Privacy Policy

TI Capital s.r.o., with its registered office at Talichova 2110/2, 841 02 Bratislava – Dúbravka district. Company ID (IČO): 55941362, Tax ID (DIČ): 2122141516, registered in the Commercial Register of the Bratislava III District Court, Section Sro, Insert No. 175070/B. Tel.: +421 940 984 000, Email: info@ti-capital.sk

1. Protection of Personal Data

1.1. The Contracting Parties acknowledge and agree that, within the contractual relationship established by the Agreement, the provider is a Processor under Article 28 of Regulation (EU) 2016/679 (GDPR) and the client is the Controller under Article 4(7) GDPR. This Article 1 constitutes the contract under Article 28(3) GDPR. If the parties conclude a separate data processing agreement that departs from this Article, the provisions of that separate agreement prevail; in all other respects this Article applies.

1.2. The provider is authorised to process personal data on the client's behalf as Processor from the effective date of the Agreement. The client and the provider agree that Article 1 of this Privacy Policy fully replaces the contract within the meaning of Sections 34 et seq. of Act No. 18/2018 Coll. on Personal Data Protection.

1.3. The subject of this Article is the client's instructions to the provider in the process of personal data processing.

1.4. After the Agreement ends, the provider shall hand over to the client the personal data and documents that the client requests, including in an accessible electronic form where one exists. Documents containing personal data that are delivered by email are sent in an encrypted format (ZIP or PDF), protected by a password that meets the provider's password security policy. Within 30 days after the Agreement ends, the provider shall delete all of the client's personal data and documents held in electronic form, except data that the provider is required to retain under specific regulations (in particular, accounting records under Act No. 431/2002 Coll. and data under Act No. 297/2008 Coll., including business correspondence, for 5 years after the business relationship ends). Such data are deleted once the statutory period expires. Data are removed from backup copies when those are routinely overwritten, at the latest within 90 days. Paper documents handed over by the client are returned to the client. The provider retains only its own accounting records concerning the contractual relationship with the client (the agreement, the provider's invoices, payments) for the period required by Section 35 of Act No. 431/2002 Coll. on Accounting. After the Agreement ends, the client shall ensure the storage and protection of its personal data and accounting documentation in accordance with applicable law.

1.5. Personal data are processed by both automated and non-automated means.

1.6. The purpose of personal data processing, the name of the information system, and the list or scope of the personal data processed are specified in Appendix 1 to this Privacy Policy.

1.7. For the purposes of this Article, data subjects are primarily natural persons — the client's customers (clients) and staff (employees).

1.8. Obligations and Rights of the Client

a) The client shall provide the provider with all cooperation necessary for the fulfilment of this Article.

b) The client has the right to request from the provider regular reports on the state of protection of the personal data processed, and the provider must provide them without undue delay.

c) If the client entrusted the provider with personal data processing only after the personal data were collected, the client must ensure that data subjects are notified of this fact at the first contact with them, and no later than three months from the date the provider was entrusted. This also applies where processing is taken over by the client's legal successor within the meaning of Section 69 of the Commercial Code.

1.9. Obligations of the Provider

a) Process personal data only on the basis of the client's written instructions.

b) Ensure that persons authorised to process personal data — the provider's employees as well as contractual collaborators (e.g., external accountants) — have committed themselves to confidentiality regarding the information they learn; with contractual collaborators the provider concludes a data processing agreement under Article 28 GDPR.

c) Follow the security measures under Section 39 of the Personal Data Protection Act when processing personal data.

d) Assist the client, through appropriate technical and organisational measures, in fulfilling the client's obligation to act on data subjects' requests under the Personal Data Protection Act.

e) Return personal data to the client after the provision of services relating to personal data processing has ended.

f) Erase existing copies containing personal data upon the client's decision.

g) Provide the client with the information necessary to demonstrate compliance with its obligations, and cooperate with personal data protection audits and inspections carried out by the client or by an auditor appointed by the client.

h) Inform the client without undue delay if, in the provider's view, an instruction of the client infringes the GDPR, the Personal Data Protection Act, another special law, or an international treaty binding on the Slovak Republic concerning personal data protection.

i) Notify the client without undue delay of any personal data breach after becoming aware of it.

j) At the first contact with a data subject, always inform them that their personal data are processed on the client's behalf for a defined or established purpose.

k) Not share the client's personal data with third parties, except where necessary for filing tax returns with the tax office or where required by applicable law.

l) Ensure technical and organisational measures, including the use of servers within the EU. Data transmission is secured using TLS 1.2 or higher, and the database and its backups are stored in encrypted form. Regular security audits and system testing are performed as needed.

m) Retain personal data for the periods set out in point 1.18.

