Effective from: 24 August 2026
1. General Provisions
- This Privacy Policy sets out the rules for the processing of personal data in connection with the use of the e-toolkit.app website, the shop.e-toolkit.app store, user accounts, SaaS applications, forms, plugins, subscription services and other services offered as part of e-toolkit.
- This Policy applies in particular to persons who:
- visit e-toolkit websites,
- contact us through forms or by e-mail,
- create an Account,
- make purchases,
- use a Subscription or Trial Period,
- use SaaS applications,
- use technical support,
- subscribe to the newsletter,
- represent business customers or act as contact persons on behalf of customers.
- The Controller processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (“GDPR”), applicable Polish law, including the Act of 12 July 2024 – Electronic Communications Law, and security principles appropriate to the nature of the services provided.
2. Personal Data Controller
The personal data controller is:
Centrum Programowania Dawid Skibiński
Knieja 5/1
88-190 Barcin
Poland
Tax ID (NIP): 5621717984
REGON: 523576637
e-mail: contact@e-toolkit.app
hereinafter referred to as the “Controller”.
For matters concerning the processing of personal data or the exercise of rights under the GDPR, you may contact the Controller at:
3. Categories of Personal Data Processed
Depending on how e-toolkit is used, the Controller may process in particular:
- first and last name,
- company name,
- e-mail address,
- telephone number,
- correspondence address or business address,
- Tax ID (NIP) and other data required for accounting documents,
- data related to the user Account,
- user and Subscription identifiers,
- information about purchased products and services,
- payment and transaction status information,
- Trial, Subscription, licence and product activation information,
- correspondence content,
- technical support request content,
- information about the technical environment provided in connection with a support request,
- IP address,
- device, browser and operating system information,
- data contained in system and security logs,
- information about the use of the Website or applications,
- information about consents given and withdrawn,
- data voluntarily provided by the user in forms or while using the services.
The Controller processes only the data necessary for specific purposes.
4. Contact Forms and Correspondence
Data provided through contact forms, e-mail or other communication channels may be processed for the purposes of:
- responding to an enquiry,
- providing information about products or services where requested by the user,
- taking steps at the request of the data subject prior to entering into a contract,
- conducting correspondence,
- establishing, pursuing or defending possible claims.
The legal basis for processing is:
- Article 6(1)(b) GDPR – where correspondence concerns entering into or performing a contract,
- Article 6(1)(f) GDPR – the Controller’s legitimate interest in conducting communication, handling enquiries and protecting against claims.
Data relating to ordinary correspondence may generally be retained for up to 12 months from the end of the correspondence, unless:
- the enquiry resulted in the conclusion of a contract,
- further retention is necessary to establish, pursue or defend claims,
- a longer retention period is required by law.
5. User Account
Where the use of a particular service requires the creation of an Account, user data is processed for the purposes of:
- creating and maintaining the Account,
- enabling login,
- managing services and Subscriptions,
- providing access to purchased products,
- handling licences,
- communicating in connection with the Account,
- ensuring Account security.
The legal basis for processing is Article 6(1)(b) GDPR – performance of a contract or taking steps prior to entering into a contract.
Account-related data is processed for the duration of the Account and, after deletion, may be retained to the extent necessary for:
- settlements,
- compliance with legal obligations,
- security purposes,
- establishing, pursuing or defending claims.
6. Purchases, Contracts and Service Delivery
Customer data is processed for the purposes of:
- accepting and fulfilling orders,
- entering into and performing contracts,
- delivering Plugins, Digital Content or Digital Services,
- activating licences,
- enabling the use of SaaS,
- providing Subscription services,
- providing technical support,
- processing settlements,
- communication regarding the service being provided.
The legal basis for processing is Article 6(1)(b) GDPR.
Where applicable law requires the Controller to process certain data, in particular for accounting, tax or transaction documentation purposes, the legal basis is also Article 6(1)(c) GDPR.
7. Invoices, Accounting and Tax Obligations
Data contained in invoices, accounting documents and payment-related documents is processed for the purposes of:
- keeping accounting records,
- issuing accounting documents,
- fulfilling tax obligations,
- complying with invoicing requirements,
- demonstrating the correctness of settlements before competent authorities.
