Privacy policy

The data controller is: R4_TECH Rafał Jurek Al. Ks.K.S. Wyszyńskiego 76/6, 94-047 Łódź, Poland VAT ID: PL7282787249 E-mail: [email protected] ("Controller") Contact for data protection matters: [email protected]

We process the following categories of personal data: • Account data: email address, name, password (encrypted). • Organisation data: company name, VAT ID, address (if provided). • Financial data: subscription and payment history (no card data — handled exclusively by Stripe). • Technical data: IP address, browser type, operating system, session identifiers. • KSeF document data: invoice data processed through the Service (if applicable). • Activity data: login logs, system operations, tool usage history. • Newsletter data: subscriber email address, sign-up date, IP address. • Browser notification data (only if you enable it): the push endpoint URL issued by your browser, that device's encryption keys, its browser and operating system name, and your chosen language. We delete this when you turn notifications off, log out, or delete your account.

Data is processed for the following purposes: • Providing the Service (registration, login, feature access) Legal basis: Art. 6(1)(b) GDPR (performance of a contract) • Payment and subscription handling (Stripe) Legal basis: Art. 6(1)(b) GDPR (performance of a contract) • System security and technical logs Legal basis: Art. 6(1)(f) GDPR (legitimate interests) • Analytics and usage statistics (Google Analytics, Cloudflare Analytics) Legal basis: Art. 6(1)(a) GDPR (consent) — requires acceptance of analytics cookies • Newsletter and marketing communications Legal basis: Art. 6(1)(a) GDPR (consent) • Compliance with legal obligations (e.g. tax regulations) Legal basis: Art. 6(1)(c) GDPR

The website uses Google AdSense, a service provided by Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA), to display advertising. Google AdSense uses cookies and DoubleClick technology to display ads matched to the user's interests on the basis of earlier visits to this and other websites. Data collected by Google through AdSense may include: • advertising identifiers (cookies, device identifiers), • IP address, • information about activity on the website, • demographic data and interests (where the user is signed in to a Google account). Users may opt out of personalised advertising: • at https://www.google.com/settings/ads • through the Network Advertising Initiative: https://optout.networkadvertising.org/ • through the cookie settings on this website (the consent management panel) Google's privacy policy: https://policies.google.com/privacy

Data may be shared with the following parties: • OVH SAS – infrastructure hosting (EU) • Stripe, Inc. – payment and subscription processing • Google LLC – Google Analytics (analytics), Google Tag Manager • Cloudflare, Inc. – CDN, DDoS protection, Cloudflare Analytics • Zoho Corporation Pvt. Ltd. – e-mail delivery (SMTP) • National Revenue Administration (KSeF) – integration with the National e-Invoice System Each party processes data under appropriate Data Processing Agreements (DPA) or Standard Contractual Clauses (SCCs).

Some data may be transferred outside the European Economic Area, in particular to the United States (in the case of Google LLC, Stripe Inc., Zoho Corporation, Cloudflare Inc.). Such transfers take place on the basis of: • Standard Contractual Clauses (SCCs) approved by the European Commission, or • Other mechanisms ensuring an adequate level of protection under Art. 46 GDPR.

This website uses the following categories of cookies: Essential (always active): • User session, authentication token, language preferences. Analytics (with consent): • Google Analytics (_ga, _gid, _gat) — traffic and user behaviour analysis. • Cloudflare Analytics — performance and security statistics. You can manage your cookie preferences through the cookie settings panel on this site or through your browser settings. Further details are provided in the Cookie Policy at /legal/cookies.

We collect email addresses of individuals who voluntarily subscribe to our newsletter. Subscribing to the newsletter is entirely optional and is not a condition of using the Service. Creating an account does not automatically subscribe you to the newsletter. Data collected upon newsletter sign-up: • Email address, • Date and time of sign-up, • IP address (for security purposes). You may unsubscribe at any time by: • Clicking the "Unsubscribe" link in any newsletter email, or • Contacting us at: [email protected]. Email delivery is handled by Zoho Corporation Pvt. Ltd. under a Data Processing Agreement.

The R4 Biuro Android application uses the same account and the same data as the browser version. In addition, and solely in connection with the operation of the application, we process: • Push notification token (Firebase Cloud Messaging) — an identifier assigned by Google to one installation of the application on one device. It is used only to deliver the notifications the user asked for (for example, a new invoice in KSeF). Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and 6(1)(f) (legitimate interest). • Device type and application version — to the extent needed to deliver a notification in the correct format and language, and to diagnose errors. • Data stored locally on the device — session token, chosen language, interface and sound settings. These remain on the device and are removed when the application is uninstalled or the user signs out. The application does not collect location, contacts, photos or advertising identifiers, and does not display advertising — §4 concerns the website only. The recipient of push tokens is Google Ireland Limited (Firebase Cloud Messaging). Notifications can be switched off in the application or in Android settings at any time; switching them off removes the subscription on the server. Deleting an account also deletes push tokens and device identifiers — see Account and data deletion.

Data is retained for the following periods: • Account data: for the lifetime of the account, or until deletion by the user. • Payment logs: in accordance with tax law — up to 5 years. • Technical and security logs: up to 12 months. • Newsletter data: until the subscription is cancelled. • Analytics data (anonymised): up to 26 months (Google Analytics) or as configured.

Under the GDPR, you have the following rights: • Right of access to your data (Art. 15 GDPR), • Right to rectification of inaccurate data (Art. 16 GDPR), • Right to erasure ("right to be forgotten", Art. 17 GDPR), • Right to restriction of processing (Art. 18 GDPR), • Right to data portability (Art. 20 GDPR), • Right to object to processing (Art. 21 GDPR), • Right to withdraw consent at any time (without affecting the lawfulness of processing before withdrawal), • Right to lodge a complaint with a supervisory authority: President of the Polish Data Protection Authority (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, https://uodo.gov.pl. To exercise your rights, contact us at: [email protected].

The Controller applies appropriate technical and organisational measures to protect personal data, including: • Encrypted connections (TLS/HTTPS), • Password hashing, • Access controls, • Regular security reviews. The Controller does not guarantee full protection against all threats and is not liable for incidents caused by third parties or force majeure.

The Controller reserves the right to update this Privacy Policy. Users with an account will be notified of material changes by email or via an in-app notice. Last updated: 26 March 2026.

For all data protection enquiries, please contact us: Email: [email protected] Postal address: R4_TECH Rafał Jurek, Al. Ks.K.S. Wyszyńskiego 76/6, 94-047 Łódź, Poland