1.10. Personal Data Processing Conditions

a) The provider shall ensure, in accordance with the GDPR, the Personal Data Protection Act, and appropriate technical and organisational measures, that personal data are processed and disclosed to the competent institutions under special laws in a way that secures the purpose of processing and the protection of the personal data.

b) The provider shall ensure the protection of data subjects' personal data — in particular their confidentiality, integrity, and availability — in accordance with the GDPR, the Personal Data Protection Act, and technical, organisational, and personnel security measures.

1.11. Permitted Personal Data Operations

a) The provider's permitted activities in the information systems listed in Appendix 1 consist of performing operations, or sets of operations, with personal data, including collection, recording, organising, structuring, alteration, retrieval, consultation, use, disclosure, combination, storage, deletion, and other lawful operations, to the extent and under the conditions laid down in applicable law and agreed in this Privacy Policy.

b) The provider may obtain and process personal data only from the persons listed in Appendix 1, and only to the extent necessary to provide the services.

c) The provider shall not use or combine personal data obtained from the client for purposes other than those specified in Appendix 1.

d) The provider shall implement technical, organisational, and personnel measures proportionate to the processing risk, taking into account the confidentiality and importance of the data and the potential risks to the security and functionality of its information systems.

e) The provider and its employees must maintain the confidentiality of personal data obtained from the client that they come into contact with in the course of providing services, and remain bound by it after the assignment ends.

f) The provider warrants that it will not process personal data contrary to the data subjects' legitimate interests and will not infringe their rights or their privacy.

g) The provider shall ensure that persons who, on its instruction, come or may come into contact with personal data are informed of their rights, obligations, and responsibilities before the first instruction is issued.

h) The provider shall process personal data in accordance with good morals and all applicable laws.

1.12. Personal Data Processing via Electronic Services (E-forms) and Contact Forms

a) The provider processes personal, financial, and contact data entered by the client through the web application, in accordance with the GDPR and applicable law.

b) Data processed via E-forms are used exclusively for the preparation and filing of tax returns and for communication with the customer.

c) Contact forms are used for the client's communication with the provider; only the minimum necessary data are collected. The legal basis for processing is Article 6(1)(b) GDPR (necessity for performance of a contract or pre-contractual measures) and Article 6(1)(f) GDPR (the provider's legitimate interest in communication). Data collected through contact forms are not used for advertising or profiling purposes.

d) Personal data are not shared with third parties, except where necessary for filing tax returns or where required by law.

e) Data are stored on EU-based servers and transmitted via TLS 1.2 or higher. The database and its backups are stored in encrypted form.

f) The retention periods for personal data processed via E-forms and contact forms are set out in point 1.18.

g) The client may request access to their data upon identity verification; if no data exist, the client will be informed accordingly.

1.13. Website Analytics and Cookies

a) The provider's website does not use advertising or tracking cookies. No consent banner is displayed because no cookies requiring consent are set.

b) To understand which pages of this website are visited and how often, the provider uses a privacy-friendly, self-hosted analytics tool running on the provider's own servers within the EU. This tool does not set cookies, does not store any information on user devices, does not collect data that can identify users personally, and processes only aggregate anonymous statistics such as page views and referring sites. Because no cookies or personal identifiers are used, this measurement does not require consent under Article 5(3) of Directive 2002/58/EC (ePrivacy Directive). User data are never sold or shared with advertising networks.

c) The website does not use Google Analytics, Google Tag Manager, Google Ads, Google Maps, Facebook Pixel (Meta), Stripe, reCAPTCHA, or any other advertising network tools. Fonts are self-hosted on the provider's servers; no requests are made to Google Fonts or other external font services on page load.

d) In the client portal (login area), strictly necessary session cookies may be used. These cookies remain valid for the signed-in session (at most a few days without activity), expire on logout, serve exclusively to maintain the authenticated session, do not transfer personal data to third parties, and do not require consent.

