Data processing notice
Last updated: October 15, 2026
This describes processing; it is not a DPA or a compliance certificate. A DPA draft is intended for separate legal review and agreement with the customer; registration alone does not conclude it. Updated following a technical review of the service. This revision has not yet undergone professional legal review.
1. Roles and instructions
DGV Solutions d.o.o. normally processes documents on customer instructions to prepare Intrastat data. The customer is a controller or its own customer’s processor and must hold appropriate authority, a lawful basis and provide required notices. Our own accounts, business administration and analytics are covered by our controller role in the privacy policy.
2. Subject matter and scope
The service receives PDF invoices and supporting business documents, stores them, performs OCR/extraction, suggests tariff codes and weights, and supports review, correction, export and deletion. Data may concern users, buyers, suppliers, sole traders and contact people. Do not intentionally upload special-category data unnecessary for report preparation. Review suggestions before using them.
3. Providers and separate copies
For the public tariff finder, OpenAI receives the product description and optional details entered directly to prepare a suggestion. Do not enter personal or confidential information. See the privacy policy for the separate result cache.
Gemini receives complete PDFs; OpenAI receives selected fields for classification and estimation. Supabase stores files/data, Railway runs the backend and Vercel hosts the website. Non-essential PostHog and Vercel Analytics/Speed Insights run after consent. Langfuse currently monitors AI usage and costs for the public tariff finder; other flows depend on configuration. Support may include messages and attachments through Resend and the receiving mailbox.
Company memory, provider copies and logs have separate lifecycles. Report deletion does not automatically erase them. We do not claim all processing stays in the EU or that providers retain no data. Details and retention periods appear in the privacy policy.
4. Data processing agreement
Binding processing arrangements require agreement covering instructions, confidentiality, security, subprocessor use and change notices, rights/security assistance, breaches, information/audits, and return or deletion at service end. Publishing this notice does not replace that agreement. To arrange a DPA before processing personal data, contact info@minotask.si.
5. Rights, incidents and service end
We receive requests at info@minotask.si and handle them according to our role and the requester’s authority. We handle report or company-memory deletion requests, account closure and contract termination separately. Duties concerning our own invoices are not a general reason to retain all customer documents.
Where we act as processor, we notify the controller of a personal-data breach without undue delay; our target is generally within 48 hours of detection. This target does not justify waiting. Where supervisory notification is required, the controller’s duty to notify without undue delay and, where feasible, within 72 hours of awareness is separate from ours. A request-response deadline is not a guarantee that every copy is erased within 30 days.