Privacy Policy

1. Data controller

The data controller is SYSDEVOPS.EU Jarosław Karsznia, ul. Zbożowa 5/34, 81-020 Gdynia, Poland, Tax ID (NIP): 5871592779.

Contact: [email protected]

2. Analytics - Umami

The public website (landing page and CVE catalog) uses Umami Analytics - a web analytics tool that does not use cookies and does not collect personal data. Umami processes only anonymized statistical data (device type, country, visited pages, clicks on links such as "Start free trial"). Using Umami does not require user consent under GDPR or the Polish Telecommunications Law.

Analytics tracking runs only on the public website (landing page and CVE catalog). The login panel and the dashboard for authenticated users do not include this script.

3. Cookies

This public CVE catalog does not use any tracking or marketing cookies. The login panel (outside the scope of this page) may use session cookies necessary for authentication - this is a separate part of the application and not the subject of this policy.

4. Trial account users

When you register for a free trial we process the data you provide (email address) and account data needed to deliver the Service, on the basis of performing the agreement (GDPR Art. 6(1)(b)). After moving to a paid plan, we also process billing data to fulfil our legal obligations - issuing invoices and keeping accounting records (GDPR Art. 6(1)(c)).

5. Registration IP address (anti-abuse)

At registration we store the IP address from which the account was created (signupIp). We use it solely to prevent abuse of open registration - for example to limit mass automated account creation from a single address. The legal basis is our legitimate interest in protecting the Service (GDPR Art. 6(1)(f)).

6. Partner programme applications

The partner programme form collects: full name, e-mail address, type of applicant (certifying auditor or consultant), and optionally company name, a link to a public profile (LinkedIn or website) and a free-text note. We also store the exact wording of the consent you ticked, the time it was given, the IP address the form was sent from and the language of the page.

The application data is processed on the basis of your consent (GDPR Art. 6(1)(a)), given in order to review the application and contact you about it. You can withdraw the consent at any time by writing to [email protected]; withdrawal does not affect the lawfulness of processing before it. The IP address is stored on the basis of our legitimate interest (GDPR Art. 6(1)(f)) - it caps the number of applications sent from one address.

Retention: a rejected application is deleted in full 90 days after the decision, or 90 days after it was submitted if no decision date was recorded. An application still awaiting a decision stays in the queue until it is decided. An accepted application is kept for as long as the account created on its basis exists - it is the basis of that account and the record of what exactly was consented to. The IP address is erased 90 days after the form was sent, regardless of the status of the application.

A notification about a new application goes to the operator by e-mail (Resend) and as a Telegram message (Telegram Messenger Inc.). It contains the name, e-mail address, type of applicant and, if given, the company and the profile link.

7. Data recipients (processors)

To deliver the Service we use the following processors who may process account data on our behalf:

• Resend (Resend, Inc., USA) - sending transactional emails (account verification, notifications). Data processed: email address. Transfer to the USA takes place under the appropriate GDPR safeguards (standard contractual clauses / Data Privacy Framework).
• OVHcloud (OVH SAS, region - Warsaw, Poland) - storage of encrypted backups. Backups are encrypted (restic) before being sent, so OVHcloud has no access to the data in plaintext.
• Error reporting (GlitchTip) is self-hosted on our own server in Poland - not a separate third-party processor. Error reports may contain technical data needed for diagnostics.
• Hosting infrastructure: OVHcloud (OVH SAS), servers located in Warsaw, Poland.

8. Data retention

Personal data is stored for the following periods:

• Account data (email address) - for the duration of the Service (while the Account is maintained) and until the limitation of any claims arising from the agreement;
• Billing and accounting data - for the period required by tax law (5 years from the end of the tax year in which the payment deadline fell);
• Registration IP address - for the period necessary for security and anti-abuse purposes, no longer than 12 months from registration or until an effective objection is raised.
• Rejected partner programme application - 90 days from the decision (or from submission, if no decision date was recorded), then deleted in full;
• Accepted partner programme application - for as long as the account created on its basis exists;
• IP address the partner programme form was sent from - 90 days from sending, regardless of the status of the application.

9. Your rights

Under GDPR (Articles 15–21) you generally have the right to access, rectify, erase, restrict processing of, and port your personal data, the right to object to processing (in particular against processing based on our legitimate interest, e.g. storing the IP address), as well as the right to lodge a complaint with the supervisory authority - the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland.

In practice, these rights do not apply to the analytics data described above: Umami does not collect any personal data, so there is no personal data of yours for us to access, rectify, or delete in this context.