Privacy Policy

Last updated: 19 October 2026

This Privacy Policy describes how Digital Vantage ("we", "us") processes personal data in the Domyko service (domyko.pl). The Polish version prevails.

1. Who is responsible

Digital Vantage

Andriollego 34, 05-400 Otwock, Poland

VAT ID: PL5321813962

REGON: 540674000

E-mail: [email protected]

We act in two roles:

  • As a controller — for the data of accounting offices and their staff who create and use an account, people who write to us and visitors to the site
  • As a processor — for the data of the offices’ clients (and people whose data appears in their documents) that an office enters into the portal. The office’s client is the controller of that data; the office processes it on their behalf and entrusts it to us under the Terms of Service (section 6). If you are an office’s client, contact your office first about your data — we will help it respond

2. What Data We Process

2.1 Office account and payments (controller)

  • E-mail address — at registration and when signing in with an e-mailed link
  • E-mail address and name from a Google account — when signing in with Google
  • Name and role in the office (owner, staff)
  • Office name, logo and portal settings
  • Payment data (processed by Stripe — we do not store card details)
  • Billing details: buyer name, address and tax ID (NIP). We process them to issue an invoice — the basis is a legal obligation (Art. 6(1)(c) GDPR), not consent, so we keep them for the 5 years required by tax law
  • The name given when withdrawing from the agreement — kept with the date and time as proof of the statement (Art. 6(1)(c) GDPR)

2.2 Data in the portal (processor)

  • Office clients’ data: name, tax ID, contact person’s name, e-mail, phone
  • Documents uploaded by the client or the office and data read from them (seller’s tax ID, number, date, amounts)
  • Cost invoices fetched from the National e-Invoice System (KSeF) and descriptions added by the client
  • Tax and contribution amounts and deadlines entered by the office
  • Reminder history and an activity log in the portal (who did what and when)

2.3 Contact form

Name, e-mail address, subject and message. We process them to respond to your enquiry (Art. 6(1)(f) GDPR — legitimate interest, and Art. 6(1)(b) for matters concerning the agreement).

2.4 Data collected automatically

  • IP address — to protect against abuse (rate limits) and in the activity log
  • Browser, device and operating system type
  • Date and time of sign-ins and document access

3. Purposes of Processing

As a controller we process data to:

  • Provide the services to the office (Art. 6(1)(b) GDPR)
  • Handle payments and billing (Art. 6(1)(b) GDPR)
  • Keep the services secure and prevent abuse — Cloudflare Turnstile, rate limits, the activity log (Art. 6(1)(f) GDPR)
  • Communicate with offices (Art. 6(1)(f) GDPR)
  • Run site analytics and measure advertising — only with consent given in the cookie banner (Art. 6(1)(a) GDPR)
  • Meet legal obligations, including tax obligations (Art. 6(1)(c) GDPR)

We process portal data only on the office’s instructions, to provide the services described in the Terms of Service.

4. Recipients

We entrust or share data with:

  • OVH — application and database servers in Warsaw
  • A file storage provider with servers in the European Union — storing documents and invoices
  • Cloudflare — CDN, attack protection and Turnstile verification on forms
  • MailerSend — sending e-mails (sign-in, reminders, notifications)
  • SMSAPI — sending text reminders
  • Microsoft Azure (Poland region) — reading data from uploaded documents
  • The Polish Ministry of Finance — fetching invoices from the National e-Invoice System (KSeF) on the office’s instructions
  • Stripe — payment processing and VAT calculation
  • inFakt — issuing invoices to offices; invoices are sent to KSeF
  • Sentry — application error monitoring, without document contents
  • Google — sign-in with Google, Google Tag Manager and Google Analytics (only with consent)
  • Public authorities — where required by law

We do not sell personal data to third parties.

5. Retention

  • Office account data — until the account is deleted
  • Portal data — for the term of the agreement with the office; after it ends we delete it within 30 days unless the law requires longer retention
  • Invoice data — 5 years, as required by tax law
  • Contact form messages — for as long as needed to handle the enquiry
  • IP addresses in abuse-protection counters — from 1 minute to 24 hours, depending on the form

6. Your Rights (GDPR)

You have the right to:

  • Access your data
  • Rectify your data
  • Erase your data ("right to be forgotten")
  • Restrict processing
  • Data portability
  • Object to processing based on legitimate interest
  • Withdraw consent at any time (where processing is based on consent)
  • Lodge a complaint with the President of the Personal Data Protection Office (UODO)

To exercise these rights, write to us: [email protected]

7. Cookies and Measurement

We use the following types of cookies:

  • Essential — required for the service to work (session, security, remembering your cookie banner choice)
  • Analytics — Google Analytics 4 via Google Tag Manager, only with analytics consent
  • Marketing — Google advertising measurement, only with marketing consent

You give analytics and marketing consent separately in the cookie banner and can change or withdraw it at any time with the “Manage cookies” link in the footer. Without consent, Google tools run in restricted mode (Google Consent Mode): they store no cookies or identifiers. The client portal uses no analytics cookies.

8. Security

We apply appropriate technical and organisational measures:

  • Encryption in transit (HTTPS/TLS)
  • Separation of each office’s data and role-based access
  • Files available only through links valid for a few minutes
  • Passwordless sign-in with a one-time link from an e-mail
  • Bot protection on forms (Cloudflare Turnstile, rate limits)
  • An activity log and error monitoring
  • Backups in a second location

9. Transfers Outside the EEA

Portal data is stored in the European Union. Some providers (Stripe, Google, Cloudflare, Sentry) may process account data outside the European Economic Area, mainly in the USA. Transfers rely on the European Commission’s EU–US Data Privacy Framework decision or Standard Contractual Clauses.

10. Changes

We will inform offices by e-mail at least 14 days in advance of material changes to this Privacy Policy, including new processors of portal data.

11. Contact

For privacy matters, contact us:

E-mail: [email protected]

Address: Digital Vantage, Andriollego 34, 05-400 Otwock, Poland

Privacy Policy | Domyko