Kniholap – Personal Data Protection
Effective from: 1 October 2026
This is a courtesy translation of the Slovak original. In case of any difference, the Slovak version prevails.
This document explains what personal data Kniholap collects about you, why, who it is passed to and what rights you have. It applies to the website www.kniholap.sk and the Kniholap mobile app.
1. Who processes your data
The controller of your personal data is:
PREMIUM studio s. r. o., Hrachová 17960/69B, 821 05 Bratislava – mestská časť Ružinov, Slovensko, Company ID (IČO): 55682987, registered in the Commercial Register of the Bratislava III City Court, Section Sro, Insert No. 172207/B
For any questions about personal data, write to us at info@kniholap.sk. We have not appointed a data protection officer (DPO) because the law does not require us to.
2. What data we process and why
We collect only the data we need for Kniholap to work. We do not sell it to anyone and do not use it for targeted advertising by third parties.
| Purpose | Data | Legal basis | How long |
|---|---|---|---|
| User account and login | name, e-mail, password (encrypted), Google or Apple account identifier, profile photo, username (@name – other users see it instead of your name) | performance of a contract | for as long as the account exists |
| Digital library and reader | books read and in progress, the place where you stopped, highlights, notes and bookmarks in e-books, favourite books, reader settings (font, background); downloaded e-books are stored encrypted only in the app on your device | performance of a contract | for as long as the account exists |
| Subscription | plan type, start and end date, payment status from Apple or Google (we do not see your card number) | performance of a contract | 10 years (accounting) |
| Reading of paid e-books (settlement with publishers) | which paid e-book you opened in the app and when – the same book is counted for one reader at most once every 12 months; to publishers and rights holders we provide only aggregate counts without your name or other personal data | performance of contracts with publishers and legitimate interest (fair distribution of subscription revenue) | 10 years (accounting) |
| Marketplace – seller | name, listings and photos of books, shipping address, IBAN for payouts, date of birth, phone, photos of an identity document and tax details (required by the payment service Stripe to verify identity before payout) | performance of a contract, legal obligation | 10 years from the transaction |
| Marketplace – buyer | name, delivery address, phone number for the courier, orders and payments | performance of a contract, legal obligation | 10 years from the transaction |
| Marketplace messages (chat) | messages and photos that you and the other user send each other (before purchase and about an order), time sent and read | performance of a contract | for as long as the account exists; after the account is cancelled they remain in the other party’s conversation under an anonymous name |
| Resolving marketplace disputes | messages, photos of the delivered book, statements of the parties | legitimate interest | 3 years from the closing of the dispute |
| Reviews and ratings | review text, rating, username | performance of a contract | until you delete the review or cancel the account |
| Public reader profile and community | username, profile photo, “about me” text, favourite books, reviews, books on the marketplace, whom you follow and who follows you (you can hide the profile in the settings – then only you can see it) | performance of a contract | for as long as the account exists |
| Reporting and blocking users | who reported or blocked whom, the reason and the text of the report | legitimate interest (community safety) | 3 years from the report, blocking until it is removed |
| Communication with support | e-mails and their content | legitimate interest | 3 years |
| Cooperation with authors and publishers (form “Do you write or publish books?”) | first and last name or pen name, publisher name and company ID, contact person and position, e-mail, phone, website, information about books and the content of the message | consent given when submitting the form (you can withdraw it at any time by e-mail); if cooperation begins, performance of a contract | 2 years from the last communication if no cooperation begins; if it does, for its duration and according to statutory periods |
| Notifications in the app | device identifier for notifications (push token) and system type (iOS or Android) | performance of a contract; we send notifications only with your permission in the phone | until you turn notifications off, log out or uninstall the app |
| Security and fraud prevention | IP address, device type, login records | legitimate interest | 12 months |
| News and marketing e-mails | consent (you can withdraw it at any time) | until consent is withdrawn |
Data subject to the 10-year period must be kept under the Accounting Act and tax regulations even after the account is cancelled. You can cancel the account yourself in the app (Profile → Settings → Cancel account) or at www.kniholap.sk/zrusenie-uctu. We delete personal data, shelf, notes, reviews and follows immediately; orders remain without your name. If you ask for cancellation by e-mail, we will handle it within 30 days.
3. Who we pass the data to
We pass your data only to those without whom Kniholap would not work, and only to the extent necessary.
| Recipient | Why |
|---|---|
| Websupport s. r. o., Slovakia | hosting of the website, app, database and chat |
| Google (Google Ireland Limited), including the Firebase service | sign-in with Google, delivery of notifications to Android devices (Firebase Cloud Messaging), subscription payment through Google Play |
| Apple (Apple Distribution International Ltd.) | sign-in with Apple, delivery of notifications to iPhone and iPad, subscription payment through the App Store |
| Expo (650 Industries, Inc., USA) | technical delivery of notifications to the app – it receives the device identifier and the text of the notification (for example “You have a new message”) |
| Stripe (Stripe Payments Europe, Limited, Ireland) | processing of marketplace payments, identity verification of sellers and payouts to sellers |
| The other user in a marketplace deal | the seller receives the buyer’s name, address and phone number so that they can send the book |
| Accountant and public authorities (for example the Financial Administration of the Slovak Republic) | keeping accounts and meeting legal obligations |
We may be required by law to report to the Financial Administration of the Slovak Republic sellers who make at least 30 sales or earn at least €2,000 on the marketplace in one year (DAC7 rules).
Transfers outside the EU: Google, Apple, Stripe and Expo may also process some data in the USA. The transfer is protected by the EU-US Data Privacy Framework or by standard contractual clauses approved by the European Commission.
4. Cookies, notifications and younger users
Cookies: The website uses only essential cookies, which keep you logged in and remember your settings. No consent is needed for these. If we start using analytics or marketing cookies in the future, we will ask for your consent first. You can delete cookies at any time in your browser settings.
Notifications: With your permission, the app sends you notifications about new messages, offers and orders on the marketplace and deadline reminders. You can change the permission at any time in the app (Profile → Notifications) or in your phone settings. If you do not have notifications turned on, we will send you an e-mail about an unread message.
Younger users: Kniholap may be used by persons over 15 years of age. If you are under 16, we may send you marketing e-mails only with the consent of a parent or other legal guardian.
5. Your rights
In relation to personal data, you have the following rights:
- access – find out what data we have about you and get a copy,
- rectification – correct inaccurate or incomplete data,
- erasure – ask for your data to be deleted if we no longer need it and are not required by law to keep it,
- restriction of processing – for example while we verify the accuracy of the data,
- portability – receive your data in a commonly used format,
- objection – object to processing based on legitimate interest,
- withdrawal of consent – at any time, without affecting processing before the withdrawal.
You can exercise your rights by e-mail at info@kniholap.sk. We will reply within one month at the latest; in exceptional cases we will let you know if we need more time.
If you think we are handling your data incorrectly, you can lodge a complaint with the Office for Personal Data Protection of the Slovak Republic, Hraničná 12, 820 07 Bratislava 27, www.dataprotection.gov.sk.
6. Changes to this document
We may update this document, for example when adding new features. We will inform you of material changes by e-mail or in the app. The current version is always at www.kniholap.sk/ochrana-osobnych-udajov.