Privacy Policy — RAVEN Hub
Version: 1.0
Effective Date: 1 July 2026
Controller: KANDA Production s.r.o.
1. Data Controller
KANDA Production s.r.o.
Prietržka 152, 908 49 Prietržka
Slovak Republic
Company No.: 45640246 | Tax No.: 2023068663 | VAT No.: SK2023068663
Commercial Register of the District Court Trnava, Section: Sro, File No. 25837/T
E-mail: info@kanda.sk
(hereinafter „Controller“)
This Privacy Policy is issued in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data (GDPR) and Slovak Act No. 18/2018 Coll. on the protection of personal data.
2. What Personal Data We Process
2.1 Data Provided at Purchase
When you purchase a RAVEN Hub license through the Lemon Squeezy platform, the Controller may receive the following data from that platform: – Name (or company name), – e-mail address (used at purchase), – order identifier and license key, – country (for tax purposes — processed by Lemon Squeezy as Merchant of Record), – VAT number (if provided by a business customer at checkout).
The Controller does not have access to payment details (card number, bank account) — these are processed exclusively by Lemon Squeezy.
2.2 Data Generated by RAVEN Hub Software
RAVEN Hub is a desktop application running exclusively on the User’s Device. All time-tracking data, projects, invoices, and settings are stored locally on the User’s Device (or in their iCloud Drive when backup is enabled). The Controller does not have access to this data, does not determine its content, and does not process it.
2.3 Technical Data for Updates and License Validation
When checking for updates and validating the license, the software communicates with external services: – Updates: checking the URL kanda.sk/kandahub_update/version.json — only an HTTP request is sent, with no personal data. – License validation: communication with the Lemon Squeezy License API — the license key and instance identifier (a technical device identifier generated by Lemon Squeezy) are transmitted.
2.4 Customer Support Communications
When you contact us by e-mail, we process: – your e-mail address, – your name (if provided), – the content of the communication.
2.5 Website (kanda.sk)
On our website kanda.sk we may process: – Google Analytics — anonymised statistical data about website traffic (see Section 7), – Cookies — technical and analytical cookies (see Section 8), – Contact form — e-mail and name.
3. Purposes and Legal Bases of Processing
| Purpose | Legal Basis | Data Categories |
|---|---|---|
| Performance of the purchase contract and provision of the license | Performance of contract (Art. 6(1)(b) GDPR) | E-mail, name, order ID |
| Subscription and license key management | Performance of contract (Art. 6(1)(b) GDPR) | E-mail, license key |
| Tax obligations (invoicing, VAT) | Legal obligation (Art. 6(1)(c) GDPR) | Name/company, address, VAT no. |
| Customer support | Legitimate interest (Art. 6(1)(f) GDPR) | E-mail, communication content |
| Notification of updates | Legitimate interest (Art. 6(1)(f) GDPR) | |
| Website analytics (GA4) | Consent (Art. 6(1)(a) GDPR) | Anonymised technical data |
4. Recipients of Personal Data
The Controller does not sell personal data to third parties. Data may be shared with the following processors to the extent necessary:
| Recipient | Purpose | Country | Transfer Safeguard |
|---|---|---|---|
| Lemon Squeezy B.V. | Payment processing, license management, customer portal | Netherlands (EU) | Data Processing Agreement |
| Google LLC (Analytics) | Anonymised website analytics | USA | EU Standard Contractual Clauses |
| Google LLC (Gmail/Workspace) | E-mail communication | USA | EU Standard Contractual Clauses |
| Apple Inc. (iCloud) | Software-initiated backup on User’s Device | USA | EU Standard Contractual Clauses |
5. Retention Periods
| Category | Retention Period |
|---|---|
| Order and transaction data | 10 years (legal obligation — accounting records) |
| License records | For the duration of the license + 3 years |
| E-mail communications (support) | 3 years from the last contact |
| Analytics data (GA4) | 14 months (Google Analytics setting) |
6. Your Rights
Under the GDPR, you have the following rights:
6.1 Right of Access (Art. 15 GDPR)
You have the right to obtain confirmation of whether we process your personal data and, if so, to access it and receive information about the processing.
6.2 Right to Rectification (Art. 16 GDPR)
You have the right to the rectification of inaccurate or incomplete personal data.
6.3 Right to Erasure (Art. 17 GDPR)
You have the right to request erasure of personal data where the purpose for processing has ceased, you have withdrawn consent, or the data has been processed unlawfully — unless a legal retention obligation applies.
