Privacy Policy

1. Information we process

This policy covers visits to the NorroSoft website and enquiries sent to us. The company identified above is the controller. It explains our handling of personal data under the General Data Protection Regulation (GDPR) and applicable Polish data protection law. Processing within a commissioned client project may require separate information and contractual arrangements.

When you contact us, we receive your name, email address, enquiry topic and message, plus your company name if supplied. Email correspondence can contain other information you choose to send. The enquiry form, when available, emails these details to us; it does not create a customer account or save enquiries in a website database. If the form is unavailable, email [email protected].

The Start a Project form also lets you describe the services, project stage, industry, goals, intended users, features, platforms, existing materials, public reference links, integrations, preferred support, timing, role, country or time zone, contact preference and additional notes. We receive these details when you submit the brief to us or email it. The guided form does not upload your existing files or create an account.

When you submit either website form, the email sent to us also includes your selected website language, the submission date and time (Europe/Warsaw), and the IP address recorded by our server for the connection.

Providing enquiry information is voluntary. Each form marks optional fields and identifies the details needed to understand and answer the request. Contact requires a name, valid email, topic and message; Start a Project requires a name, valid email and the core project choices. The project problem description and company information are optional. Without contact details or sufficient information, we may be unable to respond. Please limit your message to what the enquiry needs.

The project wizard lets you review your answers before submitting them to NorroSoft. It does not save your answers in browser local storage or session storage.

Website requests also involve an IP address, requested URL, date and time, and technical response information. Hosting systems may record request and error logs. Form protection uses a session token and an IP-derived hash with submission timestamps and counts.

2. Purposes and legal bases

• Your prospective contract: when you ask us to take steps towards a contract with you personally, we process the necessary enquiry information under Article 6(1)(b) GDPR.
• General and business enquiries: correspondence, including with someone representing a company, relies on Article 6(1)(f). Our legitimate interest is answering questions and managing business relationships.
• Website operation and protection: serving pages, remembering requested settings, diagnosing problems and preventing abuse rely on Article 6(1)(f), reflecting our interests in a usable, reliable website and secure communications.
• Required records and claims: Article 6(1)(c) applies where a specific legal duty requires records, such as applicable Polish accounting or tax requirements. Necessary evidence for establishing, exercising or defending claims relies on Article 6(1)(f).

Sending an enquiry does not subscribe you to marketing. This website currently has no analytics or advertising tracking, operational account registration or newsletter subscription service. Search terms are matched against our page index in your browser and are not sent to our search endpoint.

3. Cookies and browser storage

We use the following storage for language selection, enquiry-form protection and restoring your reading position.

Browser restoration settings can preserve sessions across a restart. You can delete or block cookies and clear site storage through your browser. Blocking storage may prevent language persistence, contact submission or scroll restoration. We do not use persistent local storage for visitor profiles.

4. Providers and external services

People handling your enquiry within NorroSoft may access the information needed for their work. Relevant recipient categories are hosting and technical support providers, email providers, professional advisers where advice or a claim requires it, and public authorities where disclosure is legally required. A provider's role depends on the service: some process information on our behalf, while others have their own legal responsibilities.

Google Fonts: this website loads fonts from Google automatically when a page requests them. Your browser connects to Google's font servers, which receive your IP address and technical request information; browser settings affect what other headers accompany the request. See the Google Fonts privacy FAQ and Google Privacy Policy for Google's explanation of its processing.

The About page offers ordinary links for sharing through Facebook and Twitter/X. Following one opens that provider's service with the page URL and, where applicable, title. That service then handles your interaction under its own privacy terms; we do not embed its social tracking scripts.

5. International processing

Google describes worldwide infrastructure in its privacy policy, so requests for remotely hosted fonts may involve processing outside the European Economic Area. Google's data-transfer framework notice explains its use of adequacy decisions, Data Privacy Framework certification and standard contractual clauses where applicable. Other processing locations depend on the hosting, email and support arrangements used for the relevant service.

For transfers we arrange outside the EEA, an applicable GDPR transfer mechanism is required. This may be a European Commission adequacy decision covering the recipient, or appropriate safeguards such as standard contractual clauses with any necessary supplementary measures. These mechanisms are explained in the EDPB guide to international transfers. Contact [email protected] to ask about the recipients, locations and safeguards relevant to your data, including how to obtain a copy where applicable.

6. How long information is kept

Retention depends on the reason for keeping a record. Our criteria are:

• Enquiries and correspondence: while we deal with the enquiry and reasonably expected follow-up. Afterwards, retain only information needed for an ongoing relationship, an unresolved issue, an applicable legal obligation or a relevant claim.
• Contractual or mandatory records: for the applicable legal period and, where necessary, until a related dispute or proceeding is resolved. A general enquiry does not automatically become an accounting record.
• Technical and security records: for troubleshooting, investigating incidents and protecting the service, considering the event, continuing risk and whether identifiable information is still needed.

Rate-limit hashes, timestamps and counts are stored in server temporary files. The rate limiter does not automatically delete these files; removal depends on server housekeeping. Its one-hour counting window is not a deletion deadline. Email, logs, sessions and backups also depend on the systems holding them; no single automatic deletion interval applies to all records. You can ask which retention criteria apply to your information.

7. Your rights

Contact [email protected] or write to the registered address above to exercise your rights. Depending on the circumstances, you may:

• Request access to your personal data and a copy, or correction of inaccurate or incomplete information.
• Request erasure or restriction of processing where the GDPR conditions apply.
• Object to processing based on legitimate interests for reasons relating to your situation. We must stop unless overriding compelling grounds or legal claims justify continuing.
• Request portability of data you provided where processing is automated and based on consent or your contract, including direct transfer where technically feasible.
• Withdraw consent at any time if a particular activity relies on consent, without affecting earlier lawful processing.

We may need proportionate information to confirm your identity. We normally respond within one month and explain any permitted extension. See the EDPB explanation of individual rights.

We do not use your website or enquiry data for decisions based solely on automated processing that produce legal or similarly significant effects on you, including profiling of that kind.

You may complain to the President of the Polish Personal Data Protection Office (UODO), or another competent supervisory authority, particularly where you live or work or where the alleged infringement occurred. See UODO's complaint instructions. Contacting us does not remove that right.

8. Changes and contact

We will update this policy when our website or processing arrangements change and show the revision date on this page. Where required, we will provide additional information before using your data for a new purpose. Privacy questions can be sent to [email protected].