Privacy Policy

This Privacy Policy explains how we process personal data when you use tansecure.com, contact us or use our services. It fulfils the information obligations under Articles 13 and 14 of the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679). In force from 12 October 2026.

1. Controller

The controller of your personal data is TANSECURE spółka z ograniczoną odpowiedzialnością, ul. Wielicka 42 lok. B3, 30-552 Kraków, Poland, KRS 0001148378, NIP 6772520369, REGON 540616094, operating under the TanSecure brand.

Contact on personal data matters: [email protected], phone +48 574 114 301, or by post to the address above. We have not appointed a Data Protection Officer, as we are not required to; all requests are handled at the address above.

2. What data we process, why, on what basis and for how long

2.1. Contact form, request forms and email

Data: name, email address, company (optional), topic and content of the message, and any other data you include in it. Purpose: replying to your enquiry and preparing a quote. Legal basis: Article 6(1)(b) GDPR (steps taken at your request before entering into a contract) and Article 6(1)(f) GDPR (our legitimate interest in replying to messages addressed to us). Retention: until the matter is closed, and then for up to 3 years, which is the limitation period for possible claims. After you send a form, we also send you a confirmation by email.

2.2. Chat on the Website

Data: the content of messages, the email address or phone number if you provide it, a technical conversation identifier, and the IP address (used to prevent abuse and to limit the number of messages). Messages are delivered to our team in the Telegram messenger. To speed up our replies, a draft answer may be prepared by an artificial intelligence model (OpenAI). Every reply is reviewed and sent by a member of our team; the model does not reply on its own. Legal basis: Article 6(1)(b) and (f) GDPR. Retention: up to 2 years from the last message, unless the conversation leads to a contract.

2.3. Domain check tool

Data: the checked domain, email address, name and comment (if provided). Purpose: performing the check, sending you the result and, if you wish, contacting you about it. Legal basis: Article 6(1)(b) and (f) GDPR. Retention: up to 3 years from the check.

2.4. Contact via social media and messengers

If you write to us on Facebook, Instagram, Telegram or OLX, we process your username and the content of the conversation in order to reply (Article 6(1)(f) GDPR). These platforms process your data as separate controllers under their own policies. Retention: up to 2 years from the last message.

2.5. Performance of contracts

Data: the details of the Client and the Client's contact persons (name, position, email, phone), billing details, and the correspondence and materials needed to carry out the project. Legal basis: Article 6(1)(b) GDPR, and for contact persons of business Clients, Article 6(1)(f) GDPR. Retention: for the duration of the contract and then until the limitation period for claims expires.

2.6. Accounting and tax

Data on invoices and accounting documents. Legal basis: Article 6(1)(c) GDPR in connection with tax and accounting law. Retention: 5 years from the end of the calendar year in which the tax obligation arose.

2.7. Client panel

If you have an account in the client panel: email address, name, password (stored only in encrypted, hashed form), and login and activity history. Legal basis: Article 6(1)(b) GDPR. Retention: for as long as the account exists, and then up to 3 years for possible claims.

2.8. Security and server logs

When you visit the Website, our servers and our CDN provider automatically record technical data: IP address, date and time, the address requested, and browser and device type. Purpose: making the Website available, protecting it against attacks and diagnosing errors. Legal basis: Article 6(1)(f) GDPR. Retention: as a rule no longer than 90 days, unless the data is needed to investigate a security incident.

2.9. Marketing

We send commercial information by email or phone only with your prior consent (Article 6(1)(a) GDPR and Article 398 of the Polish Electronic Communications Law). Replying to your own enquiry is not marketing. You can withdraw consent at any time, without affecting the lawfulness of processing before the withdrawal. Details are in the Marketing Communications document.

2.10. Pursuing and defending claims

Where necessary, we use data from the categories above to establish, pursue or defend claims (Article 6(1)(f) GDPR), for no longer than the limitation period.

2.11. Client panel sign-in, tasks and files

When you sign in with an emailed code or link, or with Google, we process your email address, name and the confirmation that the address is verified. For tasks we process your messages, screenshots, files and billing details, to perform the contract (Art. 6(1)(b) GDPR). We keep tasks and their files while the account exists and for up to 24 months after a task is closed; invoices are kept as tax law requires. We keep the record of your acceptance of our rules (version, date, IP address, sign-in method) as proof, on the basis of our legitimate interest (Art. 6(1)(f) GDPR), for as long as claims can be pursued. Recipients include Google (sign-in) and Stripe (payments). Please do not put passwords or other sensitive data in tasks.

3. Is providing data required?

Providing data is voluntary, but without contact details we cannot reply to you, and without billing details we cannot conclude a contract or issue an invoice. Providing data for accounting purposes is a legal requirement once a contract has been concluded.

4. Recipients of data

We do not sell personal data. Data may be disclosed to entities that process it on our behalf under data processing agreements, or that act as separate controllers:

• Hetzner Online GmbH (Germany): server hosting; data is stored in data centres in the EU.
• Cloudflare, Inc. (USA): content delivery (CDN) and protection of the Website against attacks.
• Google (Google Ireland Ltd / Google LLC): the mailbox where we receive notifications from forms.
• OpenAI (OpenAI Ireland Ltd / OpenAI, L.L.C.): preparing drafts of replies in the chat and other AI features described in the AI Data Processing document.
• Telegram (Telegram FZ-LLC, United Arab Emirates): delivering messages from the chat and forms to our team.
• Meta Platforms Ireland Ltd: when you write to us via Facebook Messenger or Instagram.
• Stripe Payments Europe Ltd (Ireland): processing card payments in the client panel, if you use them.
• Accounting, legal and IT service providers who support us, and public authorities where the law requires it.

5. Transfer of data outside the European Economic Area

Some of the providers above (Cloudflare, Google, OpenAI, Meta) may process data in the USA. Such transfers are based on the European Commission's adequacy decision for the EU-US Data Privacy Framework (for certified companies) or on standard contractual clauses approved by the Commission. Telegram processes data in the United Arab Emirates, for which no adequacy decision exists; we transfer data there only to the extent necessary to handle the enquiry you sent us (Article 49(1)(b) GDPR). You can obtain a copy of the safeguards applied by writing to us.

6. Your rights

You have the right to:

• access your data and receive a copy of it (Article 15 GDPR);
• have your data rectified (Article 16 GDPR);
• have your data erased (Article 17 GDPR); instructions are in the Data Deletion Instructions;
• restrict processing (Article 18 GDPR);
• data portability (Article 20 GDPR);
• object at any time to processing based on our legitimate interest, on grounds relating to your particular situation, and to object without giving any reason to processing for direct marketing (Article 21 GDPR);
• withdraw consent at any time, if processing is based on consent;
• lodge a complaint with the supervisory authority: the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland, or with the authority of your country of residence.

To exercise your rights, write to [email protected]. We respond within one month; in complex cases this period may be extended by two further months, in which case we will let you know.

7. Automated decision-making

We do not make decisions about you based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR).

8. Security

We use appropriate technical and organisational measures: HTTPS encryption, access control, separation of environments, backups and monitoring. Access to data is restricted to people who need it to do their work.

9. Cookies and browser storage

The public part of the Website does not use cookies for analytics or advertising. Details are in the Cookie Policy.

10. Changes

We update this Policy when the way we process data changes. The current version is always available on this page together with its effective date.