Privacy Policy

1. Controller

The controller responsible for data processing on this website is:

Represented by Anton Volkhine, Director.

Email: info@volkaccountant.com

A data protection officer is not required by law. Please direct any enquiries regarding data protection to the email address above.

2. Basics of data processing

We process personal data only insofar as this is necessary to provide the website and our services, and only on the legal bases of the General Data Protection Regulation (GDPR) (Art. 6(1)(a), (b), (f) GDPR).

3. Hosting

The website is hosted by Vercel Inc. Our function region is Frankfurt am Main. CDN delivery, security data and logs may be processed globally. This is distinct from the EU/Frankfurt data region used for application data. When the site is accessed, technically necessary data are processed (server log files: IP address, date and time, page accessed, referrer, browser type and version, operating system). The legal basis is Art. 6(1)(f) GDPR (legitimate interest in the secure and stable operation of the website). As Vercel Inc. is based in the USA, access from a third country cannot be entirely excluded; the transfer is safeguarded by standard contractual clauses and a data processing agreement.

4. Email communication and contact form

If you contact us via the contact form or by email, we process the data you provide (name, email address, "Business/Accountant" selection, your message) in order to handle your enquiry. The legal basis is Art. 6(1)(b) GDPR (pre-contractual measures) or Art. 6(1)(f) GDPR (legitimate interest in responding). Sending is handled via our own mail server (Hetzner Online GmbH, server location Germany). You automatically receive a confirmation of receipt. The data are deleted once the enquiry has been conclusively dealt with and no statutory retention periods apply.

For transactional emails sent from the application (for example verification emails, delivery of invoices and quotes, and system notifications) we additionally use the service provider Resend (Plus Five Five, Inc., USA). This processes the recipient's email address and the content of the respective message. The legal basis is Art. 6(1)(b) GDPR. The transfer to the USA is safeguarded by Standard Contractual Clauses and the EU-US Data Privacy Framework.

If you use the adviser request form (Cyprus tax advice), we additionally process the three details you select there: where you stand (company planned, company already set up, move planned), what your request is about, and the country you are based in. We use these solely to assess your enquiry and to identify a suitable tax adviser or law firm.

Transfer to third parties: we pass your name, email address and the content of your request to a tax adviser or law firm only after we have come back to you and you have agreed to that particular transfer. Without your agreement no transfer takes place. The legal basis for processing your enquiry is Art. 6(1)(b) GDPR (pre-contractual measures); the basis for any transfer is your consent under Art. 6(1)(a) GDPR, which you may withdraw at any time with effect for the future. The advisers concerned are independent controllers in their own right for any data they receive.

5. User account and use of the application

A user account is required to use Volk Accountant. In doing so, we process master data (name, email address, company data, login credentials) and the content you enter (invoices, quotes, receipts, payment and bank data, client data). The legal basis is Art. 6(1)(b) GDPR (performance of a contract). Insofar as you enter personal data of third parties (e.g. your clients), you are the controller under data protection law and we are the processor; for this we conclude a data processing agreement (DPA) under Art. 28 GDPR on request.

AI-assisted processing (receipts, translation, support and imports)

Within the application we use language models provided by Anthropic. For automatic receipt recognition (OCR) of uploaded documents, for translating line-item and receipt texts between German and English, and for the support chat. We also use AI to suggest categories for receipts and bank entries and to map columns when importing bank files and tax forms. This may involve personal data contained in the respective content (for example the name, address, invoice amount or IBAN shown on a receipt). The legal basis is Art. 6(1)(b) GDPR (performance of a contract) or Art. 6(1)(f) GDPR (legitimate interest in efficient receipt processing and customer support).

The provider is Anthropic PBC, USA; for services in the EU, Anthropic Ireland Ltd. is the contracting party. Processing takes place solely to deliver the feature; the transmitted content is contractually not used to train AI models. The transfer to the USA is safeguarded by Standard Contractual Clauses (Art. 46 GDPR). Results are stored in the application where required for the feature. Support messages and attachments may form part of the stored support history.

