Privacy Policy
Effective from: 1 September 2026
1. Controller and contact
The controller of the personal data processed in connection with the Sklopio service is the provider stated above.
For questions about personal data protection and to exercise your rights, you can reach us at [email protected].
This privacy policy explains which personal data we process, for what purposes, on which legal bases, to whom we disclose it, how long we retain it and what rights you have as an individual.
2. Roles of controller and processor
In processing personal data we act in two roles:
- as controller — for account, registration, subscription billing, support, website and marketing data,
- as processor — for the content data that the subscriber (the company) enters into its private space (data about its customers, employees, projects, documents and the like). We process this data exclusively on the subscriber’s instructions and for the purpose of providing the service; the controller of this data is the subscriber.
The subscriber is obliged to ensure that it has an appropriate legal basis for the personal data it enters into the service.
3. What data we process
- account and company data: first and last name, e-mail address, telephone number, company name, address, tax number, selected settings (for example language),
- subscription and payment data: selected plan, history of billing and invoices, payment status; payment card data is processed exclusively by Stripe — we do not store card numbers,
- subscriber content data (in the role of processor): customers, contacts, enquiries, quotes, projects, documents, photographs, measurements, working hours, reservations and other content entered by the subscriber,
- communication data: messages to support, e-mails sent and received through the features of the service, SMS logs (recipient, time, delivery status),
- technical data: IP address, device and browser data, access and error logs — for security and troubleshooting,
- website data: messages sent through the contact form; the form is protected by Google reCAPTCHA.
4. Purposes and legal bases of processing
- performance of a contract (Article 6(1)(b) GDPR): registration and account management, operation of all features of the service, subscription billing, support,
- legal obligations (Article 6(1)(c) GDPR): issuing and retaining invoices and tax and accounting records,
- legitimate interest (Article 6(1)(f) GDPR): ensuring the security of the service, preventing abuse, fixing errors, improving the service on the basis of aggregated usage data,
- consent (Article 6(1)(a) GDPR): notifications about news and marketing messages, where the individual gives consent; consent can be withdrawn at any time without affecting the lawfulness of processing before withdrawal.
5. Processors and disclosure of data
We do not sell data and do not disclose it to third parties for their own purposes. For the operation of the service we use carefully selected contractual (sub-)processors:
- Stripe — processing of card payments,
- hosting provider of data centres in the EU — server infrastructure and data storage,
- e-mail service provider (Mailgun) — sending and receiving e-mail related to the service,
- SMS service provider — sending SMS messages triggered by the subscriber,
- providers of accounting integrations (for example Minimax, e-invoices) — only where the subscriber switches the integration on itself and to the extent determined by the subscriber,
- Anthropic Ireland, Limited (Ireland; processing and storage take place in the USA) — sub-processor for the AI assistant feature: where the customer switches the feature on and signs a data processing agreement, the content of questions and related data (projects, customers, orders) are transmitted to Anthropic to generate answers. The data is not used to train models and is deleted at Anthropic no later than 30 days. A data processing agreement with standard contractual clauses has been concluded; the current list of further sub-processors is published at anthropic.com/subprocessors.
- Google reCAPTCHA — protection of forms against abuse.
We have data processing agreements in place with processors in accordance with Article 28 GDPR.
Data is primarily stored within the EU. Where an individual provider (for example Stripe or Google) transfers data outside the EU/EEA, the transfer takes place on the basis of appropriate safeguards (adequacy decisions or standard contractual clauses).
We may disclose data to public authorities where required by applicable law.
6. Retention periods
- account data and content data: for the duration of the subscription; after expiry or cancellation of the subscription for a further 30 days, after which they are permanently deleted (see the Terms and Conditions),
- invoices and accounting documents: 10 years or in accordance with tax legislation,
- support communication: up to 2 years after the handling is concluded,
- technical logs: as a rule up to 12 months,
- marketing data based on consent: until the consent is withdrawn.
After the retention periods expire, we delete or anonymise the data.
7. Rights of individuals
As an individual, you have the following rights regarding your personal data:
- the right of access to data,
- the right to rectification of inaccurate data,
- the right to erasure (“right to be forgotten”) where there is no legal basis for further retention,
- the right to restriction of processing,
- the right to data portability,
- the right to object to processing based on legitimate interest and to processing for direct marketing purposes,
- the right to withdraw consent.
You exercise your rights by sending a message to [email protected]. We will respond to a request no later than within one month.
If you believe that the processing infringes the regulations, you have the right to lodge a complaint with the Information Commissioner of the Republic of Slovenia (Dunajska cesta 22, 1000 Ljubljana, [email protected]).
For content data entered into the service by the subscriber (your employer or contractor), please address your requests first to the subscriber as the controller; the provider will assist the subscriber in fulfilling the request.
8. Cookies and local storage
The sklopio.com website does not use analytics or advertising cookies.
We use only technically necessary mechanisms:
- browser local storage (localStorage) to remember the selected language,
- cookies or mechanisms of the Google reCAPTCHA service on forms (protection against abuse),
- in the sklopio.app application, session mechanisms for login (authentication token).
Because these are technically necessary mechanisms, consent is not required for them.
9. Data security
To protect data we implement appropriate technical and organisational measures, including:
- encrypted data transmission (HTTPS/TLS),
- strict separation of data between individual subscribers (tenants),
- role- and permission-based access control within the application,
- the option of two-factor authentication (2FA),
- regular backups and access logging.
In the event of a personal data breach that could result in a risk to individuals, we will act in accordance with Articles 33 and 34 GDPR (notification of the supervisory authority and, where necessary, of individuals).
10. Changes to the privacy policy
We may update this policy from time to time. The current version is always published at sklopio.com/en/privacy-policy; we will notify users of material changes by e-mail or within the application.
This privacy policy applies from 31 July 2026.