GANADO FAKTURA · PRIVACY
What happens to invoice data.
This notice supplements Ganado’s general privacy policy and describes the actual data flow of the Czech invoice tool.
1. Controller and roles
Ganado international s.r.o. is the controller for account identity, service operation, security, support and minimal usage records. Contact: Ganado international s.r.o., IČO 19322119, VAT ID CZ19322119, Příčná 1892/4, Nové Město, 110 00 Praha 1, registered in the Commercial Register kept by the Municipal Court in Prague, section C, insert 384722, info@ganado.cz.
For personal data that a user enters about an invoice recipient, the invoice issuer normally determines why the data is used and acts as controller. Ganado processes that content on the issuer’s instructions only to provide Faktura. The processing terms in the Faktura Terms apply to that relationship.
2. Data, purpose and legal basis
Using the tool without an account keeps drafts and issued documents in this browser. After a new document is successfully issued, Faktura may prepare one vector PDF in the background and cache it only in browser memory; opening an archived document does not do this. A hosted link is created only on request. Signing in additionally enables the durable account archive and cross-device sync.
| Activity | Data | Purpose and legal basis | Application retention |
|---|---|---|---|
| E-mail of Ganado’s own invoice | Recipient e-mail address, invoice number, item description, amount, due date and hosted invoice link. | Send the invoice after Ganado’s authorised owner confirms the recipient. Performance of the service under Article 6(1)(b), or Ganado’s legitimate interest in billing its services under Article 6(1)(f). | Faktura does not create a separate e-mail archive. Resend processes the message and delivery records under its data processing agreement and retention settings; short-lived sending limits last up to one hour. |
| Account and sign-in | Ganado Core user ID; e-mail, name and avatar supplied by Google when Google sign-in is chosen. | Authentication, account continuity and sync: performance of the service under Article 6(1)(b) GDPR. | Until account closure. With a kept archive the sign-in address stays with it, to verify requests, until the archive is deleted. Authentication-provider records follow that provider’s own policy. |
| Invoice content and archive | Supplier and customer identity, address, IČO/DIČ, contact and bank details, line items, dates, amounts, status, relations and activity history. | Create, preserve, sync and restore documents requested by the user: Article 6(1)(b) for the user’s data; processing on the issuer’s instructions for recipient data. | Signed-in archive: until 31 December of the tenth calendar year after the year of issue. After account closure only if the user chooses to keep the archive; otherwise it is deleted at closure. |
| Online payment of Ganado’s own invoice | Document/payment linkage, amount, currency, time, status and verification evidence; technical data when connecting to Stripe. | Receiving and matching payment: Article 6(1)(b) where the payer is a natural person and party to the contract; otherwise Ganado’s legitimate interests under Article 6(1)(f). Transaction protection and resolving discrepancies: Article 6(1)(f). Keeping Ganado’s own accounting and tax records where required by law: Article 6(1)(c). | Archive rules in section 5; data held by Stripe follows its own rules. See Online payments to Ganado. |
| PDF generation | Validated invoice HTML needed to render the requested PDF. | Prepare one vector file after successful issuance, or generate it when the user later requests a download: Article 6(1)(b). | Processed on Ganado’s own infrastructure for that render and cached only in browser memory for the immutable snapshot; Faktura does not write the PDF or its HTML to an application database. |
| Hosted invoice link | A signed copy of the invoice snapshot, invoice ID, ownership/fingerprint metadata and read-security counters. | Show the invoice to people chosen by the user: Article 6(1)(b). | Maximum 30 days. A managed signed-in link is denied when the durable document is voided, removed or no longer matches. An anonymous capability link ends after successful revocation or expiry. |
| Reliability and abuse prevention | Pseudonymous document ID/type/timestamps; request metadata and rate-limit identifiers derived from IP address. | Idempotency, service capacity, incident diagnosis and abuse prevention: legitimate interests under Article 6(1)(f). | Minimal usage records until account closure, or with a kept archive until its last document is deleted; short-lived rate-limit keys and technical logs only for the relevant operational window. |
3. Local storage, sync, PDF and sharing
- Browser storage belongs to the device profile. Clearing site data, using private browsing or losing the device can remove it.
- The signed-in archive is stored server-side in Ganado Core and is available only through a session verified for the same account. Browser roles have no direct table access.
- A hosted link is a possession capability: anyone who receives it can view the invoice. Managed signed-in links are checked against the durable non-voided snapshot on every read. Anonymous links remain readable until revocation succeeds or they expire. Do not send a link to unintended recipients.
- Older transitional device-sync copies may remain in Upstash for their existing maximum 90-day TTL; new signed-in document truth is kept in Ganado Core.
- Voiding a document preserves its accounting history; it is not a privacy deletion request.
