; revoking the key ends the access immediately.

We do not provide your data to any provider for training their models and we never share data of other users. Processing on the assistant's side is governed by the terms of the provider you chose. Every connector call is logged (time, key, tool used) for security and billing.

• Access (Art. 15): to obtain confirmation whether we process your personal data and a copy of it.
• Rectification (Art. 16): to have inaccurate data corrected and incomplete data completed.
• Erasure (Art. 17): to have data deleted where there is no longer a legal basis for keeping it. Data we must retain by law, such as invoices, is excluded.
• Restriction (Art. 18): to limit processing while a dispute about accuracy or lawfulness is resolved.
• Portability (Art. 20): to receive your data in a structured, machine-readable format; the Service offers exports for this purpose.
• Objection (Art. 21): to object to processing based on legitimate interest, including direct marketing, at any time.
• Withdrawal of consent (Art. 7(3)): at any time, without affecting the lawfulness of processing before withdrawal.
• Complaint: with a supervisory authority. In the Czech Republic this is the Office for Personal Data Protection (Urad pro ochranu osobnich udaju, https://uoou.gov.cz). You may also complain to the authority of your own country of residence or work.

To exercise a right, e-mail hello@kontevia.com. We respond without undue delay and at the latest within one month; we may ask you to verify your identity.

The website uses cookies and similar technologies. Strictly necessary cookies are set on the basis of our legitimate interest; analytics and marketing cookies only with your consent, which you can change at any time through the cookie settings in the footer. The full list and storage periods are in the Cookie Policy.

We update this policy when the Service or the law changes. Users are informed by e-mail or by a notice in the dashboard; the current version is always available on this page with the date of the last update.