Privacy policy

Data controller

The controller of your personal data is Baumgart Software Services. Company details: Chełmińska 61a 86-070 Czarże, NIP: 5611582956. For anything related to personal data, write to support@baumgartsoftwareservices.pl.

What data we process

• Portal account data: name, e-mail address, phone, company, role and chosen language.
• Content of requests and messages, attachments, device data, estimates and their approvals, and time records.
• Technical data: IP address, browser information and event logs (sign-ins, errors) kept by our hosting, database and error-monitoring providers.
• The contact form on the home page: name, e-mail address, optionally company and phone, the message and a hash of your IP address (only to protect the form from spam, deleted after a day). If you e-mail us, we process the data in that correspondence.

Purposes and legal bases

• Running your account and handling service requests: performance of the contract with your company and our legitimate interest in contacting its staff (Art. 6(1)(b) and (f) GDPR).
• Billing and keeping billing records: legal obligation (Art. 6(1)(c) GDPR).
• Security of the website and the portal, detecting errors, spam and abuse: legitimate interest (Art. 6(1)(f) GDPR).
• Replying to contact form messages and other correspondence: legitimate interest (Art. 6(1)(f) GDPR) and, when you ask about our services, steps taken before entering into a contract (Art. 6(1)(b) GDPR).

Who processes data for us

The following providers process data on our behalf under data processing agreements:

• Supabase: database, sign-in and file storage, servers in Frankfurt (EU).
• Vercel: application hosting, functions running in Frankfurt (EU).

People working for Baumgart Software Services also have access, limited to the clients assigned to them.

Some providers are US companies. Where data leaves the European Economic Area, this is based on a European Commission decision (EU-US Data Privacy Framework) or standard contractual clauses.

How long we keep data

Account and request data is kept for the duration of the cooperation with your company and then until claims become time-barred. Billing records are kept for the period required by tax law. Contact form messages are deleted automatically after 12 months (the IP address hash after a day); if we continue by e-mail, that correspondence follows the same rules as other messages. Technical logs and error reports are deleted automatically, usually after a few days to a few weeks.

Your rights

You have the right to access, rectify, erase, restrict and port your data, and to object to processing based on legitimate interest. You can also lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw).

Cookies

We only use strictly necessary cookies: the sign-in session the portal stores after you sign in. We do not use analytics or advertising cookies.

Data in your company's systems

Where IT support gives us access to personal data in your company's systems (for example user accounts or e-mail), we process it as a processor on behalf of your company, under a data processing agreement.

Other information

Providing data is voluntary, but without it we cannot create a portal account or reply to a contact form message. We do not make automated decisions or profile anyone.