Privacy policy

1. The controller

The controller of personal data collected through bitperfect.pl is Sebastian Zabrzyski, trading as BitPerfect Sebastian Zabrzyski, address for correspondence: ul. Grunwaldzka 8A/15, 39-300 Mielec, Poland, VAT ID (NIP) 5862377082, business register number (REGON) 521142580, entered in the Polish Central Register and Information on Economic Activity (CEiDG).

Contact for anything concerning personal data, including the rights described in section 7: kontakt@bitperfect.pl, or by post to the address for correspondence above.

The Controller has not appointed a Data Protection Officer - the scale and nature of the processing do not trigger that obligation under Article 37 GDPR. Requests from data subjects are handled by the Controller directly.

2. Scope of the data processed

From the contact form, only what the user enters into it is processed:

• a name, or whatever designation the user chooses,
• the email address the reply is to be sent to,
• the content of the message.

The form has no other fields and attaches no data gathered in the background.

On every visit the server records ordinary technical details of the request in its log: IP address, date and time, the page requested, the response code, and the browser and operating system names.

On submission of the form, a hash of the IP address is additionally stored for the length of the rate-limit window. It serves only to reject further attempts from the same address and is not linked to anything else.

The site does not ask for special categories of data (health, beliefs, membership of organisations) and has no use for them - they should not be included in a message.

3. Legal bases for processing

• Answering an enquiry and carrying on the related correspondence - Article 6(1)(f) GDPR, the Controller's legitimate interest in handling enquiries addressed to the business.
• If the correspondence turns into talks about working together - Article 6(1)(b) GDPR, steps taken at the user's request prior to entering into a contract.
• Keeping the site running, diagnosing failures and defending it against abuse, including form spam - Article 6(1)(f) GDPR.
• Establishing, exercising or defending legal claims if the need arises - Article 6(1)(f) GDPR.

4. Retention periods

• The message from the form - until the correspondence on the matter is finished, and then for as long as follow-up questions may still come up or the correspondence may be needed to establish, exercise or defend legal claims; at the longest, until claims become time-barred.
• Server logs - for as long as needed to maintain and secure the site; they are overwritten by routine rotation.
• The hashed IP address used for rate limiting - for the length of the rate-limit window, after which the entry expires on its own.

5. Where a form message goes

The message goes to the company mailbox at kontakt@bitperfect.pl and stays there like any other email. It is not stored in any database - bitperfect.pl has no database. The form is a replacement for writing from one's own mail client, not a new data set.

Message contents are not written to the logs either. The only thing logged is the fact that a delivery failed, so that a lost enquiry can be noticed.

Mail is handled by the same server that runs the site. The message does not pass through an external mail provider or any intermediary service.

6. Recipients of the data

The data is not sold and is not shared with data brokers, ad networks or anyone for marketing purposes.

The only party processing this data on the Controller's behalf is the server provider: Webdock.io ApS, Asperup, Denmark - hosting for the site and its mail. The servers are located within the European Economic Area.

The data may also be disclosed to public authorities entitled to demand it under the law, strictly to the extent and in the manner those provisions require.

The data is not transferred to third countries or international organisations.

7. Rights of the data subject

In connection with the processing of the data, the user has the right to:

• access the data and obtain a copy of it (Article 15 GDPR),
• have inaccurate data corrected and incomplete data completed (Article 16 GDPR),
• have the data erased (Article 17 GDPR),
• have the processing restricted (Article 18 GDPR).

Right to object. Because the data is processed on the basis of a legitimate interest, the user has the right to object to that processing at any time on grounds relating to their particular situation (Article 21(1) GDPR). Following an objection the Controller will stop processing the data, unless compelling legitimate grounds can be demonstrated which override the interests, rights and freedoms of the data subject, or grounds for establishing, exercising or defending legal claims.

The right to data portability (Article 20 GDPR) does not apply here - it covers data processed on the basis of consent or a contract, and this data is processed on the basis of a legitimate interest. A copy of the data can of course still be obtained under the right of access.

Requests should be sent to kontakt@bitperfect.pl. The Controller will report the action taken within one month of receiving the request; where necessary that period may be extended by a further two months because of the complexity of the request, and the person concerned will be informed of the extension and its reasons.

Anyone who considers that their data is processed unlawfully has the right to lodge a complaint with a supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl. A complaint may also be lodged in the country of habitual residence, place of work, or the place of the alleged infringement.

8. Whether the data has to be provided

Providing the data is entirely voluntary, but without an email address and a message no reply can be sent. Simply browsing the site requires no data at all.

9. Automated decisions and profiling

The Controller does not take decisions about the user by automated means that would produce legal effects concerning them or similarly significantly affect them, and does not carry out profiling.

The only automated step is rejecting submissions that look like spam - based on a hidden field, how long the form took to fill in, and how many submissions came from one IP address. The mechanism does not assess personal characteristics, and its only effect is that one message is not accepted. In such a case the message can be sent to kontakt@bitperfect.pl directly instead.

10. Cookies

The site stores two cookies in the user's browser, both strictly necessary for the contact form to work:

• bitperfect-session - the session holding the token that protects the form against submission from another site (CSRF), and the confirmation shown after a message is sent,
• XSRF-TOKEN - the same token, in the form the page itself reads.

Both expire after two hours and are not used for tracking. The site uses no analytics cookies, no advertising cookies and no third-party cookies.

The site embeds nothing from other servers: fonts, images, styles and scripts are all hosted at this same address, so opening the page connects the browser to no server other than the Controller's.

Because both cookies are necessary to deliver the service the user asked for - sending a message - the law does not require consent for them, and the site shows no consent banner.

11. Security

The site is served exclusively over an encrypted connection (HTTPS). The number of messages that can be sent from a single IP address is limited, and the Controller is the only person with access to the mailbox they arrive in.

12. Changes to this policy

If the way data is processed changes, a new version of this policy will be published at this address together with its date. The date of the version in force is given at the top of the document.

Controller details

BitPerfect Sebastian Zabrzyski
Address for correspondence: ul. Grunwaldzka 8A/15, 39-300 Mielec, Polska
NIP 5862377082 · REGON 521142580
kontakt@bitperfect.pl