The matu.sk app is used for photographing accounting documents and sending them into the bookkeeping, for an overview of bank payments, for the mileage log, and for keeping in touch with the accountant. This page explains what the app processes, where it sends it, and how it is protected.
In effect from 15 October 2026
matu.sk, Sabinovská 362/5, 821 03 Bratislava
IČO: 50 756 893
E-mail: uctovnictvo@matu.sk
The app is not a public service. It is used by the matu.sk accounting office and its clients, who receive login details from it. Without an account on the office’s server, you cannot sign in to the app or do anything in it.
For the data on clients' documents, matu.sk acts as a processor: it processes the data for the client and on the client's instructions, under a data processing agreement. For the login credentials of an app user, it acts as a controller.
A photo or PDF of the document and the data the app reads from it: the supplier and the customer, the company ID, tax ID and VAT ID, dates, the document number, the variable symbol, the account number, amounts and the VAT breakdown, the individual items and all the text that could be read from the document. A document may also contain personal data, for example the name of a sole trader or an address. The app handles the document as it arrived; it deletes nothing from it.
If bank access has been set up for the company, or a statement is loaded into the app, the date, amount, currency, variable symbol, the counterparty's name and account number are processed. This serves one purpose: to match a payment with a document and show which document a payment is still missing for.
Your login name and password for the office's server. The password is kept exclusively in the phone's secure storage (Keychain) and is released only after verification by face, fingerprint or device passcode. It never leaves the device except to the office's server, at the moment you sign in.
The device location, including when the app is not on screen. The course of the route is recorded (coordinates, time, speed and kilometres travelled), and a trip also includes the registration number and vehicle details, the driver's name, the purpose of the journey, the start and destination, stops, costs and the meal allowance. The mileage log is a mandatory record under tax legislation and cannot be kept without a record of the route.
Location is tracked only while a trip is running. A trip is started manually, by tapping a tag in the car or by connecting to the car; once it has ended, the app no longer tracks location. While it runs, iOS shows a blue indicator in the status bar.
The text of questions and answers, and any attached image. They pass through the office server and stay with the document or the payment they concern. If the app takes a voice call from a website visitor, the call audio goes through it; the call is recorded on the visitor's side and transcribed into text so that a written record remains (the audio itself is deleted after transcription). The microphone only turns on once you accept the call.
If you allow notifications, an identifier that Apple assigns to the app (the device token) is stored on the office server. It serves one purpose only: to let you know that a question has come in or that something has finished. It contains no name and no phone number.
In the app, the accountant also sees her clients' payroll and contributions, the balances of their tax accounts and their preliminary VAT. This data is not created in the app: it is loaded from the office server and serves as an overview of what needs to be paid.
The choices you make in the app: the open month, the selected company, the appearance, the way files are named, reminders. They stay on the phone.
The app keeps an internal record of how it runs: times, error messages, file and company names. It is used to find the cause when the app gets stuck. It is only sent when you press “Send debug to NAS” in Settings, and it goes to the same server as the documents, nowhere else. It can be deleted from the same place.
The app communicates only with the services listed below. All communication is encrypted (HTTPS), and the app has no exception that would let the encryption be bypassed. All parties except Apple are based in the European Union. Apple is a US company, and this involves system services of the phone itself (notifications and maps); the transfer relies on the European Commission's adequacy decision on data protection in the US.
