Last updated: 6 August 2026

Sumly is operated by Drivly Ltd (registration no. HE474043), Eleftheriou Venizelou 48, 8022 Paphos, Cyprus. Sumly does your books, which means we handle some of your most sensitive business data. This policy explains what we collect, why we collect it, where it lives, and the rights you have over it under the EU General Data Protection Regulation (GDPR).

What we collect

Account details — your name, email address, company name and registration details, and the settings you choose in Sumly.
Transaction data — when you connect a bank account, we receive your transaction history and balances through licensed, read-only open-banking providers. We never see or store your bank login credentials, and we can never move your money.
Receipts and documents — invoices, receipts and other records you upload or forward to Sumly so we can match them to your books.
Usage analytics — basic information about how you use the product and this website, so we can fix problems and improve Sumly.

Why we collect it

We use your data to:

keep your books — categorising transactions, matching receipts, reconciling accounts
prepare your filings — VAT returns, VIES declarations and IP Box calculations
answer your questions and provide support
keep Sumly secure, reliable and improving

We do not use your data for anything unrelated to running Sumly for you.

Legal bases

We process your data on the following GDPR legal bases:

Contract — most processing is necessary to provide the service you signed up for.
Legal obligation — some records must be kept to comply with accounting and tax law.
Legitimate interests — keeping the service secure and improving it, in ways that do not override your rights.
Consent — where we ask for it explicitly, such as connecting a bank account. You can withdraw consent at any time.

Where your data lives

Your data is hosted in the European Union. It is encrypted in transit and at rest. Access within our team is limited to what is needed to run the service and support you.

Who we share it with

We never sell your data. We share it only with the subprocessors we need to run Sumly:

licensed open-banking and financial-data providers, to fetch your transactions
cloud hosting and infrastructure providers
payment processors, to handle your subscription

Each subprocessor is bound by a data-processing agreement and receives only the data it needs to do its job.

How long we keep it

We keep your data while your account is active. Accounting records may need to be retained for the period required by Cyprus law (generally six years) even after you close your account. Beyond what the law requires, we delete or anonymise your data when you ask us to or when your account is closed.

Your rights

Under the GDPR you have the right to:

access the personal data we hold about you
correct data that is inaccurate
have your data erased
receive your data in a portable format
object to or restrict certain processing

To exercise any of these rights, email contact@sumly.cy. You also have the right to lodge a complaint with the Office of the Commissioner for Personal Data Protection in Cyprus.

Cookies and analytics

We use a small number of cookies to keep you signed in and to run privacy-friendly analytics on this website. We do not use cross-site advertising trackers, and we do not share analytics data with ad networks.

Changes to this policy

If we change this policy in a meaningful way, we will update the date at the top and let you know by email or inside the product before the change takes effect.

Contact

Questions about this policy or your data? Email contact@sumly.cy or write to Drivly Ltd, Eleftheriou Venizelou 48, 8022 Paphos, Cyprus.

Privacy Policy