1. Who is responsible for your data
DATAHILL, s.r.o., with its registered office at Martina Granca 11, 841 02 Bratislava, Slovakia, company ID (IČO) 51 962 349, registered in the Commercial Register, section Sro, file no. 131915/B, operates SolvencyBridge and is the controller for account, billing, security, product analytics, and service-administration data. Contact us at info@solvencybridge.com.
For filing content uploaded or entered by an organization, the organization normally determines why that data is processed and is the controller; DATAHILL, s.r.o. acts as its processor. Users should direct content-related requests to their organization first.
2. Data we process
- account details, including name, email, password hash, role, and the time and document versions acknowledged at account creation;
- organization, reporting-entity, filing, review, audit, attachment, export, and workflow data supplied by customers;
- billing contact, company, tax, invoice, and payment-reconciliation data;
- sign-in, device, IP address, security, diagnostic, and service-usage events; and
- support messages, assistant questions and feedback, and any data a user deliberately shares with an enabled external AI provider; and prospective-customer enquiries, including work contact details, organization, reporting authority, requested scope, and reporting challenges submitted through the public filing-scope form. The free-tool contact form sends your verified email, reporting country, optional company and role, language, and the wording and time of your request to our team. If you explicitly request an assessment review, it also shares a read-only link to the selected assessment, including its reported values, for that evaluation. This does not subscribe you to updates or attach your source upload to an email.
- free-tool updates subscriptions: email address, language, consent wording and version, and request, confirmation and withdrawal timestamps. These records do not contain uploaded files or validation findings.
An email address and password are required to create an account; a display name is optional. Without the required account details we cannot provide authenticated access. Enquiry forms identify their required fields; without them we cannot process that request. Optional analytics can be refused without losing access to the service.
Please do not place unnecessary personal data or special-category data in filings, attachments, comments, support messages, or assistant prompts.
3. Why we process it and our legal bases
- to create accounts, authenticate users, provide the service, and administer subscriptions - performance of a contract;
- to invoice, keep accounting records, and respond to lawful requests - compliance with legal obligations;
- to secure, troubleshoot, support, and improve the service and defend legal claims - our legitimate interests and those of our customers; and to assess and respond to a requested evaluation or scoping call - steps requested before entering a contract and our legitimate interest in responding to prospective customers; and
- to send requested free-tool updates and run optional product analytics - consent, which can be withdrawn at any time without affecting earlier processing.
Free-tool downloads and processing require a verified email address and reporting country (or “not sure”). These details support access, requested result delivery and recovery, not automatic sales outreach. Free-tool updates are optional and require email confirmation within 24 hours. Opening the confirmation link alone does not subscribe you. Use the unsubscribe link in an update or confirmation email, then select Unsubscribe, or contact us at the address in section 1. Requesting a reply about reporting services is separate and does not subscribe you to updates. Neither choice is required to use the tool or see all findings. Opting into the new free-tool email sequence includes practical guides, tool updates and information about reporting services. The initial sequence contains a guide after one day and an offer after three days; withdrawal or a contact request stops pending sequence emails.
Where we process customer filing content as a processor, our customer determines the legal basis and gives us documented instructions under the data-processing agreement.
4. Cookies and browser storage
Essential cookies and browser storage support sign-in, security, language and display preferences, and remembering your privacy choice. They are required for the requested service.
When configured and only after you allow analytics, PostHog EU measures page visits and workflow events and records sessions with privacy masking. It uses cookies and local storage, and links signed-in sessions to an opaque account ID. Recordings show public-page text and fixed interface labels; other workspace text, form inputs, media, console logs, and network contents remain hidden. Use Privacy choices to reject analytics or withdraw permission at any time.
[The operator must state whether analytics is enabled, the provider and region, the data sent, the capture controls, and how consent is withdrawn.]
5. Recipients, service providers, and transfers
Authorized members of your organization can access data according to their roles. We also use vetted providers for hosting, error monitoring, email or webhook delivery, analytics where accepted, and AI assistance where explicitly enabled. Sentry diagnostics use an opaque account ID to correlate signed-in errors. We do not deliberately attach account email addresses, names, or organization names. Sentry session replay and default personal-data collection are disabled; technical error context may still contain personal data.
