# Data Security and Privacy at Lucanto | Lucanto

Zdroj: https://lucanto.eu/data-security
Aktualizované: 2026-09-08

Data security at Lucanto rests on transparency rather than claims you cannot verify. We build and host the application in the EU, the controller is Stark Codes, s. r. o., and personal data is processed under the GDPR. Below you will find what we process, who we do not send it to, and how to exercise your rights.

export const rightsFacts = [
  {
    label: 'Right of access',
    value: 'Find out whether and what data of yours we process, and get a copy.',
    note: 'Article 15 GDPR',
  },
  {
    label: 'Right to rectification',
    value: 'Have inaccurate data corrected or incomplete data completed.',
    note: 'Article 16 GDPR',
  },
  {
    label: 'Right to erasure',
    value: 'Ask for your data to be deleted, on the conditions GDPR sets out.',
    note: 'Article 17 GDPR (“right to be forgotten”)',
  },
  {
    label: 'Right to restriction',
    value: 'Temporarily limit how we handle your data.',
    note: 'Article 18 GDPR',
  },
  {
    label: 'Right to portability',
    value: 'Receive your data in a structured, machine-readable format.',
    note: 'Article 20 GDPR',
  },
  {
    label: 'Right to object',
    value: 'Object to processing based on legitimate interest or direct marketing.',
    note: 'Article 21 GDPR',
  },
  {
    label: 'Withdrawing consent',
    value: 'Withdraw a consent you gave earlier — for analytics, for instance — at any time.',
    note: 'Article 7(3) GDPR',
  },
  {
    label: 'Complaint to a supervisory authority',
    value: 'Turn to the supervisory authority in your own country.',
    note: 'Article 77 GDPR',
  },
];

<div class="prose-lc max-w-3xl">

## How we think about data security at Lucanto

Data security is not a list of fashionable acronyms to us. It is a simple bargain: you know who we are, where your data lives, what we do with it and what stays in your hands. So this page carries no marketing slogans we could not evidence — it carries facts and links to documents you can read yourself.

Lucanto is operated by Stark Codes, s. r. o. We build and host the application in the European Union. Personal data is processed under Regulation (EU) 2016/679 (GDPR), which applies identically across every member state.

## Who controls your data

The controller — under **Article 4(7) GDPR**, whoever determines the purposes and means of processing — is **Stark Codes, s. r. o.**, Holíčska 3043/13, 851 05 Bratislava, company ID 51 414 546. Write to us at [hello@lucanto.eu](mailto:hello@lucanto.eu); data requests go to the same address.

That a named company with a registered office and a company registration stands behind the service matters: you have a real counterparty, not an anonymous app with no address.

## Data security in practice: where it lives and who processes it

Lucanto is built and hosted in the EU. To run the service we also use processors — for sending e-mail, for support, for web analytics. Each processes data only on our instructions and is bound by a data processing agreement under **Article 28 GDPR**. The list and the purpose of each is in the [Data Processing Agreement (DPA)](/dpa) and in the [Privacy Notice](/privacy-policy).

Where a processor operates outside the European Economic Area (EEA), the transfer is covered by standard contractual clauses approved by the European Commission under **Article 46 GDPR**. Specific retention and deletion periods are described in the Privacy Notice.

## What we process and on what legal basis

We process the data we need so that you can invoice: your login e-mail, details of your business and clients, the content of documents, and basic information about how the service is used. We do not collect data "just in case" — the data-minimisation principle is set out in **Article 5(1)(c) GDPR**.

Every processing operation has a legal basis under **Article 6 GDPR**. Most often that is performance of the contract (we provide you the service), legitimate interest (account security, for instance) or consent (web analytics). Some data we are required to keep for tax and accounting purposes.

Documents can also sit in a 10-year digital archive — part of the PRO and Business plans (see [pricing](/pricing)).

## Who we do not send your data to

We **do not sell** your personal data. We do not pass it to third parties for their own marketing. Access is limited to our staff who need it for their work and to processors, to the extent required to run the service (per the DPA).

We disclose data to public authorities only where the law or a court decision requires it. Web analytics, moreover, loads only after you consent — before that it does not run at all. How we handle this is described in the [cookie policy](/cookies).

</div>

<CtaBand
  class="mt-16"
  heading="Try Lucanto on your own invoicing"
  lead="The Free plan is free forever and needs no card. Web analytics on this site starts only after you agree to it."
  ctaLabel="Start for free"
  analyticsLocation="data_security_mid"
/>

  <div class="prose-lc mt-16 max-w-3xl">

## Your rights over your data under GDPR

GDPR gives you specific rights over your personal data. You do not have to give a reason, and exercising them is free. Here is the overview, with the article each right rests on.

</div>

<KeyFactsTable
  id="rights-table"
  class="mt-6"
  rows={rightsFacts}
  labelHeading="Right"
  valueHeading="What it means for you"
  caption="Rights over personal data under GDPR and the articles they rest on"
/>

  <div class="prose-lc mt-16 max-w-3xl">

## How to exercise your rights and raise a complaint

The process is straightforward:

- Write to [hello@lucanto.eu](mailto:hello@lucanto.eu) and say what you want — access, rectification, erasure, portability and so on.
- We check the request really comes from you, so that we do not hand your data to someone else.
- We handle it without undue delay and within one month at the latest. For complex requests we can extend that by two months, and we tell you if we do (**Article 12(3) GDPR**).

If you disagree with how we handled it, you have the right to lodge a complaint with a supervisory authority under **Article 77 GDPR**. The competent one is the authority in the country of your habitual residence, your place of work, or the place of the alleged infringement. You can also reach us through the [contact page](/contact).

## What we deliberately do not claim about data security

We would rather say less and mean it. So this page deliberately does not list security certifications, specific encryption technologies, uptime figures or guarantees we could not currently back with a document or an audit. A claim like that belongs on a website only when there is verifiable evidence behind it.

What we can tell you is above: who we are, where your data lives, on what basis we process it, who we do not send it to, and what rights you have. If something is missing, write to [hello@lucanto.eu](mailto:hello@lucanto.eu) — we will add whatever we can evidence.

</div>

<FaqAccordion class="mt-16" items={frontmatter.faq} heading="Frequently asked questions about data security" />