Open ICS Sp. z o.o. (“Open ICS”, “we” or “us”) is the controller of personal data under the GDPR. This policy covers the FinTechAPI website, its contact form and related correspondence.
1. Personal data we collect
The form asks for your name, email address, topic and message. Your organisation is optional. Providing data is voluntary, but the required information is necessary to handle an enquiry through the form. Do not send passwords, banking credentials, customer data or sensitive information.
Hosting infrastructure may process your IP address, request time, page address and browser information. Form security uses short-lived technical identifiers. The application does not store message content in public files or in its event logs.
2. Purposes and legal bases
We handle enquiries and correspondence on the basis of our legitimate interest in communicating with people interested in our activities (Article 6(1)(f) GDPR). Article 6(1)(b) may apply where an enquiry concerns steps taken at your request before entering into a contract.
Protection against spam, abuse and attacks is based on our legitimate interest in security (Article 6(1)(f)). Legal obligations are met under Article 6(1)(c). Sending an enquiry does not subscribe you to a newsletter or constitute marketing consent. When enabled, an automatic acknowledgement may be sent to the address provided; it serves contact handling, rather than marketing.
3. Recipients
Authorised Open ICS personnel and providers acting on our behalf, particularly hosting, IT infrastructure and email providers, may access data. Data may also be disclosed where required by law.
We do not sell, rent or exchange your email address. If optional Google reCAPTCHA protection is configured, its provider (Google) processes technical information for risk assessment, including the IP address and browser data. This mechanism only runs when configured by the administrator. See the Google Privacy Policy.
4. Cookies and technical services
When the form is enabled, a necessary technical cookie binds a submission attempt to the browser. We have not added advertising analytics, marketing pixels or advertising profiling. See our cookie policy.
Fonts are loaded from Google Fonts. The browser shares technical information needed to fetch them, including an IP address. A private Sites preview may also use hosting and authentication mechanisms operated by the preview provider.
5. Your rights
Subject to the GDPR, you may request access, rectification, erasure, restriction of processing and data portability. You may object to processing based on legitimate interests. Where consent is the legal basis, you may withdraw it without affecting the lawfulness of earlier processing.
Use the contact form and choose “Privacy and personal data”, or write to the controller’s postal address. We may request information necessary to verify your identity. You may complain to the President of Poland’s Personal Data Protection Office: uodo.gov.pl.
6. Retention
We retain correspondence for as long as needed to handle the matter and, where justified, establish, exercise or defend claims and meet legal obligations. The period depends on the matter, subsequent cooperation and applicable legal time limits.
The technical form cookie lasts 30 minutes. Submission tokens expire after 20 minutes and anti-spam rate windows last 15 minutes. Security state is held in server memory without message content. Hosting logs and the mailbox follow the retention rules of their respective infrastructure.
7. Security and automation
We use technical and organisational measures appropriate to the processing. Form protections include validation, request limits and token verification. Form messages are not used for automated decisions producing legal or similarly significant effects on users.
8. Transfers outside the EEA
The main correspondence processing arrangements depend on the hosting and email providers selected by Open ICS. Google Fonts, optional Google reCAPTCHA or a private Sites preview may involve processing outside the European Economic Area. Where required, GDPR mechanisms such as applicable adequacy decisions or standard contractual clauses are used. Contact the controller for information about safeguards.
9. Policy changes
We update this policy when website features or processing arrangements change. The document date records a policy change and is separate from the automatically updated copyright year.