Tax and Duty Payment Privacy Policy
Version: Version 1.0
Effective date: 19 August 2026
Applies to: the Tax and Duty Payment software-as-a-service product, its onboarding, activation, invoicing, payment and email flows
This Privacy Policy explains how ByLogic OÜ handles personal data in connection with Tax and Duty Payment (the Service). It is one of the three documents accepted during onboarding, together with the Tax and Duty Payment Subscription Terms and the Tax and Duty Payment Data Processing Addendum (the DPA). The version accepted is stored in the acceptance record.
The separate privacy policy published at https://bylogic.io/privacy/ covers the ByLogic marketing website and the Telegram enquiry bot. It does not cover the Service. Where the two documents differ, this Privacy Policy governs the Service.
1. Who we are
The controller for the processing described in this Privacy Policy is ByLogic OÜ, an Estonian private limited company, registry code 16567996, registered at Tartu mnt 67/1-13b, Tallinn 10115, Estonia.
Privacy contact: info@bylogic.io. Billing correspondence: billing@bylogic.io.
2. Our two roles
ByLogic OÜ processes personal data in two distinct roles.
As controller. We decide the purposes and means of processing the data needed to onboard a Customer, record acceptance of the Service documents, issue and collect invoices, deliver Service email, and keep the Service secure and auditable. Section 3 onwards describes that processing.
As processor. Personal data that a Customer submits or connects for consignment processing — for example recipient and sender details inside express waybills — is processed on the Customer's documented instructions. The Customer is the controller for that data and the DPA governs it, including subprocessing, assistance, breach notification, international transfers, and return or deletion. This Privacy Policy does not replace the Customer's own privacy notice to those individuals.
Card payment data is processed by the payment provider on its own hosted page as an independent controller. See section 6.
3. Personal data we process as controller
| Category | Data | Source |
|---|---|---|
| Customer identity | Legal name, country of registration, registration number, VAT identification number where provided, billing time zone, invoicing currency, agreed rate per processed express waybill and any monthly minimum | Provided by the Customer during onboarding and recorded by a ByLogic operator |
| Business contacts | Contact person's name, and one to ten billing email addresses that receive activation, invoice, reminder and payment-confirmation messages | Provided by the Customer |
| Acceptance evidence | Full name, job title and work email address of the person who accepts, the UTC date and time of acceptance, the IP address and user-agent string of the accepting device, and the versions of the Subscription Terms, this Privacy Policy and the DPA that were accepted | Collected on the activation page when the representative accepts |
| Billing records | Invoice numbers, billing periods, billable waybill numbers with their processing timestamps, quantities, rates, amounts, tax notes, due dates, and the generated invoice PDF and waybill CSV documents | Generated by the Service |
| Payment records | Payment order and session identifiers, transaction identifiers, payment status and error codes, the last four digits of the card, and the payment timestamp | Returned by the payment provider |
| Communication records | Message metadata for Service email, including recipient address, subject, delivery status and attachment references | Generated by the Service and its email provider |
| Technical records | Server and application logs containing request metadata, IP addresses, timestamps and error information, and operator authentication events | Generated automatically |
Activation and payment links contain single-purpose bearer tokens. Those tokens are never written to logs, issues, screenshots or documentation.
We do not request or store card numbers, card security codes, or other full payment-card data. We do not process special-category or criminal-offence data for the Service and ask Customers not to submit it.
4. Why we process it, and on what legal basis
| Purpose | Legal basis under the EU GDPR |
|---|---|
| Onboard the Customer, create the client record, and issue the one-time activation link | Performance of a contract, or steps taken at the Customer's request before entering into it (Article 6(1)(b)); our legitimate interest in administering a business relationship with an organisation (Article 6(1)(f)) |
| Record and preserve evidence that an authorised representative accepted the Service documents, including which versions were accepted | Legitimate interest in proving the existence and content of the agreement (Article 6(1)(f)); establishment and exercise of legal claims (Article 9(2)(f) where relevant) |
| Calculate monthly usage, issue invoices, deliver invoice PDFs and waybill CSVs, and reconcile payment | Performance of a contract (Article 6(1)(b)) |
| Keep accounting and tax records, including VAT documentation | Compliance with a legal obligation (Article 6(1)(c)) |
| Send payment reminders and, after review, notify a Customer about suspension of new consignment processing | Legitimate interest in collecting sums due (Article 6(1)(f)) |
| Secure the Service: authentication, access control, abuse and fraud prevention, logging, incident response, backup | Legitimate interest in protecting the Service and its users (Article 6(1)(f)); security of processing (Article 32) |
| Maintain and improve the Service using aggregated and irreversibly anonymised information | Legitimate interest in operating and improving the Service (Article 6(1)(f)) |
We do not use Service data for advertising, we do not sell personal data, and we do not use it to train publicly available artificial-intelligence models. We do not carry out automated decision-making that produces legal effects or similarly significantly affects an individual. The Service sends no marketing email; every message it sends is transactional.
