1. Data controller (Art. 4(7) GDPR)
The controller of personal data is Web 3.0 s. r. o., Alvinczyho 1694/19, 040 01 Košice, Slovak Republic. Registered in the Commercial Register of Košice City Court, Section: Sro, Insert No.: 44086/V. Company ID (IČO): 51764822. VAT ID (IČ DPH): SK2120777516. Managing Director: Michal Drozd. Contact: [email protected]. We have not appointed a Data Protection Officer as our processing activities do not meet the mandatory-appointment criteria of Article 37 GDPR. Privacy inquiries: [email protected].
2. Data we collect
- Registration data: email, phone number, name
- Bank data: current account balance, account holder name, masked IBAN and bank name via licensed PSD2 APIs. Transaction history is never fetched. Balance and masked IBAN are retained while your badge is valid and deleted when you delete your account.
- Property data: cadastral territory, title deed number, area
- Resulting score: status tier and bracket (without exact amounts)
3. Purpose of processing
We process data solely to verify the user's financial status and generate a cryptographically verifiable badge. We do not retain transaction history or IBANs. The current bank balance is retained only for the lifetime of the badge so that your tier can be recomputed on renewal.
4. Processors and international transfers
We share data only with the following processors, each under a data-processing agreement under Article 28 GDPR: Tink AB (Sweden, EU) — PSD2 aggregator for balance retrieval; Salt Edge Inc. (Canada, EU adequacy decision) — alternative PSD2 aggregator; Stripe Payments Europe Ltd. (Ireland, EU) and Stripe, Inc. (USA) — payment processing, secured by EU Standard Contractual Clauses (SCCs) and the EU-US Data Privacy Framework (DPF); Resend, Inc. (USA) — transactional email delivery (SCCs + DPF); Cloudflare, Inc. (USA) — DNS and DDoS protection (SCCs + DPF); Google Ireland Ltd. (Ireland, EU) — Google Ads / Google Tag for conversion measurement (only with your consent). The production application server (database, app container) is located in the Slovak Republic.
5. Your rights (GDPR)
- Right of access: You can request a copy of your data
- Right to rectification: You can correct inaccurate data in settings
- Right to erasure: You can delete your account and all data
- Right to portability: You can request a data export
6. Security
All data is encrypted in transit (TLS 1.3) and at rest. Passwords are hashed with scrypt. Session tokens are cryptographically random and hashed with SHA-256.
7. Legal basis (Art. 6 GDPR)
- Performance of contract (Art. 6(1)(b)): registration, processing of bank data, badge generation, plan administration
- Legal obligation (Art. 6(1)(c)): retention of accounting and tax records
- Legitimate interest (Art. 6(1)(f)): service security, fraud prevention, server logs, abuse monitoring
- Consent (Art. 6(1)(a)): advertising/analytics cookies, Google Ads, optional marketing emails
8. Retention periods
Registration data (name, email, phone) is retained while your account is active; after deletion it is removed within 30 days. Current bank balance and masked IBAN are retained only while your badge is valid so your tier can be recomputed on renewal — they are deleted when you delete your account. Transaction history is never stored. Resulting scores and verification history are retained for the duration of the badge (Keep: 90 days, Lifetime: indefinite but deletable at any time). Accounting documents are retained for 10 years (Slovak Act 431/2002). Server logs are anonymised after 14 days.
9. Cookies and tracking
We embed the Google Tag (gtag.js) for Google Ads (AW-18094356368). Scripts and cookies are loaded only after your active consent; by default advertising and analytics cookies are blocked (Google Consent Mode v2 — ad_storage=denied, analytics_storage=denied). Upon consent the following is transmitted to Google Ireland Ltd.: IP address, User-Agent, conversion identifier, optionally a hashed email for Enhanced Conversions. Legal basis: consent (Art. 6(1)(a) GDPR and the ePrivacy regime). You can revoke consent anytime via the Cookie settings link in the footer.
10. Right to lodge a complaint
You have the right to lodge a complaint with a data-protection authority (Art. 77 GDPR). The competent Slovak authority is the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava, https://dataprotection.gov.sk. You may alternatively complain to the authority of your country of residence (e.g. BfDI in Germany, DSB in Austria, UODO in Poland, NAIH in Hungary, ICO in the UK).