Privacy policy

This policy explains what data we collect through the contact form and for visit statistics, why, on what legal basis, and how we protect it. We keep it plain and true to how our site actually works.

Data controller

The controller of your data is Marian Szenfeld SoftwareStorm (a sole proprietorship registered in Poland), based in Gliwice, Poland, EU VAT PL6312692117.

For any matter concerning your personal data, write to contact@softwarestorm.eu.

What data we collect and why

Through the contact form we collect only the data you enter in it:

• your name (or company name),
• email address,
• inquiry type,
• your message.

We use it solely to respond to your inquiry and to correspond with you about it. Providing the data is voluntary, but without it we cannot reply.

Solely to protect the form against abuse, we also process an irreversible hash of the IP address the message was sent from. We use the hash only to protect the form: to count submissions in a single day, and to tie the task the form solves in the background to your browser. We do not store the IP address itself: it is not written to our logs, it is not kept alongside your message, and the hash is made with a key we do not disclose, so the address cannot be recovered from it.

Separately from the form, we collect visit statistics for the site. We describe them under “Analytics and cookies”.

Legal basis

• Legitimate interest: handling your inquiry (Article 6(1)(f) GDPR) — replying to your message and our correspondence about it.
• Legitimate interest: protecting the form (Article 6(1)(f) GDPR) — the IP address hash described above.
• If your inquiry concerns potential cooperation, we also process the data to take steps at your request before entering into a contract (Article 6(1)(b) GDPR).
• Legitimate interest: visit statistics (Article 6(1)(f) GDPR) — knowing which pages people read, where visitors come from, and how many of them send the contact form. We use this to improve the site and our offer. Details under “Analytics and cookies”.

We do not make automated decisions about you and we do not profile you.

Who we share data with

Your message reaches us as an email, and on the way it passes through two providers.

Scaleway (a French cloud provider) handles site hosting, the software behind the form, and email delivery (Transactional Email). This stage runs on Scaleway servers in the European Union.

Proton AG runs the mailbox your message lands in. Proton is based in Switzerland, which lies outside the European Economic Area. Switzerland is, however, covered by a European Commission decision recognising an adequate level of data protection (Article 45 GDPR) — and that decision is the basis on which we transfer your data to Proton.

Apart from these two providers, we do not share the data you enter in the form with anyone. We do not sell your data and we do not use it for marketing. Separately from the form, visit data goes to the provider of our analytics server, and its backups go to Scaleway — we describe this under “Analytics and cookies”.

How long we keep data

We keep your message for as long as needed to handle your inquiry. If it does not lead to cooperation, we delete the data no later than 12 months after our last contact. We keep it longer only where required by an agreed engagement or by applicable law.

The IP address hash we use to protect the form against abuse is kept for no longer than 3 days and is deleted automatically.

Visit data, described under “Analytics and cookies”, is kept for 13 months and then deleted automatically. That is what we need to compare the same month year on year. Backups of the analytics database are deleted automatically 90 days after they are made, so deleted data may remain in backups for that long.

Analytics and cookies

For visit statistics we use Umami, an analytics tool that does not use cookies and itself stores nothing on your device. For each page view, and when the contact form is sent, it records an event together with:

• the address and title of the page visited, without any parameters after the “?” and “#” characters,
• the address of the page you came from, also without those parameters,
• browser type, operating system, device type, screen resolution and browser language,
• approximate location: country, region and city, derived from your IP address,
• the time of the event.

The tool does not store your IP address in the statistics database. The server that receives visit data does, however, limit the number of requests from a single IP address to protect the statistics against abuse, and for that limit it keeps the IP address in memory until the server is next restarted. To tell one person’s page views apart from other people’s, the server derives a pseudonymous session identifier from your IP address, your browser description and a secret key. We do not disclose the key, so your IP address cannot be recovered from the identifier. The identifier stays the same at most until the end of the calendar month. From the first day of the next month the same visits produce a different identifier, so it does not link visits from different months. It applies to our site only and is not used to track you on other sites. We do not combine it with other data to find out who you are. We use visit data for aggregate statistics.

You can object to visit statistics (Article 21 GDPR) without writing to us: just turn on the switch below. From then on, the site sends no data about your visits from this browser on this device, including from tabs you already have open. We store your choice in your browser’s storage as a single flag, and only when you turn the switch on yourself. Turning the switch off removes the flag. The flag also disappears when you clear this site’s data in your browser, so turn the switch on again after such a clean-up. We cannot link data collected before you turned it on to you, so we delete it together with the rest after the period described under “How long we keep data”.

The tool also respects the Do Not Track setting, if your browser still offers it: when it is on, the site sends no visit data at all. Apart from the objection flag, we store nothing on your device, so our site shows no cookie banner and uses no marketing or tracking cookies.

The tool runs on a server we maintain ourselves, hosted by Euronodes (a company registered in Cyprus) in a data centre in Lisbon. Backups of the analytics database are kept in Scaleway storage in Warsaw. Visit data never leaves the European Union.

Your rights

You have the right to:

• access your data and receive a copy,
• rectify (correct) your data,
• erase your data,
• restrict processing,
• object to processing based on our legitimate interest; you can object to visit statistics right away with the switch under “Analytics and cookies”.

The right to data portability applies where we process the data on the basis of a contract, or of steps taken before entering into one (Article 6(1)(b) GDPR), and by automated means.

To exercise these rights, write to contact@softwarestorm.eu. You also have the right to lodge a complaint with the supervisory authority — in Poland, the President of the Personal Data Protection Office (PUODO).

Policy changes

If we change how we process data, we will update this policy. You will find the date of the last change at the top of the page.