The website uses no advertising or analytics tools. I receive your data when you contact me through the form, by email or by phone. Customers invited to the private project portal receive an account solely to manage our specific collaboration. Technical data is used for security and correct website operation.
Data controller
The controller of personal data processed in connection with 9ne.pl is 9ne.pl Jarosław Staroń.
For privacy matters, contact:
- e-mail: kontakt@9ne.pl,
- Tax ID (NIP): 8942787122,
- address: ul. Starobielawska 32a, 54-061 Wrocław.
- phone: +48 737 487 087.
Data I process
Form, email and phone
Depending on how you contact me, this may include your full name, email address, phone number, message subject, enquiry content and information you voluntarily provide in correspondence.
If the internal CRM module is enabled, your enquiry may be stored in the website's local database together with its handling status, priority, follow-up date, tags, working notes and change history. The module does not store your full IP address in the contact record.
Customer portal
When the private project portal is activated, the following data is processed: full name, email address, company name, a secure password hash, assigned projects, milestones, deadlines, updates and files uploaded by the customer or administrator. A basic history of security and portal operations is also recorded.
A customer organisation may have several individual accounts. For each account, the portal records its role and permissions, account activity, email notification preference, notification read status and the author identifier for comments, decisions or uploaded files. This data supports organisation isolation, access control and documentation of our collaboration.
Activation links are single-use and time-limited. Passwords are not stored in plaintext. Projects and files are accessible only to users of the assigned organisation, according to their role, and the 9ne.pl administrator.
WebAuthn passkeys
If you voluntarily add a passkey, the service stores its credential identifier, public key, usage counter, your chosen device name, credential type and creation and last-used dates. The service does not receive or store biometric data, the device PIN or the private key. User verification takes place locally on the device or in the passkey manager.
Corporate OpenID Connect sign-in
If corporate SSO is enabled for the portal, the service may process the provider identifier, immutable user identifier sub, verified email address, username, assigned groups, connection date and last sign-in date. This data is used only for authentication, linking to an individual portal account, assigning the configured role and security auditing. The provider's client secret is not stored in the user database.
Audit and deliverable versions
An audit log may be retained for administrative and project operations. It contains the event time, actor type and identifier, operation type, resource identifier and technical change details. Entries are linked by cryptographic hashes to detect later modification of the history. Project deliverable files may have a logical name, version number, publication status, release note and link to the previous version.
Technical data
The server may process your IP address, request date and time, requested URL, HTTP response code, browser information and operating system. This data appears in Nginx technical logs and is used to protect the website, diagnose errors and limit automated spam.
The form's rate limiter keeps the IP address only in the running application's memory for the duration of the limiting window. The IP address is not included in the message sent through the form.
Processing purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Responding to an enquiry, preparing a scope of work or taking steps before entering into a contract. | Article 6(1)(b) GDPR. |
| Managing correspondence, organising work, protecting the website and establishing, exercising or defending legal claims. | Article 6(1)(f) GDPR — the controller's legitimate interests. |
| Providing project progress, milestones, updates and secure file exchange to the customer through the private portal. | Article 6(1)(b) GDPR — performance of a contract or related activities. |
| Authentication with passkeys and corporate OpenID Connect SSO, integrity checks for operation history and unambiguous versioning of project deliverables. | Article 6(1)(b) and (f) GDPR — performance of a contract and legitimate interests in account protection, accountability and secure collaboration. |
| Meeting accounting, tax and other legal obligations if we work together. | Article 6(1)(c) GDPR. |
Your name, email address and message are necessary to handle the form. Phone number and subject are optional. No decisions are made solely by automated means, and no profiling is performed.
Recipients and processing locations
Data may be entrusted only to parties needed to operate the website and handle enquiries, particularly the hosting/VPS provider, email operator, configured OpenID Connect identity provider and providers of IT, accounting or legal support. They receive data only to the extent necessary for their tasks.
Data is processed primarily within the European Economic Area. If the chosen infrastructure or email provider transfers data outside the EEA, this will take place only using a mechanism under Chapter V GDPR, and this policy will be updated accordingly.
Retention periods
- enquiries that do not lead to collaboration — generally up to 12 months after the last contact; records marked completed or archived may be deleted automatically according to the configured CRM retention,
- contract-related correspondence — for the duration of the collaboration and then for the period required by law or needed to defend claims,
- portal accounts, project information and files — throughout the collaboration and for a reasonable period afterwards to receive materials, settle accounts and handle claims; an account may be disabled earlier and data deleted or anonymised if no further basis for retention exists,
- single-use portal invitations — until used, revoked or their configured expiry date,
- passkeys and OIDC links — until deleted by the user, the account is disabled or access is no longer needed; short-lived WebAuthn challenges and OIDC state/nonce transactions expire automatically,
- audit logs and deliverable version metadata — for the collaboration period and the time needed for accountability, acceptance, claims and system security,
- data used by the in-memory form limiter — for the configured limiting window, by default no more than 1 hour,
- Nginx access logs — for the period set by log rotation configuration and no longer than needed for security and diagnostics; incident-related data may be kept longer until the incident is explained.
Your rights
Within the scope provided by GDPR, you may request access, rectification, erasure, restriction of processing or data portability. You may also object to processing based on legitimate interests.
You can send your request to kontakt@9ne.pl. To protect your data, I may request identity verification. You also have the right to lodge a complaint with the President of the Polish Personal Data Protection Office.
Data security
The website uses encrypted HTTPS connections, limited application exposure, rate limiting, form validation and access controls for the server environment. Application logging is limited, and form content is not stored in application logs.
The CRM panel and customer portal are protected by strong password hashes, signed HttpOnly sessions, CSRF tokens and additional sign-in attempt limits. Optional SSO uses Authorization Code Flow with PKCE, single-use state, nonce and cryptographic verification of the provider token. The database and portal files reside in a private server volume and are covered by controlled backups and integrity checks.
Optional passkeys use WebAuthn public-key cryptography and require user verification through the device's security mechanism. Single-use challenges are time-limited and cannot be reused. The audit log's hash chain helps detect unauthorised changes to stored history, but does not replace backups or access controls.
No method of transmitting or storing data guarantees absolute security. If an incident is detected, measures are taken to limit its effects and meet applicable legal obligations.
Policy changes and contact
This policy describes the current website configuration. It may change when new features or external services are added, or data processing changes. The current version is always published at this address with its update date.
Have a question about your data?
Email kontakt@9ne.pl