Privacy Policy.

Effective 14 September 2026. Last updated 14 September 2026. English translation of the Slovak original; in case of conflict the Slovak version prevails.

This document explains how the Toprya service (https://toprya.com) collects, uses and shares information when you visit the website, click a listing or pay for a position. It applies together with the Terms of Use.

Who is responsible

The controller of personal data processed through the Service is Nethek, s.r.o., M. R. Štefánika 2414/9, 984 01 Lučenec, Slovakia, company ID 52799832, VAT ID SK2121135753.

E-mail: info@toprya.com

What we collect

We keep the Service small. We collect only what we need to run the leaderboard, take payments, prevent abuse and understand traffic.

Anonymous visitor identifier: When a page is viewed and when a listing is clicked we create a one-way fingerprint (SHA-256) from your IP address, browser string and a secret key that changes every day. We store only this fingerprint — not the IP address or browser string. It powers the “online” and “visits today” counters and limits repeated clicks. It cannot be reversed to a person or linked across days. No cookie is used for it.
Listing and payment data: The website address you enter, the category, the amount for the position and the public name, description and favicon we retrieve for that website. We store Stripe payment confirmation identifiers (Checkout Session, Payment Intent), the amount, currency, status, confirmation time and invoice number so that we can assign the position.
Payment details: Card details and billing identity are collected by Stripe, not by us. Stripe sends us a confirmation that you paid and the amount. See Stripe’s privacy policy.
Clicks: When you go from the leaderboard to a company website we record the listing, the time and the anonymous visitor fingerprint. One visitor counts once per company per day. This limits fake clicks; it is not used to profile you.
Technical data: Standard request data such as browser type, referring page and IP address may be processed briefly by our web server for operation and security of the Service.
Messages you send us: If you e-mail us a notice, a category change request or a personal data request, we keep the correspondence as needed to respond and to keep a legal record.

Cookies

We use a single technical session cookie that protects forms (CSRF) and shows messages after submission. We use no advertising or analytics cookies and do not track you across websites. Traffic is counted without cookies as described above. We therefore do not ask for cookie consent.

Why we use this data

Performance of a contract. Taking the payment, creating or topping up the listing, showing the position and providing the service you asked for.
Legitimate interest. Fairness of the leaderboard (limits, bot filtering), display of public listing metadata, traffic measurement, resolving outages and defending legal claims. You may object to processing based on legitimate interest as described below.
Legal obligation. Keeping tax and accounting records and records of complaints where the law requires it.

Public listings

The position, amount paid, name, logo, description and website link on the leaderboard are public. Anyone can see them, including search engines. If you do not want this information shown, do not add the website. We retrieve public metadata from the website you enter so that visitors recognise it; during this retrieval the target website learns that Toprya requested the page.

Who we share data with

Stripe — payment processing, payment confirmation and invoicing.
Google — company favicons are loaded by your browser from a Google service; Google sees your IP address and the domain whose logo is loaded.
Hosting and database — the infrastructure the Service runs on.
Professional advisers, public authorities or an acquirer of the Service — if we must share data to comply with the law, enforce the Terms or transfer the project.

We do not sell your personal data. Some processors may be outside the European Economic Area. Where we rely on them we use appropriate safeguards, such as standard contractual clauses or an equivalent mechanism they provide.

How long we keep data

Anonymous visit and click records are deleted after 90 days; only the click count per company remains on the leaderboard.
Public listings remain while the listing is on the leaderboard and may remain for a limited time in backups or activity history after withdrawal.
Payment identifiers, amounts and invoices are kept as long as needed for accounting, tax, fraud prevention and dispute resolution (generally 10 years under accounting rules).
Technical server logs are kept for at most 30 days.

Your rights

If the GDPR or a similar law applies to you, you may ask us for access to the personal data we hold about you, for its rectification, erasure or portability, for restriction of processing, or object to certain processing. You may also lodge a complaint with a supervisory authority — in Slovakia the Office for Personal Data Protection of the Slovak Republic — or in your country of residence.

Write to info@toprya.com. We may need enough information to find your data. Public listing content that is also on your own website does not become private by appearing on the leaderboard; you may however ask us to withdraw the listing.

Children

The Service is intended for adults. We do not knowingly collect personal data of children. If you believe a child has used the Service, contact us and we will delete the data we can identify.

Changes

We may update this document when the Service or the law changes. The date at the top of the page marks the current version. For a material change we publish the updated wording here.