For category suggestions, we process counterparty or reference text, amount, transaction direction and internal identifiers; receipt images and IBANs are not sent for this purpose. Column mapping uses column headers and a small sample of rows from the import file. Category suggestions take effect only after confirmation by the accountant. AI results do not replace professional review.

Other processing within the application

To track receipt delivery and handle failures, we store the recipient address, delivery status, failure reason, timestamp and document reference. The delivery log does not contain the message body; the email provider processes the message itself to deliver it. We do not use open or click tracking for transactional emails. Electronic acceptance of a quote may be recorded with an IP address and timestamp as evidence. The legal bases are Art. 6(1)(b) and, where needed, (f) GDPR (reliable delivery and evidence of declarations); for business data we follow your instructions.

If you participate in the referral programme, we process referral codes, attributed registrations and commission records to operate and settle the programme and prevent abuse (Art. 6(1)(b) and (f) GDPR). Only authorised persons may access these records.

6. Payment processing via Stripe

For processing payments we use Stripe Payments Europe, Ltd. (1 Grand Canal Street Lower, Dublin, Ireland). When a payment is made, the necessary data (including name, email address, payment method details, invoice amount) are transmitted to Stripe and processed there. Full card details are processed exclusively by Stripe and are not accessible to us. The legal basis is Art. 6(1)(b) GDPR. Further information can be found in Stripe's privacy policy athttps://stripe.com/privacy.

7. Google Drive integration (optional, only at your instigation)

If you activate the Google Drive integration, you establish a connection between your Google account and Volk Accountant via Google's authorisation procedure (OAuth). The integration works in both directions:

• Import. You can import files (in particular receipts) from your Google Drive into Volk Accountant. These files are transferred into our database and stored there permanently until you delete them or the contract ends.
• Export, you can export files stored in Volk Accountant to your Google Drive. The files additionally remain in your Volk Accountant account; this is a copy, not a move.

We access only the folders and files required for these operations. You can revoke the connection at any time in your account or in the security settings of your Google account; files already imported remain unaffected. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The legal basis is Art. 6(1)(a) GDPR (consent through activation) in conjunction with Art. 6(1)(b) GDPR (performance of a contract).

8. Bank account connection (optional)

If you connect a bank account to Volk Accountant, we receive the account information you authorise: account holder or account name, IBAN, balances and transactions, including amounts, currency, dates, references and counterparty details. We use this information for your bookkeeping and to match payments with invoices and receipts. This connection is read-only; it cannot be used to initiate payments.

Bank access is provided by Enable Banking Oy, Otakaari 5, 02150 Espoo, Finland, business ID 2988499-7, a PSD2 account information service provider registered with the Finnish Financial Supervisory Authority (FIN-FSA). Where access relies on Enable Banking's authorisation, Enable Banking provides the account information service as an independent controller under its own terms and privacy notice. We subsequently process business data in Volk Accountant as your processor. In this access model, the technical connection alone does not make Enable Banking our sub-processor.

Connecting an account is optional. Access to the selected accounts begins only after your express authorisation during the connection process and authentication with your bank. The legal basis for the optional connection is Art. 6(1)(a) GDPR; delivery of the agreed functions is based on Art. 6(1)(b) GDPR. Where we process business data on your behalf, you determine the applicable legal basis as controller. Authorisation for an account information service under PSD2 is distinct from consent under data protection law.

Technical connection identifiers, your IP address and browser information may also be transmitted to Enable Banking and your bank to establish and secure the connection. Bank-access data transmission takes place within the European Union. Subsequent storage in Volk Accountant is described under “Database and file storage”.

The connection expires at the time shown during authorisation, subject to your bank's requirements. After expiry or withdrawal, fresh authorisation is needed before any further retrieval. You can disconnect in the application and withdraw authorisation with your bank or through Enable Banking's consent management service. Withdrawal takes effect for the future. It does not automatically delete transactions already imported into your books; deletion follows your instructions, the available export and deletion functions, and statutory retention requirements.

See Enable Banking's privacy notice and terms of service for its processing.

