Privacy and cookie policy
What personal data this website processes, why, on what legal basis, for how long and who receives it, and how you can exercise your rights.
Last updated: 26 October 2026
1. Controller and contact
The controller of your personal data is BCF Software Sp. z o.o., ul. Technologiczna 2, 45-837 Opole, Poland, entered in the National Court Register (KRS) under number 0000634606, NIP PL 754 31 26 298, REGON 365280382.
For any matter concerning your personal data, including exercising your rights, write to [email protected] with “Personal data” in the subject line, or by post to the address above.
2. Scope
This policy covers the BCF Cloud & Data website and the data processed when you visit it, use the contact form, write to us by e-mail or use the offices map. Sites we link to (for example bcf-software.com, LinkedIn or Google Maps) have their own privacy policies.
3. Purposes, legal bases and retention
Each purpose below has its own legal basis under Art. 6(1) of the GDPR and its own retention period. We do not use your data for marketing, and we do not sell it.
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Replying to your enquiry sent through the contact form or by e-mail and conducting the business talks that follow | Name, company, business e-mail address, the content of your message and any other data you include in it | Art. 6(1)(a) GDPR: your consent given in the form. Where the enquiry concerns concluding a contract with us: Art. 6(1)(b) GDPR (steps taken at your request before entering into a contract) | Until the enquiry is handled and the talks end, and then for no longer than 12 months, unless you withdraw consent earlier or a contract is concluded |
| Establishing, pursuing or defending legal claims connected with our correspondence | Correspondence and the data in it | Art. 6(1)(f) GDPR: our legitimate interest in protecting our rights | Until the claims become time-barred, generally 3 years after the talks end for claims between businesses |
| Protecting the contact form against spam and abuse (limit of 5 messages per 10 minutes) | IP address and time of sending | Art. 6(1)(f) GDPR: our legitimate interest in the security of the website | Kept only in the server's memory for 10 minutes; never written to disk |
| Delivering the website and keeping it secure | IP address, date and time of the request, requested address, browser and operating system data | Art. 6(1)(f) GDPR: our legitimate interest in running a working and secure website | Technical server logs: up to 30 days, unless needed longer to investigate a security incident |
| Showing our offices on the map | IP address and browser data that your browser sends to OpenFreeMap when it loads the map tiles | Art. 6(1)(f) GDPR: our legitimate interest in showing where our offices are | We do not receive or store this data; OpenFreeMap processes it under its own rules |
| Centring the map on the office nearest to you (optional) | IP address sent to ipapi.co and the approximate location (city level) it returns | Art. 6(1)(a) GDPR: your consent given in the privacy settings. Transfer to the USA: Art. 49(1)(a) GDPR | We do not store the location: it is used only in your browser while the page is open. Your choice is remembered for 12 months |
| Website statistics: counting visits and seeing which pages are read, so we can improve the website (optional) | Pages viewed, the page you came from, time of the visit, device, browser and operating system data, approximate location (country, city) derived from your IP address, and a random identifier stored in the _ga cookies | Art. 6(1)(a) GDPR: your consent given in the privacy settings. Transfer to the USA: Art. 45 GDPR (EU-U.S. Data Privacy Framework) | Cookies: 12 months from your last visit. Statistics in Google Analytics: up to 14 months, then deleted automatically. Your choice is remembered for 12 months |
| Remembering your privacy choice and being able to demonstrate consent | Your choice and the date it was made, stored in your browser | Art. 6(1)(c) GDPR in connection with Art. 7(1) GDPR, and Art. 6(1)(f) GDPR: not asking you again on every page | 12 months, after which we ask again |
Replying to your enquiry sent through the contact form or by e-mail and conducting the business talks that follow
- Data
- Name, company, business e-mail address, the content of your message and any other data you include in it
- Legal basis
- Art. 6(1)(a) GDPR: your consent given in the form. Where the enquiry concerns concluding a contract with us: Art. 6(1)(b) GDPR (steps taken at your request before entering into a contract)
- Retention
- Until the enquiry is handled and the talks end, and then for no longer than 12 months, unless you withdraw consent earlier or a contract is concluded
Establishing, pursuing or defending legal claims connected with our correspondence
- Data
- Correspondence and the data in it
- Legal basis
- Art. 6(1)(f) GDPR: our legitimate interest in protecting our rights
- Retention
- Until the claims become time-barred, generally 3 years after the talks end for claims between businesses
Protecting the contact form against spam and abuse (limit of 5 messages per 10 minutes)
- Data
- IP address and time of sending
- Legal basis
- Art. 6(1)(f) GDPR: our legitimate interest in the security of the website
- Retention
- Kept only in the server's memory for 10 minutes; never written to disk
Delivering the website and keeping it secure
- Data
- IP address, date and time of the request, requested address, browser and operating system data
- Legal basis
- Art. 6(1)(f) GDPR: our legitimate interest in running a working and secure website
- Retention
- Technical server logs: up to 30 days, unless needed longer to investigate a security incident
Showing our offices on the map
- Data
- IP address and browser data that your browser sends to OpenFreeMap when it loads the map tiles
- Legal basis
- Art. 6(1)(f) GDPR: our legitimate interest in showing where our offices are
