Privacy policy

Controller of personal data

The controller of the personal data of users of the Certyx service is Rafał Będkowski, a natural person operating the Certyx website available at https://certyx.space. The controller can be contacted about the processing of personal data at the e-mail address: support@certyx.space.

Controller and processor roles

For account administration, service security and contact-form requests, the controller is Rafał Będkowski, a natural person operating the Certyx website at https://certyx.space, contact support@certyx.space. For customer infrastructure data processed on documented customer instructions, the customer acts as controller and the operator as processor under a data processing agreement.

Data and purposes

Account identifiers, organization membership, role and MFA state enable access control. IP addresses, timestamps, user agent, request outcomes and audited changes support fraud prevention, incident investigation and operational security. Certificate metadata, endpoints, assets, owners, notification addresses and dependency data support the customer-requested CERTYX service. Details sent through the contact form (name, company, e-mail, optional phone, country and tax ID, message and questionnaire answers) are used to answer the request and prepare an offer. Passwords are derived hashes; MFA secrets are protected. Do not upload private keys to browser forms.

Legal bases

Contract performance and steps taken at your request before a contract (Article 6(1)(b)) apply where you are, or intend to become, party to the contract, including contact-form requests; legitimate interests (Article 6(1)(f)) apply to business account administration, answering business inquiries and proportionate security. Article 6(1)(c) applies only to a specific legal obligation. Optional purposes require their own valid basis. Ordinary account access is not conditioned on generic GDPR consent.

Recipients and transfers

Access is limited to authorized personnel and contracted providers such as hosting, e-mail delivery and, where configured, identity providers. The current list of subprocessors, their locations and transfer safeguards is part of the data processing agreement and available from support@certyx.space. Advertising scripts are never loaded; web analytics is used only as described below.

Website analytics (Google Analytics 4)

When web analytics is switched on for this website, the public information pages (home page and these legal pages, never sign-in, console or setup pages) ask for your consent before Google Analytics 4 is loaded. Only after you accept does your browser load the Google tag and send page views, approximate location derived from the IP address (Google Analytics 4 does not store IP addresses), device and browser data and the cookies _ga and _ga_<ID> (up to 2 years) to Google, so that Rafał Będkowski, a natural person operating the Certyx website at https://certyx.space can understand how the website is used. Advertising features, Google signals and ad personalization are switched off. Legal basis: your consent (Article 6(1)(a) GDPR and the national rules on terminal equipment access). Recipient: Google Ireland Limited; data may be transferred to Google LLC in the USA, which is certified under the EU-U.S. Data Privacy Framework (adequacy decision of the European Commission). Analytics data is kept for the retention period set in Google Analytics (at most 14 months). You can withdraw consent at any time under "Cookie preferences" in the footer; the analytics cookies are then removed and nothing more is sent. Without consent nothing is loaded from Google.

Retention

Account and security records are kept for as long as the customer agreement and security or legal obligations justify; customer data is returned or deleted at the end of the agreement as it specifies. Contact-form inquiries are kept as sales correspondence and erased on request.

Your rights

Subject to applicable conditions, you may request access, rectification, erasure, restriction, portability and object to processing based on legitimate interests. Optional consent can be withdrawn without affecting earlier lawful processing. Contact support@certyx.space. You may complain to the competent supervisory authority; in Poland, the President of UODO.

Required data and automated processing

Necessary account data are required to provide authenticated access; without them sign-in is unavailable. Policy and risk scores support administrative decisions and require context. CERTYX does not make solely automated decisions with legal or similarly significant effects on individuals.

More information

Read the cookie policy and the data protection page for storage details and customer processing terms.