1.14. When providing services, the provider may use automated document processing tools, including third-party artificial intelligence services acting as sub-processors under Article 28 GDPR. Such services are used exclusively for the structured extraction of data from accounting documents. The provider guarantees that sub-processors: (i) process data within the EU or — for providers outside the EU — on the basis of a data processing agreement with standard contractual clauses under Chapter V GDPR; (ii) are bound by a data processing agreement (DPA) with terms no less stringent than this Privacy Policy; (iii) do not use the client's data for model training or any other purpose; (iv) do not retain data longer than necessary for processing and delete it within the period set out in the data processing agreement.

1.15. Client portal

a) The client portal (the "portal") is the secured area of the website to which the provider invites the client's authorised persons. Sign-in uses an e-mail address with a password or a one-time code sent by e-mail; passwords are stored only as cryptographic hashes.

b) Within the portal the provider processes: the user's identification and contact data (name, e-mail address, role in the client's company), documents and messages the user uploads, records of tasks and deadlines, and technical sign-in records (time, IP address, browser type) for security and access evidence.

c) A user's name and e-mail address are visible to the other authorised persons of the same client company and to the provider's designated staff (for example in the team list and in message signatures). Users of other companies have no access to them.

d) Communication between the client and the provider takes place within the portal (messages and attachments). Messages are kept for the duration of the contractual relationship and for 5 years after it ends (Section 19(2) of Act No. 297/2008 Coll.); after a user account is closed, the author of its messages is anonymised (see point g).

e) Notifications. The portal shows notifications about new documents, tasks and messages. A user may additionally opt in to browser push notifications on a specific device; the content of such a notification is transmitted encrypted and may appear on the device's lock screen. Push notifications can be switched off at any time in the portal or browser settings; consent is given separately for each device and is off by default. In the portal settings, a user can choose to hide the content of notifications on the lock screen. When an account is deleted, all devices registered for push notifications are deleted with it. In the TI Capital mobile app a push notification carries only the type of event and a technical record identifier; message text, amounts and names are not included in the notification and the app loads them from the server after it is opened.

f) Documents uploaded to the portal are stored on the provider's servers within the EU; preview and editing of office documents run on the provider's own server without transfer to third parties.

g) Account closure. A user may request closure of their account directly in the portal. The account is deactivated immediately; within 30 days the request can be withdrawn by signing in again. After that period the user's personal data are erased and their messages are anonymised. The client company's documents and accounting records are not affected by the closure of an individual's account; they are retained in accordance with the Accounting Act and the contract with the client.

h) Backups. The provider makes regular copies of portal data for disaster recovery; the copies are kept within the EU and are accessible only to the provider's designated persons.

1.16. Communication channels

a) Communication between the client and the provider takes place through the client portal, e-mail or — at the client's choice — the Telegram and WhatsApp applications.

b) If the client chooses Telegram or WhatsApp, the client acknowledges that these services are operated by third parties under their own terms and privacy policies and that the provider has no control over their data retention. The provider recommends handing over documents through the client portal or the provider's cloud storage.

c) Documents received by e-mail or through the applications are stored by the provider in its storage within the EU and processed in the same way as documents uploaded to the portal.

