Privacy Policy

1. Controller

The controller of personal data is the operator of the Taxify service (taxify.sk). Contact for data protection matters: info@taxify.sk.

2. What data we process

Account data: email address, first and last name (if provided), password in encrypted form (bcrypt), preferred language.

Financial data: trade statements you upload to the Service (trades, dividends, fees, broker account identifiers) and the tax outputs calculated from them.

Technical data: IP address, browser type and basic logs necessary for the secure operation of the Service.

Contact form data: name, email and the content of the message you send us.

3. Purposes and legal bases

Providing the Service (account management, statement import, tax calculation, document export) – legal basis: performance of a contract (Art. 6(1)(b) GDPR).

Security and abuse prevention (logs, rate limiting) – legal basis: legitimate interest (Art. 6(1)(f) GDPR).

Website traffic measurement via Google Analytics – legal basis: your consent given via the cookie banner (Art. 6(1)(a) GDPR); you can withdraw consent at any time.

Responding to contact form messages – legal basis: legitimate interest or steps prior to entering into a contract.

4. Retention period

We keep account data and financial data for as long as your account exists. After account deletion we erase or anonymise the data within 30 days, except for data we are legally required to retain longer.

Contact form messages are kept for a maximum of 12 months after resolution. Analytics data is retained for the periods configured in Google Analytics.

5. Recipients and processors

We use vetted processors to operate the Service: web hosting and delivery (Vercel), database (Neon – servers in the EU), email services for system messages, and web analytics (Google Analytics, only with consent).

We never sell your financial data or provide it to third parties for marketing purposes.

6. Transfers to third countries

Some providers (e.g. Vercel, Google) may process data outside the EU/EEA. In such cases the transfer is safeguarded by EU standard contractual clauses or an adequacy decision (EU-US Data Privacy Framework).

7. Your rights

Under GDPR you have the right to access your data, rectify it, erase it, restrict processing, data portability, and the right to object to processing based on legitimate interest. Consent (e.g. to analytics) can be withdrawn at any time.

You can exercise your rights by emailing info@taxify.sk. If you believe we process your data unlawfully, you have the right to lodge a complaint with the Office for Personal Data Protection of the Slovak Republic (dataprotection.gov.sk).

8. Cookies and analytics

The website uses essential technical cookies (e.g. language preference, consent state) and – only with your consent – Google Analytics cookies for anonymous traffic measurement. You can change your preferences by withdrawing consent in the cookie banner.

9. Security

Data is transferred exclusively over encrypted connections (TLS) and stored in an encrypted database on servers in the EU. Passwords are stored only as secure hashes (bcrypt). Access to production data is limited to the minimum necessary circle of people.

10. Changes to this policy

We may update this policy, in particular when legislation or the scope of the Service changes. The current version is always published on this page together with the date of the last update.