1. Who processes your data
The controller within the meaning of Regulation (EU) 2016/679 of the European Parliament and of the Council (the “GDPR”) and Slovak Act No. 18/2018 Coll. on the Protection of Personal Data is Bokaflow s. r. o., with its registered office at Partizánska 3261/18, 058 01 Poprad, Slovak Republic, company ID (IČO) 50 962 795, registered in the Commercial Register of the District Court of Prešov, section Sro, insert no. 34860/P (“we” or the “Provider”).
This document explains what personal data we process when operating the bokaflow.com website and the Bokaflow service available at app.bokaflow.com, for what purpose, for how long, and what rights you have. Terms such as “Service”, “User”, “Account” and “User data” have the same meaning as in the General Terms and Conditions.
We have not appointed a Data Protection Officer (DPO), as the GDPR does not require us to do so given the scope of our activities. For any data protection questions, contact us at info@bokaflow.com.
2. What data we process
As a controller, we process the following data about users of the Service and visitors to the website:
- Registration and account data — name, email, password in the form of a cryptographic hash, membership of a company (tenant), role and account settings.
- Billing data — business name, address, company ID, tax ID, VAT ID, selected plan and payment history. You enter payment card details directly into the payment gateway; we have no access to them.
- Usage data — login dates, records of operations performed in the application (audit log), IP address, device and browser type.
- Communication — the content of messages you send us by email or through the contact form on the website, including the name and email you provide.
- Technical records — server and application logs needed for operation, security and troubleshooting.
We do not process the personal data of third parties that you enter into the Service (for example, contacts of authors and partners) as a controller, but on behalf of the user as a processor. This processing is governed by section 4.
We do not process special categories of personal data and do not carry out automated decision-making or profiling with legal or similarly significant effects.
3. Purposes and legal bases
- Registration, provision of the Service and account management — performance of a contract (Art. 6(1)(b) GDPR).
- Invoicing, payment records and accounting — compliance with a legal obligation (Art. 6(1)(c) GDPR), in particular under accounting and VAT legislation.
- Technical support and customer communication — performance of a contract or our legitimate interest in answering questions (points (b) and (f)).
- Replies to messages from the contact form — steps taken at your request prior to entering into a contract, or legitimate interest (points (b) and (f)).
- Security of the Service, audit log and abuse prevention — legitimate interest in protecting the Service and user data and in the traceability of operations performed (point (f)).
- Establishment, exercise and defence of legal claims — legitimate interest (point (f)).
- Sending information about product updates — legitimate interest towards existing customers, or consent (point (f) or (a)); you can unsubscribe at any time via the link in the message or by email.
Providing registration and billing data is a contractual requirement. Without it, we cannot provide the Service.
4. Data entered into the application
Data that you enter into or import into the Service (titles, license contracts, sales, stock documents, contacts, royalty statements) remain yours. Where they contain personal data of natural persons, you are the controller of that data and we act as a processor under Art. 28 GDPR.
The provisions of this section constitute a data processing agreement between you and the Provider. You enter into it by accepting the General Terms and Conditions, and it remains in force for the entire period during which the Service is provided.
4.1 Subject matter and scope of processing
- Subject matter and purpose — storing and processing user data solely for the purpose of providing the Service under the Terms.
- Data subjects — authors, translators, illustrators and other rights holders, literary agents, customers and business partners of the user and their contact persons.
- Categories of data — first name and surname, address, email, telephone, bank details, data from license contracts, data on royalties, advances and payments, and other data entered into the Service by the user.
- Duration — for the duration of the contract and the export period after it ends, as set out in section 6.
Do not enter special categories of personal data (for example, health data) into the Service, or data for which you have no legal basis for processing. You are responsible for the lawfulness of entering the data and for fulfilling your information obligations towards data subjects.
4.2 Our obligations as a processor
- We process data only on the basis of your documented instructions, which are the Terms, your settings and your actions in the Service. If we consider an instruction to be in breach of the law, we will inform you.
- We do not use the data for our own purposes, do not sell them and do not provide them to third parties, except to sub-processors under section 5 and where required by law.
- Persons on our side who have access to the data are bound by confidentiality.
- We implement appropriate technical and organisational measures as described in section 8.