1.17. Processors (sub-processors)

The provider uses the following processors:

• Hetzner Online GmbH (Germany, EU) — servers, mailbox, cloud storage and backups;
• Resend, Inc. (USA) — sending of e-mails (sign-in code, invitation, password-change notice, notifications and the tax-return wizard files under point 1.21); transfer to the USA under standard contractual clauses (Article 46(2)(c) of the Regulation);
• Anthropic, PBC (USA) — automated recognition of documents (statements, invoices) under point 1.14; per Anthropic's terms, data sent via the API is not used to train models; transfer to the USA under standard contractual clauses (Article 46(2)(c) of the Regulation); not applied to documents of mobile-app users without an account or with a free account (point 1.20 e));
• the operators of Telegram and WhatsApp — only if the client chooses that channel (point 1.16).
• push-service operators — only if the user has enabled push notifications themselves (point 1.15 e), point 1.20 e)): in the browser, Google LLC, Mozilla Corporation or Apple Inc. depending on the user's browser — the notification content is transmitted encrypted end-to-device and the service sees only its time and size; in the mobile app, Apple Inc. (Apple Push Notification service) or Google LLC (Firebase Cloud Messaging) depending on the device — the service receives the type of event and a technical record identifier (no amounts, names or text); these operators' servers may be located outside the EU — transfers to the USA are based on the European Commission's adequacy decision (EU–US Data Privacy Framework) or on standard contractual clauses.

The client grants the provider a general written authorisation under Article 28(2) of the Regulation to engage further processors. The current list of processors is set out in this point. The provider shall inform the client of any intended addition or replacement of a processor by email or in the client portal at least 14 days in advance. The client may object to the change within this period; if no objection is raised, the change is deemed approved. If the client objects for data protection reasons and the parties do not reach agreement, the client may terminate the Agreement. The provider contractually imposes on each processor the same data protection obligations as the provider has under these Principles.

1.18. Retention periods

a) The client's personal data and documents are retained for the duration of the Agreement; after it ends, the provider proceeds in accordance with point 1.4.

b) The provider's own accounting records concerning the contractual relationship with the client are retained for ten years following the year to which they relate (Section 35 of Act No. 431/2002 Coll.).

c) Enquiries and questions sent via the contact form or by other means by a person who is not a client are deleted two years after the last contact, unless a contractual relationship arises from them. The data subject may request earlier deletion.

d) A client portal user account is deleted, after a request for its cancellation, in accordance with point 1.15 g).

e) Backup copies are retained for no longer than 90 days; older copies are deleted.

f) Correspondence with persons who are not clients is deleted by the provider two years after the last contact; correspondence with the client is governed by subpoint a).

g) An email address subscribed to the newsletter is retained until unsubscription. Unsubscribing is possible at any time via the link in every email sent or by request to info@ti-capital.sk.

h) The account and personal space of a mobile-app user are retained under point 1.20 f); the record of consent to marketing communications and the usage statistics under point 1.20 g).

1.19. Data sources — register of subjects

a) For the processing under this point the provider is a controller within the meaning of Article 4(7) of the Regulation (not a processor of the client); the provider's identification and contact details are given in the introduction to these Principles. This point also constitutes the information under Article 14 of the Regulation for natural persons whose data are contained in the register of subjects.

b) Purpose. The provider keeps its own copy of public registers of companies and entrepreneurs (the "register of subjects") in order to set up clients and their business partners (customers and suppliers) quickly and correctly and to verify their identification details. The register of subjects is used for searching when a client or partner record is created or checked in the provider's system and in the client portal. The data are not used for marketing or profiling and are not sold. The register of subjects also serves website visitors and app users to fill in a company's identification details by IČO when completing document templates (point 1.21).

c) Legal basis. The legal basis is legitimate interest under Article 6(1)(f) of the Regulation — the interest of the provider and its clients in correct identification details of business partners in contracts and accounting documents. The provider has assessed that this interest overrides the interests and rights of the data subjects because: (i) these are data that the law makes public precisely for legal certainty and the protection of third parties in business dealings (judgment of the Court of Justice of the EU in Case C-398/15 Manni of 9 March 2017); (ii) only the scope necessary to identify the subject is taken (subpoint d); (iii) the data are used only for the same purpose for which they were published — identification in business dealings; (iv) data on natural persons whose business has ceased are deleted after a set period (subpoint f). Whoever fills in a company's details by IČO into a document template has the same interest — correct identification details of a contracting party; only data public in the source registers is filled in. Without signing in (point 1.21), data of only one entity is returned, by an exactly entered IČO and not by name, and in a limited number of requests.

