Privacy policy

The controller of the data of DoPusk Service Users is Sergey Panphilov, Kąty Grodziskie 19B/39, 03-289 Warszawa, kontakt@dopusk.pl. (For Employee data entered by the User — see point 8: processing entrustment.)

Account data: first name, surname, email address, company data (if provided). Technical data: access logs, IP address, device type — to the extent necessary for operation and security.

Providing the service (Art. 6(1)(b) GDPR); security and logs (Art. 6(1)(f) — legitimate interest); legal obligations, e.g. donation accounting (Art. 6(1)(c)).

Account data — for the duration of using the Service and until any claims become time-barred. Logs — up to 12 months.

Infrastructure providers (hosting) with which processing agreements are concluded. Data is not sold. The Service uses no profiling or third-party advertising cookies.

The Service uses only essential files (session, preferences, including language and theme choice). No marketing cookies and no profiling. Visit statistics for the public pages are aggregate and cookie-free (Cloudflare Web Analytics) — no user profile is created. Fonts are hosted locally — no requests to external CDNs.

Access, rectification, erasure, restriction, objection, data portability, and a complaint to the President of the UODO. Handled via: kontakt@dopusk.pl.

Employee data entered by the User is processed by the Operator as a processor on behalf of the User (the controller of that data). The rules are set out in the Data Processing Agreement (DPA) — see the separate document.

Data is stored in the EEA; there are no transfers to third countries. (Should the infrastructure provider change — appropriate safeguards under Art. 46 GDPR will be ensured.)

Field-level encryption of sensitive data, an audit log, document checksums — details on the Security page.