1. Who we are and how to contact us
Esken is operated by BLW, spletna prodaja, d.o.o. (BLW d.o.o.), Rakuševa ulica 8, 1000 Ljubljana, Slovenia; company registration number 9834451000; VAT identification number SI69023409. In this Policy, 'we', 'us' and 'our' refer to BLW d.o.o. For privacy questions or requests, email info@esken.si or write to our registered address.
This Privacy Policy explains how we handle personal data when you visit Esken, create an account, use our invoice and business-document features, purchase access, or contact us. It covers identifiable individuals, including business users, sole traders and people whose details appear in documents. Company information is also personal data when it identifies a natural person.
2. Our role and your business documents
BLW d.o.o. is the data controller for account administration, our own billing records, security, service communications and other purposes we determine ourselves. As controller, we are responsible for deciding why and how that personal data is processed.
For personal data in documents and business records that customers submit for processing, we generally act as a data processor on the customer's instructions. The customer is normally the controller, or a processor acting for another controller, and is responsible for having a lawful basis, giving the necessary privacy information, and determining which documents to upload and how long to keep them. Having an Esken account does not give you permission to process someone else's personal data.
Where we act as a processor, the applicable data processing agreement sets out the parties' obligations and authorised instructions. This Policy is a privacy notice and does not replace an agreement required by Article 28 GDPR. Contact info@esken.si for data-processing terms. Requests about personal data in a customer's documents should normally be addressed to that customer; if you contact us, we will help identify the appropriate route and assist the customer as required by law.
3. Personal data we handle and where it comes from
Account data: your first and last name, email address, account identifiers, password hash, verification status, account role and settings, account creation and update dates, and records needed for sign-in, email verification and password resets. Passwords are stored as hashes rather than readable passwords.
Business and document data: companies and contacts you enter, names, addresses, VAT and other tax identifiers, contact details, invoice and order-summary contents, bank or payment details appearing in documents, transaction amounts, line items, dates, notes, uploaded PDFs and images, file names and metadata, extracted information, corrections, and processing results. The exact personal data depends on what you or the business using Esken submit.
Billing data: billing names and addresses, country, postal code, tax details, billing email recipients, selected plans, purchased and used page allowances, access periods, checkout and payment references, payment status, amounts, currency, and invoices we issue for Esken access. Stripe collects payment credentials through its checkout; Esken does not store your full payment-card number or card security code.
Technical and security data: registration and session IP addresses, browser user agents, session identifiers and timestamps, a random browser identifier used to prevent repeated demo claims, pseudonymous demo-claim fingerprints, the time and version of Terms acceptance, campaign parameters, referring website, landing page, registration button and offered plan associated with account registration, service requests, error and processing logs, processing status, and resource-usage information. We also handle the messages and attachments you choose to send when asking for support or exercising your rights.
We receive data directly from you, automatically through your use of the service, from customers submitting business documents, and from providers supporting the service. VAT checks can obtain validation results, registered names and addresses from the EU VAT Information Exchange System (VIES) through VIES API. Stripe supplies checkout and payment information. We do not require health information, biometric data, criminal records or other sensitive personal data; avoid uploading such information unless it is necessary, lawful and covered by appropriate arrangements with us.
4. Why we use personal data and our legal bases
Providing the service: we use account, document, settings and usage data to register and authenticate users, store and organise documents, extract and validate information, provide exports, apply plan allowances, and respond to service requests. For our controller activities, the legal basis is performance of our contract with you or steps you request before entering it (Article 6(1)(b) GDPR). Where you act for a company rather than contracting personally, we rely on our legitimate interests in providing and administering the service for that company (Article 6(1)(f)). Customer document processing follows the customer's instructions and lawful basis, as explained in section 2.
Payments and accounting: we use billing and transaction data to take payments, issue invoices and administer purchased access, relying on contractual necessity or our legitimate interests in administering a business customer's purchase. We retain and disclose records required by tax, accounting or other applicable law to meet legal obligations (Article 6(1)(c)).
Security and service reliability: we use technical data, Terms-acceptance records, logs and usage information to protect accounts, prevent fraud and repeated trial abuse, investigate failures, enforce lawful service restrictions, and maintain the service. We rely on our legitimate interests in protecting users, operating a reliable service, and defending legal claims. We must balance these interests against your rights and freedoms; legitimate interests do not give us an unrestricted right to use personal data.
