Privacy policy

The controller of personal data is MJKM sp. z o.o., with its registered office in Warsaw, ul. Mińska 25C lok. 3, 03-808 Warszawa, NIP 1133166912, REGON 541690247, KRS 0001172136, registered with the District Court for the Capital City of Warsaw in Warsaw, 14th Commercial Division of the National Court Register, share capital 10 000,00 zł.

For all matters concerning personal data, please contact us at biuro@mjkm.com.pl or by telephone: +48 797 625 609. For matters concerning accounts, orders and the platform tools you can also write to pomoc@mjkm.com.pl.

We have not appointed a data protection officer. It is not required for the scope of our activities.

Correspondence and projects. We receive personal data in connection with correspondence, telephone conversations and the running of projects. In particular we process first and last name, email address and telephone number, the name of the organisation and the position or role in the project, the content of correspondence, data necessary to prepare an offer, to conclude and perform a contract and to settle accounts, as well as contact details of people taking part in the design process.

Accounts and platform tools. In connection with the use of accounts and engineering tools we process:

• account data: email address, display name, the date the account was created and the date of the last login; the password is stored only as a cryptographic hash and is not known to us,
• team data: the name and logo of the team, the composition of the team and the roles of its members, and the addresses of people invited to the team,
• licence data: seat numbers, the people they are assigned to, and the validity dates of access,
• order and billing data: the items ordered, the period, the number of seats, amounts, payment identifiers assigned by the payment operator, refunds, and the invoice details: first and last name or company name, address, NIP and the email address given at payment,
• the record of declarations made when ordering: their content and version, the version of the document they refer to, the time they were made and the IP address from which they were made,
• data entered into tools that save work on the account (for example bar bending schedules) and data entered into calculators for the duration of the calculation,
• technical data described in points 10 and 11.

We do not collect or store payment card data: payment takes place on the payment operator's page. Model files opened in tools running in the browser are not sent to us: they are processed only on the user's device.

The information website has no contact forms. Providing data is voluntary, but it may be necessary to answer an enquiry, to conclude and perform a contract, to maintain an account or to fulfil an order.

We obtain data directly from the people it concerns: through correspondence, by telephone, when an account is created and when an order is placed.

The address of a person invited to a team is provided by the team administrator. Invoice details are provided by the person placing the order on behalf of the team. In the course of projects we also receive contact details from other parties (investors, clients, contractors and collaborators) or obtain them from project documentation, where the person is named as a participant in the design process. In that case the data is limited to the business details necessary to handle the matter.

We process data for the following purposes:

• handling enquiries and conducting correspondence,
• preparing offers, concluding and performing contracts, and running projects,
• maintaining accounts and teams and making tools available,
• fulfilling orders, handling payments, refunds and withdrawal from the contract,
• issuing invoices and corrective invoices and meeting other accounting and tax obligations,
• sending messages related to the account and the order (address confirmation, team invitation, order confirmation, invoice),
• documenting the declarations made when ordering,
• ensuring that the website and tools work properly and securely, including limiting the number of operations to protect against abuse,
• archiving project documentation and correspondence,
• keeping aggregate visit statistics,
• establishing, pursuing or defending against claims.

The legal bases of processing are:

• Article 6(1)(b) GDPR: taking steps prior to entering into a contract and performance of a contract, including the contract for maintaining an account and the contract for access to the tools,
• Article 6(1)(c) GDPR: compliance with a legal obligation, in particular under tax and accounting regulations and consumer rights regulations,
• Article 6(1)(f) GDPR: the controller's legitimate interest, covering correspondence and projects, the handling of teams (including invitations), the archiving of project documentation, security, statistics, and the establishment, pursuit and defence of claims.

We do not carry out marketing mailings and we do not profile users.

We archive project documentation indefinitely. The archive is the working tool of the office. We return to earlier structural solutions in later tasks, technical analyses and continuations of projects. Archiving is also important for being able to reconstruct the course of a matter and to defend against claims, which in construction are often made many years after completion.

We limit the personal data in project documentation to what is necessary to identify the matter, to contact project participants and to reconstruct the history of the task. This rule does not apply to accounts and platform tools: the retention periods for that data are described in point 6.

Correspondence: for as long as it may be needed to conduct or reconstruct the matter and to defend against claims.

Project documentation: indefinitely, for the reasons given in point 5.

Account data: for as long as the account is kept, and then for 6 years from the end of the contract for maintaining the account, in order to establish, pursue or defend against claims. Only the account owner can delete an account, by themselves in the account panel; a team cannot delete a person's account, it can only detach that person from itself. After an account is deleted, logging in is no longer possible, and we keep only the email address, the display name, the dates the account was created and last used, team membership, the licences assigned at the moment of deletion and the link to the record of declarations made when ordering. This data is not available in the panel.

Inactive accounts: an account with no login for 3 years and to which no valid licence was assigned during that time is deleted after a warning sent 30 days in advance to the address assigned to the account. Logging in during that time keeps the account. After deletion, the rules described in the previous paragraph apply.

Team data and data saved in the tools: for as long as the team is used. A team with no valid licence and no login by any of its members for 3 years is anonymised: we delete its name, logo and data saved in the tools, and keep only order data for the period given below. The change history of a document in a tool (for example a schedule) is part of that document and is kept together with it.

Team invitations: the address of an invited person is kept until the invitation is accepted, declined, withdrawn or expires (an invitation is valid for 7 days), and is then deleted after no more than 30 days. An invitation does not create an account: only the invited person creates an account.

Order data, invoices, accounting records and the record of declarations made when ordering: for 6 years from the end of the calendar year in which the service was performed or, for access for a fixed period, in which the access period ended; regardless of the deletion of the account. The IP address saved with the declarations is kept for the same period as the declarations themselves.