9. Database and file storage

We store the content of your account, including invoices, quotes, receipts and imported files, in a database at Supabase Inc. The data region is Frankfurt am Main, Germany (European Union). Supabase processes the data exclusively on our behalf and on our instructions; a data processing agreement under Art. 28 GDPR is in place. The legal basis is Art. 6(1)(b) GDPR (performance of a contract).

10. Reach measurement

To analyse website use, we employ our own cookieless analytics tool "Volk Analytics". It stores no cookies and creates no cross-device identifiers. Only aggregated usage data are collected, such as pages accessed, referrer, approximate region of origin, device type and time of access. IP addresses are not stored permanently. The data are processed on our own infrastructure and not passed on to third parties; identification of individuals is not possible. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in data-minimising reach measurement).

Cookie-free analytics

We measure the use of this website with our own privacy-friendly method. No cookies are set and no information is stored on your device. We record the page visited, the referring website or campaign parameters (e.g. utm_source), device type, country (derived from the network request) and clicks on links to our application.

Your IP address is not stored. To count unique visitors we derive a check value from your IP address, browser identifier and a random key generated anew each day. The key is deleted after two days at the latest; from then on the stored data is fully anonymous and cannot be linked to any person. We keep it for statistical purposes. The data is processed on the servers of our application. The legal basis is our legitimate interest in improving our service (Art. 6(1)(f) GDPR).

Your right to object under Art. 21 GDPR: You may object to this processing at any time, informally to info@volkaccountant.com. You can also prevent the transmission yourself by blocking requests toapp.volkaccountant.com in your browser.

Google Analytics 4 and consent management

In addition we use Google Analytics 4, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics uses cookies and similar identifiers that allow an analysis of your use of the website. Among the data recorded are the pages you visit, time spent, the source of your visit, your approximate location at city level and details about your browser and device. Your IP address is truncated before it is stored; it is not combined with other data held by Google.

We set cookies only after your express consent. The legal basis for storing and reading information on your device is § 25(1) TDDDG; for the subsequent processing of your data it is Art. 6(1)(a) GDPR (consent).

If you decline: We operate Google Analytics in what is known as consent mode. This means Google's script is loaded for all visitors. If you decline, no cookies are set and no persistent identifier is created. However, cookieless signals continue to be transmitted to Google containing your IP address, details about your browser and device, and the page you are viewing. Google uses these signals solely for statistical extrapolation and cannot identify an individual person from them. The legal basis is Art. 6(1)(f) GDPR (legitimate interest in statistically reliable reach measurement).

Your right to object under Art. 21 GDPR: You may object at any time to this processing based on Art. 6(1)(f) GDPR. Informally toinfo@volkaccountant.com. You can also prevent the transmission entirely yourself by installing theGoogle Analytics opt-out browser add-on or by blocking requests togoogletagmanager.com in your browser.

We have disabled the "Google signals" feature and cross-device advertising reports; your data are not used for advertising purposes. Retention of usage data in Google Analytics is limited to 14 months.

A transfer to Google LLC in the USA cannot be ruled out. Google LLC is certified under the EU-US Data Privacy Framework and Standard Contractual Clauses under Art. 46 GDPR are additionally in place. Despite these safeguards, a transfer to the USA carries the residual risk that US authorities may access the data and that you have no legal remedies comparable to those available in the EU.

Withdrawal: You may withdraw your consent at any time with effect for the future using the "Cookie settings" link in the footer of every page. After withdrawal, consent signals are set to denied. The Google script may still load and transmit the cookieless signals described above. The lawfulness of processing carried out up to the point of withdrawal remains unaffected.

Further information on how Google handles user data can be found inGoogle's privacy policy.

11. Cookies

On this website we use exclusively technically necessary cookies that are required for operation and security (e.g. session management in the user account, security functions). These are exempt from consent under Art. 6(1)(f) GDPR or § 25(2) TDDDG.

