Privacy Policy for the Monitor KSeF Application

1. Introduction and scope

This policy describes the principles of data processing in the Monitor KSeF application for iOS.

The KSeF system and its infrastructure are operated by the Polish Ministry of Finance. With regard to data processing within KSeF, the Ministry of Finance acts as a separate data controller.

2. Information required under Art. 13 GDPR (summary)

1. Data controller: mDesign Michal Lotocki (brand: KrzewiLabs).
2. Purposes and legal bases: described in section 4.
3. Recipients: described in section 8.
4. Transfers outside the EEA: described in section 9.
5. Retention period: described in section 7.
6. Rights: section 11.
7. Complaint to the supervisory authority: section 12.
8. Obligation to provide data: section 6.
9. Profiling: none (section 10).

3. Definitions

• Personal data – information relating to an identified or identifiable natural person.
• User – a person using the Application.
• KSeF Token – an authentication token used to connect to the KSeF API.
• KSeF – the National e-Invoicing System (Krajowy System e‑Faktur) operated by the Polish Ministry of Finance.

4. What data we process, for what purposes and on what legal basis

The Application has been designed following the "privacy by design" principle – as a rule, we do not store invoice content on the Controller's servers and strive to keep data on the user's device.

4.1 Categories of data

• Identification and access data: NIP (Polish Tax Identification Number), KSeF Token (entered by the user).
• Data from KSeF: invoice data and metadata processed for display purposes.
• Security data: PIN (stored only as a hash), application settings.
• Diagnostic data (optional): local logs with sensitive data redacted (the user may export them for support purposes).
• Purchase data: subscription status / transaction identifiers provided by Apple.

4.2 Purposes and legal bases

1. Providing application functionality (connecting to KSeF, displaying data, export): Art. 6(1)(b) GDPR.
2. Security (PIN, lockouts, connection integrity): Art. 6(1)(f) GDPR.
3. Technical support (when the user provides data, e.g. logs): Art. 6(1)(b) and/or (f) GDPR.
4. Biometrics (Face ID/Touch ID, optional): Art. 6(1)(a) GDPR – consent expressed by enabling the feature.
5. Purchases (IAP/subscriptions): Art. 6(1)(b) GDPR; billing is handled by Apple.

5. Sources of data

• NIP, token, settings and PIN are provided directly by the user.
• Invoice data and metadata originate from the KSeF API, which the application connects to at the user's request.

6. Is providing data mandatory

Providing a NIP and KSeF token is a prerequisite for using the invoice retrieval and display functionality. Without this data, the application cannot authenticate the connection to KSeF.

Biometrics are optional. A PIN is required for using the PIN lock feature.

7. How long we retain data (retention)

• NIP and token: stored in iOS Keychain until removed by the user (or until the application is uninstalled).
• Invoice content: as a rule, held only in RAM – not stored on the Controller's servers.
• Temporary files (PDF/XML): created locally for the duration of sharing and removed in accordance with iOS mechanisms.
• Diagnostic logs: stored locally; export occurs only at the user's initiative.

8. Disclosure and data recipients

The Controller does not sell data and does not share invoice content for marketing purposes.

• Ministry of Finance / KSeF – recipient of requests during API communication.
• Apple – purchase billing and system features.
• Entities chosen by the user when sharing files (e.g. email, cloud).

9. Transfers of data outside the EEA

The Controller does not transfer invoice content to its own servers outside the EEA. Apple may process purchase data outside the EEA in accordance with its own policies.

10. Profiling and automated decision-making

The Application does not engage in profiling or automated decision-making within the meaning of Art. 22 GDPR.

11. User rights

The User has the right of access, rectification, erasure, restriction, data portability, objection, and withdrawal of consent (where consent is the legal basis).

12. Complaints to the supervisory authority

The User has the right to lodge a complaint with the President of the Polish Data Protection Authority (UODO).

13. Children's data

The Application is not directed at children.

14. In-App Purchases

The Application may offer subscriptions. Billing is handled by Apple (App Store / StoreKit). The Controller receives only the minimum information necessary to verify subscription status.

15. How we store data on the device (local architecture)

• KSeF Token stored in iOS Keychain with the kSecAttrAccessibleWhenUnlockedThisDeviceOnly attribute.
• PIN stored only as a hash (PBKDF2 + salt).
• Invoice data kept in RAM as a rule, for display purposes.
• Screen content masked in the App Switcher when the application enters the background.

16. Network connections and external APIs

• KSeF API (Ministry of Finance) – HTTPS only.
• Apple services required for In-App Purchases (if the user makes use of them).

17. Data security

• TLS/HTTPS enforcement and ATS,
• certificate pinning for the KSeF API,
• data minimization and redaction of sensitive data in diagnostic logs,
• storage of credentials in Keychain,
• no advertising or analytics SDKs.

18. Changes to this policy

This policy may be amended. The current version will be published within the application or on the Controller's website together with the update date.

19. Contact

Data controller (GDPR): mDesign Michal Lotocki (brand: KrzewiLabs)

Address: Osiedlowa 5/9, 65-268 Zielona Gora

E-mail: kontakt@krzewilabs.pl

Website: krzewilabs.pl