Communications and requests: account verification, password resets, billing notices and essential service messages support our contract or our legitimate interests in administering business accounts. Support correspondence is used to resolve the request. Handling data-protection requests and legally required disclosures is based on our legal obligations; keeping necessary evidence of a dispute is based on our legitimate interests in establishing or defending claims.
We do not rely on acceptance of the Terms or this Policy as blanket consent to personal-data processing. If a separate optional activity requires consent, we will request it for that activity, and you can withdraw it without affecting earlier lawful processing. We do not currently use Esken account or document data for behavioural advertising or send promotional mailing campaigns.
5. Who receives personal data
We disclose relevant data to providers supporting the functions you use: Google Cloud for application hosting, file storage and processing queues; our database hosting provider for stored application records; OpenAI for AI document extraction, identifying document boundaries and structuring business addresses; Stripe for checkout, payment processing and payment-related fraud prevention; VIES API for VAT-number validation and related business details; and our email delivery provider for verification, password-reset, welcome, billing and other service messages. Depending on the feature, OpenAI receives uploaded document contents, file names, processing instructions and relevant company details; a VAT lookup sends the VAT identifier to the validation provider.
Authorised personnel can access information where needed to administer the service, assist customers, review processing problems, or address security and legal matters. Where we process documents for a customer, access and disclosure must remain within the customer's authorised instructions and applicable processor obligations. We do not make uploaded documents publicly available as part of normal service operation.
We may disclose necessary information to professional advisers, accountants, auditors, or competent authorities to meet legal obligations or establish, exercise or defend legal claims. In a business sale or reorganisation, information may be disclosed where necessary and lawful, with appropriate confidentiality and data-protection safeguards.
We do not sell personal data or share it for cross-context behavioural advertising. Providers may act as our processors or, for activities they determine themselves, as independent controllers. In particular, Stripe describes its payment, compliance and fraud-prevention processing in its own privacy notice. Data you export or send to a recipient you select is also subject to that recipient's handling and your own responsibilities.
6. AI processing and automated decisions
Esken uses AI to extract document fields, identify documents within PDFs, and organise business information. This involves transmitting the relevant contents to OpenAI's API. AI output may be inaccurate and must be reviewed before you rely on or export it. Esken does not train its own AI models on your documents. OpenAI's published API policy states that API inputs and outputs are not used to train its models by default; provider storage for processing and abuse monitoring is a separate matter, described in section 9.
Document extraction is an aid to your review. Esken does not use it to make decisions about individuals that have legal or similarly significant effects within Article 22 GDPR. Automated service checks can apply verification requirements, access periods, page allowances and abuse restrictions. Contact info@esken.si if you believe a restriction is incorrect or need a person to review it.
7. Cookies and browser storage
Esken uses authentication cookies to keep you signed in and support secure account access. The main Better Auth session cookie normally lasts up to seven days and can be renewed during use; choosing not to remember a session can make it a browser-session cookie. Signing out ends your authenticated session. Other authentication cookies can support the sign-in flow.
The 'esken-theme' cookie remembers your selected appearance for up to one year. The 'esken-demo-device' cookie stores a random identifier for up to one year to help prevent the same person from repeatedly claiming the free demo. First-party attribution cookies remember campaign parameters, the referring website, landing page and selected registration button for up to 90 days so we can understand how registered users found Esken; the resulting registration attribution is retained with the account. Browser local storage can remember your selected company and associated display details until you clear it or delete your account. We do not currently use advertising cookies or third-party audience analytics on Esken.
You can delete cookies and local storage or block them in your browser settings. Blocking authentication cookies prevents sign-in or interrupts account features. Stripe's checkout runs on Stripe's service and can use its own cookies under its notices; our statement about Esken's cookies does not describe every technology on a third-party site.
8. International processing and transfers
Esken is operated from Slovenia. Providers and their subprocessors may handle personal data in the European Economic Area (EEA) and other countries, including the United States. Hosting an application in Europe does not by itself mean that every provider processes all data exclusively in Europe.
Transfers outside the EEA are subject to GDPR international-transfer requirements. Where required, a transfer must be covered by a European Commission adequacy decision applicable to the recipient or appropriate safeguards, such as the European Commission's standard contractual clauses together with any necessary supplementary measures. A provider's participation in an adequacy framework only covers transfers within the scope of its certification. Contact info@esken.si for information about the countries and transfer arrangements applicable to your data, or to request a copy of relevant safeguards, with confidential commercial information redacted where appropriate.
