Privacy Policy

I. Data Controller

The controller is Siberlogy s.r.o., Company ID 21294461, Olešnice 104, 517 36 Olešnice, Czech Republic, operator of the SIbPay service (the “Provider”). Contact for data protection: info@sibpay.cz, phone +420 733 392 354 (working days 8 am to 5 pm).

This policy describes what personal data we process when you use sibpay.cz, the SIbPay app, the payment terminal and the merchant portal, why, on what legal basis, who receives it and what rights you have under Regulation (EU) 2016/679 (GDPR).

II. Merchant Data We Process

1. Registration and identification data: name, company name, company and VAT ID, e-mail, phone, registered and business address, bank account for payouts.
2. Data for verification by the bank: date and place of birth, residential address, citizenship, copies of identity documents and proof of address, politically exposed person declaration, beneficial owners and persons controlling the company.
3. Signing of the contract and power of attorney: signature image, signer's name, time, IP address and browser, phone number for the SMS code and the fingerprint of the signed document.
4. Terminal order: terminal option, quantity, delivery address, phone, time and version of accepted terms.
5. Transaction data: amount, date, time, status, payment method, receipt number and items, device and employee.
6. Technical data: device and app version, IP address, device location during card payments (required by the payment app), security and operational logs.
7. Website behaviour with consent: pages visited, time on page, clicks and source; if you enter your e-mail in a form, we link previous visits to it.
8. Campaign links: IP address and browser type when you open our campaign link.

III. Data About Merchants' Customers

When a customer asks for an e-mail receipt, we process the e-mail and payment data. To send future receipts automatically we store a card identifier (PAR) from the card scheme, never the card number. Across merchants we match only by PAR. The customer can stop receipts any time via the link in the receipt or at info@sibpay.cz.

For fraud prevention we store card details returned by the payment partner (scheme, type and country of the card, last four digits). We never process the full card number, expiry date or security code.

IV. Purposes and Legal Basis

1. Performance of contract (Art. 6(1)(b) GDPR): account, terminal order and delivery, payments, receipts, payouts and support.
2. Legal obligations (c): identity and beneficial owner checks under Czech anti money laundering law, accounting, tax and sales reporting.
3. Legitimate interest (f): security, fraud prevention, evidence of signing, improving the app and business communication with companies.
4. Consent (a): analytics and marketing cookies and website behaviour measurement. You can withdraw consent at any time.

V. Recipients and Processors

1. Shift4 Limited: acquirer that authorises and settles card payments and verifies the merchant.
2. Softpay ApS (Denmark): payment app that reads the card.
3. Brevo (Sendinblue SAS, France): e-mails and SMS codes.
4. Railway and Supabase: server and database hosting.
5. Vercel: website hosting and anonymous traffic measurement.
6. Google (Firebase): app notifications, app crash reports and basic app usage statistics.
7. Sentry (Functional Software, Inc., USA): server error reports.
8. Google, Microsoft, Meta, Imper CZ (Leady): only with cookie consent, see section IX.
9. Public authorities where required by law.

Some recipients may process data in the USA; transfers are governed by EU standard contractual clauses or the EU and US Data Privacy Framework. We do not sell data.

VI. Retention

1. Merchant data, identity verification, contract and power of attorney: for the term of the contract and 10 years after it ends.
2. Transaction data and accounting records: 10 years.
3. Customer e-mail for receipts and its card link: at most 30 days after unsubscribing, otherwise at most 3 years after the last receipt.
4. Website behaviour and campaign links: 24 months.
5. Technical logs: 12 months.

VII. Your Rights

1. access to your data and a copy;
2. rectification;
3. erasure and restriction of processing;
4. data portability;
5. objection to processing based on legitimate interest;
6. withdrawal of consent at any time;
7. complaint to the Czech Office for Personal Data Protection (uoou.gov.cz).

Exercise your rights by e-mail at info@sibpay.cz. We reply within 30 days.

VIII. Payment Cards

Cards are read by the Softpay payment app under PCI standards. The Provider has no access to full card numbers. More at softpay.io.

IX. Cookies and Measurement

With consent we use analytics tools (Google Analytics, Microsoft Clarity, SIbPay measurement) and marketing tools (Meta Pixel, Leady), each group only with consent to it. Vercel Web Analytics runs without cookies and without identifying anyone. Details and consent settings on the Cookies page.

X. Security

We protect data with encrypted communication, access control, two factor admin login, sealed identity documents and PCI compliant payment infrastructure.

XI. Changes

We may update this policy and will inform you about material changes by e-mail or in the app. The current version is always at sibpay.cz/privacy.