4. Providers and international transfers
Ganado gives providers only the data needed for their role. Ganado operates account sign-in and the archive in Ganado Core on its own server in the Czech Republic. HTTPS requests to Faktura and Core pass through Cloudflare. External providers or their subprocessors may process data outside the EEA under the safeguards in their applicable agreements.
| Provider | Role in Faktura | Relevant data |
|---|---|---|
| Resend | Transactional e-mail delivery of Ganado’s own invoices, on Ganado’s instructions | Recipient e-mail, message content, invoice link and technical delivery information. Processing may occur outside the EEA under Resend’s data processing agreement and standard contractual clauses. |
| Ganado international s.r.o. (Ganado Core) | Account sign-in and archive on Ganado’s own server in the Czech Republic | Account identity, immutable invoice snapshots, lifecycle and numbering metadata. |
| Cloudflare | Secure delivery of HTTPS requests to Faktura and Ganado Core, on Ganado’s instructions | Faktura and Core request and response content, including account and invoice data; IP addresses and technical connection information. |
| Ganado international s.r.o. (Faktura) | Hosting, API execution and transient PDF rendering on Ganado’s own infrastructure | Web requests, validated PDF input during rendering and technical metadata. |
| Upstash | Hosted-link storage, short-lived counters and transitional sync storage | 30-day signed invoice snapshots for hosted links; short-lived security keys; legacy sync copy with a maximum 90-day TTL. |
| Optional sign-in identity provider; Google Workspace e-mail for privacy and closure requests and for copies from a kept archive | The account identity Google returns after the user chooses Google sign-in; request correspondence and requested document copies. | |
| Stripe | Online payment of Ganado’s own invoices; the role depends on the activity, as explained below. | Amount, currency, technical identifiers and payment data handled by the payment element. |
Online payments to Ganado
Online payment is available only for selected hosted invoices issued by Ganado international s.r.o., for the full amount in CZK or EUR. Ganado is the controller of personal data when collecting payments for its own services.
After an unpaid invoice is verified as eligible, Stripe.js loads automatically to display the Apple Pay button. Stripe may receive your IP address and browser and device information when this payment element loads. Opening the invoice does not create or confirm a payment; payment requires your confirmation in the wallet.
Stripe may use cookies or browser storage and access device information to provide and secure the online payment you request. The exception in Section 89(3) of Act No. 127/2005 Coll. applies only to device storage or access strictly necessary for that expressly requested service. We disable Stripe’s optional advanced fraud-signal collection; payment-field interaction and authentication logs remain. This exception does not authorise optional analytics or advertising. Stripe explains its technologies in its cookies policy.
Ganado sends Stripe the amount, currency, identifiers of the document, payment attempt, Ganado accounts and profile, and the document fingerprint. This metadata does not include the PDF, invoice items or the recipient’s name, address, e-mail or tax ID. Faktura’s payment tables keep transaction identifiers, amounts, currencies, time, status and evidence for payment verification, refunds or disputes; they do not store card data.
Stripe acts as processor for activities carried out on Ganado’s instructions and as controller for some of its own purposes, such as fraud prevention and legal obligations. Its privacy notice and data processing agreement explain these roles.
Application records follow the archive and account-closure rules in section 5. An unfinished payment must be verified or canceled before its records are deleted. Stripe has its own retention rules and may process data outside the EEA with applicable safeguards, including standard contractual clauses. Closing a Faktura account does not itself erase records Stripe retains for its own legal obligations.
Stripe privacy notice · Stripe data processing agreement · Stripe cookies policy
5. Retention, deletion and account closure
- A daily database job deletes signed-in invoice content after the service retention above. For example, a document issued in 2026 is eligible for deletion on 1 January 2037.
- Technical numbering counters contain no document or customer content and remain while the account or its kept archive exists so an old number is not reused.
- To close the account, e-mail the privacy contact from the sign-in address and choose. Keep the archive: sign-in and links stop, and Ganado keeps the archive without sign-in or link access for the retention above, keeps the sign-in address to verify later requests, and provides copies of original documents on a verified request. Export and delete: Ganado deletes the archive at closure. An account without documents is deleted at closure. A kept archive can be deleted on request at any time. Ganado handles a closure or deletion request without undue delay and within 30 days of verifying it, and confirms it by e-mail to the sign-in address.
- Export every document you must retain before closing the account. Ganado Faktura is a creation and convenience archive, not a replacement for the issuer’s statutory accounting archive or backup.
- Copies end with the data. Managed shared links stop at closure and their stored copies expire within 30 days of the link’s creation; older transitional sync copies expire at the end of their 90-day TTL; Ganado removes an e-mailed copy from its mailbox after sending it. Deleted database rows can remain in encrypted database backups after deletion; they are not available or used in ordinary Faktura operation, and a restore from a backup repeats the deletion.
Privacy or account-closure request: info@ganado.cz
6. Rights and requests
Subject to the GDPR, you may request access, correction, erasure, restriction, portability or object to processing based on legitimate interests. Erasure is not absolute where continued processing is required by law or for legal claims. We respond without undue delay and normally within one month.
If you are named on an invoice created by another user, contact the invoice issuer first because the issuer normally controls that invoice content. You may also contact Ganado; we will not disclose another user’s account information and will assist with a valid request.
You may complain to the Czech Office for Personal Data Protection (ÚOOÚ), Pplk. Sochora 27, 170 00 Praha 7.
7. Security and user responsibility
- Server tables are deny-by-default for browser roles; server operations verify the signed-in account and immutable invoice snapshot.
- PDF responses are marked no-store, hosted links expire and can be revoked, managed links fail closed against the durable ledger, and public endpoints have bounded rate limits.
- The user must secure their device and sign-in session, enter only data needed for invoicing, avoid special-category data, and keep an independent statutory archive.