Privacy notice

The developer and licensor of Confirmatica, and the controller for the processing described in this notice, is Bonfleur s.r.o., a company registered in Czechia. Its company number is IČO 28169166. It can be reached about privacy through the enquiry form at /request-access, which is the only contact channel this site offers; we publish no e-mail address. No data protection officer has been appointed; privacy questions sent through that form are answered by a person.

What this notice covers: visiting this website, and sending us an enquiry through it (section 2). That is the whole of it.

What it does not cover. Confirmatica is licensed software, used by audit firms to obtain external confirmations. A licensee deploys it on their own infrastructure and is the operator and controller of that instance — its client data, the people it writes to, the documents it receives back and the resulting audit evidence are the firm's, held on the firm's systems. We are neither controller nor processor for any of it, and none of it reaches us. Section 3 says where to take a question about that.

The showcase at this domain runs on synthetic demonstration data — invented firms, invented counterparties, invented balances. No real audit engagement runs here.

Confirmatica is not sold self-serve, so the first thing we hold about most people is an enquiry submitted at /request-access.

• What we collect: your name, work e-mail address, audit firm name and country, and — only if you choose to give them — a phone number and free-text context. Those six fields are the whole form.
• Why: to assess the enquiry, to reply to you, and — if it goes further — to arrange a demonstration and discuss a licence.
• Legal basis: Art. 6(1)(b) GDPR, taking steps at your request prior to entering into a contract, and Art. 6(1)(f) GDPR, our legitimate interest in assessing and answering enquiries from prospective business customers. You may object to the latter at any time (section 7).
• Whether you have to: you do not, but without a name, work e-mail and firm name we cannot evaluate the request or reply to it.
• Automated decisions: none. Every access request is read and decided by a person; there is no scoring, profiling or automated rejection anywhere in this flow.

If you received a link because you are a company director asked to authorise the release of information, or a bank or counterparty asked to confirm a balance, the audit firm named in that letter is the controller, not us. It decides who is contacted and why, and it runs the deployment that sent it.

Confirmatica is licensed software. The firm named in that letter deploys it on its own infrastructure and is the operator and controller of that instance; we are neither its controller nor its processor, and the information you send there does not reach us. Bonfleur supplies the licence, customization and maintenance, and nothing on this website is connected to that firm's deployment.

Every letter and e-mail carries that firm's own legal identity and contact details. Use those to ask why you were contacted, or to exercise your rights over that processing. A request sent to us instead cannot be actioned by us — we do not hold the data — so we will tell you that and point you to the firm named on your letter.

• Our hosting provider, which runs this website and stores the enquiries sent through it.
• Our network provider, which fronts this website and filters abusive traffic.
• Our e-mail provider, which transmits what we send in reply to an enquiry.
• Server logs: our hosting provider keeps standard request logs (IP address, timestamp, URL) for reliability and abuse investigation. We also count requests per IP address to rate-limit the public forms; that counter stores the address only as a keyed one-way digest, and stale rows are deleted.
• Transfers outside the EEA: where a provider processes data outside the EEA, we rely on the Article 46 safeguards in our agreement with that provider.

We do not sell personal data, we do not use it for advertising, and we do not share it with other customers.

This site runs no analytics, no advertising technology and no third-party scripts of any kind. There is no consent banner because there is nothing to consent to beyond what is strictly necessary to sign you in.

Access requests are kept while we assess the request and while we remain in contact with your firm about it. The period after which we delete them is 12 months from the decision on the request. No scheduled deletion job runs today, so removal is a manual act — ask us and we will do it.

Accounts live as long as your firm keeps you as a member.

One record we cannot erase. The platform keeps an integrity record of significant actions, including the submission of an access request, which we are not able to edit or delete — that inability is what makes it worth keeping. So we keep your e-mail address out of it: what it holds for an access request is the firm name you gave and a keyed one-way digest of the address, which lets us confirm that an entry concerns an address you name to us without the address itself being stored there. The readable address stays only on the access request itself, which we can and do delete.

Backups. We keep up to 30 daily database backups and a 7-day point-in-time-recovery window, and a superseded version of a stored file for 90 days, so deleted data can persist in backups for a period after the live record is gone.

Under the GDPR you may ask us for access to your personal data, for rectification of anything inaccurate, for erasure, for restriction of processing, for a portable copy, and you may object to processing we base on legitimate interests — including, at any time and without giving a reason, to being contacted by us about the product. We rely on no consent for anything described here, so there is none to withdraw.

Send the request through the form at /request-access — say which right you are exercising and give the e-mail address the data concerns, so that we can find it. We answer within one month and will tell you if the request needs longer or if an exception applies — for example the record described in section 6 that we cannot erase.

If the data was given to an audit firm rather than to us — you signed an authorisation, or answered a confirmation request — send the request to that firm, whose identity and contact details are on the letter or e-mail you received (section 3).

