Privacy policy & GDPR

Effective date: February 25, 2026
Last updated: February 25, 2026

Data Controller

CyberForge sp. z o.o.
Tax ID (NIP):
KRS:
e-mail: kontakt@cyberforge.agency
phone: +48 883 008 720

1. Scope

This policy covers the processing of personal data on the cyberforge.agency website and within the services we provide (training, assessment of the software development process, implementation of security practices).

2. Purposes and legal bases for processing

Contact (form, e-mail, phone)
Data: name, surname, e-mail, phone, message content
Legal basis: Art. 6(1)(b) GDPR (contract) or Art. 6(1)(f) (legitimate interest)
Retention: up to 3 years from last contact or until objection

Service delivery (assessment and implementation)
Data: repository data (logs, configurations, metadata)
Legal basis: Art. 6(1)(b) GDPR (contract) + Art. 28 (processing agreement)
Retention: duration of the contract + 5 years (claims) or until deleted by the Client

Direct marketing (newsletter, offers)
Data: name, e-mail, phone number
Legal basis: Art. 6(1)(a) GDPR (consent) or Art. 6(1)(f) (legitimate interest)
Retention: until consent withdrawal / objection or 3 years from last contact

Complaints and claims
Data: complaint data, contract data
Legal basis: Art. 6(1)(c) GDPR (legal obligation) + Art. 6(1)(f) (legitimate interest)
Retention: 6 years (civil claims) or 10 years (administrative penalties)

3. Data recipients

Data may be shared with:

Processors acting on our behalf: OVHcloud / Hetzner (hosting), Google Workspace / Microsoft 365 (email and documents), Calendly (scheduling), Woodpecker / Lemlist (cold mailing — email addresses only)
Public authorities upon request (data protection authority, police, courts, KNF for DORA regulations)
Auditors and legal consultants (for internal audits or disputes)

We do not sell data and do not share it for marketing purposes.

4. Data transfers outside the EEA

We transfer data outside the EEA (e.g., Google Workspace / Microsoft 365) exclusively on the basis of Standard Contractual Clauses (SCC) or EU adequacy decisions. IP addresses are anonymized before transfer.

5. Your rights (Art. 15–22 GDPR)

You have the right to:

Access your data and obtain a copy
Rectify your data
Erase your data (“right to be forgotten”)
Restrict processing
Data portability
Object to processing (including direct marketing)
Withdraw consent (where processing is based on consent)
Not be subject to automated decisions (we do not use profiling)

To exercise your rights — write to kontakt@cyberforge.agency.
We respond within 1 month (up to 3 months in complex cases).
You have the right to lodge a complaint with the President of the Personal Data Protection Office (uodo.gov.pl).

6. Data security (Art. 32 GDPR)

We apply technical and organizational measures, including:

Encryption in transit (HTTPS, TLS 1.3)
Access controls (passwords, 2FA, least privilege)
Regular system and tool updates
Backups with 30-day retention
Penetration tests and security audits (at least once a year)
Staff training in GDPR and cybersecurity
Incident response procedure (report within 24h to the Controller)

In the event of a data breach, we will notify you and the supervisory authority within 72 hours (if there is a high risk).

7. Cookies and similar technologies

Details in the separate.

8. Changes to this policy

This policy may be updated — the latest version is always available on this page. We will inform you of significant changes by email or a notice on the website.

Questions? Write to kontakt@cyberforge.agency or call: +48 883 008 720.

Thank you for your trust.
CyberForge sp. z o.o.