Privacy Policy

1. Data controller

The controller is CODEFLUXION sp. z o.o., registered office at ul. Pamiątkowa 2/18, 61-512 Poznań, Poland, entered in the register of entrepreneurs of the National Court Register kept by the District Court Poznań – Nowe Miasto i Wilda in Poznań, 8th Commercial Division of the National Court Register under KRS 0001096213, EU VAT PL7831900709, REGON 528158689, share capital PLN 5,000.00.

For any data protection matter, write to hello@codefluxion.com.

We have not appointed a Data Protection Officer — none of the conditions in Article 37 GDPR applies. Requests are handled directly by the management board.

2. Where the data comes from

On this website, personal data reaches us through exactly four channels:

E-mail contact

You write to the address published on the site. We process whatever the message contains: name, e-mail address, company details, job title and the content of your enquiry.

Governance scorecard (Microsoft Forms)

The self-assessment form is hosted in Microsoft Forms. We process your answers and any contact details you choose to provide in it.

Analytics (Google Analytics 4)

Only after you accept in the consent banner. Covers a truncated IP address, a cookie identifier, pages viewed, referral source, device and browser type, and on-page interaction events.

Hosting logs

Our hosting provider records standard request logs (IP address, timestamp, URL, user agent) to keep the site available and secure.

3. Purposes and legal bases

Answering your enquiry and business correspondence

Article 6(1)(b) GDPR (steps prior to entering into a contract) and Article 6(1)(f) GDPR (legitimate interest in conducting business correspondence).

Processing the governance scorecard and returning your result

Article 6(1)(a) GDPR (consent given by completing and submitting the form) and Article 6(1)(f) GDPR (legitimate interest in qualifying enquiries).

Website analytics

Article 6(1)(a) GDPR — consent only. Without consent analytics never starts and the Google script is not even downloaded.

Keeping the site secure and available

Article 6(1)(f) GDPR (legitimate interest in protecting our infrastructure against abuse and failure).

Performing a contract and meeting accounting and tax obligations

Article 6(1)(b) GDPR (performance of a contract) and Article 6(1)(c) GDPR (legal obligation under Polish accounting and tax law).

Establishing or defending legal claims

Article 6(1)(f) GDPR (legitimate interest).

4. Retention periods

Business correspondence that did not lead to an engagement

24 months from the last contact, unless you object earlier.

Governance scorecard responses

24 months from submission.

Analytics data in Google Analytics 4

14 months (the configured user- and event-level data retention), after which it is deleted automatically.

Hosting logs

Up to 30 days, per the provider’s retention policy.

Accounting and billing records

5 years from the end of the year in which the tax obligation arose.

Data needed to defend claims

Until the applicable limitation period expires.

5. Recipients

We do not sell personal data and we do not share it with third parties for their own purposes. We do use providers who process data on our behalf under data processing agreements:

• Vercel Inc. — hosting and content delivery (request logs).
• Google Ireland Limited — Google Analytics 4, only after consent.
• Microsoft Ireland Operations Limited — Microsoft 365 (e-mail, Microsoft Forms, document storage).
• Our accounting firm and legal advisers — to the extent needed for billing and legal support.
• Competent public authorities — only where the law requires it.

6. Transfers outside the European Economic Area

Some of the providers listed above belong to groups headquartered in the United States, which means data may be transferred outside the EEA.

Transfers rely on the European Commission’s adequacy decision of 10 July 2023 on the EU–US Data Privacy Framework (for providers certified under it) and, in addition, on the European Commission’s Standard Contractual Clauses together with supplementary technical and organisational measures.

We will provide a copy of the safeguards in place on request sent to hello@codefluxion.com.

7. Your rights

In relation to this processing you have the right to:

• access your data and obtain a copy (Article 15 GDPR),
• rectify inaccurate or incomplete data (Article 16 GDPR),
• erasure (Article 17 GDPR),
• restriction of processing (Article 18 GDPR),
• data portability (Article 20 GDPR),
• object to processing based on legitimate interest (Article 21 GDPR),
• withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal (Article 7(3) GDPR).

8. How to exercise your rights

An e-mail to hello@codefluxion.com is enough. We respond without undue delay and in any case within one month of receiving the request.

You can withdraw analytics consent yourself, instantly — the “Cookie settings” link sits in the footer of every page.

9. Complaint to a supervisory authority

If you believe we process your data unlawfully, you may lodge a complaint with the Polish supervisory authority:

President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl.

You may also lodge a complaint with the supervisory authority in your own EU or EEA country of residence or work.

10. Is providing data mandatory?

Providing data is voluntary. Without contact details, however, we cannot answer an enquiry or send a proposal. Completing the scorecard and accepting analytics are entirely optional and do not affect access to any content on the site.

11. No profiling, no automated decisions

We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR). Analytics is used only for aggregate assessment of site traffic.

12. Security

We apply technical and organisational measures proportionate to the risk: encryption in transit (HTTPS), multi-factor authentication on our services, least-privilege access control, backups, and confidentiality undertakings for everyone with access to data.

13. Cookies

Cookies and browser storage are covered by a separate Cookies Policy, linked from the footer.

14. Changes to this policy

We update this policy whenever the scope of processing or the set of tools used on the site changes. The current version is always published at this address, with the date of the last update shown at the top.