- We assist you by appropriate means in handling data subject requests, in data protection impact assessments and in fulfilling your obligations towards the supervisory authority. Data subject requests we receive directly will be forwarded to you without undue delay.
- We will inform you of any personal data breach affecting your data without undue delay, and no later than 48 hours after becoming aware of it, together with the information you need to meet your notification obligation.
- After the contract ends, we will allow you to export the data and then delete it as set out in section 6, unless we are required by law to retain it.
- On request, we will provide you with the information necessary to demonstrate compliance with these obligations. An audit or on-site inspection may be carried out with at least 30 days’ prior written notice, to a reasonable extent and at the user’s expense.
4.3 Provider access to your data
We access the data in your account only when necessary for technical support you have requested, to fix an error or a security incident, or where required by law. Access to an account for support purposes is logged.
4.4 Sub-processors
You grant us general authorisation to engage the sub-processors listed in section 5. We bind sub-processors to the same data protection obligations and remain liable to you for their performance. We will inform you by email or in the application at least 15 days in advance of any intended addition or replacement of a sub-processor. If you do not agree with the change, you may object or terminate the contract before that date.
The data of individual companies are technically separated within the Service. The liability of the contracting parties is governed by Article 10 of the Terms.
5. Who we share data with
We share data only to the extent necessary with the following recipients:
- Hosting and server infrastructure (processor) — Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany.
- Email delivery (processor) — ZeptoMail, a service of Zoho Corporation; sending system emails and messages from the contact form.
- Barion payment gateway — Barion Payment Zrt., Hungary; processes payment data for subscription payments as an independent controller under its own privacy policy.
- Accounting and law firms — to the extent necessary to comply with legal obligations and to assert claims.
- Public authorities — where required by law.
We process data within the European Economic Area. Should any processor process data outside it, it does so only on the basis of a European Commission adequacy decision or standard contractual clauses.
We do not sell your data or use it for third-party advertising.
6. How long we keep data
- Account data and user data — for the duration of the contract and then 14 days after the subscription ends, during which you can export them. After that, we delete them irreversibly.
- Invoices and accounting records — 10 years from the end of the year to which they relate, under the Slovak Accounting Act.
- Technical logs — 12 months.
- Support communication and contact form messages — 3 years from the last communication.
If we need data to establish, exercise or defend legal claims, we keep it until such proceedings are concluded. After the periods above expire, we delete or anonymise the data.
7. Your rights
In connection with the processing of your personal data, you have the right:
- of access to your data and to information about how we process it;
- to rectification of inaccurate or incomplete data;
- to erasure of data that is no longer needed, unless a legal obligation prevents it;
- to restriction of processing;
- to data portability in a structured, commonly used format;
- to object to processing based on legitimate interest;
- to withdraw consent where processing is based on consent, without affecting the lawfulness of processing before its withdrawal;
- to lodge a complaint with the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov SR), Hraničná 12, 820 07 Bratislava, dataprotection.gov.sk, or with the supervisory authority in the EU member state of your habitual residence or place of work.
You can exercise your rights by email at info@bokaflow.com. We will respond within one month at the latest; in justified cases we may extend this period by a further two months, and we will let you know if we do. We may verify your identity before handling the request.
If your data were entered into the Service by one of our users (for example, if you are an author or a partner of a publishing house), please direct your request to that user, as they are the controller of your data. If the request reaches us, we will forward it to them.
8. Security
Data transmission is encrypted (HTTPS). We store passwords only in the form of a cryptographic hash. The data of individual companies are logically separated in the application, and access to them is restricted by permissions. Only the necessary number of authorised persons have access to production systems.
Should a personal data breach occur that poses a risk to your rights, we will inform you without undue delay and fulfil our notification obligation towards the supervisory authority.
10. Changes to this document
We may update this document, for example when the Service’s features, sub-processors or the law change. We will notify you of material changes in advance by email or in the application, and of changes to sub-processors within the period set out in section 4.4.
The current version is always available on this page. This document is drawn up in the Slovak language; in the event of any discrepancy with its translation, the Slovak version prevails.
11. Contact
For questions about data protection, contact us at info@bokaflow.com or by post at Bokaflow s. r. o., Partizánska 3261/18, 058 01 Poprad, Slovak Republic.
Related document: General Terms and Conditions.