Privacy notice
Version 2.1. It takes effect 30 days after the notice is sent to clients.
The current text, version 2.0, applies until this version takes effect.
This document sets out what personal data we process, why, for how long and who we make it available to. It is written to the GDPR and covers both the portican.com website and the Portican service.
1. Who processes the data
The controller is Nydrok LLC. Our identification details are on the Contact page. For anything concerning data protection, write to info@portican.com.
The GDPR applies to our processing as controller (data about clients and website visitors) under its Art. 3(2). We therefore have a representative in the European Union under Art. 27 GDPR: Matúš Mikčo, Duplín 119, 091 01 Stropkov, Slovak Republic, matus@portican.com. You can contact our representative on any question about the processing of your data.
2. Two different roles worth telling apart
For data about our clients, meaning the people and companies who rent a store from us, we are the controller: we decide why and how it is processed.
For data about our clients’ customers, meaning the people who buy from stores running on Portican, we are the processor. The purpose and the scope are set by the client as the controller of their own store; we process it on their instruction and to make the store work. If you are a customer of one of those stores, approach that store first. Its own notice is published on its own site.
3. Data we process as controller
Visiting portican.com
| Data | technical data about the visit: IP address, browser type, pages visited, time |
|---|---|
| Purpose | running and securing the site, measuring traffic and how well advertising works |
| Legal basis | legitimate interest in running and securing the site; for measurement and advertising, your consent |
| Retention | server operational logs for a short time, until newer records overwrite them (rotation by volume); data in measurement tools as configured in each tool, at most 14 months |
Enquiries, registration and running an account
| Data | name, email, phone, company name and billing details, credentials, the content of your correspondence with us |
|---|---|
| Purpose | answering an enquiry, entering into and performing the contract, support, invoicing |
| Legal basis | performance of the contract or steps before entering into it; for accounting documents, a legal obligation |
| Retention | for the term of the contract and the periods under clause 11 of the terms of service (90 days of access and 90 days of retention after the contract ends); accounting documents for as long as the law requires |
Subscription payments
| Data | payment identifier, amount, status, billing details. Card details never reach us and we do not store them. |
|---|---|
| Purpose | taking payment, issuing the document, resolving payment disputes |
| Legal basis | performance of the contract and a legal obligation |
| Retention | for the term of the contract; documents and payment records for as long as the law requires |
The client’s business identification number and VAT number
| Data | the business identification number and, if the client has one, the VAT number; if we verify them in the public register or in VIES, also the result and the date of the check |
|---|---|
| Purpose | verifying that the client is a business, and correct invoicing without VAT |
| Legal basis | performance of the contract, and a legal obligation in invoicing |
| Retention | for the term of the contract and then for as long as accounting documents are kept |
Notices of illegal content
| Data | name and email address of the person submitting the notice, the content of the notice, our decision and the correspondence |
|---|---|
| Purpose | handling the notice and giving reasons for the decision under the Digital Services Act |
| Legal basis | a legal obligation (Art. 6(1)(c) GDPR) |
| Retention | 3 years from the decision |
Contacting businesses
If we contact you as a business by email with an offer of partnership or of our services, we process the company name, the name of the contact person if it is published, and the work email address your company has published on its website. The source is your company’s website. The legal basis is our legitimate interest in offering services to businesses (Art. 6(1)(f) GDPR). We keep the data for no more than 12 months from our last communication. You can object to the processing at any time by replying “no” or by writing to info@portican.com. After that we will not contact you again and will keep only a record of your objection so that we can respect it.
Commercial messages
If you give us consent, or if you are our client, we may send you information about the service and what is new in it. Every such message can be unsubscribed from in one click, or by writing to info@portican.com.