6.4 Right to Restriction of Processing (Art. 18 GDPR)
In certain circumstances, you have the right to request restriction of processing of your personal data.
6.5 Right to Data Portability (Art. 20 GDPR)
You have the right to receive the personal data you have provided to us in a structured, commonly used, and machine-readable format and to transfer it to another controller.
6.6 Right to Object (Art. 21 GDPR)
You have the right to object to processing of your personal data based on the Controller’s legitimate interest.
6.7 Right to Withdraw Consent
Where processing is based on consent (e.g. analytics), you have the right to withdraw consent at any time without affecting the lawfulness of prior processing.
6.8 Right to Lodge a Complaint
You have the right to lodge a complaint with a supervisory authority:
Office for Personal Data Protection of the Slovak Republic
Hraničná 12, 820 07 Bratislava, Slovak Republic
Tel.: +421 2 3231 3214
E-mail: statny.dozor@pdp.gov.sk
Web: dataprotection.gov.sk
You may also lodge a complaint with the supervisory authority in your EU Member State of habitual residence.
Exercising Your Rights
You may exercise your rights by: – E-mail: info@kanda.sk (subject: „GDPR Request“) – Post: KANDA Production s.r.o., Prietržka 152, 908 49, Slovak Republic
We will respond to your request within 30 days. We may verify your identity before processing a request.
7. Google Analytics
We use Google Analytics 4 (GA4) by Google LLC on our website kanda.sk to analyse website traffic.
What Is Collected
- anonymised IP addresses (the last octet is anonymised before storage),
- browser and operating system (User-Agent),
- pages visited on kanda.sk and time spent,
- traffic source (search engine, direct access, social media).
What Is Not Collected
- data about activity within RAVEN Hub (the application is offline and shares no analytics data with the Controller),
- payment details or license keys.
Legal Basis
Analytics are processed only with your consent (via the cookie consent banner). GA4 is not activated without consent.
Opt-Out
You may disable Google Analytics tracking at any time: – by withdrawing consent in the cookie banner on kanda.sk, – by installing the Google Analytics Opt-out Browser Add-on, – by configuring your browser to block cookies.
More information: Google Privacy Policy
8. Cookies
8.1 What Are Cookies
Cookies are small text files stored in your browser when you visit a website. They allow the website to remember your settings and improve your experience.
8.2 Types of Cookies Used on kanda.sk
| Type | Purpose | Duration | Legal Basis |
|---|---|---|---|
| Strictly Necessary | Technical functionality, cookie consent record | Session / 1 year | Legitimate interest |
| Analytical | Google Analytics 4 — traffic statistics | Up to 14 months | Consent |
8.3 Cookie Management
When you first visit kanda.sk, you will see a cookie banner where you can: – accept all cookies, – decline analytical cookies (strictly necessary cookies remain active), – change your settings at any time via the „Cookie Settings“ link in the website footer.
You may also manage cookies directly in your browser settings.
8.4 Third-Party Cookies
Lemon Squeezy (payment platform) may use its own cookies when the checkout page is loaded. Their processing is governed by the Lemon Squeezy Privacy Policy.
9. Security
The Controller has implemented appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or destruction: – all communications with servers use encrypted HTTPS connections, – license records are stored in macOS Keychain with hardware encryption, – access to personal data is restricted to those who need it, – regular backup of operational data.
10. International Transfers
Some data may be processed outside the European Economic Area (EEA), in particular in the USA (Google LLC). Such transfers are based on Standard Contractual Clauses approved by the European Commission (Decision 2021/914/EU), ensuring a level of protection equivalent to that within the EU.
11. Automated Decision-Making and Profiling
The Controller does not carry out automated decision-making, including profiling, which produces legal effects or similarly significantly affects Users.
12. Data Protection Contact
The Controller is not legally required to appoint a Data Protection Officer (DPO). For any queries regarding personal data protection, please contact:
KANDA Production s.r.o.
E-mail: info@kanda.sk
Address: Prietržka 152, 908 49, Slovak Republic
13. Changes to This Policy
The Controller reserves the right to update this Privacy Policy at any time. Users will be informed of material changes by e-mail or through the RAVEN Hub software. The effective date of the current version is stated in the header of this document.
This Privacy Policy takes effect on 1 July 2026.