# eFTI Compliance Privacy Notice

**Version 2026-10-11. Effective 11 October 2026.** This notice covers efticompliance.com, the account/Workspace service when available, contact and billing. Publishing this notice does not open paid accounts or unrestricted uploads. Public field-name demos run locally in the browser; do not include personal data, credentials or full transport documents. When a feature sends information to our server, its interface identifies that transfer.

## 1. Controller and roles

For website contact, accounts, authentication, service security and the customer relationship, the controller is **Bartosz Kowalczyk, ul. Gieysztora 4/161, 02-999 Warsaw, Poland**. Privacy contact: **contact@efticompliance.com**. No data protection officer is claimed.

When a business customer determines the purposes and means of processing personal data in its transport records, that customer may be the controller and the Workspace provider its processor. Before such records are used, the parties must establish their roles and conclude an Article 28 GDPR data-processing agreement where required. Until then, use anonymous/test records and do not send third-party personal data or full transport documents through public tools.

## 2. Data, purpose and legal basis

| Context | Data | Purpose and basis |
| --- | --- | --- |
| Contact | Email, message and voluntarily supplied professional information | Reply and pre-contract steps (GDPR Art. 6(1)(b) where the person is a party), otherwise legitimate interest in handling enquiries (Art. 6(1)(f)). |
| Account | Email, organisation name, role, password hash, session/invitation identifiers and dates | Contract delivery where applicable (Art. 6(1)(b)); otherwise legitimate interest in secure business-account operation (Art. 6(1)(f)). |
| Billing | Stripe customer ID, Checkout attempt, plan, currency, subscription/payment state and billing details supplied to Stripe | Contract delivery (Art. 6(1)(b) or (f)); applicable tax/accounting duties (Art. 6(1)(c)); claims (Art. 6(1)(f)). Card numbers are not collected by the Workspace server. |
| Workspace | Source-system names, mapping paths and versions, shipment/record identifiers, input hash, results and usage history | Provide and meter the service (Art. 6(1)(b) or (f)). The present implementation stores summaries and metadata rather than full input JSON values; identifiers and mapping paths can still be personal data. |
| Security | Technical request/session identifiers, hashed request source, sign-in attempts and server diagnostics; web-server logs can include IP address, time, requested URL, response status and browser information | Protect accounts and integrity (Art. 6(1)(f)). Do not put credentials or sensitive information in URLs or support messages. |

Core service access does not depend on marketing consent. Any future optional marketing or non-essential analytics will be separately disclosed and controlled.

## 3. Recipients and international transfers

Service providers receive data necessary for their function: **Hetzner** hosts the website, application, database and local backups; **OVHcloud** carries contact and authentication email; **Stripe** supplies hosted payments, subscriptions and billing management. Stripe/Link independently determines some payment processing, including Managed Payments transaction support. We do not send transport input values to an AI/OCR service as part of this Workspace offer. Competent public authorities may receive data where legally required.

The providers publish information about their entities, subprocessors and safeguards in the [Hetzner privacy information](https://www.hetzner.com/legal/privacy-policy/), [OVHcloud data-protection information](https://www.ovhcloud.com/en/personal-data-protection/legal-privacy-security/) and [Stripe Privacy Center](https://stripe.com/privacy-center/legal). Stripe operates internationally and describes transfers outside the EEA, including adequacy decisions and standard contractual clauses, in its [Privacy Policy](https://stripe.com/privacy) and transfer documents. OVHcloud also publishes its arrangements for international processing. Do not assume that every provider operation stays within the EEA. For information about the applicable safeguards or a copy relevant to your data, contact contact@efticompliance.com. Third-party transport-personal-data processing is not opened until the applicable processor arrangements and transfer safeguards have been established; the present transport-input scope is anonymous/test data.

## 4. Storage periods

An account-verification token is valid for up to 24 hours, a password-reset token for 30 minutes, an invitation for seven days and a browser session for 12 hours. Expiry stops use of these credentials but does not itself immediately erase a stored record or backup.

