Privacy Policy

Account data (contact name, email, phone, encrypted password, role in the firm); company data (business name, address, company number, PIB, activity code, bank account, premises and tills); subscription and billing data; technical data and logs (IP address and the approximate location derived from it, country and city only, access time, device and browser, login and API call logs, the activity log of who did what, technical errors); data about till devices (model, system, app version, printer, print and runtime errors, push token, commands sent to the device); the log of sent emails, including whether bulk notices to firms were opened (receipts a firm sends its customers are not tracked); support correspondence; and proof of consent (accepted version, date, time and IP).

Processing rests on contract performance (opening and running the account, providing the Service, support, billing), legal obligation (issuing and keeping receipts and the records required by tax and accounting rules), legitimate interest (system security, abuse prevention, the activity log, basic visit statistics, and legal claims), and consent, which is asked only where expressly needed and can be withdrawn at any time.

Account data and User Content are kept while the contract lasts and at least 30 days afterwards for download, then deleted or anonymized. Receipts and accounting records are kept for the statutory periods. Technical logs are deleted automatically: login and email logs after 180 days, API call log 90 days, technical errors 180 days, device diagnostics 60 days, visit statistics 400 days (no personal data), our administrator's action trail 2 years, bank statement intake log 5 years (financial trail). The firm's activity log is part of the firm's data and is kept while the contract lasts. Website inquiries and demo requests are kept up to 2 years. Proof of consent is kept for the contract term and the limitation period after it.

Data is not sold or handed to third parties for their own purposes. Processors acting on Go Simple's instructions under contract are Vercel Inc. (application hosting, Frankfurt), Neon Inc. (database, EU), Cloudflare, Inc. (DNS, traffic protection and intake of bank statements sent by email), Resend (email), Leaseweb Netherlands B.V. (our server in the Netherlands: images, logos, attachments and site visit measurement), Google Ireland Ltd. (Google Analytics with consent, Google sign-in if chosen, Android notifications), Apple Inc. (Apple sign-in if chosen, iPhone and iPad notifications) and GitHub, Inc. (GitHub sign-in if chosen). Backups (last 30 days) are kept on our own server in Serbia. Transfers outside Serbia and the EU go only to countries with adequate protection (for the US, the EU-US Data Privacy Framework) or under standard contractual clauses. Card payment data is handled only by the authorized payment operator and is never seen or stored by Go Simple; data goes to authorities only when the law requires it.

Traffic is protected by HTTPS and passwords are stored only in encrypted form. Access is limited by role and by firm, so each firm sees only its own data. Staff have no insight into a firm's business data; only technical data is processed for support and monitoring, and access to business content happens only when the firm expressly requests and enables it. In the sent-email log, the address of a firm's customer, employee or accountant is shown to support masked; the full address is viewed only to solve a delivery problem, and every such view is logged. High-risk breaches are reported to affected persons and to the Commissioner within statutory deadlines.

Necessary cookies are used for login and session security, without which the Service cannot run. Public-page visits are counted with Go Simple's own measurement, without profiling and without the IP address; cookies that remember where you came from and whether you visited before, and Google Analytics, are used only with your consent given in the banner. Details are in the Cookie Policy.

You have the rights of access, rectification of inaccurate data, erasure, restriction of processing, portability, objection to processing based on legitimate interest, and withdrawal of consent at any time. Send requests to podrska@tezgafiskal.com; we reply within 30 days, extendable with notice for a complex request. You may also complain to the Commissioner for Information of Public Importance and Personal Data Protection, or go to court.

Firms that use Tezga enter data about their own customers and staff; for that data the firm is the controller and Go Simple is only a processor acting on its instructions. Some processes need more data, for example a refund, where the regulation requires identifying the customer. If you are a firm's customer, address your rights to that firm; this processing is governed by the Data Processing Agreement.

The Android and iPhone app is part of the same Service, so everything above applies to it too. Issued receipts (the journal), the item catalogue, customers, cashiers and device settings stay on the device until sent to the Service. The device sends issued receipts, company-data requests and technical device data (model, system, app version, printer, errors, push token) over HTTPS. Support can send settings and technical commands to the device and update part of the app remotely; commands do not change the firm's data on our server and cannot delete receipts, and each is logged. Permissions: internet; Bluetooth (thermal printer and smart-card reader); local network (network printer); notifications; camera and microphone only when you attach a photo, logo or video. On Android older than 12 the system also requires location for Bluetooth scanning; the app does not read or send location. No ads, no third-party analytics, no advertising identifier. Notifications pass through Google and Apple. Account deletion can be requested from the app.

The Service is intended only for businesses and is not aimed at minors. Go Simple does not knowingly collect data about minors.

The Policy may change, and each version carries a version mark and effective date. Changes that materially alter how data is processed are announced by email or in the Service at least 15 days before they take effect.