Privacy policy

Who is responsible for your data

The data controller is LuKas Holdings sp. z o.o., registered in Warsaw, Poland.

Address

ul. Stefana Batorego 18/108, 02-591 Warsaw, Poland

KRS

0001233010

Tax ID

7011306806

REGON

544397097

Data contact

kontakt@berc.pl

What data we collect

The "Book a call" form

First name, e-mail address, phone number and the service you pick. Optionally a website address, a Polish tax ID and a company name.

Tax ID

When you enter a tax ID we fetch the company name from the public VAT taxpayer register run by the Polish Ministry of Finance. Only the number itself is sent there.

The website audit form

The website address, your e-mail address and the report language, plus the report we prepare about the site. For the free audit limits we store a hash of your IP address, from which the address itself cannot be read, and your e-mail address in a normalised form. We do not store the IP address itself.

Payments

When you order the full report or monitoring: your name or company name, address, tax ID and e-mail address for the invoice. Card and other payment details are seen only by Stripe; we receive only the payment status and amount.

Report opens

When someone opens a report we store the date, the country (derived by Cloudflare from the IP address, which we do not store), the device type and the browser.

Recruitment

The data in the CV and messages you send to our e-mail address.

Correspondence

The content of your message and your contact details when you write to us.

Site statistics

Aggregate visit and click data, without cookies and without identifying individuals.

Why, and on what legal basis

Contact and offer

We answer your request and prepare for the call. Basis: steps before entering a contract and our legitimate interest (Article 6(1)(b) and (f) GDPR).

Website audit

We prepare the report you ordered, send you an e-mail with its link and answer questions about the results. Basis: the contract for an electronically supplied service (Article 6(1)(b) GDPR).

Protection against abuse

Limits on free audits (IP hash, e-mail address, domain) and a check that a human sends the form. Basis: our legitimate interest in protecting the service from abuse (Article 6(1)(f) GDPR).

Payments, invoices and monitoring

We settle the order, issue the invoice and run the monthly audit under monitoring. Basis: the contract and our obligations under tax and accounting law (Article 6(1)(b) and (c) GDPR).

Site statistics

We see which pages and features are used, so we can improve them. Basis: our legitimate interest (Article 6(1)(f) GDPR).

Recruitment

We run the recruitment process. Basis: labour law and your consent for any extra data (Article 6(1)(a), (b) and (c) GDPR).

Defence against claims

We keep correspondence for as long as we need it to protect our rights. Basis: Article 6(1)(f) GDPR.

How long we keep data

Contact form submissions

Up to 12 months from the last contact, unless we start working together.

Audit reports

A free report and the form data: 12 months from the last audit. A paid report: 24 months. With monitoring on, for as long as it runs, then on the same terms. We delete a report sooner if you ask.

IP hash and report opens

We delete the IP hash after 30 days and the records of report opens after 12 months.

Invoices and client data

For the term of the contract and the period required by tax and accounting law (usually 5 years from the end of the year the invoice was issued).

Recruitment

Until that recruitment ends, or with your consent up to 12 months for future openings.

Who processes data for us

Only the people on our team handling your case see the data. We use providers that process data on our behalf. Some of them operate outside the European Economic Area; data goes there under the European Commission's standard contractual clauses or an adequacy decision (the EU-US Data Privacy Framework).

Hosting and database

Cloudflare, Inc. (United States). The site runs on the Cloudflare network, and audit reports and the audit form data are stored in a Cloudflare D1 database. The contact form is not stored: it reaches us straight away as an e-mail.

Form protection

Cloudflare Turnstile (Cloudflare, Inc.). On the /audit page it checks that a human sends the form; your browser contacts a Cloudflare server for this.

E-mail

Resend (Plus Five Five, Inc., United States). It delivers the contact form to us and sends you the report and monitoring e-mails.

Payments

Stripe Payments Europe, Limited (Ireland). It handles the payment, the monitoring subscription and the invoice details. Payment takes place on Stripe's page, which has its own privacy policy and cookies.

Site statistics

PostHog, Inc.; data stored in the European Union (PostHog EU Cloud, Frankfurt). It counts visits and clicks without cookies and without storing anything in your browser. The IP address is used only to count unique visits and is not stored.

Tax ID register

The Polish Ministry of Finance VAT register. If you enter a tax ID, we ask the public register for the company name. We send it none of your personal data.

What you can do

Access and a copy

You can ask what data we hold about you and receive a copy.

Correction and deletion

You can correct the data or ask us to delete it. We delete an audit report on request sent to kontakt@berc.pl.

Restriction and objection

You can restrict processing or object to it where we rely on legitimate interest.

Portability

You can receive the data in a format you can hand to another controller.

Withdrawing consent

At any time, without affecting processing that already happened.

Complaint

To the President of the Polish Data Protection Authority, ul. Stawki 2, 00-193 Warsaw.

Cookies and statistics

The site uses no cookies and stores nothing in your browser: not for tracking, not for advertising, not for statistics. We collect visit statistics with PostHog in cookieless mode; the data passes through our own server, so your browser does not contact PostHog for it. We do not record sessions or build profiles of individuals. Fonts are served from our own server as well.

Exceptions: the /audit page runs Cloudflare Turnstile, which contacts a Cloudflare server, and payment takes place on Stripe's page with its own cookies. The only cookie on our site is set by the admin panel, which only our team uses.

An audit report is an automated analysis of a website, not of a person. We make no automated decisions about you and we do not profile you.

Changes to this policy

When we change how we process data, we update this page and the date at the top. Earlier versions are available on request.