The approved local policy deletes unpaid organisations without a started purchase after 90 days without qualifying activity. Product history follows the known plan's 90/365-day period, except current configuration, approved baselines, active-period metering and dependencies needed to interpret retained evidence. These pins remain until no longer required or organisation closure; a downgrade does not silently shorten retained history. For a proved ended paid subscription, product data is removed after the 30-day read-only window. A stale ACTIVE state, trial, failed renewal or open Checkout is not treated as a proved end.

Necessary tax records follow five years from the end of the year in which the tax-payment deadline elapsed, with reviewed legal/claims extensions where required. The actual deadline year must be established; Stripe transaction dates do not establish it. Unknown facts or changed billing records remain review-required. Disputes receive a separate deletion hold and 90-day review, without retaining all product history automatically. Expired authentication records and seven-day-old authentication throttles are purged by the hourly policy. Web-server logs use daily rotation with 14 rotated copies; normal retention is approximately 15 days. System journals have a 30-day maximum retention setting, and forwarded system logs use four weekly rotated copies. Rotation depends on scheduling and whether a file contains entries, rather than an exact per-entry deletion clock. Incident evidence may be isolated and held only as needed for investigation or a claim, with periodic review.

Availability and larger-licence requests held in the local request service expire after 90 days from the last activity; withdrawal of a notification request is separate from data erasure. Ordinary support correspondence is held while the enquiry is handled and, where necessary, for the relevant contract, legal or claim period; it is not covered by the local account-export operation or the request-service purge. Provider-held email and payment records are subject to the relevant provider and applicable legal criteria.

The organisation owner can export all allowed local account/product/billing metadata through snapshot-pinned JSON pages and request confirmed local product erasure, without a paid plan. Active billing must be ended first. Other tenants, shared users and required minimum financial records are protected. Large organisations above 50,000 rows/64 MiB require a private reviewed job; no silent truncation is promised. Individuals can also send rights requests to the privacy contact; an organisation-owner action does not replace individual GDPR rights.

Recognised local backups and rehearsal copies expire after 30 days, after verification of a fresh copy. Old restore copies are restricted to recovery and current deletion intents are applied before service access. A private minimal opaque account/date barrier prevents resurrection and remains until a restore-copy review establishes it is no longer needed. Active/unknown copies are protected and reviewed separately. These are logical local controls, not a promise of forensic erasure, offsite disaster recovery or deletion of records independently held by Stripe.

## 5. Cookies, security and rights

Authenticated Workspace uses necessary `__Host-efti_session` and `__Host-efti_csrf` cookies for sign-in and CSRF protection; both are Secure, the session cookie is HttpOnly, and their maximum lifetime is 12 hours. The current website and application add no advertising or third-party analytics scripts. Local readiness tools process the entered information in the browser unless an explicitly identified transfer is selected. Hosted Stripe Checkout/Link uses its own cookies and privacy notices on its domains.

HTTPS, access controls and password hashing are used, without claiming absolute security. Within GDPR limits, individuals may request access, rectification, erasure, restriction and applicable portability, and object to processing based on legitimate interests. Where consent is used, it may be withdrawn prospectively. Send requests to contact@efticompliance.com; identity may be verified to protect an account. A complaint may be made to the Polish Personal Data Protection Office (UODO) or another competent supervisory authority.

Data necessary for an account or payment is required to supply that part of the service; contact-message data is voluntary, but without contact details we may be unable to reply. We do not make solely automated decisions producing legal or similarly significant effects about individuals. Technical shipment scores are not decisions about people.

Material changes will be dated and, where they affect an active service, communicated appropriately. The dated version can be downloaded from the privacy page; earlier versions are available on request.

Contact requests are handled without undue delay and normally within one month, subject to the conditions and permitted extensions in GDPR. Exercising a right is not conditional on a paid subscription. [Workspace Business Terms](https://efticompliance.com/terms/) describe the software contract; they do not limit individual privacy rights.