The legal basis for processing is Article 6(1)(c) GDPR.
Documentation is retained for the period required by tax, accounting and invoicing regulations, including until the expiry of applicable retention periods and limitation periods for tax liabilities.
8. Payments – Stripe
Payments for e-toolkit products and services may be processed by the external payment provider Stripe.
In connection with payment processing, the Controller may provide to or receive from the payment provider data necessary to process a transaction, including in particular:
- first and last name,
- e-mail address,
- billing details,
- payment amount and currency,
- order identifier,
- Customer identifier,
- transaction identifier,
- payment status information,
- Subscription information.
Payment instrument data is processed in accordance with the rules applied by the payment provider.
In certain situations, Stripe may act as a processor processing data on behalf of the Controller, while in other situations it may act as an independent controller, particularly in relation to payment security, fraud prevention and compliance with legal obligations applicable to the payment provider.
The legal basis for the Controller’s processing of data in connection with payments includes in particular:
- Article 6(1)(b) GDPR – performance of a contract,
- Article 6(1)(c) GDPR – compliance with legal obligations,
- Article 6(1)(f) GDPR – transaction security, prevention of abuse and the establishment, pursuit or defence of claims.
9. Subscriptions
Where the Customer uses a service under a Subscription model, the Controller processes data for the purposes of:
- activating the Subscription,
- collecting and settling recurring payments,
- monitoring Subscription status,
- providing access to features assigned to a particular plan,
- sending information concerning payments, renewals, cancellations or payment issues,
- terminating or modifying the Subscription.
The legal basis for processing is Article 6(1)(b) GDPR.
Data relating to settlements may also be processed under Article 6(1)(c) GDPR to the extent required by the Controller’s legal obligations.
10. Trial Period
Where a Trial Period is used, data may be processed for the purposes of:
- activating the Trial,
- providing access to service functionality,
- monitoring the Trial duration,
- preventing abuse of free Trial mechanisms,
- converting to a paid Subscription where the user has chosen such an option,
- communication relating to the Trial.
The legal basis for processing is Article 6(1)(b) GDPR and, with respect to preventing abuse, Article 6(1)(f) GDPR.
11. Plugins, Licences and Activations
Where use of a Plugin requires licence activation or communication with e-toolkit systems, the Controller may process in particular:
- licence identifier,
- domain or installation address,
- licence status information,
- Plugin version,
- technical information necessary for licence and update handling,
- activation date and date of last communication with the licensing system.
This data is processed for the purposes of:
- activating the licence,
- verifying the Customer’s entitlements,
- delivering updates,
- providing features dependent on an active plan,
- protecting against unauthorised licence use,
- technical diagnostics.
The legal basis for processing is Article 6(1)(b) GDPR and, with respect to preventing abuse and ensuring security, Article 6(1)(f) GDPR.
12. Use of SaaS
In connection with the use of SaaS applications, the Controller may process data concerning:
- Account users,
- Account settings,
- features used,
- logins,
- technical activity,
- service configuration,
- reports and errors,
- Subscription and plan,
- security.
The data is processed for the purpose of performing the contract and providing access to SaaS under Article 6(1)(b) GDPR.
Technical data and logs may additionally be processed under Article 6(1)(f) GDPR for the purposes of:
- ensuring security,
- maintaining service continuity,
- diagnosing errors,
- preventing abuse,
- protecting infrastructure,
- establishing, pursuing or defending claims.
13. Data Processed in SaaS on Behalf of the Customer
In certain SaaS services, the Customer may enter personal data relating to their own customers, employees, contractors, users or other persons.
In such cases, depending on the nature of the particular service:
- the Customer may remain the controller of such data,
- e-toolkit may act as a processor processing personal data on behalf of the Customer.
The rules governing such processing are set out in a Data Processing Agreement – DPA – where such an agreement is required.
The Customer is responsible for having an appropriate legal basis for entering personal data of third parties into e-toolkit services and for fulfilling the applicable information obligations towards such persons.
This Privacy Policy does not replace a Data Processing Agreement.
14. Data After Termination of SaaS Use
After termination of a Subscription or service, access to data stored in SaaS may be restricted.