4. Who we share data with
We do not sell data. We share it only with those without whom the service would not work, and always only as far as necessary:
| Supplier | What for | Where the data is |
|---|---|---|
| netcup GmbH, Germany | the stores’ server and database, backups on the server | EU (Vienna, Austria) |
| Cloudflare, Inc., USA | website delivery, protection against attacks, storage of images, files and backup copies (R2) | worldwide network |
| Mailgun Technologies, Inc., EU region | sending email | EU |
| Amazon Web Services, Inc. (Amazon SES) | fallback email sending | as configured, EU (Frankfurt) by default |
| Stripe | subscription payments and commission payouts to partners | EU and USA |
| WebSupport, Slovakia | mailboxes on the portican.com domain | EU |
| Datovia | issuing and recording subscription invoices; the tool runs on Portican’s server | EU (Austria) |
| OpenAI OpCo, LLC | the language model behind the assistant in the admin, writing and translating content, reading product images and the podcast voice; it processes the content the staff send to it | USA |
| fal.ai (Features & Labels Inc.) | generating and editing images and the podcast voice from text; it processes the content the staff send to it | USA and other countries |
| Measurement and advertising providers | only if you consent; the list is in the Cookie notice | depends on the tool |
We may also disclose data to public authorities where the law requires it of us.
5. Transfers outside the European Union
The server and database the stores run on are in the European Union (Austria). Images, files and backup copies are stored by Cloudflare. The provider is established in the United States and the service is also administered remotely from countries outside the Union. Some suppliers are based in the United States. We cover transfers to them by the supplier’s certification under the EU-US Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795), or by the European Commission’s standard contractual clauses. We will provide a copy of the clauses on request at info@portican.com.
6. How long we keep data
Only as long as we need it for the purpose we obtained it for, or as long as the law requires. The specific periods are given with each purpose above. After a contract ends, the client keeps access to the admin and to the data export for a further 90 days; we then keep the store’s data for a further 90 days without access, and then erase it. Copies in backups expire no later than 90 days after erasure. Accounting documents and records are kept for as long as the law requires.
7. Your rights
- to know whether and what data we process about you, and to get a copy of it
- to have incorrect data corrected
- to have data erased where there is no longer a reason to process it
- to restrict processing
- to receive your data in a machine-readable format and move it elsewhere
- to object to processing based on legitimate interest
- to withdraw consent at any time where you gave it; withdrawal does not affect processing before it
- to complain to a supervisory authority, in Slovakia the Office for Personal Data Protection of the Slovak Republic, or to the authority in your own country of residence
Writing to info@portican.com is enough. You can also contact our representative in the European Union (section 1). We answer within one month at the latest.
8. Automated decision making
Applications to the partner programme are handled automatically by the platform according to set rules. Once the email address has been confirmed, it checks the company registration number in the business register (the Register of Legal Entities for Slovakia, ARES for Czechia) and compares the application with existing partners.
- It approves the application if the company is in the register, has not ceased to exist and the application is not a duplicate.
- It rejects it if, according to the register, the company has ceased to exist, or if the same email address or company registration number already belongs to a partner in the programme or to a partner whose participation in the programme has ended.
- It returns it for correction if the company registration number is not in the register.
- If the register is unavailable, it waits. If the company name is similar to that of another partner, or there is a dispute over the company registration number, a person decides.
- A partner whose company is in neither the Slovak nor the Czech register is checked by VAT number in VIES. If VIES does not confirm a valid number with the same company name, a person decides.
If your application was rejected or returned automatically, you can ask for it to be reviewed by a person at info@portican.com. The platform administrator will review the application and tell you the outcome. In doing so you can express your point of view and contest the decision.
Suspending a store on the Free plan or without the plan it needs is performance of the contract (clauses 4 and 11 of the terms of service), not an assessment of you as a person: a store that goes over the limit of the Free plan, or does not have the plan it needs for a reason other than the number of orders, keeps selling for another 30 days and is then suspended until the client moves to a higher plan. The automatic move to a higher plan based on average orders is also performance of the contract (clause 5 of the terms of service): it rests only on the store’s number of orders, not on any assessment of you as a person.
We make no other automated decisions with a legal effect on you, and no profiling with such an effect.
9. Cookies
What we store in your browser and how to change it is in the separate Cookie notice.
10. Changes to this document
We may update this document. We announce material changes to clients by email at least 30 days in advance. The date it takes effect is always at the top.
11. Language versions
This notice is published in several languages. Should the versions differ in meaning, the Slovak version is the reference text and prevails.