OSNUTEK / DRAFT — for counsel review, not in forceTa stran je osnutek. Ne velja in ni ponudba. Na voljo je v slovenščini in angleščini; drugih 11 jezikov aplikacije (skupaj 13) dodamo po pregledu. Oznaka […] pomeni podatek, ki ga še vpišemo, oznaka Q vprašanje za odvetnika.
Podobdelovalci
Podjetja, ki nam pomagajo pri delovanju Bureo in za nas obdelujejo osebne podatke. Navajamo jih samo zato, da veste, kam gredo vaši podatki; to ni priporočilo. Q45
O novem podobdelovalcu vas obvestimo vsaj [10] dni pred začetkom (glejte pogodbo o obdelavi, točka 8).
V uporabi danes
Ponudnik
Kaj naredi za nas
Podatki
Kje se podatki obdelujejo
Zaščita pri prenosu
Supabase
baza, prijava (povezave po e-pošti), shramba datotek
vsi podatki o računu in podjetju
EU, Frankfurt (eu-central-1)
ponudnik je družba iz ZDA; standardne pogodbene klavzule ali okvir EU–ZDA za morebiten dostop izven EU (UNVERIFIED)
Vercel
gostovanje spletne strani in strežniških funkcij aplikacije
vse, kar gre skozi zahtevo; strežniški dnevniki
funkcije v EU, Frankfurt (fra1); statične strani se dostavljajo prek ponudnikovega svetovnega omrežja
ponudnik je družba iz ZDA; standardne pogodbene klavzule ali okvir EU–ZDA (UNVERIFIED)
[ponudnik modela AI: lastnik potrdi, Amazon Web Services (Bedrock), ko je vklopljena pot v EU]
asistent v klepetu: odgovori, branje dokumentov, priprava besedil. Na poti v EU ni spletnega iskanja v živo
vaša sporočila, podatki iz računa, potrebni za odgovor, dokumenti, ki jih želite prebrati
pot v EU: Frankfurt (eu-central-1), prek ponudnikovega profila sklepanja za EU, ki ostane v regijah EU; ničesar se ne pošilja izdelovalcu modela (UNVERIFIED, dokler se ne preverijo ponudnikovi pogoji). Neposredna pot do API izdelovalca modela ni v EU in je za delovanje samo v EU izklopljena
standardne pogodbene klavzule v ponudnikovih pogojih obdelave [lastnik potrdi]
Enable Banking Oy (Finska, matična številka 2988499-7)
storitev dostopa do informacij o računu: po vašem soglasju v vaši banki se poveže z banko in nam posreduje stanje in promet poslovnega računa (samo branje). Vaših podatkov za prijavo v banko nikoli ne vidimo
ime imetnika, IBAN, stanja, promet (datum, znesek, nasprotna stranka, sklic) računov, ki jih izberete
[…]
[…]
[ponudnik pretvorbe govora v besedilo: ime]
pretvori glasovna sporočila v besedilo v brskalnikih brez vgrajenega prepoznavanja govora
glasovni posnetek
[regija: lastnik potrdi] (UNVERIFIED)
[lastnik potrdi]
Vklop in preverjanje poti v EU sta opisana v opombah prehoda o rezidenčnosti AI (apps/mojracunovodja-gateway/docs/ai-residency.md). Nastavitve ponudnika modela AI glede učenja in hrambe so opisane v obvestilu o varstvu osebnih podatkov, točka 6.
Izbrani pred zagonom
Ti še niso v uporabi. Vsakega dodamo sem, z imenom in regijo, preden začne delati.
Ponudnik
Kaj bo naredil
Podatki
Ponudnik e-pošte [še ni izbran]
povezave za prijavo v večjem obsegu, opomniki, obvestila, računi, ki jih pošljete strankam
e-naslovi, vsebina sporočil
Ponudnik plačil [še ni izbran]
plačila s kartico za pakete in doplačila
ime, e-naslov, podatki o plačilu (številke kartic ostanejo pri ponudniku)
Ponudnik e-računov [še ni izbran]
pošiljanje in prejemanje e-računov (e-SLOG, Peppol); morda davčno potrjevanje računov
vsebina računov, podatki vaših strank in dobaviteljev
Ponudnik SMS [še ni izbran]
enkratne kode za podpis
telefonske številke
Druge storitve, s katerimi se poveže vaš brskalnik
Storitev
Zakaj
Kaj vidi
[ponudnik DNS/CDN, če je pred stranjo: lastnik potrdi]
dostava strani
vaš naslov IP in zahtevano stran
OSNUTEK / DRAFT — for counsel review, not in forceThis page is a draft. It is not in force and is not an offer. It is in Slovenian and English only for now; the app's other 11 languages (13 in all) follow after review. […] marks a detail still to be filled in, Q a question for counsel.
Sub-processors
The companies that help us run Bureo and process personal data for us. We name them here only so you know where your data goes; this is not an endorsement. Q45
We tell you at least [10] days before a new sub-processor starts (see the data processing agreement, section 8).
In use today
Provider
What it does for us
Data
Where the data is processed
Safeguard for transfers
Supabase
database, sign-in (e-mail links), file storage
all account and company data
EU, Frankfurt (eu-central-1)
the provider is a US company; standard contractual clauses or the EU–US framework for any access from outside the EU (UNVERIFIED)
Vercel
hosting of the website and the app's server functions
everything that passes through a request; server logs
functions in the EU, Frankfurt (fra1); the static pages are delivered from the provider's worldwide network
the provider is a US company; standard contractual clauses or the EU–US framework (UNVERIFIED)
[AI model provider: owner confirms, Amazon Web Services (Bedrock) once the EU route is switched on]
the chat assistant: answers, reading documents, drafting. On the EU route there is no live web search
your messages, the account data needed for the answer, documents you ask it to read
EU route: Frankfurt (eu-central-1), through the provider's EU inference profile, which stays inside EU regions; nothing is sent to the model maker (UNVERIFIED until the provider's terms are checked). The direct route to the model maker's own API is not EU-resident and is switched off for EU-only operation
standard contractual clauses in the provider's data processing terms [owner confirms]
Enable Banking Oy (Finland, business ID 2988499-7)
account-information service: connects to your bank after you consent in your own bank, and passes us your business account's balances and transactions (read-only). We never see your bank login
account holder name, IBAN, balances, transactions (date, amount, counterparty, reference) of the accounts you choose
[…]
[…]
[Speech-to-text provider: name]
turns voice notes into text, on browsers without built-in speech recognition
the voice recording
[region: owner confirms] (UNVERIFIED)
[owner confirms]
How the EU route is switched on and checked is described in the gateway's AI residency notes (apps/mojracunovodja-gateway/docs/ai-residency.md). The AI model provider's no-training and retention settings are set out in the privacy notice, section 6.
Chosen before launch
These are not in use yet. We add each one here, with its name and region, before it starts.
Provider
What it will do
Data
E-mail provider [TBD]
sign-in links at volume, reminders, notices, invoices you send to your customers
e-mail addresses, message content
Payment provider [TBD]
card payments for plans and top-ups
name, e-mail, payment details (card numbers stay with the provider)
E-invoicing provider [TBD]
sending and receiving e-invoices (e-SLOG, Peppol); possibly fiscal receipts
invoice content, your customers' and suppliers' details
SMS provider [TBD]
one-time codes for signing
phone numbers
Other services your browser connects to
Service
Why
What it sees
[DNS/CDN provider, if one sits in front of the site: owner confirms]