| Where | What goes there | Why |
|---|---|---|
| matu.sk server (NAS, Slovakia) |
The document as a PDF, the data read from it, the month’s list of documents, the login name; the debug log on request | This is the office's own accounting storage. The document belongs there, and without it the app would serve no purpose. |
| matu.sk map server (Slovakia) |
Points of the recorded route | Smoothing the route to follow the shape of real roads so it can be read on the map. It is the same office server, not an outside service. |
| Apple (notifications and maps) |
Device identifier and the notification text; when completing an address for a trip, the coordinates and the searched place name | Only Apple can deliver notifications to the phone. The map and place names are a system feature of the phone. |
| Open-Meteo (Germany) |
Coordinates of the starting point and the date of the trip | The weather that was on the route that day. Nothing is sent that could identify a person or a vehicle. |
| Overpass API (Germany, OpenStreetMap) |
Coordinates of a section of the route | Finding out whether the route went along a motorway or through town (fuel consumption and driving pace are calculated from this). |
| stkonline.sk (Slovakia) |
The vehicle registration number you enter yourself | Adding the VIN, make, model and the roadworthiness and emissions test dates from the public vehicle register. This happens only when you tap for it. |
| Register of Legal Entities (Statistical Office of the Slovak Republic) |
The IČO from the document | Adding the name and registered address of the company that issued the document. |
| eKasa of the Slovak Financial Administration | The identifier from the QR code on the cash receipt | Verifying the receipt directly with the tax authority. It returns the exact amounts and items, so we don't have to rely on reading them from a photo. It is sent only when the document has a QR code. |
| Register of Financial Statements of the Slovak Republic | The IČO from the document | Adding the name and tax ID of the company that issued the document. |
| VIES (European Commission) | The VAT ID from the document | Verifying whether the VAT ID is valid. |
| National Bank of Slovakia | Nothing, only the date | Downloading the exchange rate table for documents in a foreign currency. No personal data leaves in the process. |
| FIO banka (Czech Republic) |
The read-only token you enter yourself | Downloading the company's bank statement. Without a token entered it will not connect at all. The token is read-only: it cannot be used to make a payment. |
The matu.sk server is physically located in the Slovak Republic and is managed exclusively by the accounting office. It is not a third-party cloud.
Data from documents is processed because the Accounting Act and tax legislation require it, and in order to perform the bookkeeping contract, Article 6(1)(b) and (c) GDPR. Login credentials are processed in order to perform the contract and to secure access, Article 6(1)(b) and (f) GDPR.
Providing the data isn't voluntary in the sense that without a document there is nothing to book; the app is just one of the ways to get a document into the accounts.
You have the right to access your data, to have it corrected or deleted, to restrict its processing, to data portability, and the right to object. You can exercise these rights at uctovnictvo@matu.sk.
The right to erasure does not apply to documents that the office is required to keep under the Accounting Act: those can only be deleted once the statutory period has expired.
You can file a complaint with the Slovak Data Protection Authority (Úrad na ochranu osobných údajov SR), dataprotection.gov.sk.
The app is a work tool for bookkeeping and is not intended for anyone under 16. Children’s data is not deliberately processed.
Whenever something changes in the app that affects your data, this page changes too, along with the date at the top. The office notifies users directly of any significant changes.
Sections 01 to 10 mainly describe the iPhone version. This section applies to the Android version (package sk.matu.doklady). Who processes the data, for what purpose, your rights and how long data is kept are the same as above. Where Android differs from the iPhone, what is written in this section applies.
The password for the office server, the Fio bank read-only token, the e-invoice keys and the passwords of e-mail mailboxes are stored on the phone only in encrypted form, in the Android Keystore system storage. They are never stored as plain text. With biometric unlock switched on, the password is released only after verification by fingerprint, face or the device code. Backup of the app to Google and transfer of data between phones are switched off.
To the office server (a NAS in Slovakia) go: the document as a PDF and the data the app read from it, the list of bank movements, issued invoices and e-invoices, and the logbook (vehicles with their registration number, trips, places, kilometres and, for business trips, also the recorded route). The identifier of the car's bluetooth device that you assign to a vehicle is saved with the vehicle. On request, the debug log is also sent to the server.
Only on the phone stay the Fio bank read-only token, the app settings and unfinished documents until they are sent. Private trips are uploaded to the server only as a summary, without the recorded route.
Reading text from a photo of a document and reading QR codes happen directly on the phone. The photo is not sent to anyone else for recognition.
