Privacy policy

This policy covers the eFakt website and the eFakt desktop app. It is published by R&D LLC (“we”), as controller under the Law on Personal Data Protection of North Macedonia (Official Gazette No. 42/2020, as amended). Our contact details are at the bottom of the page.

In short

• Without add-ons, your documents do not pass through us. There is no account with us. The app sends your invoices directly to the e-Faktura system of the Public Revenue Office (UJP).
• Add-ons are your choice. If you turn on an add-on (online backup, invoice from a document with AI, sending by email or reminders), we receive only what that add-on needs. See Add-ons.
• We only receive the license check and usage counts. Installation ID, version, operating system, IP address, license key and daily counts (how often a page was opened or an action used). You can turn the counts off in Settings.
• Your invoices, certificate and PIN stay with you. We have no access to them.
• The website uses Google Analytics only if you agree. See Cookies.
• We only receive data from you when you write to us.

The app

eFakt is a program that runs on your computer. It processes the data you enter (buyers, line items, amounts) and sends it directly to UJP, through efaktura.ujp.gov.mk (or the test environment efakturatest.ujp.gov.mk).

• Local database. Sent and received documents, statuses, PDFs and drafts are kept in a database on your computer. You remove them by deleting the database or the app.
• Certificate and PIN. The certificate stays in its file, on the token or in the system Keychain. The PIN and password are held in memory only while the app is unlocked and are never written to disk.
• We are not a processor, except for add-ons. Without add-ons the data does not pass through us, so we do not see it or process it on your behalf. For personal data in your invoices (for example, the name of a sole trader), your company is the controller. For data you send to UJP, UJP is a separate controller under its own regulations.

Add-ons

Add-ons are paid separately and are on only if you order them. Only then does the app send us data from your documents. For that data we are a processor on behalf of your company, and your company remains the controller. Legal basis: performance of the contract. The certificate, PIN and password are never sent.

• Online backup. The app regularly sends a copy of the local database (documents, buyers, PDFs, drafts) to our server in the EU. We keep 2 copies in geographically separate locations. We keep the copies while the add-on is on and delete them no later than 30 days after it ends.
• Invoice from a document with AI. The document you upload (Word, PDF, image, scan) is sent to our server and from there to an AI model provider that reads it and returns a draft invoice. The provider processes the document on our behalf and does not use it to train models. We do not keep the document once the draft is returned; we keep only how many credits you have used.
• Sending invoices by email and unpaid invoice reminders. The message, with the buyer’s address, the text and the attached PDF, goes through our server and an email provider to the buyer. We do not keep the content once the message is sent. For billing we keep a record of each message (time, recipient address, status) for at most 24 months.

The providers we use for add-ons process the data only on our behalf, under a written agreement.

License and usage statistics

The app contacts our license server at startup and then about once a day.

• License check. It sends: a random installation ID (created at first start), the app version, the operating system and your license key if you have entered one. The server also records the IP address and time of the check. This data is used for the trial period, to check whether the license is valid and to protect against misuse of the key. Legal basis: performance of the license agreement, or our legitimate interest for the trial.
• Usage statistics. Together with the check, the app sends daily counts: how often each page was opened, how often each action was used (for example “Send” or “Save draft”) and how often each kind of error occurred. The counts are linked to the installation ID and, through it, to the license. Amounts, names, tax numbers, document contents, certificates and PINs are never sent. We use the counts to see what is used and where problems occur. Legal basis: our legitimate interest. Statistics are on by default; at first start the app tells you about them, and you can turn them off right away or later in Settings. When they are off, nothing is counted and unsent counts are deleted.
• Retention. We keep license checks (IP address, time, installation ID) and the daily counts for at most 24 months; after that the server deletes them automatically. For a trial with no check for 24 months, only the installation ID and the start date remain, so the trial cannot be started again.
• Where it is stored. We run the license server ourselves, on a server in Germany (EU). The hosting provider processes the data on our behalf; the data is not transferred outside the EU.

The website

The website is static: no forms, no login and no comments. Fonts and images are served from our own domain, not from third parties.

Google Analytics. If you press “Accept” in the cookie notice, we use Google Analytics 4 to count visits and see which pages are read and where visitors come from.

• Data: a random browser identifier (the _ga cookie), pages visited, time, referrer (where you came from), device and browser type, language and approximate location (country, city) derived from the IP address. Google Analytics 4 does not store the IP address.
• Purpose: to see what is read and what needs improving. We do not build profiles of individuals and do not use the data for advertising.
• Legal basis: your consent. You can withdraw it at any time through “Cookie settings” at the bottom of the page.
• Processor: Google Ireland Limited, under Google’s data processing terms. Data may be transferred to the USA, under the EU–US Data Privacy Framework and standard contractual clauses.
• Retention: 14 months, after which Google deletes it automatically.

Like any web server, the hosting provider may automatically log technical data for each request: IP address, time, requested page and browser type. This is used to run and protect the site (for example, against attacks), not for profiling, and is kept for a short time.

When you write to us

When you write to us (for example, about the early version, support or the SDK), we process your email address, name, company and the content of your message.

• Purpose: to reply, send you the app and help you.
• Legal basis: steps taken at your request before entering into a contract, or performance of a contract, and our legitimate interest in answering messages.
• Retention: for as long as the conversation lasts and at most two years after the last contact, unless the law requires longer (for example, for accounting records).

If you send us a screenshot, document or log for support, we use it only for that request and delete it once it is resolved. Before sending, remove any data we do not need.

We do not sell your data or share it with third parties for marketing. We receive messages through an email provider, which processes them on our behalf.

Your rights

You have the right to request access to your data, rectification, erasure, restriction of processing and portability, and the right to object. Write to us at the address below; we will reply within one month.

If you believe we process your data unlawfully, you can lodge a complaint with the Personal Data Protection Agency (azlp.mk).

Children

eFakt is meant for companies and accountants. We do not knowingly collect data from anyone under 18.

Changes

If we change anything, we will update the date above. If we start collecting new data, we will change this page first and, where needed, ask for your consent.