Unless the terms of the particular service, contract or DPA provide otherwise, data may be retained for up to 30 days after termination of the service for the purpose of enabling reactivation, export or technical completion of the service.
After this period, data may be deleted or anonymised unless:
- further retention is required by law,
- continued retention is necessary for security purposes,
- the data is required to establish, pursue or defend claims,
- the DPA or an individual agreement provides for a different retention period.
15. Technical Support and Error Reports
Data provided as part of technical support may be processed for the purposes of:
- handling a support request,
- identifying the problem,
- diagnosing errors,
- communicating with the Customer,
- performing the contract,
- ensuring service security.
The Controller may receive information concerning the Customer’s environment, configuration, software versions, domain, error messages or other technical information provided by the Customer.
The Customer should not provide the Controller with personal data of third parties, confidential data or access credentials beyond the extent necessary to resolve the issue.
The legal basis for processing is Article 6(1)(b) and Article 6(1)(f) GDPR.
16. Newsletter and Marketing Communications
Where a user subscribes to the e-toolkit newsletter, the Controller processes their e-mail address and information relating to the consent given for the purpose of sending information about:
- e-toolkit products,
- updates,
- new functionalities,
- educational materials,
- promotions,
- e-toolkit services and offers.
The newsletter may be operated using the Controller’s own IT systems or messages may be sent directly by the Controller.
The legal basis for the processing of personal data for the purpose of operating the newsletter is the user’s consent – Article 6(1)(a) GDPR.
Commercial and marketing communications by electronic means are sent only after obtaining the user’s prior consent in accordance with applicable provisions of Polish Electronic Communications Law.
The user may withdraw consent at any time, in particular by using the unsubscribe option indicated in the message or by contacting the Controller at:
Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.
Newsletter data is processed until consent is withdrawn or the newsletter is discontinued.
Information concerning the granting and withdrawal of consent may be retained for the period necessary to demonstrate compliance with the law and to protect against possible claims.
17. System Logs and Security
When using the Website and applications, IT systems may automatically record technical information, including in particular:
- IP address,
- date and time of connection,
- device type,
- operating system,
- browser type and version,
- address of the requested resource,
- error information,
- login information,
- session identifiers,
- other technical data necessary to ensure security.
This data is used for the purposes of:
- administering infrastructure,
- diagnosing errors,
- ensuring security,
- detecting abuse,
- preventing attacks,
- ensuring service stability,
- determining the circumstances of incidents.
The legal basis for processing is Article 6(1)(f) GDPR – the Controller’s legitimate interest.
Logs are retained for a period justified by technical and security requirements, generally no longer than 12 months, unless a particular record is necessary to investigate an incident, protect against abuse or pursue claims.
18. Cookies and Similar Technologies
e-toolkit services use cookies and similar technologies.
The use of cookies and similar technologies is governed in particular by Polish Electronic Communications Law and, where personal data is processed, by the GDPR.
Cookies may be used in particular for the purposes of:
- ensuring proper operation of the Website,
- maintaining user sessions,
- ensuring security,
- remembering preferences,
- operating the Account and shopping cart,
- processing purchases,
- conducting statistics and analytics – after obtaining the required consent,
- conducting advertising and marketing activities – after obtaining the required consent.
Cookies and similar technologies necessary to provide a service requested by the user may be used without additional consent to the extent permitted by applicable law.
Analytics, advertising, marketing and other technologies requiring consent are activated only after such consent has been obtained.
The user may change or withdraw their consent at any time through the cookie settings available on the Website.
Withdrawal of consent should be as easy as granting it.
Detailed information concerning the cookies used, their providers, purposes and retention periods is provided in the Cookie Policy and in the consent management panel.
19. Google Services – Analytics and Advertising
The Controller uses Google services for analytics, tag management, advertising and measuring the effectiveness of advertising activities.
For Google services provided to users located in the European Economic Area, the relevant service provider may in particular be Google Ireland Limited, in accordance with the rules applied by Google.
19.1. Google Analytics 4
e-toolkit services use Google Analytics 4 for the purposes of:
- compiling statistics concerning use of the Website,
- analysing traffic,
- analysing how users use the Website,
- measuring Website effectiveness,
- improving the functionality and usability of the Website.
