2. Privacy Policy

• Company: Envoo d.o.o., matična št. 6195407000, davčna št. SI45695539
• Registered office: Cesta dolomitskega odreda 10c, 1000 Ljubljana, Slovenija
• Contact: info@relayplan.com

2.1. Personal Data Processed

• Account Data: name, email, company name, role, language, preferences.
• Usage Data: logs, IP, device identifiers, browser type, timestamps, visited pages/screens.
• Transaction Data: subscription and payment records (processed via Stripe; card numbers are not stored).
• Content Data: data entered by the customer (employees, hours, projects, warehouse data, etc.).

2.2. Legal Bases (GDPR Art. 6)

• Contract performance (providing access and functionality).
• Legitimate interest (security, improvement, abuse prevention).
• Consent (marketing emails, non‑essential cookies).
• Legal obligation (tax and accounting requirements).

2.3. Purposes of Processing

• Provide and manage the Service, support, and notifications.
• Billing and subscription management.
• Security (abuse detection, backups, audit logs).
• Analytics and improvement (aggregated/anonymous where possible).

2.4. Recipients and Sub‑processors

• Stripe – payments.
• [Hetzner] – data hosting.
• [Google/Gmail] – transactional communication.
• [Google] – privacy‑friendly analytics.

A current list is available in Annex A – Sub‑processors and is updated periodically.

2.5. Data Transfers

Where data is transferred outside the EEA (e.g., to the U.S. via Stripe), appropriate safeguards such as SCCs are in place.

2.6. Data Retention

• Account data: can be retained for the duration of the contract and 12 months after termination, unless deletion is requested earlier or required by law.
• Accounting/tax data: can be retained for 10 years in accordance with legal obligations.
• Logs and technical data: can be retained for 6 months, unless required longer due to security incidents or legal obligations.
• Support communications: can be retained for 2 years after last interaction.
• Backups: automatically deleted within 30 days of removal from production.

2.7. Data Subject Rights

• Right of access, rectification, erasure, restriction, objection, and portability.
• Right to withdraw consent at any time (without affecting prior lawful processing).
• Right to lodge a complaint with the Slovenian Information Commissioner or another EU authority.

2.8. Security Measures

• Encryption in transit (TLS) and, where applicable, at rest.
• Logical tenant separation, RBAC, 2FA (if enabled), audit trails.
• Regular backups and controlled restoration procedures.

2.9. Children

The Service is not intended for users under 16 years of age. If a minor’s data was collected inadvertently, please notify us.

2.10. Contact

For questions: [info@relayplan.com]