Effective date: 25 February 2026
Last updated: 25 October 2026
Data Controller
CyberForge sp. z o.o.
Tax ID (NIP):
KRS:
e-mail: kontakt@cyberforge.agency
phone: +48 883 008 720
We have not appointed a data protection officer. For any matter concerning your personal data, write to kontakt@cyberforge.agency.
1. Scope
This policy covers the processing of personal data on the cyberforge.agency website, including the contact form and the self-assessment tools in the Diagnosis section, and within the services we provide: training, assessment of the software development process and implementation of security practices.
2. Purposes, legal bases and retention
Answering your enquiry (form, email, phone)
Data: name, email address and message; if you provide them — the topic of the call, industry, team size and phone number. The form also passes on the address of the page on our website from which you reached it.
Legal basis: Art. 6(1)(b) GDPR (steps taken at your request before entering into a contract) and Art. 6(1)(f) (legitimate interest — replying to correspondence).
Retention: up to 3 years from the last contact or until a successful objection.
Entering into and performing a contract
Data: name, job title and business contact details of the Client’s representatives, and the data needed to issue an invoice.
Legal basis: Art. 6(1)(b) GDPR (a contract you are party to), Art. 6(1)(f) (contact with representatives of a Client that is a business) and Art. 6(1)(c) (tax and accounting obligations).
Retention: for the term of the contract and then until claims become time-barred; accounting records — for the period required by tax law.
First business contact (companies we have not spoken to before)
Data: name, job title, company name and business email address.
Source: publicly available sources — company websites, professional profiles (e.g. LinkedIn) and public registers (KRS, CEIDG).
Legal basis: Art. 6(1)(f) GDPR (legitimate interest — establishing a business contact).
Retention: up to 3 years from the last contact or until you object. After an objection we keep only a record of it, so that we do not contact you again.
Information about our services (people we work with or have corresponded with)
Data: name and email address.
Legal basis: Art. 6(1)(f) GDPR (direct marketing of our own services) and, where the law requires consent for such contact, your consent (Art. 6(1)(a)).
Retention: until you object or withdraw consent.
Operation and security of the website
Data: technical connection data, including your IP address, processed by our hosting provider on every visit.
Legal basis: Art. 6(1)(f) GDPR (legitimate interest — delivering the website and protecting it against attacks).
Retention: in line with the hosting provider’s log retention rules.
Complaints and claims
Data: data from the complaint and the contract.
Legal basis: Art. 6(1)(f) GDPR (establishing, pursuing or defending claims) and Art. 6(1)(c) where the obligation arises from law.
Retention: until claims become time-barred.
Data in the Client’s systems. During assessment and implementation work we may have access to personal data stored in the Client’s systems, e.g. in logs, configurations and repository history. The Client is the controller of that data; we process it only on the Client’s instructions under a data processing agreement (Art. 28 GDPR), which sets out the scope, duration and deletion of the data.
Do you have to provide your data? Providing data is voluntary. Without your name, email address and message we cannot reply to a form enquiry, and without the data required by law we cannot conclude a contract or issue an invoice. The self-assessment tools in the Diagnosis section calculate the result in your browser and do not send us your answers.
3. Data recipients
Data may be shared with:
- processors acting on our behalf: Cloudflare (website hosting and delivery), Formspree (receipt of contact form messages) and the providers of tools we use in day-to-day work — email, documents, meeting scheduling, contact database and email sending — to the extent needed for them to work,
- legal advisers, accountants and auditors — to the extent needed for their tasks,
- public authorities, where required by law.
We will provide the current list of providers on request. We do not sell data or share it with other companies for their own marketing.
4. Data transfers outside the EEA
Some providers, such as Cloudflare and Formspree, also process data outside the European Economic Area, mainly in the USA. We transfer data only where adequate protection is in place: on the basis of a European Commission adequacy decision (including the EU–US Data Privacy Framework for certified organisations) or standard contractual clauses approved by the Commission. You can request a copy of these safeguards.
5. Your rights
You have the right to:
- access your data and receive a copy,
- rectification,
- erasure,
- restriction of processing,
- data portability — where we process data by automated means on the basis of consent or a contract,
- object to processing based on legitimate interest, and to direct marketing at any time without giving reasons,
- withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
We do not make decisions based solely on automated processing, including profiling.
To exercise your rights, write to kontakt@cyberforge.agency. We reply within one month; in complex cases this may be extended by two further months, and we will let you know.
You also have the right to lodge a complaint with the President of the Personal Data Protection Office in Poland (uodo.gov.pl) or with the supervisory authority in your country.
6. Data security
We apply technical and organisational measures appropriate to the risk (Art. 32 GDPR), including:
- an encrypted connection to the website (HTTPS) and security headers,
- access to data only for people who need it, with two-factor authentication wherever the tool supports it,
- regular updates of systems and tools,
- selecting providers with whom we sign data processing agreements,
- a procedure for handling personal data breaches.
If a personal data breach is likely to result in a risk to your rights or freedoms, we will notify the supervisory authority within 72 hours of becoming aware of it, and where the risk is high we will also inform you without undue delay.
7. Cookies and similar technologies
The website does not use cookies, analytics tools or tracking scripts. Fonts are served from our own server, so your IP address is not passed to third parties when they load. The one exception is the header photo on the “About” page, loaded from Unsplash — when it is displayed, Unsplash receives your IP address and technical browser details, without cookies. The only thing stored in your browser is your chosen theme (light or dark) in local storage — this is not a cookie and is not used to identify you. Details: Cookies.
8. Changes to this policy
This policy may be updated. The current version, with the date of the last update, is always available on this page. We will inform Clients and people we correspond with by email about material changes affecting ongoing cooperation.
Questions? Write to kontakt@cyberforge.agency or call: +48 883 008 720.
Thank you for your trust.
CyberForge sp. z o.o.