Google Analytics may process in particular information concerning:
- pages visited,
- time and manner of using the Website,
- approximate location of the user,
- device,
- operating system,
- browser,
- interactions with the Website,
- identifiers used by the Analytics service.
Google Analytics is launched and managed through Google Tag Manager.
Google Analytics is used to the extent requiring consent only after such consent has been obtained.
The legal basis for the processing of personal data for this purpose is Article 6(1)(a) GDPR.
The user may change or withdraw consent at any time through the cookie settings available on the Website.
19.2. Google Ads
The Controller uses Google Ads for the purposes of:
- running advertising campaigns,
- measuring campaign effectiveness,
- measuring conversions,
- analysing advertising effectiveness,
- conducting remarketing and personalised advertising – where the user has provided the relevant consent.
Depending on the consent given, the data may include in particular information concerning:
- visits to the Website,
- interaction with an advertisement,
- completion of a specific action or conversion,
- device,
- browser,
- identifiers used by Google advertising services.
Google Ads technologies requiring consent are used only after such consent has been obtained.
The legal basis for processing personal data in this respect is Article 6(1)(a) GDPR.
The user may change or withdraw consent at any time through the cookie settings available on the Website.
19.3. Google Tag Manager
The Controller uses Google Tag Manager for the technical management of tags and scripts used on the Website, in particular Google Analytics 4 and Google Ads.
Google Tag Manager itself is not used by the Controller to create user profiles or conduct behavioural analytics.
The scope of data processing is determined primarily by the tools launched through Google Tag Manager and by the user’s consent settings.
20. Consent Management
The Controller uses a consent management mechanism allowing the user to decide whether optional cookies and similar technologies may be used.
The user may in particular:
- accept all optional technologies,
- reject optional technologies,
- consent only to selected categories,
- change or withdraw consent at a later time.
In the case of Google services, information concerning the user’s choices may be communicated to Google services using consent management mechanisms, including Google Consent Mode.
The Controller may retain information concerning consents granted or withdrawn for the purposes of:
- respecting user choices,
- ensuring compliance of the Website with applicable law,
- demonstrating that consent was obtained where required.
21. Source of Personal Data
As a rule, the Controller obtains personal data directly from the data subject.
In the case of business customers, data may also be provided by:
- an employer,
- a co-worker,
- a contractor,
- another person representing the relevant organisation.
Such data may include in particular:
- first and last name,
- job title,
- business e-mail address,
- business telephone number,
- information concerning the represented organisation.
In such cases, the data is processed primarily for the purpose of contact and cooperation on the basis of the Controller’s legitimate interest – Article 6(1)(f) GDPR.
22. Recipients of Personal Data
Personal data may be disclosed to entities supporting the Controller in conducting its business, including in particular:
- hosting, server and cloud infrastructure providers,
- e-mail service providers,
- IT system providers,
- entities providing infrastructure maintenance and security services,
- providers of customer support and technical support tools,
- payment operators, in particular Stripe,
- Google – in connection with Google Analytics 4, Google Ads and Google Tag Manager, in accordance with user settings and consents,
- accounting offices or entities providing accounting services,
- legal, tax or other professional advisers,
- entities authorised to receive data under applicable law.
Entities acting on behalf of the Controller process data under appropriate agreements and only to the extent necessary to perform the tasks entrusted to them.
Some entities, in particular payment operators or providers of certain external services, may act as independent controllers to a certain extent.
23. Transfers Outside the European Economic Area
Certain service providers used by the Controller, in particular global technology and payment service providers, may process data outside the European Economic Area or use entities located outside the EEA.
Where such a transfer takes place, the Controller ensures that it is carried out in accordance with the GDPR, in particular on the basis of:
- a European Commission adequacy decision,
- appropriate legal frameworks recognised by the European Commission,
- Standard Contractual Clauses approved by the European Commission,
- other mechanisms provided for under the GDPR.
Information concerning the safeguards applied to a specific transfer may be obtained by contacting the Controller.
24. Data Retention Periods
The retention period depends on the purpose and legal basis of processing.