d) Scope of data. Only the data that belong on a subject's record are taken from the registers: IČO (company ID), name (business name), address of the registered office or place of business, legal form, dates of establishment and termination; from the lists of the Financial Administration of the Slovak Republic, DIČ (tax ID), IČ DPH (VAT ID) and VAT registration details. As regards natural persons, neither the Register of Legal Entities, Entrepreneurs and Public Authorities nor the lists of the Financial Administration of the Slovak Republic contribute any data on persons who are not self-employed persons (sole traders and other entrepreneurs) — from both sources, the only data taken on a natural person is the business name and place of business of a self-employed person. Data on statutory bodies, shareholders and other persons registered with a subject, dates of birth and personal identification numbers (rodné čísla) are not taken.

e) Sources. The Register of Legal Entities, Entrepreneurs and Public Authorities (Register právnických osôb, podnikateľov a orgánov verejnej moci, RPO), administered by the Ministry of the Interior of the Slovak Republic, provided as open data under the Creative Commons Attribution 4.0 licence (CC BY 4.0); the data have been modified (selection of fields, address format). The lists of taxable persons published by the Financial Administration of the Slovak Republic (the list of taxable persons registered for income tax and the list of persons registered for VAT). The copy is updated daily. The data are for information purposes.

f) Retention period. Data on a self-employed person whose business has ceased are deleted from the register of subjects three years after the termination, unless the person is a client of the provider or a business partner of a client; data of clients and their partners stored in records, contracts and documents are retained in accordance with point 1.18 and specific legislation (e.g. Section 35 of Act No. 431/2002 Coll.). Data from the lists of the Financial Administration are replaced with the current list at every update. Data on legal persons are retained for as long as they are needed for the purpose under subpoint b).

g) Recipients. The data are accessible to authorised employees of the provider and to authorised users of the client portal when searching for a partner. The data are stored on the provider's servers within the EU (point 1.17) and are not transferred outside the EU. When company details are filled in by IČO in a document template (point 1.21), the name, address and DIČ of the entered company are received by whoever entered the IČO, without signing in.

h) Informing data subjects. The data are not obtained from the data subjects themselves. Notifying each of them individually would involve a disproportionate effort — this concerns a large number of persons with whom the provider is not in contact and whose contact details it does not process. The provider therefore makes the information publicly available under Article 14(5)(b) of the Regulation by means of this point.

i) Rights of data subjects. A data subject has the right of access to the data (Article 15 of the Regulation), to rectification (Article 16 — since the data come from public registers, incorrect data also need to be corrected in the relevant register; the copy is updated daily), to erasure (Article 17) and to restriction of processing (Article 18). Under Article 21 of the Regulation, a data subject has the right to object at any time, on grounds relating to their particular situation, to the processing; the provider will then no longer process the data unless it demonstrates compelling legitimate grounds that override the data subject's interests, rights and freedoms. An objection or any other request may be sent to info@ti-capital.sk or to the provider's registered office address given in the introduction to these Principles. The data subject also has the right to lodge a complaint with the Office for Personal Data Protection of the Slovak Republic (Úrad na ochranu osobných údajov SR).

j) This version of this point is effective from 11 November 2026.

1.20. Mobile application

a) This point is the information under Article 13 of the Regulation for persons who use the TI Capital mobile application without signing in or with a free account (the "user"). In relation to account data, security, usage statistics, marketing communications and the contents of the personal space of a natural person who stores documents for their own needs, the provider is the controller; its identification and contact details are given at the beginning of this Policy. For documents that a business stores in the personal space and that contain personal data of third parties, the business is the controller and the provider is the processor (point 11.2 of the App Terms of Use). Clients of the provider who use the app as their client portal (the client zone) are governed by points 1.1 to 1.19. Automated decision-making, including profiling, is not used in the app.

