Privacy policy

This policy explains which personal data dopascal.com processes, why, for how long, and what rights you have. It covers the website, user accounts, the closed beta, the newsletter and messages you exchange with us.

1. Controller

The controller of your personal data is Maciej Izak (“we”). For anything concerning your data, write to dathox.com@gmail.com.

2. What we process

• Account: your email address, your password (stored only as a salted hash, never in readable form), when the account was created, whether your email address is confirmed, your language and the time of your last login.
• Two-factor authentication: if you turn it on, the authenticator key and your recovery codes.
• Beta access: whether you have access and when it was granted.
• Sign-up source: if you registered through a link with a source label (for example a link shown at a talk), that label.
• Newsletter: whether and when you agreed to receive it, which version of the consent text you agreed to, and when you withdrew your consent. If you tick the newsletter box when you sign up, your consent counts from the moment you confirm your email address. If you answer “No, thanks” to the newsletter question on your account page, we store when you did so, so that we do not ask again.
• Emails we send you: for each message, its type, the recipient address, its sending status and when it was sent. We delete the content of a message from our database once it has been sent; the email provider does not store message content, only a delivery log for a limited time (see section 7).
• Messages you send us: if you write to us, for example to the contact address or by replying to one of our emails, your email address, your message and our reply.
• Technical data: your IP address is processed while you use the site, to deliver the pages you request and to limit the number of requests (protection against abuse). The application does not store it, and the server keeps no access logs of your visits. System and application logs (errors, service events, and account events such as sign-ups, logins and beta downloads, recorded with the account’s internal ID) are kept for 30 days; they never contain passwords, and the application writes email addresses to them only masked (for example j***@example.com).

3. Purposes and legal bases

• Your account and the closed beta: creating and running your account (including remembering your answer to the newsletter question), keeping you on the beta waiting list, granting access, and sending you service messages about beta access and about the release of the beta or compiler you signed up for. Legal basis: Art. 6(1)(b) GDPR, performance of the contract for using the service and steps taken at your request before entering into it.
• Newsletter: only with your consent, Art. 6(1)(a) GDPR. You can withdraw it at any time on your account page or with the unsubscribe link in every newsletter. Withdrawal does not affect the lawfulness of processing before it.
• Security: protecting the service and your data against abuse (request limits, a temporary lockout after repeated failed logins), logs and backups. Legal basis: our legitimate interest in a secure service, Art. 6(1)(f) GDPR.
• Sign-up statistics: counting sign-ups by source label, to see which talks and links bring people to DoPascal. Legal basis: our legitimate interest in knowing how people find the project, Art. 6(1)(f) GDPR.
• Accountability: records of newsletter consents and their withdrawal, and records of administrative actions concerning your account, so that we can show how your consent and your account were handled (Art. 5(2) and Art. 7(1) GDPR). Legal basis: our legitimate interest in being able to demonstrate this, Art. 6(1)(f) GDPR.
• Correspondence: answering your messages and handling your requests. Legal basis: our legitimate interest in answering the people who write to us, Art. 6(1)(f) GDPR; for requests to exercise your rights under the GDPR, also our legal obligation to handle them, Art. 6(1)(c) GDPR.

4. Cookies

We use only cookies that are strictly necessary for the site to work, so they do not require consent. There are no analytics, advertising or tracking cookies, and the site loads nothing from third parties: fonts and scripts are served by dopascal.com itself.

5. Recipients

These providers process your data on our behalf, under data processing agreements (Art. 28 GDPR):

• OVH Sp. z o.o., ul. Swobodna 1, 50-088 Wrocław: hosting of the server, the database and the backups;
• Sendinblue SAS (Brevo), Paris: email delivery; it receives your email address and the messages we send you.

Open and click tracking by the email provider. The provider adds an invisible image to the HTML version of our emails and routes the links in them through its own servers. When you open such an email with images shown, or click one of its links, the provider’s servers receive the request, including your IP address and information about your email program, and the provider records the open or the click together with your email address. We do not use these records for marketing or to profile you. If you do not want opens to be recorded, turn off automatic loading of images in your email program.

Our contact mailbox. Our contact address, dathox.com@gmail.com, is a Gmail mailbox. The messages you send to it, including replies to our emails and unsubscribe requests sent by email, are stored by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), which provides Gmail under its own terms and privacy policy, not under a data processing agreement with us.

We do not sell your data and do not share it with anyone for marketing. We disclose it to public authorities only when the law requires us to.

6. Transfers outside the EEA

The hosting and email providers listed above are established in the European Union. If a sub-processor of either provider transfers data outside the European Economic Area, it may do so only with the safeguards required by Chapter V GDPR, such as an adequacy decision of the European Commission or standard contractual clauses.

Google may process the messages sent to our Gmail address outside the European Economic Area as well, including in the United States. Google LLC is certified under the EU-U.S. Data Privacy Framework, for which the European Commission adopted an adequacy decision on 10 July 2023.

7. How long we keep data

• Account data: until you delete your account.
• Accounts whose email address is never confirmed: deleted automatically after 14 days.
• Newsletter consent records: as long as the account exists, also after you withdraw, so that the consent and its withdrawal can be shown. After the account is deleted, each record is kept until it is 365 days old and refers to the account only by its internal ID.
• Records of sent emails: 30 days. We delete the content of a message from our database as soon as it has been sent or has finally failed. A message that waits too long is cancelled and loses its content: a password reset email after 2 hours, other account emails after 7 days. The email provider does not store the content of sent messages; it keeps a delivery log of each message (recipient address, subject, delivery events) for 1 month.
• Backups: each backup is deleted after 14 days. Data you delete disappears from the backups within 15 days.
• Server logs: 30 days.
• Records of administrative actions (for example “beta access granted”): 365 days. They identify your account by its internal ID and a partly hidden email address (first letter and domain, for example j***@example.com), never by the full address, and they stay until this period ends, also after your account is deleted.
• Messages you exchange with us: 12 months after the matter has been dealt with.

8. Your rights

You have the right to access your data (Art. 15 GDPR), to have it corrected (Art. 16) or erased (Art. 17), to restrict its processing (Art. 18) and to data portability (Art. 20). You can withdraw consent at any time (Art. 7(3)).

Right to object. You can object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest (Art. 21(1) GDPR), that is, processing for security, sign-up statistics, accountability and correspondence. We then stop that processing unless we demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or need the data to establish, exercise or defend legal claims. To object, write to dathox.com@gmail.com.

You can do two things yourself on your account page. The export gives you a JSON file with your account data, your consent records, the record of emails sent to you and the administrative actions concerning your account. Account deletion removes your account and its data from our database immediately and from backups within 15 days; the logs and records that section 7 keeps after deletion, and the email provider’s delivery logs, are deleted when their periods end. For anything else, write to dathox.com@gmail.com.

You also have the right to lodge a complaint with a supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa. You can also complain to the authority of the EU country where you live or work.

9. Is providing data required?

No, it is voluntary. Without an email address and a password, however, we cannot create an account or give you beta access. The newsletter is optional and does not affect beta access.

10. Automated decisions

We do not make automated decisions about you and do not profile you (Art. 22 GDPR). Beta access is granted by a person.

11. Changes to this policy

When this policy changes, we publish the new version on this page with a new date.