ProductsModulesPricingBlogAbout PL Log in See demo

Last updated: 13 October 2026

Privacy Policy

This is a translation provided for convenience. The Polish version of this document is the legally binding original.

This policy describes how the operator of the RealSec platform processes your personal data when you use the platform, our website, the contact form, the newsletter, and related services. This document complies with GDPR (Regulation 2016/679) Articles 13 and 14.

1. Data Controller

The controller is Błażej Lewartowski, a sole trader registered in the Polish CEIDG under the business name Błażej Lewartowski, ul. Świeradowska 47, 02-662 Warszawa, Poland, VAT ID (NIP) PL5242414096, REGON 382843314, e-mail [email protected], phone +48 787 782 214. The controller has not appointed a Data Protection Officer; for personal data matters write to [email protected].

2. Purposes and Legal Bases

We process your data for the following purposes:

  • Service delivery (platform login, account management) ; Art. 6(1)(b) GDPR (contract)
  • Business communication (contact form, email, phone) ; Art. 6(1)(f) GDPR (legitimate interest)
  • Marketing of own services (newsletter, if you sign up voluntarily; details in section 6) ; Art. 6(1)(a) GDPR (consent)
  • Proof of newsletter consent (after it is withdrawn) ; Art. 6(1)(f) GDPR (legitimate interest: demonstrating lawful processing and defending against claims)
  • Legal obligations (accounting, archiving) ; Art. 6(1)(c) GDPR
  • System security (logs, audit, abuse detection) ; Art. 6(1)(f) GDPR

3. Recipients

We share your data only with trusted sub-processors:

  • Hetzner Online GmbH (DE) ; hosting and data storage
  • Cloudflare Inc. ; CDN, DDoS protection, TLS termination
  • Migadu-Mail GmbH (Switzerland) ; e-mail for the realsec.pl domain, including replies to messages sent from [email protected]
  • Sendinblue SAS (Brevo, France) ; newsletter and sign-up confirmation e-mails, storage of the subscriber list; data stays in the EEA
  • accounting office ; bookkeeping

All entities have signed a Data Processing Agreement (DPA).

4. Transfers Outside the EEA

The newsletter subscriber list is stored by Brevo in the EEA. E-mail (Migadu) is processed in Switzerland, which is covered by a European Commission adequacy decision. We use providers based in the USA (Cloudflare). Transfers are carried out on the basis of Standard Contractual Clauses (SCCs) adopted by the European Commission and the Data Privacy Framework (DPF) for certified entities.

5. Retention Periods

  • User account data ; for the duration of the contract + 12 months after termination
  • Contact data (form submissions) ; 24 months or until consent is withdrawn
  • Newsletter ; until consent is withdrawn; an unconfirmed sign-up expires after 2 days; proof of consent (e-mail address, consent text version, source, time of sign-up, confirmation and unsubscribe) until the limitation period for claims expires
  • Audit logs ; 12 months
  • Accounting records ; 5 years (Polish Tax Ordinance, Art. 86)

6. Newsletter

The RealSec newsletter covers DORA, NIS2, GDPR and related regulations and includes commercial information about our products and services. You can sign up with a form on realsec.pl (footer, home page, the boxes next to downloadable materials and the gap assessment tools) and in the shop at sklep.realsec.pl (footer or a separate, optional box when ordering). Signing up is never a condition of a purchase or of using any service.

Each of our brands has its own list and its own consent. The RealSec newsletter (realsec.pl and sklep.realsec.pl) is a different list from the Iodynka newsletter (iodynka.pl); signing up to one does not sign you up to the other. The Iodynka newsletter is described in the privacy policy on iodynka.pl.

  • What data ; your e-mail address and the data we store as proof of consent (contact attributes in Brevo): CONSENT_VERSION (the version of the consent text you ticked, e.g. rs-site-2026-10a), CONSENT_AT (time you gave consent), CONFIRMED_AT (time you confirmed via the link), SOURCE (the form or page you used), and after unsubscribing the time of unsubscribing. Times are stored in ISO 8601 format, in UTC.
  • Double opt-in ; after you submit the form, RealSec ([email protected]) sends you an e-mail with a confirmation link. Only clicking the link adds the address to the list. The link is valid for 2 days; without confirmation we send no newsletter.
  • Topical lists ; a sign-up from the gap assessment tools (ISO 27001, DORA, NIS2) also adds the address to a RealSec topical list for users of those tools, and a sign-up next to the ICT supplier materials adds it to the supplier list, from which we send a short series of a few messages (bank questionnaire, contract annex, subcontractors, incidents, package offer). This is still the RealSec newsletter covered by the same consent; we tailor topics to where you signed up, but we do not profile subscribers. The unsubscribe link in every RealSec message removes you from all RealSec lists.
  • Sending statistics ; Brevo counts opens and clicks only in aggregate, without linking them to any individual (anonymous tracking); we do not build recipient profiles.
  • Legal basis ; your consent (Art. 6(1)(a) GDPR) and the consent to receive commercial information by electronic means required by the Polish Electronic Communications Law.
  • Withdrawing consent ; at any time, via the unsubscribe link in every message or by writing to [email protected]. Withdrawal does not affect the lawfulness of processing carried out before it.
  • How long ; until you withdraw consent. After unsubscribing we keep the proof of consent (e-mail address, CONSENT_VERSION, CONSENT_AT, CONFIRMED_AT, SOURCE and the time of unsubscribing) until the limitation period for claims expires, based on our legitimate interest (Art. 6(1)(f) GDPR), solely to demonstrate that our messages were sent lawfully; we no longer send you the newsletter.
  • Who processes it ; the subscriber list is kept and the newsletter is sent by Sendinblue SAS (Brevo), Paris, France, as a processor under a data processing agreement; the data stays in the EEA. The forms send your address to our server at realsec.pl, which then passes it to Brevo; your browser never connects to Brevo. If you reply to a message, the reply lands in our mailbox at Migadu-Mail GmbH (Switzerland, European Commission adequacy decision).
  • Voluntary ; providing the address is voluntary, but without it we cannot send the newsletter. We do not profile subscribers or make automated decisions about them.

7. Your Rights

Under GDPR you have the right to:

  • access your data (Art. 15)
  • rectify inaccurate data (Art. 16)
  • erasure of data (Art. 17, "right to be forgotten")
  • restriction of processing (Art. 18)
  • data portability for data processed under a contract or consent, including your newsletter address (Art. 20)
  • object to processing (Art. 21)
  • withdraw consent at any time
  • lodge a complaint with the Polish DPA (UODO) (Urząd Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland)

To exercise your rights, write to [email protected]. We respond within 30 days.

8. Cookies

Detailed information about cookies is available in our cookie policy.

9. Changes to This Policy

This policy may be updated. We notify registered users of changes by email and via this page. The date of the last update is shown at the top of this document.