b) Without signing in, the app does not process the user's personal data except for technical server records (time, IP address, requested address) that arise with every request, serve security and operation (legitimate interest, Article 6(1)(f) of the Regulation) and are kept only for the time necessary for that purpose. Calculator computations run on the server without storing the entered values; saved computations and data filled into templates remain on the user's device (and in the device backup, if enabled) and are not sent to the provider. A service request or a "Problem or idea" message is processed by the provider under point 1.18 c) (name, email, optionally phone and text; for a message from the app also the app and operating system version, language and appearance) in order to reply and to improve the app. The legal basis is, for a service request, taking steps at the person's request prior to entering into a contract (Article 6(1)(b) of the Regulation), and for a "Problem or idea" message, the legitimate interest in improving the app (Article 6(1)(f)).

c) Account. To create and secure the account the provider processes the email address, language, sign-in records (time, IP address, device and system type; kept while the sign-in lasts and at the latest until the account is deleted), the details of the user's own company card entered by the user (IČO, name, address, logo) and — if the user enables push notifications — the technical device identifier assigned by Apple or Google (kept while the sign-in on that device lasts, at most 30 days from signing in; deleted on sign-out or when notifications are switched off). A client of the provider may also have a password, which is stored only as a cryptographic hash. The legal basis is performance of the contract on the use of the app (Article 6(1)(b) of the Regulation) and the legitimate interest in security (Article 6(1)(f)). Providing an email address is a condition of creating an account; the other data is voluntary.

d) Personal space. Documents and photos the user stores (including documents scanned with the camera and files handed over from other apps) are kept on the provider's servers in the European Union in a separate space of the account. The provider does not read or analyse their contents, does not apply automated recognition to them and does not pass them to the artificial-intelligence services under point 1.14; this changes only when the space is transferred to a client portal at the user's request (point 4.5 of the App Terms of Use). The provider's authorised staff access the contents only under the access rule in point 4.4 of the App Terms of Use (on the user's instruction, when resolving a technical problem with the user's knowledge, or where required by law). The legal basis is performance of the contract.

e) Recipients. Data is stored with the processor Hetzner Online GmbH (point 1.17). Emails (sign-in code, confirmations, notifications) are sent by Resend, Inc. Push notifications are delivered by Apple Inc. (Apple Push Notification service) or Google LLC (Firebase Cloud Messaging) depending on the user's device; a notification carries the type of event and a technical record identifier, not amounts, names or message text, and is sent only to a user who has enabled notifications. Resend, Inc., Apple Inc. and Google LLC may process data in the USA; the transfer is based on the European Commission's adequacy decision (EU–US Data Privacy Framework) or on standard contractual clauses under Article 46(2)(c) of the Regulation. When a cash register receipt is verified by its QR code, the user's device contacts the e-kasa system of the Financial Administration of the Slovak Republic directly; the Financial Administration is an independent controller and the provider does not pass data to it. The artificial-intelligence services under point 1.17 are not applied to the data of users without an account or with a free account. Data is disclosed to other recipients only on the basis of law (for example to law-enforcement authorities at their request).

f) Retention period. The account and the contents of the personal space are kept until the user deletes the account or until it is deleted for inactivity: if the user does not sign in or do anything in the app for 12 months, the provider warns them 60, 30 and 7 days in advance, then blocks the account and deletes it 30 days after blocking (point 7.2 of the App Terms of Use). When the user deletes the account, the sign-in ends immediately and the data is deleted without undue delay and irreversibly; a deleted file is no longer available to the user and the provider does not restore it even at the user's request. Data is removed from backup copies within 90 days at the latest (point 1.18 e)). An unconfirmed registration is deleted by the provider after 24 hours. Messages sent to the provider are kept under point 1.18 c). The record of consent to marketing communications and the usage statistics are kept under letter g).

g) Marketing communications and statistics. News and offers are sent by the provider only to a user who has enabled them in the app (consent under Article 6(1)(a) of the Regulation and Section 116 of Act No. 452/2021 Coll.); consent is off by default and can be withdrawn at any time with the same switch or via the link in an email. The record of granting and withdrawing consent (time of granting and withdrawal, channel, version of the text) is kept by the provider for 4 years from the withdrawal of consent or from the deletion of the account if consent was not withdrawn earlier, also after the account is deleted, so that the consent can be proven (legal obligation, Article 6(1)(c) of the Regulation and Section 116(5) of Act No. 452/2021 Coll.). To assess which parts of the app are used, the provider records only the type of event and the day — with no link to the account, personal space, device or IP address; these are anonymous counts, not personal data. The app uses no third-party behavioural analytics tools or advertising identifiers and does not track the user across other apps and websites.

