Privacy Policy
This document describes how Sciomagis d.o.o. (“Sciomagis”, “we”, “us”) collects, processes, and protects Personal Data in connection with the Sky.Flow platform (“the Platform”). It can be printed for reference using the print command in your browser.
Last updated: May 2026.
Sky.Flow is a business-to-business (B2B) document management and business process platform. The content stored and processed within the Platform — documents, invoices, purchase orders, workflow records, KPI data, and similar — is business data owned by the customer organization. It is not personal data of individual users.
Personal Data processed by the Platform is limited to what is necessary to operate user accounts, provide the service, and maintain security and audit trails.
When a user account is created, the following data is collected:
This data is necessary for the performance of the service agreement.
To protect user accounts and detect unauthorized access, the Platform records the following data when users log in, log out, or when a login attempt fails:
This data is accessible to:
The legal basis for this processing is legitimate interest (Article 6(1)(f) GDPR) — specifically, the security of user accounts, detection of unauthorized access, and protection of the Platform.
Security log data is retained for 12 months and is automatically deleted thereafter.
The Platform may collect technical data generated during use, such as page requests and error logs. This data is used exclusively for service operation, maintenance, and troubleshooting.
The Platform uses session cookies strictly necessary for authentication and maintaining the user session. No tracking cookies, analytics cookies, or third-party advertising cookies are used.
| Data category | Legal basis | GDPR Article |
|---|---|---|
| Account data | Performance of contract | Art. 6(1)(b) |
| Business content | Performance of contract (data processor role) | Art. 6(1)(b) |
| Security logs | Legitimate interest (security) | Art. 6(1)(f) |
| Usage / system logs | Legitimate interest (service operation) | Art. 6(1)(f) |
For Account Data and Security Logs, Sciomagis acts as the data controller — we determine the purpose and means of processing this data.
For Business Content stored within the Platform (documents, workflow records, KPIs, and similar), Sciomagis acts as a data processor on behalf of the customer organization, which is the data controller. Business content is processed solely as instructed by the customer organization and in accordance with the service agreement.
Customer organizations using the Platform are responsible for ensuring that any personal data they upload or process through the Platform complies with applicable data protection laws, including obtaining any necessary consents from data subjects.
The Platform infrastructure is hosted on Amazon Web Services (AWS) in the EU West (Ireland) region. All data — including user accounts, business content, and security logs — is stored and processed within the European Union.
Data is not transferred outside the European Economic Area (EEA), with the following exception:
Disaster recovery backups: For business continuity purposes, encrypted backups of business content (documents and files) may be stored in AWS US East (Virginia). These backups are encrypted at rest, accessible only to Sciomagis platform administrators, and covered by the EU-US Data Privacy Framework. User account data, security logs, and database records are not included in off-region backups and remain exclusively within the EU.
Third-party services used:
| Service | Provider | Purpose | Location |
|---|---|---|---|
| Cloud infrastructure | Amazon Web Services | Hosting, storage, compute | EU (Ireland) |
| Email delivery | Amazon SES | Transactional email (notifications) | EU (Ireland) |
| OCR processing | Amazon Textract | Document text extraction (optional) | EU (Ireland) |
| Disaster recovery | Amazon S3 | Encrypted backup of business content | US (Virginia) |
| Data category | Retention period |
|---|---|
| Account data | Duration of the service agreement; deleted upon account closure |
| Business content | As determined by the customer organization; deleted upon contract end |
| Security logs | 12 months, then automatically deleted |
| System / error logs | 90 days |
When an account is closed or a user requests deletion, personal data is masked or removed in accordance with the Sciomagis GDPR procedure. Business content retention and deletion is the responsibility of the customer organization.
Under the GDPR, users have the following rights regarding their Personal Data:
To exercise any of these rights, contact us at: davorinanton.dumancic@sciomagis.com
Requests will be addressed within one month.
Sciomagis implements appropriate technical and organizational measures to protect Personal Data, including:
Sciomagis reserves the right to update this privacy policy at any time. Users will be notified of material changes through the Platform or by email. The date of the last update is shown at the top of this document.
It is recommended to review this page periodically.
For any questions regarding this privacy policy or the processing of your Personal Data:
Sciomagis d.o.o. — Kolodvorska 34, 10410 Velika Gorica, Croatia — VAT: HR41324938444
EN