Privacy policy

Draft for review

Working draft dated 25 October 2026 for legal review. This is not binding terms, an approved policy or a concluded processing agreement. It does not change existing order terms.

Operator: Przedsiębiorstwo Techniczne MTC Wiktor Suska. Address: ul. Jezuicka 24A, 05-230 Kobyłka, Poland. Polish tax ID (NIP): 1251751514. Contact: [email protected], tel. +48 534 166 163. Privacy: [email protected].

1. Controller and contact

Przedsiębiorstwo Techniczne MTC Wiktor Suska is the controller for personal account data, communications with Fidument and its own billing. Privacy matters may be sent to [email protected] or the postal address above. Data protection officer details must be provided if one has been appointed; this draft does not assume an appointment.

2. Organization data and operator data

An organization determines the purposes of processing its customer, personnel, document and device data. When hosting that data on documented instructions, Fidument acts as processor under an agreed DPA. The payer, document owner and parties to a contract are separate facts. Platform administration does not automatically grant access to an organization’s data.

3. Information processed

The scope depends on the feature used: account and contact details, memberships and permissions, submitted form content, orders and payment confirmations, saved Tools drafts and results, and necessary security events. The system design form may include a business name, team size, process descriptions and contact details. Unnecessary sensitive data, passwords and secrets must not be entered.

4. Purposes and legal bases

Account operation, order performance and steps requested by a person before contracting rely on GDPR Article 6(1)(b). Tax and accounting duties rely on Article 6(1)(c). Security, abuse prevention and legal claims require an assessment of legitimate interests under Article 6(1)(f). Optional marketing, if introduced, requires an appropriate basis and separate permissions; consent is not the default basis for operating an account.

5. Sources and provision of data

Data comes from the user, an inviter or authorized organization member, recorded Fidument records and links, and the payment provider. It is not automatically obtained from GUS or CEIDG: those integrations remain inactive. Required fields are identified for each action; omitting them may prevent that action. Entering someone else’s data requires a lawful basis and appropriate information for that person.

6. Recipients and transfers

The architecture uses Cloudflare for the website and traffic, Supabase for database, authentication and files, Resend for transactional email, and Stripe for payment processing. Disclosures are limited to what the feature needs; a local DXF export does not require uploading the file. Before publication, the exact vendor entities, roles, processing locations, agreements and grounds for transfers outside the EEA must be confirmed. A database region does not prove that all data stays in the EEA.

7. Retention periods

Active account data is needed while the account is operated; organization documents follow the organization’s instructions and processing agreement. Tools history depends on product limits, but an entry-count limit is not a deletion period. Accounting and claims retention follows the relevant duty and limitation period. Before approval, specific periods must be set for contact enquiries, logs, post-closure data and backups, and technical deletion must be confirmed. This draft does not assert an unverified retention period.

8. Individual rights

Subject to the GDPR, individuals have rights of access, correction, erasure, restriction, portability and objection to certain processing. Consent can be withdrawn without affecting prior lawfulness. A complaint may be lodged with the Polish UODO or the competent supervisory authority. Requests go to the controller, which may verify identity proportionately without asking for a password or MFA code. Responses are generally due within one month, with a reasoned extension where the GDPR permits it.

9. Files, browser storage and security

The cookie policy describes language preferences and temporary form storage. A paid or result-saving Tool may process a file on a server as explained for that product; it must not be confused with anonymous local DXF. Access to stored documents, including repeat downloads, requires current authorization. Safeguards reduce risk but do not promise that incidents are impossible or assert certification.

10. Automated decisions and updates

Permission checks, offer prices and form suggestions must not be presented as autonomous AI decisions. This draft does not assert profiling with effects under GDPR Article 22; such a process would require separate assessment and information. New policy versions receive a date and a description of material changes. Updating the document does not replace a lawful basis, consent or information required for a new purpose.

To confirm before approval

Retention and deletion periods, providers and transfers, required annexes and external review of the content and translations remain to be confirmed. This version remains a draft until then.