Legal
Privacy policy
In short: this site sets no cookies, runs no analytics and loads nothing from third parties. The only personal data we process is what you send us (a message, an email address) and the technical logs our hosting provider keeps for security. We never sell or share your data for marketing. Everything is processed under the EU General Data Protection Regulation (GDPR).
1. Controller
The controller of your personal data is Ethicalc spółka z ograniczoną odpowiedzialnością, ul. ks. Leona Miszewskiego 18/2C, 80-239 Gdańsk, Poland, KRS 0001241947, NIP 9571202612, REGON 544803812. Contact for all data-protection matters: contact@esap.pro. We have not appointed a data protection officer, as the law does not require one for our processing.
2. What we process, why, and on what legal basis
| Situation | Data | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|---|
| You visit the site | Server logs: IP address, date and time, page requested, referring page, browser and device type | Security, abuse prevention, troubleshooting | Art. 6(1)(f) — our legitimate interest in running a secure site | Up to 90 days, then deleted or anonymised |
| You write to us (form or email) | Name, email address, company, LEI if given, the content of your message, our reply | Answering your message; preparing a proposal if you ask for one | Art. 6(1)(b) — steps prior to a contract at your request; otherwise Art. 6(1)(f) — our legitimate interest in replying to correspondence | For the duration of the correspondence and up to 3 years after the last message, for evidence in case of claims; longer if a contract follows (then as required by accounting and tax law) |
| You ask to be notified about a tool or update | Email address | Sending the one notification you asked for | Art. 6(1)(a) — your consent, which you can withdraw at any time by writing to us | Until the notification is sent and you are offered to opt out, or until you withdraw consent, whichever is earlier |
| You become a client | Contact and contract data; files you provide for the agreed work | Performing the contract; invoicing; legal obligations | Art. 6(1)(b) and Art. 6(1)(c) | Contract data for the limitation period of claims; accounting records as required by law (in Poland, 5 years from the end of the financial year); files provided for an audit are deleted after delivery unless you ask us to keep them |
Providing data is voluntary, but without an email address we cannot reply to you, and without the data needed for a contract we cannot perform it.
3. Cookies and tracking
esap.pro does not set cookies, does not use web analytics, advertising or social-media plug-ins, and does not embed fonts, scripts or images from third-party servers. We do not profile visitors and make no automated decisions about you. If this ever changes, we will update this policy before the change takes effect and, where the law requires it, ask for your consent.
4. Who processes data on our behalf
We use a small number of service providers, under data-processing agreements, only to the extent needed:
- Amazon Web Services (Amazon Web Services EMEA SARL, Luxembourg) — hosting of the site and of our systems, in a data-centre region located in the European Union.
- Google Workspace (Google Cloud EMEA Limited, Ireland) — our email and document service. Messages you send us are stored there. Google may process data in locations outside the European Economic Area; such transfers rely on the European Commission's adequacy decision for the EU–US Data Privacy Framework and, where applicable, on standard contractual clauses, under Google's data-processing terms.
We may also disclose data where the law obliges us to (for example, to a court or public authority) or to professional advisers bound by confidentiality. We do not sell personal data and do not share it with anyone for their own marketing.
5. Transfers outside the EEA
Other than the Google Workspace processing described above, we do not transfer personal data outside the European Economic Area. Where a transfer is necessary, we rely on an adequacy decision of the European Commission or on standard contractual clauses with additional safeguards.
6. Your rights
Under the GDPR you have the right to access your data; to have it rectified or erased; to restrict its processing; to receive it in a portable format where processing is based on consent or a contract; to object to processing based on our legitimate interests; and to withdraw consent at any time without affecting the lawfulness of processing before withdrawal. To exercise any of these rights, write to contact@esap.pro. We reply within one month, extendable by two further months for complex requests, in which case we tell you.
You also have the right to lodge a complaint with a supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl. You may also complain to the authority of the EU country where you live or work.
7. Security
The site is served over HTTPS only. Access to our mailbox and systems is limited to people who need it, protected by strong authentication, and logged. Files received for an audit are kept in access-restricted storage in the EU and deleted after delivery unless you instruct otherwise.
8. Children
The site is addressed to companies and professionals. We do not knowingly collect data from children under 16.
9. Changes
We update this policy when our processing changes. The version and effective date appear at the top of this page; earlier versions are available on request.