5. Who receives personal data
Access inside ByLogic OÜ is limited to the personnel who operate and support the Service, under confidentiality obligations and least-privilege access.
The following providers process personal data on our behalf as subprocessors:
| Subprocessor | Purpose | Processing location |
|---|---|---|
| Railway (railway.com) | Hosting of the application, the PostgreSQL database, the queue worker and the encrypted document volume that stores invoice PDFs and waybill CSVs | United States (current deployment region us-west2) |
| Resend (resend.com) | Delivery of transactional Service email: activation, invoice, reminder, payment-confirmation and operator-alert messages, including their attachments | United States, using Amazon Web Services sending infrastructure |
The same list is published in Schedule 3 of the DPA. We give Customers advance notice of a new subprocessor as described in section D4 of the DPA.
We also disclose personal data to our accountants, auditors and professional advisers where necessary, and to a competent authority, court or public body where the law requires it. If our business or the Service is transferred to another entity, we may transfer the related records, subject to this Privacy Policy or an equivalent successor document.
6. Card payments
Card payment takes place on a hosted payment page operated by Stripe. Stripe collects and processes payment-card data as an independent controller under its own privacy notice. ByLogic OÜ never receives full card data. We receive only the payment result and reference information described in section 3 and use it for reconciliation, receipts, fraud prevention and accounting.
7. International transfers
Our hosting and email subprocessors process personal data in the United States. Where that involves a restricted transfer from the European Economic Area or the United Kingdom, the transfer relies on the European Commission's standard contractual clauses adopted by Implementing Decision (EU) 2021/914, supplemented by the UK International Data Transfer Addendum where the transfer originates in the United Kingdom, together with supplementary technical and organisational measures such as encryption in transit and restricted access. Section D8 of the DPA states the corresponding terms for Customer-controlled personal data. A copy of the relevant transfer mechanism is available on request to info@bylogic.io.
8. How long we keep it
| Record | Retention |
|---|---|
| Accounting documents, including invoices, waybill CSVs, payment records and VAT documentation | Seven years from the end of the financial year to which they relate, as required by Estonian accounting law |
| Acceptance evidence | For the duration of the agreement and for seven years afterwards, so that the accepted document versions remain provable |
| Client and billing-contact records | For the duration of the agreement, then archived with the accounting records above |
| Security and operational logs | Up to twelve months, unless a longer period is needed to investigate a specific incident or to establish, exercise or defend a legal claim |
| Email delivery metadata held by the email provider | According to the provider's retention period for transactional message logs |
Acceptance records are append-only: an accepted version is never edited or deleted while the retention period runs.
9. How we protect it
We apply the baseline technical and organisational measures set out in Schedule 2 of the DPA. For the Service this includes: encryption in transit; an owner-authenticated operator interface that is separate from the public client surfaces; per-process cross-site request forgery protection and same-origin checks; storage of generated invoice documents on a restricted encrypted volume rather than in source control; secrets held in a system keychain and deployment secret storage; single-purpose bearer tokens that are excluded from logs; signature verification and deduplication of payment webhooks; append-only acceptance evidence enforced in the database; and least-privilege access with prompt removal when it is no longer required.
No technical measure provides absolute protection. We investigate suspected incidents, notify affected Customers without undue delay after confirming a personal data breach that affects them, and notify supervisory authorities where the law requires it.
10. Your rights
Subject to the conditions in applicable data-protection law, individuals may request access to their personal data, rectification of inaccurate data, erasure, restriction of processing, portability of data they provided, and may object to processing based on legitimate interests. Requests can be sent to info@bylogic.io. We may ask for information needed to verify identity, and we answer within one month unless the request is complex, in which case we tell the requester and may extend the period as the law permits.
Where ByLogic OÜ acts as processor for waybill personal data, we refer the request to the Customer as controller and assist the Customer as described in section D5 of the DPA.
Individuals may lodge a complaint with a supervisory authority. Our lead authority is the Estonian Data Protection Inspectorate, Andmekaitse Inspektsioon (https://www.aki.ee). Individuals in the United Kingdom may complain to the Information Commissioner's Office (https://ico.org.uk).
11. Changes to this Privacy Policy
Each published version of this Privacy Policy keeps a fixed version number and a stable address. When we change it, we publish a new version at a new address and update the version applied to new acceptances. Existing acceptance records continue to identify the version that was accepted. We notify Customers by email to their recorded billing contacts before a material change takes effect for them.
12. Contact
Privacy questions, rights requests and transfer-mechanism requests: info@bylogic.io.
Invoices and billing correspondence: billing@bylogic.io.
Postal address: ByLogic OÜ, Tartu mnt 67/1-13b, Tallinn 10115, Estonia.
This Privacy Policy is written and controlled in English.