- Retention
- We do not receive or store this data; OpenFreeMap processes it under its own rules
Centring the map on the office nearest to you (optional)
- Data
- IP address sent to ipapi.co and the approximate location (city level) it returns
- Legal basis
- Art. 6(1)(a) GDPR: your consent given in the privacy settings. Transfer to the USA: Art. 49(1)(a) GDPR
- Retention
- We do not store the location: it is used only in your browser while the page is open. Your choice is remembered for 12 months
Website statistics: counting visits and seeing which pages are read, so we can improve the website (optional)
- Data
- Pages viewed, the page you came from, time of the visit, device, browser and operating system data, approximate location (country, city) derived from your IP address, and a random identifier stored in the _ga cookies
- Legal basis
- Art. 6(1)(a) GDPR: your consent given in the privacy settings. Transfer to the USA: Art. 45 GDPR (EU-U.S. Data Privacy Framework)
- Retention
- Cookies: 12 months from your last visit. Statistics in Google Analytics: up to 14 months, then deleted automatically. Your choice is remembered for 12 months
Remembering your privacy choice and being able to demonstrate consent
- Data
- Your choice and the date it was made, stored in your browser
- Legal basis
- Art. 6(1)(c) GDPR in connection with Art. 7(1) GDPR, and Art. 6(1)(f) GDPR: not asking you again on every page
- Retention
- 12 months, after which we ask again
4. Finding the office nearest to you by IP address
The contact section shows a map of our offices. If you switch on “Nearest office (IP location)” in the privacy settings, your browser sends a request to ipapi.co, a geolocation service operated by Kloudend, Inc. in the United States. The service receives your IP address, as with any internet request, and returns an approximate location derived from it, usually accurate to a city or region.
We use this location only in your browser to calculate which of our offices is closest and to centre the map on it. The location is not sent to our server, is not stored, is not combined with the contact form and is not used for profiling or any decision about you. Without your consent no request is sent to ipapi.co and the map shows all our offices.
Because ipapi.co is located in the United States, your IP address is transferred outside the European Economic Area. We rely on your explicit consent (Art. 49(1)(a) GDPR) for this transfer. Please note the possible risks: the USA may not ensure a level of protection equivalent to the EU, US authorities may be able to access the data, and your rights may be harder to enforce there. ipapi.co processes the request under its own privacy policy.
You can withdraw your consent at any time under “Cookie settings” in the footer. From that moment no further requests are sent; withdrawal does not affect the lawfulness of processing before it.
5. Recipients
Your data may be received by:
- our hosting provider, which runs the server of this website, and our e-mail service provider, which delivers messages from the contact form; both process data on our behalf under data processing agreements (Art. 28 GDPR);
- OpenFreeMap (openfreemap.org), which delivers the map tiles directly to your browser;
- Kloudend, Inc. (ipapi.co, USA), only if you consent to the nearest-office lookup;
- Google Ireland Limited (Ireland) and Google LLC (USA), which provide Google Analytics, only if you consent to statistics;
- IT and legal service providers, when needed to support the website or to protect our rights;
- public authorities, when we are obliged to disclose data by law.
When you click an office marker, Google Maps opens in a new tab; from then on Google processes your data under its own privacy policy. The social media icons in the footer are plain links: no data is sent to those services until you click them.
6. Transfers outside the European Economic Area
Using this website results in a transfer outside the EEA only if you switch on an optional feature. The nearest-office lookup at ipapi.co in the USA, described in section 4, relies on your explicit consent. Google Analytics data may be transferred to Google LLC in the USA; Google LLC is certified under the EU-U.S. Data Privacy Framework, so this transfer relies on the European Commission’s adequacy decision (Art. 45 GDPR). Data from the contact form and e-mails is processed by our providers within the EEA.
7. Your rights
Depending on the legal basis of the processing, you have the right to:
- access your data and receive a copy of it (Art. 15 GDPR);
- have inaccurate data rectified and incomplete data completed (Art. 16 GDPR);
- have your data erased (Art. 17 GDPR);
- restrict processing (Art. 18 GDPR);
- receive the data you provided in a structured, machine-readable format and have it sent to another controller, where processing is based on consent or a contract and carried out by automated means (Art. 20 GDPR);
- object, on grounds relating to your particular situation, to processing based on our legitimate interest (Art. 21 GDPR);
- withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal;
- lodge a complaint with the supervisory authority: the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warszawa, Poland, uodo.gov.pl, or the authority in the EU country where you live or work.
To exercise your rights, contact us as described in section 1. We reply without undue delay, and no later than within one month.
8. Providing data and automated decisions
Providing data is voluntary. Without your name, e-mail address and message we cannot reply to an enquiry sent through the form. We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.
10. Changes to this policy
We update this policy when the way we process data changes, for example when a new tool is added to the website. The date of the latest update is shown at the top of the page. If a change concerns an optional feature, we will ask for your choice again.