| Permission | What it is for | When it asks |
|---|---|---|
| Camera | Photographing documents with the app's own camera. The system document scanner needs no permission. | When you tap to take a photo. |
| Location (precise and approximate) | Recording the route and kilometres in the logbook. | When you start a trip or tap “Allow location”. |
| Background location (“Allow all the time”) | Optional only, for automatic trip start after connecting to the car while the app is closed. | Only when you switch on automatic trip start, after an explanation in the app. |
| Activity recognition | To tell whether you are walking or driving, so the app can offer a trip and detect its end. The phone evaluates it (Google Play services) and nothing is sent to us. | Only when the logbook has a use for it. |
| Nearby devices (bluetooth) | To detect that the phone has connected to the car assigned to a vehicle. The app does not search for or connect devices. | When you switch on automatic trip start. |
| Foreground service (location) | Keeps the route recording going while a trip runs, with a visible notification. | When a trip starts; it is not a question to the user but a system rule. |
| Notifications | Reminders for documents and taxes, upload progress and the notice that a trip is running. | When a company has a reminder set. |
| Biometrics | Unlocking the app with fingerprint or face and releasing the stored password. | At sign-in and unlock. |
In addition, the app uses ordinary system permissions: internet, network state, vibration and start after a phone restart (to restore reminders). The app does not ask for contacts, calendar, SMS, microphone, photo library or file access: you pick photos and files through the system picker. Every permission can be refused or withdrawn later in the phone settings; only that one thing then stops working.
All communication is encrypted (HTTPS). Besides the services from the table in section 03 that the Android version also uses (office server, map server, Open-Meteo, Overpass, stkonline.sk, the Register of Legal Entities, eKasa, VIES, the National Bank of Slovakia, FIO bank), these are added:
| Where | What goes there | Why |
|---|---|---|
| Google ML Kit (on the phone) | Nothing. Text and QR code recognition runs on the phone and the document does not leave it. Google may collect technical data about the use of the library; details: developers.google.com/ml-kit/android-data-disclosure. | Reading documents and QR codes (eKasa, payment QR). |
| Google Play services (on the phone) | Activity recognition (“walking” or “driving”) and the system document scanner. Processed on the phone. | Offering a trip and scanning documents. |
| OpenStreetMap (map tiles) | IP address, the map area you are viewing, and the app name. | Showing the trip map (osmdroid library). |
| System place search (Geocoder, on most phones Google) | The place name you search for, or coordinates. The phone's system sends them to its provider, not the app. | Choosing the trip place and finding the country of the trip. |
| Open-Meteo (Germany) | Coordinates of the trip start (rounded to about 11 metres) and the date of the trip. This is sent automatically when the logbook is opened, for trips that do not have weather yet, including private ones. | The weather during the trip. |
| Overpass API (OpenStreetMap) | Route points (at most 300). Only if you switch on “road classes”; it is off by default. | Finding out whether the trip was on a motorway or through a town. |
| stkonline.sk (Slovakia) | The vehicle registration number. Sent when a vehicle is entered and once a month when deadlines are refreshed. | Filling in vehicle data and the technical and emission inspection deadlines. |
| Peppol provider Verteco | The e-invoice (customer and supplier data) and the company key. | Sending and receiving e-invoices, only if the company uses e-invoices. |
| Financial Administration of the SR (open data) and the European Central Bank | The company ID number; for exchange rates only the date. | Filling in VAT numbers and tax IDs, and exchange rates. |
| The server of your mailbox (SMTP) | The e-mail with the invoice (PDF) and the mailbox login. Only if the company chooses its own mailbox; the connection is encrypted and the certificate is verified. | Sending an invoice by e-mail. |
| WhatsApp, SMS, Signal | A short text about sent documents through system sharing, only when you tap for it. | Letting the office know that the documents have been uploaded. |
The app does not use Firebase, contains no advertising or analytics libraries and sends nothing “home” to its author beyond the office's own servers.
All connections to the office server and to the services in the tables above use HTTPS (TLS). E-mails from your own mailbox are sent encrypted (STARTTLS or SSL) and the app always verifies the server certificate. The app does not allow unencrypted connections.
If anything in the app does not work, or you do not understand something, get in touch with the office:
E-mail: uctovnictvo@matu.sk
Phone: +421 904 343 950
Working days 8:00 – 17:00
Closing your account. Access to the app is set up by the office, so the office closes it too. Write to uctovnictvo@matu.sk and we will close the account. What happens to the data, and which documents have to be kept by law, is covered in sections 06 and 08 above.
Who publishes the app. The matu.sk mobile app is published by ACC-NET s.r.o., co-owner of matu.sk, IČO: 51 482 711, Sabinovská 362/5, 821 03 Bratislava. Data in the app is processed by the matu.sk accounting office as described in section 01.
We process the conversation and the data you enter in line with our privacy policy. We send the chat transcript to the accountant and, once you confirm your address, to you as well.