You may also complain to a data protection supervisory authority, in particular in the EU or EEA country where you live, where you work, or where you believe the problem occurred. Bonfleur s.r.o. is registered in Czechia, so for the processing described here that authority is the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů, ÚOOÚ).

Questions, or a rights request: use the form at /request-access. We publish no e-mail address; the form is the contact route, and a person reads it. Company number: IČO 28169166. The registered seat is not published here; it is recorded against that number in Commercial Register kept by the Municipal Court in Prague (Městský soud v Praze), Section C, File 130229, which is the authoritative source for it.

If we change how we handle personal data we will update this page and change the date at the top. Material changes affecting people with accounts are also notified to their firm.

These terms govern your use of this public website only. Like the rest of this page, they are a protective draft pending review by counsel, and they change nothing said above about personal data. By accessing or using this website you accept these terms. If you do not accept them, please do not use the site.

Who operates this website. This website is operated by Bonfleur s.r.o., a company registered in Czechia, whose registered name states its legal form: s.r.o. — společnost s ručením omezeným, a Czech limited liability company. Its company number (IČO) is IČO 28169166, and it is entered in Commercial Register kept by the Municipal Court in Prague (Městský soud v Praze), Section C, File 130229, where its registered seat is recorded — this site is a showcase rather than a place of business, so the seat is identified by register entry rather than reprinted here. It can be reached directly through the form at /request-access, which a person reads; no e-mail address is published. These particulars are given so that the provider of this site can be identified and contacted, as the European rules on information-society services and § 435 of the Czech Civil Code require.

Exhibits, screenshots and demonstration data. Every screen, letter, working paper and figure shown on this site is an illustrative exhibit captured against a fictional demonstration tenant. The audit firm, the client companies, the counterparties, the balances, the dates, the references and the statuses in them are invented for demonstration. They are not any real client, counterparty, engagement or result; no connection with any real person or institution is intended or implied; and they are neither a representation nor a warranty of what any firm's own output, figures, timings or response rates will be.

Operator and intellectual property. All content on this site — text, exhibits, marks, design and software — belongs to Bonfleur s.r.o. or its licensors, and viewing the site grants no licence to any of it.

Informational purposes only; no offer, no reliance. The content of this site is provided for general information. Nothing on it is professional, audit, accounting, tax or legal advice, and nothing on it is an offer capable of acceptance, a proposal to contract, or a commitment of any kind. No contract, engagement or professional relationship arises from your use of this site or from an enquiry sent through it; a contract arises only when Bonfleur s.r.o. and the other party have signed a written agreement. Do not rely on the site's content for any decision, and in particular for any audit, accounting, financial, legal or purchasing decision.

The software. Confirmatica is licensed software. A licence agreement with Bonfleur s.r.o. governs its use, and a licensee deploys and operates its own instance on its own infrastructure — access to that instance is granted by the licensee, not by us, under whatever terms the licensee sets for its own people, client signers and counterparties. Those written agreements — not these website terms — govern the software and any deployment of it. Where anything on this site differs from a written agreement, the written agreement prevails, and nothing on this site adds to, varies or waives it. The showcase at this domain, and every exhibit shown on it, runs on synthetic demonstration data.

Portals. The signer and responder portals may be used only by the addressee of the corresponding correspondence, and only for the purpose that correspondence states. Unauthorised access, probing or interference is prohibited.

No warranties. The site is provided "as is" and "as available", without warranties of any kind, express or implied, to the maximum extent permitted by law. We do not warrant that it will be available, uninterrupted or free of error, or that its content is complete, current or accurate.

Limitation of liability. To the maximum extent permitted by applicable law, Bonfleur s.r.o. is not liable for any damages arising from use of, or inability to use, this site, including lost profit, lost data, business interruption and any indirect or consequential loss, however arising and whether or not the possibility was known to us. Nothing in these terms excludes or limits liability that cannot be excluded or limited under Czech law — including harm caused intentionally or by gross negligence, and harm to a person's natural rights.

Who this site is for. Confirmatica is licensed to audit firms, and this site addresses them and other businesses rather than consumers. Where a mandatory consumer-protection rule nevertheless applies to a reader, these terms do not restrict the rights it gives them.

Links and third-party names. Where this site links to a site we do not operate, we are not responsible for its content. Any third-party name or mark mentioned belongs to its owner and is used only to describe how the platform works; it implies no endorsement, affiliation or partnership.

Availability and changes. We may change, suspend or withdraw this site or any part of it at any time and without notice, and we are under no duty to update anything on it. We may also update these terms; the date at the top of this page states when its texts last changed, and the version published at the time of your visit is the one that applies to that visit.

Severability and waiver. If any provision of these terms is held invalid or unenforceable, the remainder stays in force and that provision is replaced by the valid one closest to its purpose. A delay in enforcing a provision is not a waiver of it.

Governing law and venue. These terms are governed by Czech law, and the courts of the Czech Republic have exclusive jurisdiction over any dispute arising from them.