Data is retained in particular as follows:
- Account data – for the duration of the Account and thereafter for the period necessary for settlements and protection against claims,
- contract-related data – for the duration of the contract and thereafter for the period necessary to comply with legal obligations and protect against claims,
- accounting and tax documents – for the period required by law,
- payment data – for the period necessary to process transactions, settlements, legal obligations and protection against claims,
- newsletter data – until consent is withdrawn or the newsletter is discontinued,
- information concerning consents granted or withdrawn – for the period necessary to demonstrate that such consent was lawfully obtained,
- correspondence data – generally for up to 12 months after correspondence ends, unless there is a basis for further retention,
- technical logs – generally for no longer than 12 months, unless required to investigate an incident or protect against claims,
- operational data in SaaS after termination of the service – generally for up to 30 days, unless the contract, offer or DPA provides otherwise,
- data relating to claims – until such claims expire, become time-barred or the relevant proceedings are finally concluded.
After expiry of the relevant period, data is deleted or anonymised unless continued retention is required by applicable law.
25. Rights of Data Subjects
Subject to the conditions provided for under the GDPR, data subjects have the right to:
- access their personal data,
- obtain a copy of their data,
- rectify inaccurate data,
- complete incomplete data,
- request deletion of data,
- request restriction of processing,
- data portability,
- object to processing based on Article 6(1)(f) GDPR,
- withdraw consent at any time where processing is based on consent.
Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.
To exercise these rights, contact the Controller at:
The Controller may request additional information necessary to verify the identity of the person making the request where this is necessary to protect personal data.
26. Right to Lodge a Complaint
Where a person believes that their personal data is being processed unlawfully, they have the right to lodge a complaint with:
President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych)
in accordance with applicable law.
27. Voluntary Provision of Data
Providing personal data is generally voluntary.
However, providing certain data may be necessary to:
- create an Account,
- enter into and perform a contract,
- fulfil an order,
- make a payment,
- activate a Subscription,
- use a Trial,
- use certain SaaS functionality,
- receive a response to a message,
- use technical support.
Failure to provide data required for a particular service may make it impossible to provide that service.
28. Automated Decision-Making and Profiling
As a rule, the Controller does not make decisions concerning users based solely on automated processing that would produce legal effects concerning them or similarly significantly affect them.
External providers, in particular payment operators, may use automated mechanisms for purposes including:
- fraud prevention,
- transaction risk assessment,
- payment security,
in accordance with their own data processing policies.
Where the Controller uses Google Ads for personalised advertising or remarketing, such activities may include automatically assigning the user to particular audience groups based on information concerning use of the Website, solely to the extent covered by the consent given.
Such activities generally do not result in the Controller making decisions that produce legal effects concerning the user or similarly significantly affect them.
29. Data Security
The Controller applies technical and organisational measures appropriate to the nature and risks of the processing.
Such measures may include in particular:
- access controls,
- user authentication,
- encryption of data transmission,
- security updates,
- event logging mechanisms,
- restriction of permissions,
- backups to the extent required for a given service,
- infrastructure security monitoring,
- incident response procedures.
No IT system can provide absolute security. The Controller nevertheless takes measures intended to reduce risk to a level appropriate to the nature of the services provided and the data processed.
30. Links and Third-Party Services
The Website may contain links to websites or services operated by third parties.
The Controller is not responsible for the data processing practices of independent entities once the user leaves e-toolkit services.
Before providing data to such an entity, the user should review its privacy policy.
31. Amendments to this Privacy Policy
The Controller may update this Privacy Policy in particular in the event of:
- changes in applicable law,
- changes in the way personal data is processed,
- implementation of new services or functionalities,
- changes in service providers used,
- organisational or technical changes,
- the need to improve the transparency of information provided.
The current version of the Privacy Policy will be published on the Website.
Where changes are materially relevant to data subjects, the Controller may provide additional information in an appropriate form.
32. Contact
For matters concerning privacy, personal data processing or the exercise of rights under the GDPR, contact the Controller:
Centrum Programowania Dawid Skibiński
Knieja 5/1
88-190 Barcin
Poland
Tax ID (NIP): 5621717984
REGON: 523576637
e-mail: contact@e-toolkit.app