Data controller and contact
Your data controller is Soft-Yoo Piotr Kosmala, registered address: ul. Malechowska 10, 78-111 Sianożęty, Poland, tax identification number (NIP): 6711769643. The business operates the Kaldrix website. For questions about your data, write to [email protected] or the registered address.
We have not appointed a Data Protection Officer. You can contact the controller directly about any privacy matter.
The data we receive and its source
- Earlier newsletter subscriptions: email address, consent time, wording and version, language, subscription source and email channel. The data comes from an earlier optional subscription. The form currently accepts no new addresses. We do not store IP addresses as consent evidence.
- Correspondence: your email address, your message and any data you include in it.
- Website operation and security: technical data from your device and connection, such as your IP address, browser type, request date and time, and the page address visited. Server logs may process this data independently of a newsletter subscription.
- Privacy settings: your analytics choice, the settings version, and the time the choice was saved and expires, stored in your browser.
- Analytics: with your consent, Google Analytics collects browser identifiers and data about visits, your device, approximate location, scrolling, clicks to other websites and file downloads. We do not send it the email address entered in the newsletter form or the form contents.
We do not obtain newsletter address lists from other parties. Newsletter consent and analytics consent are independent.
Why we use data
| Purpose | Data | Legal basis |
|---|---|---|
| Emails about the Kaldrix launch and important product updates | Email address and subscription information | Your consent — GDPR Article 6(1)(a). Commercial emails require prior consent under Article 398 of the Polish Electronic Communications Law. |
| Demonstrating consent while you are subscribed | Email address, time, wording, version, language, source and consent channel | The obligation to demonstrate consent — GDPR Article 6(1)(c), read with Article 7(1). |
| Replying to a message | Email address, correspondence and data you include | GDPR Article 6(1)(b) when you request steps before entering a contract. For other matters, Article 6(1)(f); our legitimate interest is handling correspondence. |
| Website security and correct operation | Technical data and server logs | GDPR Article 6(1)(f); our legitimate interest is protecting the website and its visitors. |
| Remembering your analytics choice | A setting stored in your browser | GDPR Article 6(1)(f); our legitimate interest is respecting your choice. The necessary storage of this setting falls under Article 399(3) of the Polish Electronic Communications Law. |
| Measuring traffic and improving the website | Google Analytics data | Your consent — GDPR Article 6(1)(a), and Article 399 of the Polish Electronic Communications Law for access to information on your device. |
| Establishing, pursuing or defending claims relating to correspondence or website operation | Data relevant to the matter | GDPR Article 6(1)(f); our legitimate interest is protecting legal rights. |
| Answering product questions and handling support requests | The message and contact or account data needed for the matter | GDPR Article 6(1)(b) for contract matters. For other matters, Article 6(1)(f); our legitimate interest is handling questions and requests. We meet legal obligations under Article 6(1)(c). |
AI assistant in the help window
In the help window, we use an AI assistant to answer questions about Kaldrix and handle support requests. AI answers can be wrong; check them before use. Do not include passwords, access tokens or unnecessary personal data about other people.
We process the content of your request, email address, company name, account or company identifiers and the address of the page concerned to provide support. The request and page address may contain personal data. Authorised support staff and providers of communication and AI services may access these data as necessary.
We keep conversations in the help window for 14 days. We do not use their content to train models or share it for that purpose. The application privacy policy describes separate retention rules for data needed to handle a matter, meet legal obligations or deal with claims.
Ask [email protected] about recipients, processing locations, retention periods and safeguards for a particular transfer.
The application privacy policy also explains account and project data, processing grounds and your rights. You can send data requests to the controller at the address above.
Who may receive data
Parties helping us operate the website may use data to the extent needed for their service:
- OVHcloud — website hosting and our newsletter database in the Warsaw region (Poland), and email services; the hosting location does not mean every subcontractor processes data only in Poland,
- Cloudflare — routing traffic to the website and protecting it against attacks; this service may process connection and request data, including when you submit the form,
- email service providers and providers of tools used for the newsletter,
- Google Ireland Limited and Google entities involved in providing Google Analytics, including Google LLC in the United States — only if you consent to analytics,
- legal or technical advisers when needed to handle a matter or protect legal rights,
- public authorities when disclosure is required by law.
Data outside the European Economic Area
Website hosting and our newsletter database are configured in OVHcloud's Warsaw region in Poland. This does not mean all email and security services operate only in Poland or the European Economic Area.
Cloudflare and its subprocessors may process connection and request data outside the EEA, including in the United States. If you consent to analytics, Google and its subprocessors may also process analytics data outside the EEA, including in the United States.
Such transfers require a basis under Chapter V of the GDPR. Cloudflare's processing terms and Google's data processing terms describe processing rules and transfer safeguards, including standard contractual clauses. For information about the terms for a particular recipient and how to obtain a copy of safeguards, write to [email protected].
How long we use data
- Newsletter: until you withdraw consent, unsubscribe, or communications about the launch and product updates end. Unsubscribing removes the active address from the list and its stored consent evidence.
- Correspondence: until the matter is resolved, and then for as long as needed to establish, pursue or defend related claims.
- Technical data and logs: for as long as needed for security and incident handling, then deleted or anonymised.
- Privacy settings and cookies: for the period in the table above or until earlier deletion.
- Analytics data: in Google Analytics, we have set event data retention to 2 months and user data retention to 14 months. Resetting the user identifier's retention period on new activity is enabled. Each new event associated with that identifier starts its 14-month period again, so regular activity may keep it for longer than 14 months from the first visit. Google deletes data covered by retention on a monthly cycle. These settings do not apply to standard aggregated reports, which may remain available longer. Cookie expiry is separate from this retention. See Google Analytics documentation for details.
Your rights
Subject to the GDPR, you may request access to your data, a copy, rectification, erasure or restriction of processing. Where processing is based on consent or a contract and is automated, you may have a right to data portability.
You can withdraw newsletter or analytics consent at any time. This does not affect the lawfulness of earlier processing.
Where we rely on legitimate interests, you may object on grounds relating to your particular situation. If data is processed for direct marketing, you may object to that purpose at any time without giving reasons.
To exercise your rights, write to [email protected]. We will respond without undue delay, normally within one month. If an extension is needed under the GDPR, we will tell you and explain why.
You can complain to the President of the Polish Personal Data Protection Office — uodo.gov.pl — or another competent supervisory authority in the EU or EEA, particularly where you habitually live or work, or where the alleged infringement occurred.
Automated decisions
We do not make decisions about you based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect you.
Policy changes
We may update this policy when website features, data processing or providers change. New rules apply for the future. If a significant change to newsletter data use requires a separate notice or new consent, we will provide it before starting that processing. The current version and date are available on this page.