9. Retention and deletion
Account and customer workspace data are generally kept while the account exists and the records are needed to provide the requested service. The end of a free demo or paid access period does not automatically delete your account or documents. You can delete supported records in the app and permanently delete your account from Settings > Security, or contact info@esken.si for assistance. Export records you need before deleting them; Esken should not be your only archive.
Account deletion removes the account's active application records and associated customer document files. We keep invoices issued by BLW for Esken purchases, their PDF files and related payment records for legal accounting and tax purposes, even after account deletion. Slovenian VAT rules generally require invoices to be retained for ten years after the end of the year to which they relate. Necessary records can be kept longer where another legal obligation or an ongoing claim requires it; this exception does not authorise indefinite retention of unrelated customer documents.
Support correspondence, technical logs, security evidence, pseudonymous demo-claim fingerprints and Terms-acceptance records are kept only as long as needed for their purpose, considering whether a request or incident is resolved, the risk of repeated abuse, the applicable claim limitation period and legal record-keeping obligations. Demo-claim records can remain after account deletion so that deleting an account does not provide another free demo. Authentication and recovery tokens have expiry periods; expiry does not necessarily mean that every related historical log is immediately erased. Temporary upload files are subject to storage cleanup rules.
Deleting data in Esken does not automatically delete every copy held by a provider or in infrastructure backups. The current AI workflow stores processing responses with OpenAI and uploads files without an automatic file-expiry setting. Under OpenAI's published API retention rules, stored response data is retained for at least 30 days and uploaded files can remain until separately deleted; abuse-monitoring logs are generally retained for up to 30 days, subject to legal and safety exceptions. These are distinct from the copies stored in Esken. Contact us with a deletion request so that we can assess and arrange any required provider-side action, subject to applicable law and the customer's instructions.
Backup copies, where maintained, remain subject to their backup retention and replacement cycle rather than instant removal from every historical copy. Stripe and other independent controllers may retain records to meet their own legal obligations. We assess erasure requests against the purpose of each remaining record and explain any applicable grounds for retention.
10. Security
We use measures intended to protect personal data, including password hashing, authenticated and authorised access to account and document features, email verification, and time-limited upload access. Security also depends on provider infrastructure and operational controls. No online service can guarantee absolute security. Use a strong, unique password, protect your email account and credentials, and notify info@esken.si promptly about suspected unauthorised access.
If a personal-data breach occurs, we must assess it and notify affected controllers, the supervisory authority and individuals where the applicable legal requirements call for notification.
11. Your data-protection rights
Subject to the conditions and exceptions in applicable law, you can ask for access to your personal data and a copy of it, correction of inaccurate or incomplete data, erasure, restriction of processing, and portability of data you supplied where processing is automated and based on consent or a contract. Where we rely on legitimate interests, you can object on grounds relating to your situation. If consent is used, you can withdraw it at any time. You also have applicable rights concerning decisions based solely on automated processing that produce legal or similarly significant effects.
Email info@esken.si to exercise your rights. Explain your request and the account or records involved; an Esken account is not required to make a request. We may ask for proportionate information to verify identity or authority so that we do not disclose or erase another person's data. Requests are normally free. We will respond without undue delay and generally within one month; where the law permits an extension for a complex or numerous request, we will explain it within that first month. If we cannot comply, we will explain the reason and available complaint rights.
You can complain directly to the Information Commissioner of the Republic of Slovenia (Informacijski pooblaščenec), Dunajska cesta 22, 1000 Ljubljana, Slovenia; email gp.ip@ip-rs.si; website www.ip-rs.si. You can also contact the supervisory authority in the EEA country where you live or work, or where you believe an infringement occurred. You do not have to contact us before making a complaint.
12. Required information and your choices
Account identity, email and authentication information are needed to create and secure your account. Required billing information is needed to complete purchases and issue compliant invoices. Documents and relevant business details are needed for the features you request. If required information is missing, we may be unable to provide the corresponding account, payment or processing feature. You choose which documents and optional details to submit; provide only information needed for your business purpose.
13. Children
Esken is intended for adults using business-document services. Registration is restricted to people aged 18 or over under our Terms. We do not knowingly offer accounts to children. If you believe a child has created an account or that unnecessary children's personal data has been submitted, contact info@esken.si so that we can investigate and take appropriate action.
14. Changes to this Policy
We may update this Policy as the service or legal requirements change. The date on this page identifies the current version. We will bring material changes to your attention through the app or email as appropriate, and provide any new notice or obtain any consent required before using personal data for a new purpose. This Policy does not limit your statutory rights or release us from our data-protection obligations.