Privacy policy

1. Who we are

Pavlo Loianych is the controller of personal information collected through irwiz.com for website operation, enquiries and customer accounts. Contact us using the details below for privacy questions or requests.

Pavlo Loianych · NIP PL1251733723 · REGON 522232315

This policy covers this website, enquiry correspondence, the customer portal and our customers' accounts. The data that customers enter into their IRWiz workspaces is processed on their behalf, as described in section 3.

2. Information we use and why

Enquiries and demo requests. When you contact us, we receive your name, e-mail address, phone number, company, team size, message, whether you asked for demo access, and anything else you choose to tell us. We use this to understand your request, reply, show you IRWiz, give you access to the demo workspace and prepare a quote. Enquiries sent through the website are stored in our Odoo customer relationship management system.

Where you ask us to take steps before entering a contract with you personally, our legal basis is taking those pre-contractual steps (Art. 6(1)(b) GDPR). For enquiries made on behalf of an organisation, our legal basis is our legitimate interest in responding to business enquiries and developing relevant business relationships (Art. 6(1)(f) GDPR). We do not add you to a marketing mailing list just because you submit the form.

The form requires your name and e-mail address so we can answer. You do not have to contact us, but without suitable contact details we may be unable to reply. Please do not send passwords, API keys, sensitive personal information or confidential test data.

Customers and the customer portal. For our customers we keep the details of the people who represent them, quotes, orders, invoices and correspondence, and give them a login to the customer portal where these documents are available. Our legal bases are performing the contract (Art. 6(1)(b) GDPR) and our accounting and tax obligations (Art. 6(1)(c) GDPR).

Website and service operation and security. Requests to the website and to IRWiz can include an IP address, request time, requested address, browser and device information and technical error or security information. We use these technical records to operate the service, diagnose problems and prevent misuse. Our legal basis is our legitimate interest in maintaining a reliable and secure service (Art. 6(1)(f) GDPR).

Legal responsibilities. If an enquiry becomes an engagement, we may need business correspondence and transaction records to perform the agreement, meet legal obligations or establish, exercise or defend legal claims.

3. Data in customers' workspaces

Each customer has its own IRWiz workspace. The data the customer and its people enter there, such as users' names and e-mail addresses, test plans and results, bug reports, attachments and the accounts of its stakeholders, is processed by us on the customer's behalf as a processor, under a data processing agreement (Art. 28 GDPR). The customer is the controller of that data and decides what goes into the workspace. People whose data is in a workspace should address requests about it to that customer; we help the customer answer them.

No workspace can see another workspace's data. We access a workspace only to provide and support the service, or on the customer's instruction. When a customer connects its workspace to an issue tracker, bug reports are sent to that tracker on the customer's instruction.

4. Who may receive information

Access is limited to people who need the information to handle the enquiry, operate our systems or meet legal responsibilities. This may include authorised team members and contractors, infrastructure and communications service providers, and professional advisers such as our accountants where necessary. We may also disclose information where required by law or where necessary to protect legal rights.

• Hosting: our Odoo application, databases, files and their backups are self-hosted on our own hardware in Poland. Nightly backups are also copied to a second server of ours in Poland.
• Cloudflare provides the public delivery and security layer for this website and IRWiz and processes connection information to provide those services, under its Customer Data Processing Addendum. Our legal basis is our legitimate interest in operating a reliable service and preventing abuse.
• Brevo delivers our transactional e-mails, such as replies, invitations, notifications from IRWiz and documents, not marketing campaigns. Information needed to deliver a message, including recipient details and message content, may be processed by Brevo as our processor under the data-processing provisions of its Terms of Service.

5. Processing outside the European Economic Area

Our external providers may process data outside the EEA. We have agreed to the applicable data-processing terms for Cloudflare and Brevo. Depending on the recipient and transfer, the arrangements rely on an applicable adequacy decision, including the EU–US Data Privacy Framework for covered recipients, or Standard Contractual Clauses and supplementary safeguards where required. A provider's European data-storage location does not by itself exclude international access or onward processing. Contact [email protected] for information about the safeguards applicable to your data and how to obtain a copy.

6. How long we keep information

• Unsuccessful enquiries: 90 days after the enquiry is closed, unless a legal obligation or a specific legal claim requires longer retention. If we start working together, the relevant information becomes part of the customer records.
• Customer records: for the duration of the agreement and then as required by law, including accounting and tax records (usually 5 years from the end of the tax year) and until claims are time-barred.
• Workspace data: for the duration of the agreement, then deleted after the period agreed with the customer for exporting it.
• Logs: routine website access and application logs for up to 90 days; security events and administrative audit records for up to one year. Records needed for an active incident or legal claim may be kept until that matter is resolved.
• Backups: kept for 14 days, both on the server and in the off-site copy. Information removed from active records can remain in these restricted recovery copies until they expire.

7. Your choices and rights

Under applicable data-protection law, you may request access to your personal data, correction of inaccurate data, erasure, restriction of processing and, where applicable, portability. You may object to processing based on legitimate interests on grounds relating to your situation. If processing is based on consent, you may withdraw consent without affecting processing that took place before withdrawal.

E-mail [email protected] with your request. We may ask for proportionate information to confirm your identity. We normally respond within one month; where the law allows an extension, we will explain it. Some rights are subject to legal exceptions.

You may complain to the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland) or to the competent supervisory authority where you live or work or where you believe an infringement occurred. You do not have to contact us first.

8. Cookies and similar technologies

Odoo uses browser storage and cookies for features such as sessions, sign-in and language preferences. Cloudflare security services may set cookies when checking requests or remembering a completed security challenge. Blocking these technologies can affect site, sign-in or form functionality. See Cloudflare's cookie information for the cookies associated with its enabled services; not every cookie described there is necessarily used here.

We do not use analytics or advertising cookies. If we ever add analytics, we will ask for your consent before loading it and update this policy.

9. Changes to this policy

We will update this page when our processing changes and show the effective date of the revised policy. For questions about this policy, contact [email protected].