Event logs: login data, IP addresses and security events are kept for no longer than 12 months. Operation limit counters are kept for up to 2 days.

Backups: data may be present in system backups for the period necessary to ensure security and continuity of the platform, but no longer than 90 days after it is deleted from the production system.

At the request of the data subject we delete the data, unless an obligation to keep it arises from legal provisions or it is necessary to establish, pursue or defend against claims. We state the reason for further retention in our reply.

We do not sell personal data and we do not share it for marketing purposes. We use providers who process data on our behalf:

• Microsoft: email and document storage in Microsoft 365,
• Vercel: hosting of the website and platform,
• Supabase: database of accounts, teams, licences, orders and data saved in the tools, authentication and file storage (team logo, tool documents),
• Fly.io: the server that performs the calculator computations; it receives the account identifier, the display name and the calculation data,
• Resend: sending messages related to the account and the order,
• Fakturownia: issuing invoices and corrective invoices,
• Cloudflare: visit statistics,
• the accounting office: for settlements,
• collaborators and subcontractors taking part in a project: to the extent necessary to perform the task.

Payments are handled by Stripe Payments Europe, Limited, established in Ireland, to which we pass customer data for the purpose of handling payments. For payment services, fraud prevention and obligations under anti-money laundering and counter-terrorist financing regulations, including identity verification, Stripe processes data as a separate controller. Detailed rules are set out in Stripe's privacy policy.

We pass invoices to the National e-Invoicing System run by the Head of the National Tax Administration to the extent required by law. Data may also be disclosed to legal and tax advisers to the extent necessary for the legal support of the company, and to other entities entitled under legal provisions.

Providers process data only to the extent necessary to provide services to us.

Some of the providers listed in point 7 are established outside the European Economic Area or use infrastructure outside it: the content of the website is delivered through a global network of edge servers. Data may therefore be processed outside the EEA.

Transfers take place on the basis of a European Commission decision finding an adequate level of protection, including the EU-U.S. Data Privacy Framework, or on the basis of standard contractual clauses approved by the European Commission. You can obtain a copy of the safeguards used by contacting us at biuro@mjkm.com.pl.

We apply technical and organisational measures appropriate to the nature of our activities and the scope of the data processed. They include in particular encrypted data transmission, storing passwords only as a cryptographic hash, database access rules that limit each user's view to the data of their own account and team, access control for email and documents, and the use of providers that ensure an appropriate level of security.

To count visits we use Cloudflare Web Analytics. The tool does not save cookies and does not create a profile of the visitor. It provides only aggregate data: the number of visits, the pages viewed, and the country, device type and source of the visit.

Separately, we count page views and tool launches ourselves. We record only daily totals, split into use without an account, use with an account without a licence, and use with an account with a licence, with no IP address, account identifier or cookies. Traffic from the MJKM team (accounts in the company team and browsers marked by those people) is counted separately, so that it does not mix with client traffic.

When the website and tools are provided, technical data necessary for their operation and security is processed, including the IP address, the date and time of the request, the type of browser and operating system, and the address of the requested page. Operation limits are counted per account and, when the tools are used without logging in, per hash of the IP address, without saving the address itself.

We do not use this data for profiling or for automated decision-making that produces legal effects or similarly significantly affects the data subjects. We do not carry out remarketing or behavioural advertising.

The information website does not save cookies for visitors who are not logged in (except the MJKM team marker described below, saved only at the request of a team member); for logged-in users it only refreshes the login session cookie. In the part with accounts and tools we use only cookies necessary to provide the service:

• login session (cookies whose names begin with sb-): keeps you logged in; kept until you log out, for no longer than 400 days,
• seat device identifier (mjkm_stanowisko): allows us to recognise on which device a working session within a seat is running; up to 12 months,
• Union tool pass (union_wyd): allows you to download the program files after logging in; up to 12 hours,
• Perdix program pass (perdix_wyd): allows a person with a valid licence to download the program files after logging in; up to 12 hours,
• MJKM team browser marker (mjkm_zespol): saved only in the browser of a member of the MJKM team, when they click the button on the marking page themselves; lets us count their visits separately from client visits; contains no data about the person or the device; up to 400 days or until the marking is removed,
• team invitation link (mjkm_zaproszenie): saved only when an account is created from an invitation, so that after the address is confirmed you return to the invitation; deleted on return, and in any case after no more than 7 days,
• return target after a password reminder (mjkm_powrot): remembers which panel page to return to after a new password is set; deleted after use, and in any case after no more than an hour.

The account panel and the tools also save view settings in the browser's storage (for example theme, layout and column widths). This data stays on the user's device and is not sent to us.

We do not use tracking, analytics or advertising cookies. Because we use only necessary cookies, we do not display a cookie consent window.

The website contains links to services of third parties, in particular to the pages of manufacturers of software used in the office.

After following such a link, data is processed by the operator of that service, according to its own privacy policy. MJKM sp. z o.o. is not responsible for the data processing rules applied by those entities.

You have the right to:

• access your data and receive a copy of it,
• rectification of inaccurate or incomplete data,
• erasure of data,
• restriction of processing,
• portability of data processed on the basis of a contract, to the extent applicable,
• object to processing based on the controller's legitimate interest.

To exercise these rights, please contact us at biuro@mjkm.com.pl or pomoc@mjkm.com.pl. Account data can be corrected, and the account deleted, by yourself in the account panel. The right to erasure does not cover data that we must keep under legal provisions (in particular invoices) or to establish, pursue or defend against claims, for the periods given in point 6.

You also have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warszawa.

We update this policy when the way the website and tools work, the scope of data processed, the services used or the law changes. We inform account holders of material changes at the email address assigned to the account. The current version of the document is always available on this page, together with the date of the last update.