The public filing-scope form sends the submitted details to our fixed contact inbox through our email provider. It does not add them to a separate lead database. Do not include filing values, credentials, confidential attachments, or special-category data. If you follow a Calendly link to book a call, Calendly processes the information you enter on its separately hosted booking page under its own notice; the SolvencyBridge page does not embed the scheduler or prefill your data.
Free-tool contact requests also go to our contact inbox. Updates subscription records are held in our service database and used by authorized staff and our email provider only for the requested updates. Unconfirmed or withdrawn subscriptions are not eligible for updates.
Completed free-tool runs and confirmed subscriptions also generate operational email notices to our team. These contain only the action and broad run outcome, without contact details, filenames, report contents or validation messages. Separate, consented product analytics records the free-tool journey using categorical actions and outcomes; refusing analytics does not prevent use of the tool.
The production hosting location is [the selected hosting region must be configured]. [The operator must describe who can access customer data for support, under which approval and audit controls.]
The current provider list, locations, roles, and transfer safeguards are maintained at [subprocessor list URL must be configured]. Where data leaves the EEA, we use an applicable adequacy decision or contractual safeguards and supplementary measures as required.
6. AI assistance
Local assistance does not send filing context to an external AI provider. External assistance uses OpenAI and is restricted to enabled organizations. The filing assistant requires an explicit sharing choice: the question and selected metadata, or that information plus the current selected field value. Unrelated filing values and internal tenant and record identifiers are excluded from the assistant projection.
Import-mapping assistance has separate sharing modes: sheet names and headers; headers with structural value types; or headers with up to five raw sample rows per selected table. Raw sample rows require both the user’s explicit choice and a separate organization permission. Those rows can contain personal or confidential data from the source file; the complete workbook is not sent. Review the selected mode and source contents before sharing.
Requests use the OpenAI Responses API with response storage disabled. This does not disable provider abuse-monitoring logs. Under standard API controls, OpenAI may retain inputs and outputs for up to 30 days for abuse monitoring, with longer retention where required by law or reasonably necessary to protect the provider or others from harm; different approved controls may apply. API data is not used for model training by default. The operator must verify the applicable project settings, processing location, and transfer safeguards before enabling production use. Generated suggestions can be inaccurate and are not automated regulatory decisions; a user must review them.
7. Retention and deletion
Free-tool source uploads are removed after processing. Reports, read-only source-value inspection views, and generated files are stored privately and become inaccessible 24 hours after completion, with earlier deletion available. Physical cleanup is retried if storage is unavailable. A verified browser session lasts seven days. Delivery-only contact records are deleted after 30 days without activity; subscription and enquiry records follow their separate consent and support retention rules. Report emails contain scoped links, not file attachments. Anyone holding a result link can access that report until expiry or deletion; do not forward it unless you intend to share it. Assessment-review links expire with the same report and are revoked when the report is deleted.
[The operator must publish concrete retention periods or determination criteria for accounts, customer content, backups, logs, analytics, support records, and invoices.]
[The operator must describe customer export and deletion requests, active-system deletion, retained legal records, processor deletion, and backup expiry.]
8. Your rights
Subject to applicable law, you may request access, correction, deletion, restriction, or portability of your personal data. You may withdraw consent at any time. We may need to verify your identity and will respond within the legally required period.
Your right to object: You may object to processing based on legitimate interests on grounds relating to your particular situation. Contact us using the address in section 1.
You may also complain to [the competent supervisory authority must be configured], or to the data-protection authority where you live, work, or believe an infringement occurred.
9. Security, changes, and contact
We use technical and organizational measures intended to protect personal data, including tenant access controls, role-based access, audit records, and transport security. No service can guarantee absolute security. [The operator must describe how suspected personal-data breaches are assessed, contained, documented, and notified under the customer agreement and applicable law.] We will post material notice changes here and, where required, notify affected users through the service or by email.