Legal · reviewed 2026-09-21
Privacy notice
[Owner: have counsel review. Written for GDPR.]
Controller
ARATIR SYSTEMS PROSTA SPÓŁKA AKCYJNA, ul. Henryka Sienkiewicza 36/5, 26-600 Radom, Poland. KRS 0001205443, NIP 9482656010, REGON 543250363, registry court: Sąd Rejonowy Lublin-Wschód w Lublinie z siedzibą w Świdniku, VI Wydział Gospodarczy Krajowego Rejestru Sądowego. Contact: hello@getdutybound.com.
What we process and why
- Newsletter and date reminders: your email address, which emails you asked for (the weekly digest, date reminders or both), for reminders the markets you ticked and the language, the date and time you subscribed, the page you subscribed from, a hashed IP address and the consent text you agreed to. Purpose: sending the weekly digest, or one email 30 days and one 7 days before each date in the markets you chose (the first reminders email, sent right away, carries the KRiBSI inspection checklist where Poland is ticked), and proving consent. We keep a hashed counter of first emails sent to an address that day, deleted after two days, to stop misuse. Legal basis: consent (Art. 6(1)(a) GDPR). Stored in our own system on Cloudflare Workers KV (Cloudflare, Inc. as processor) until you unsubscribe; after that only a suppression record. Every email carries a one-click unsubscribe link.
- Listing and contact forms: the fields you enter (name, company, website, email, message), the date and a hashed IP address, to handle your request. Legal basis: legitimate interest and pre-contractual steps (Art. 6(1)(b) and (f)). Stored on Cloudflare Workers KV and deleted 12 months after the request is closed.
- Purchases: handled by our checkout provider as merchant of record under its own privacy notice; we receive your name, email, company and licence details to deliver updates. Kept for the licence term plus the statutory accounting period.
- Free tools: run in your browser. We do not receive what you enter, unless you ask for your readiness scan result by email.
- Scan result by email: if you ask for it, we receive your email address and your scan answers (as a short code), build the result and send it once through our email provider (named under Recipients). We keep only a hashed counter of results sent to that address that day, deleted after two days, to stop misuse. Legal basis: your request (Art. 6(1)(b) GDPR). If you also tick the box below the form (the weekly digest on the English scan, date reminders for the markets in your answers on the Polish scan), you are added to that list as described above, with that consent recorded.
- Usage counts: we count page views and a few actions (for example "scan completed" or "buy button clicked") as daily totals per page, with the referring website for page views and the country the visit comes from (a two-letter code Cloudflare derives from the connection). No cookie, IP address or identifier is stored, so the counts cannot be linked to you and are not personal data. If you would rather not be counted at all, open getdutybound.com/api/notrack: it sets one cookie,
dt_notrack=1, and the counter then skips that browser. It holds no identifier and lasts two years; the same page with ?off=1 removes it. - Server logs: Cloudflare, Inc. processes standard request data (IP address, user agent, time) to deliver and protect the site. We set no cookies, apart from the do-not-count cookie above if you ask for it, and use no third-party analytics.
- On-site guide: in its default mode the guide runs entirely in your browser and sends nothing. If its AI mode is switched on, the questions you type are sent to Anthropic, PBC as our processor to generate the answer; we do not store them.
Recipients
Cloudflare, Inc. (hosting and storage), Polar Software Inc. (checkout and invoicing, as merchant of record), and Sendinblue SAS (Brevo), France, which sends the weekly digest, the date reminders and scan-result emails and receives your email address only to deliver each message. Where a provider is outside the EEA, transfers rely on the EU-US Data Privacy Framework or standard contractual clauses.
Your rights
Access, rectification, erasure, restriction, portability, objection, and withdrawal of consent, by emailing hello@getdutybound.com. You may complain to the Polish supervisory authority (UODO) or your local authority.