h) Rights. The user has the rights under Articles 15 to 21 of the Regulation (access, rectification, erasure, restriction, portability, objection) and the right to lodge a complaint with the Office for Personal Data Protection of the Slovak Republic (www.dataprotection.gov.sk). The user changes the language and company card details in the app; they can download the contents of the personal space at any time (month by month or in full) and delete them; they delete the account directly in the app or at ti-capital.sk/en/delete-account. A change of email address and other requests can be made at info@ti-capital.sk; the provider handles them within 30 days.

i) Data on the device. The app stores in the device's secure storage the sign-in token, the lock setting (biometrics or device passcode) and the language; in ordinary storage it keeps saved computations, forms in progress, saved employee details for filling in templates (at most 50; deleted on sign-out), files received via "Share" from other apps (at most 7 days, until the user sends them) and temporary copies of opened files. This storage is strictly necessary to provide the service requested by the user (Section 109(8) of Act No. 452/2021 Coll.); information is not read from the device for other purposes. Biometric data stays on the device and is not sent to the provider. The app uses the camera only to scan documents, with permission granted in the system; it accesses the photo library through the system picker for individual files.

j) This version of this point is effective from 11 November 2026.

1.21. Tools on the website

a) This point is the information under Article 13 of the Regulation for visitors of ti-capital.sk who, without signing in, use the calculators, online filling of document templates and the tax-return wizard (Website Terms of Use). The controller is the provider.

b) Filling in templates. The data a visitor enters into a template form stays in their browser's storage (localStorage) until they delete it. It is sent to the provider's server only when a DOCX or PDF file is prepared, is used to insert it into the model, and after the file is delivered it is neither kept nor logged; the legal basis is fulfilling what the visitor requested (Article 6(1)(b) of the Regulation). Data of other persons that the visitor enters into the template (for example the other contracting party) is only technically inserted into the model on the visitor's instruction and is not kept; the legal basis is the visitor's legitimate interest in drawing up the document (Article 6(1)(f) of the Regulation). Values entered into calculators are processed on the server only for the calculation and are not stored. Filling in company details by IČO is performed in the provider's own copy of public registers (point 1.19); the entered IČO is not stored. The visitor's confirmation of having read the Website Terms of Use is remembered by the browser until the tab is closed (sessionStorage).

c) Tax-return wizard. The values a visitor enters are processed on the server only to calculate and prepare the files and are not stored; the unfinished wizard stays in the browser. If the visitor asks for the files by email, the provider stores the email address (encrypted), the type and year of the return, the language and whether the visitor consented to news about services; the return values are not stored. The return files (XML, PDF) with the data the visitor entered are sent to their email address as attachments by the processor Resend, Inc. (USA; transfer under standard contractual clauses, Article 46(2)(c) of the Regulation); the provider does not keep the files after sending; the legal basis is performing the act the visitor requested (Article 6(1)(b) of the Regulation). The provider keeps the address for two years from the last sending to prove the sending and handle any questions (point 1.18 c)); then it deletes it. If the visitor consented to news, the address is kept until consent is withdrawn and the record of consent and its withdrawal for 4 years from withdrawal (Section 116(5) of Act No. 452/2021 Coll.); consent can be withdrawn at any time via the link in every news email or by email to info@ti-capital.sk.

d) Technical server records (time, IP address, requested address) arise with every request and serve security and operation (legitimate interest, Article 6(1)(f) of the Regulation); they are kept only for the time necessary. The number of downloads from one IP address is counted briefly to protect against abuse. No third-party tools for analysing visitor behaviour are used with the tools.

e) The data subject's rights are listed in point 1.20 h) and apply equally; the provider handles requests at info@ti-capital.sk within 30 days.

f) This version of this point is effective from 11 November 2026.

Appendix 1 (dated 11 November 2026)

Information System Name and Processed Data