Privacy policy

Peppolify protects merchant, buyer, and visitor data. We only process data that is necessary to deliver the service and meet legal obligations.

Controller: Peppolify s.r.o., Company ID 19274461

Registered office: Na Strzi 65/1702, 140 00 Prague 4, Czech Republic

Contact for privacy: compliance@peppolify.cz

At a glance

We process data to run the product, provide support, invoice customers, and comply with the law.
We never sell data to third parties. Transfers happen only with vetted processors bound by contracts.
Data subjects enjoy the full GDPR rights set (access, rectification, erasure, objection, portability).

If you have questions, email compliance@peppolify.cz.

Categories of personal data

We process data about website visitors, registered users, invoice recipients, and contacts interacting with us.

Data subject

Data types

Purpose

Website visitor

Truncated IP address, cookies, preferred language.

Security, analytics (if consented), personalising the cookie banner.

Registered user

Name, email, company name, login logs.

Account management, support, billing.

Invoice recipient

Buyer identifiers (VAT ID, PEPPOL ID), delivery addresses, invoice data in UBL format.

Delivering invoices through the PEPPOL network and keeping an audit trail.

Contact person

Name, email, phone (if provided), communication content.

Responding to requests, onboarding, contractual communication.

Lawful bases

Each processing purpose has a lawful basis under Article 6 GDPR.

Performance of contract

Operating Peppolify, running plugins, generating and delivering e-invoices.

Admin user data.
Invoice and delivery information.
Integration and webhook logs.

Legal obligation

Accounting and tax rules, public procurement requirements, statutory logging duties.

Billing documentation.
Access Point delivery records.
Audit documentation.

Legitimate interest

Improving the product, preventing abuse, securing infrastructure.

Security event logs.
Aggregated analytics without consent (only anonymised data).
Product updates for existing customers.

Consent

Given voluntarily for marketing emails and analytics cookies.

Email address for newsletters (double opt-in).
Analytics cookies (see cookie policy).
Consent can be withdrawn at any time without affecting the core service.

Retention periods

We retain data only as long as necessary. Afterwards we anonymise or securely delete it.

Data type

Retention

Deletion method

User account

For the duration of the contract + 3 months.

Account disabled, data removed from active systems and backups after 30 days.

Invoices & delivery logs

10 years to comply with Czech accounting rules.

Stored in EU data centres, purged after statutory period.

Support conversations

24 months

Deletion from ticketing system.

Marketing consent

Until withdrawn or 3 years of inactivity.

Removed from mailing system and suppression list updated.

Data transfers & processors

We work with trusted partners bound by data processing agreements.

Infrastructure

AWS EU (Frankfurt) hosts our production environment. Data remains within the EU.

Access Point partners

Certified PEPPOL Access Point providers process invoice delivery metadata under contract.

Support tools

We use EU-based helpdesk and monitoring tools. Only authorised staff can access them.

Analytics

Google Analytics 4 processes anonymised data based on your consent (see cookie policy).

Your GDPR rights

You can exercise any of the rights below by emailing compliance@peppolify.cz.

Access & rectification

We will provide a copy of your data and correct inaccuracies without undue delay.

Erasure

Request deletion when data is no longer needed or processing is unlawful. We will confirm once complete.

Restriction & objection

You may restrict processing or object to certain uses (e.g. marketing). We will assess each request individually.

Portability

Receive your data in a structured, commonly used format so you can transfer it elsewhere.

Supervisory authority

You can file a complaint with the Czech Office for Personal Data Protection (ÚOOÚ) or your local authority.