Beyond these, Google Analytics (see section 10) sets consent-requiring cookies for analytics purposes. They are set only after your express consent via our cookie notice and can be withdrawn at any time with effect for the future using the "Cookie settings" link in the footer of every page. We do not use any cookies for marketing or advertising purposes.

We store your choice from the cookie notice in your browser's local storage (localStorage) so that we do not have to ask you again on every visit. This storage is technically necessary to implement your choice and is therefore exempt from consent under § 25(2) TDDDG.

12. Recipients and processors

In providing our services we work with the following recipients and processors:

• Vercel Inc. (hosting, function region Frankfurt; USA, SCC/DPF)
• Supabase Inc. (database and file storage, data region EU/Frankfurt; USA, SCC/DPF)
• Hetzner Online GmbH (contact-form email, Germany)
• Resend (Plus Five Five, Inc.). Transactional emails from the application (USA, SCC/DPF)
• Anthropic PBC / Anthropic Ireland Ltd.. AI receipt recognition, translation, support chat, category suggestions and import column mapping (USA; Standard Contractual Clauses, no training on transmitted data)
• Stripe Payments Europe Ltd. (payments, Ireland; an independent controller for its own payment-service and legal duties)
• Enable Banking Oy (optional PSD2 account information service, Finland/EU; independent controller when using its own authorisation)
• Google Ireland Limited (Google Drive integration, optional and only at your instigation; and Google Analytics 4 for reach measurement, with cookies only after consent and cookieless signals as described in section 10)

Providers processing personal data on our instructions are engaged under Art. 28 GDPR and the required contracts. Independent controllers process data under their own legal duties and privacy notices. Other disclosures require an applicable legal basis, such as your instructions or a statutory obligation.

13. Retention period

We store personal data only for as long as necessary for the stated purposes. Contract and billing data are subject to statutory retention periods (in Cyprus generally six years after the end of the tax year). After expiry, the data are deleted or anonymised. The content of your user account is deleted after the contract ends, unless retention obligations apply.

You can export personal account data and request account deletion through your profile. If you still own companies in the account, ownership must first be resolved or transferred. Company-data deletion is handled through support after authorisation is checked. Export any business records you need beforehand; you remain responsible for your statutory retention obligations. The post-contract export period is set out in the terms.

Deletion covers associated business records and files. Backup copies are overwritten through the backup cycles. Necessary evidence of a deletion request or security incident may be retained separately for accountability and the defence of legal claims for as long as needed (Art. 6(1)(c) or (f) GDPR).

14. Your rights

As a data subject, you have the following rights with regard to your personal data:

• the right of access (Art. 15 GDPR)
• the right to rectification (Art. 16 GDPR)
• the right to erasure (Art. 17 GDPR)
• the right to restriction of processing (Art. 18 GDPR)
• the right to data portability (Art. 20 GDPR)
• the right to object to processing based on legitimate interests (Art. 21 GDPR)
• the right to withdraw consent given, with effect for the future (Art. 7(3) GDPR)

To exercise these rights, please contact us atinfo@volkaccountant.com.

15. Right to lodge a complaint

You have the right to lodge a complaint with a data protection supervisory authority. The authority responsible for us is the Office of the Commissioner for Personal Data Protection, Iasonos 1, 1082 Nicosia, Cyprus (www.dataprotection.gov.cy). You may also contact the authority in your place of residence.

16. Data security

We use appropriate technical and organisational measures to protect your data against loss, manipulation and unauthorised access. The website uses TLS encryption to protect the transmission of your data. Data are stored in encrypted form, access is restricted to authorised persons, and regular backups are created. Our security measures are continuously reviewed and adapted in line with technological developments.

Personal data breaches

Please report suspected incidents to info@volkaccountant.com. We assess and document incidents and take containment measures. Where we act as processor, we notify the affected controller without undue delay and assist with its notification duties. For processing for which we are controller, we fulfil the notification and communication requirements of Art. 33 and 34 GDPR where their conditions apply.

17. Changes to this privacy policy

We adapt this privacy policy when the legal situation or our services change, so that it always complies with the current legal requirements. The current version is available at any time on this page.