Privacy policy

Controller and contact

The controller of your personal data is BCF Software Sp. z o.o., ul. Technologiczna 2, 45-837 Opole, Poland, entered in the National Court Register (KRS) under number 0000634606, NIP PL 7543126298, REGON 365280382.

For any question about your data or to exercise your rights, write to contact@bcf-software.pl or by post to the address above, marked “Personal data”.

Contact form and e-mail enquiries

• Data: name, company, e-mail address, your message, the selected topic and language, and the page the form was sent from.
• Purpose: to answer your enquiry, conduct business talks and prepare an offer.
• Legal basis: Art. 6(1)(b) GDPR (steps taken at your request before entering into a contract) and Art. 6(1)(f) GDPR (our legitimate interest in answering business enquiries and communicating with people who represent our clients).
• Retention: until your matter is closed, then up to 3 years from our last contact to establish, pursue or defend claims. If we conclude a contract, the data becomes part of its documentation and is kept for the term of the contract and the periods that tax and accounting law require afterwards.

CRA engineering checklist

• Data: e-mail address, company name and language.
• Purpose: to give you the checklist (the download link is valid for 24 hours) and to record that you requested it.
• Legal basis: Art. 6(1)(b) GDPR (providing the material you asked for).
• Retention: up to 12 months from the request, to answer questions about the checklist. Requesting the checklist does not mean you agree to marketing: we send you e-mails about our services only if you tick the separate, optional consent described below.

Marketing e-mails (optional)

• Data: e-mail address and company name.
• Purpose: to send you information about Cyber Resilience Act compliance and our embedded engineering services.
• Legal basis: your consent, Art. 6(1)(a) GDPR, together with the consent to receiving commercial information by e-mail under the Polish Electronic Communications Law (Prawo komunikacji elektronicznej).
• Retention: until you withdraw consent or object. We then keep a record of when consent was given and withdrawn for up to 3 years to demonstrate compliance (Art. 6(1)(f) GDPR). You can withdraw at any time by replying to any of our e-mails or writing to contact@bcf-software.pl.

Recruitment

• If you write to us about a job (for example via the “Careers” topic of the contact form), we process the data you send for the recruitment you apply for: Art. 6(1)(b) GDPR and Art. 22¹ of the Polish Labour Code; any further data you provide on your own initiative - on the basis of your consent, Art. 6(1)(a) GDPR.
• Retention: until the recruitment ends. We keep your application for future recruitments, for up to 12 months, only if you consent to it.

Finding the office nearest to you (IP address)

The office map on our pages highlights the BCF office nearest to you. When the page loads, your browser asks our server for that office, and the server uses the IP address of the request to estimate your approximate location, usually at city level.

If our hosting infrastructure already provides an approximate location for the request, we use it. Otherwise the server sends the IP address to the geolocation service GeoJS (get.geojs.io), which returns approximate coordinates. We compare them with the locations of our offices (Opole, Wroclaw, Warsaw, Schwäbisch Hall, London) and send only the name of the nearest office back to your browser.

We do not store your location, write it to logs or combine it with other data, and we do not use it for analytics, advertising or profiling. To avoid repeating the lookup, the server keeps the pair “IP address - nearest office” in its memory for up to 1 hour; it is then deleted, and also when the server restarts. No cookie is set and nothing is saved on your device. Addresses of private and local networks are never looked up.

Legal basis: Art. 6(1)(f) GDPR - our legitimate interest in showing you the office and contact details most relevant to you. If your browser sends a Global Privacy Control or Do Not Track signal, the lookup is not made. You can also object to it (Art. 21 GDPR) by writing to contact@bcf-software.pl. Without the lookup the map works the same, just without a highlighted office. If you use a VPN or a proxy, the office shown corresponds to its location.

The map itself is loaded from OpenFreeMap (tiles.openfreemap.org), which serves OpenStreetMap map tiles. Like any server, it receives your IP address and browser data when your browser downloads the tiles; it sets no cookies. Clicking an office pin opens Google Maps in a new tab, where Google's privacy policy applies.

Website operation and security

• Data: IP address, date and time of the request, the address requested and browser data.
• Purpose: to deliver the website, protect it and its forms from abuse (for example, at most 5 enquiries from one IP address in 10 minutes) and investigate faults.
• Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a secure, working website).
• Retention: form limits are counted in server memory for 10 minutes. Server logs are kept only as long as needed to detect and investigate security incidents and faults, and are then deleted.

Analytics and marketing tools

We do not use analytics or marketing tools on this website, and it stores nothing that requires your consent. Before we turn any such tool on, we will describe it here and in the cookie policy and ask for your consent.

Recipients

• Providers who process data on our behalf and on our instructions, under data processing agreements (Art. 28 GDPR): hosting and server infrastructure, e-mail delivery of form messages, the CRM system in which we record enquiries, and IT support.
• Recipients of technical data needed to run individual website functions: GeoJS (the IP address for the nearest-office lookup) and OpenFreeMap (map tiles).
• Our legal, tax and accounting advisers, bound by professional secrecy, and public authorities when the law requires it.
• We do not sell personal data.

Transfers outside the European Economic Area

GeoJS and OpenFreeMap may answer requests from servers outside the EEA; they receive only the IP address and technical data of the request. For any other provider that processes your data outside the EEA, we rely on an adequacy decision or the Standard Contractual Clauses. You can ask us for information about these safeguards at contact@bcf-software.pl.

Your rights

• Access to your data and a copy of it (Art. 15 GDPR).
• Rectification of inaccurate data (Art. 16 GDPR).
• Erasure (Art. 17 GDPR) and restriction of processing (Art. 18 GDPR).
• Data portability (Art. 20 GDPR) - for data you gave us that we process on the basis of consent or a contract, by automated means.
• Objection (Art. 21 GDPR) to processing based on our legitimate interest, on grounds relating to your particular situation, and at any time to direct marketing.
• Withdrawal of consent at any time (Art. 7(3) GDPR), without affecting the lawfulness of processing before the withdrawal.
• A complaint to a supervisory authority: in Poland, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl, or the authority in the EU country where you live or work.
• We reply within one month of receiving your request; in complex cases this may be extended by two further months, and we will tell you if so (Art. 12(3) GDPR).

Is providing data required?

Providing data is voluntary. Without your name, e-mail address and message we cannot answer an enquiry, and without an e-mail address and company name we cannot send you the checklist. Consent to marketing e-mails is optional and is never a condition for receiving the checklist.

We do not make decisions based solely on automated processing, including profiling, that produce legal effects for you or similarly significantly affect you (Art. 22 GDPR). Picking the nearest office on the map is automatic but has no such effect.

Security and changes to this policy

We protect personal data with technical and organisational measures appropriate to the risk, including encrypted connections (HTTPS) and access limited to the people who need it for their work.

We update this policy when the way we process data changes; the date of the current version is shown at the top of the page. Previous versions are available on request.