Privacy Policy — TonMiro Systems

1. Who the controller is

The controller of personal data is Lexine Gawek i Kielar spółka jawna with its registered office in Kraków, ul. Witkowicka 82, 31-242 Kraków, Poland, KRS 0000335571, NIP 7010197031, which operates the tonmiro.com website and the TonMiro Systems service ("we", "the Controller").
Contact regarding personal data: e-mail info@tonmiro.com, telephone +48 797 533 645, or by post to the registered office.
We have not appointed a data protection officer. Data protection matters are handled by the person responsible for security in our team; all requests referred to in paragraph 2 above are directed to that person.

2. Two roles: controller and processor

Depending on which data is concerned, we act in one of two roles:

Which data	Our role	What it means
Data of website visitors, people submitting forms, participants of presentations, contact persons and representatives of customers, partners in the referral programme, invoicing data; system infrastructure security logs (IP address, time and result of user logins)	Controller	We decide ourselves why and how we process this data. This Policy applies to it in full.
Data entered into the TonMiro Systems system by a customer and its employees: user accounts (login, role, e-mail), employees, drivers, operators, contractors, suppliers, registration numbers, weighings, refuellings, photographs of documents, history of actions in the system, etc.	Processor	The controller of this data is our customer (the plant). We process it solely on the customer's instructions and on the basis of the Data Processing Agreement. Persons whose data is in the system exercise their GDPR rights towards the customer; we assist the customer in this.

3. Whose data and where we get it

Website visitors — IP address, browser and device data, pages visited, time of visit (server logs, section 12). Source: automatically from your browser.
People submitting the contact form or requesting a demo — name and surname, company name, e-mail, telephone, message content, "how did you hear about the system". Source: from you.
People contacting us by e-mail or telephone — data provided in the correspondence or conversation. Source: from you.
Representatives and contact persons of customers — name and surname, position, e-mail, telephone, company data, cooperation history, invoicing data. Source: from you or from your employer (the customer), or from public registers (KRS, CEIDG).
System users — account data (login, name and surname, role, business e-mail) and the history of actions in the system are processed by us as a processor: the customer decides who gets an account and with what permissions (section 2), even where we technically create the account. Only the infrastructure security logs (IP address, time and result of login) are processed by us as a controller — for our own purpose of protecting the system against abuse (Art. 6(1)(f) GDPR), for up to 90 days. Source: from the customer and automatically from the system.
Participants of the partner programme — data of the Partner necessary for participation in the programme and settlement of commission (business details, name and surname of the contact person, e-mail, telephone, bank account number and details of the settlement document; commission is settled exclusively with businesses) and data of the referred customer (company name, contact person). Source: from the partner; data of the referred customer — from the partner and from the customer itself.
People providing opinions and recommendations — name, surname, position, company, content of the opinion, link to a professional profile. Source: from you, with your consent.

4. Purposes, legal bases and retention periods

Purpose	Legal basis (GDPR)	How long
Replying to a form, e-mail or telephone enquiry; arranging and conducting a presentation	Art. 6(1)(b) — steps prior to entering into a contract at your request; Art. 6(1)(f) — our legitimate interest (handling enquiries)	until the matter is closed, then up to 12 months in case talks resume; if a contract is concluded — as below
Concluding and performing the agreement for use of the system: creating accounts, implementation, support, communication	Art. 6(1)(b) — contract (where the customer is a natural person); Art. 6(1)(f) — contact with representatives and employees of a customer that is a company	for the term of the agreement and, after its end, in accordance with § 12 of the Terms of Service: export within 14 days; for an agreement that lasted at least 12 months, read-only access indefinitely (until the customer requests otherwise or the service ends), for a shorter one — deletion after 90 days; settlement data — as for invoices
Issuing invoices, accounting, tax settlements	Art. 6(1)(c) — legal obligation (Accounting Act, tax acts)	for the period required by tax and accounting law — as a rule until the tax liability becomes time-barred (usually 5 years from the end of the calendar year in which the tax payment deadline expired), taking into account any suspension or interruption of that period
Establishing, pursuing and defending claims	Art. 6(1)(f) — legitimate interest	until limitation periods expire (usually 3 years for business claims, 6 years for claims confirmed by a judgment)
Own marketing: informing current and former customers about new modules and changes in the system	Art. 6(1)(f) — legitimate interest (direct marketing of own services); sending commercial information by e-mail, phone or SMS takes place in accordance with Article 398 of the Polish Electronic Communications Law, after obtaining the required prior consent	until objection or withdrawal of consent, no longer than 3 years from the last contact
Newsletter (if we launch one)	Art. 6(1)(a) GDPR — consent; dispatch additionally in accordance with Article 398 of the Polish Electronic Communications Law	until consent is withdrawn
Partner programme: accepting a referral, verification, calculating and paying commission	Art. 6(1)(b) — contract with the partner; Art. 6(1)(c) — tax settlements; Art. 6(1)(f) — verifying the referral with the customer	for the duration of participation in the programme, then as for invoices and claims
Publishing opinions and recommendations on the website	Art. 6(1)(a) — consent	until consent is withdrawn
Ensuring the security of the website and the system, detecting abuse, backups	Art. 6(1)(f) — legitimate interest	logs: up to 90 days; backups: according to the rotation cycle described in the Terms
Website visit statistics (we do not currently keep any; if enabled — anonymous, without cookies, or with consent)	Art. 6(1)(f) or Art. 6(1)(a)	anonymous data, or data aggregated in a way that makes identification of a person impossible (not personal data) — indefinitely

5. Recipients of data

Data may be transferred to entities supporting our business, only to the extent necessary and on the basis of agreements:
- hosting and infrastructure — cyberfolks.pl (cyber_Folks S.A., Poznań; formerly kei.pl) — servers in Poland;
- e-mail — @tonmiro.com mailboxes with the same provider, cyberfolks.pl (servers in Poland);
- accounting and invoicing — the accounting office serving the Service Provider (invoicing and settlement data only);
- legal services — in the event of a dispute;
- providers of IT tools used for developing and maintaining the system — where, in connection with their services, they process personal data on our behalf, on the basis of an appropriate data processing agreement;
- payment operators — if we introduce online payments in the future.
Data may be disclosed to public authorities on the basis of legal provisions (e.g. tax office, court, police) — only at their request having a legal basis.
We do not sell personal data and do not share it for the marketing purposes of other entities.

6. Transfers outside the European Economic Area

Customer data processed as part of hosting the website and the TonMiro Systems system is stored on servers in Poland. We do not host customer data outside the EEA.
If an external player (section 13) or another external tool is launched, technical data (e.g. IP address, browser data) may be processed by its provider — to the extent and on the terms described for that tool.
The website does not load fonts, scripts or other resources from third-party servers — all files are served from our server in Poland.
The artificial intelligence we mention on the website supports the development of the system and the analysis of the plant's process; we do not pass personal data or customer data linked to an individual to external AI model providers.
If in the future we start using tools that transfer data outside the EEA (e.g. external AI models, analytics tools), we will inform you in this Policy, and the transfer will be based on a European Commission adequacy decision or standard contractual clauses.

7. Your rights

In connection with the processing of data you have the right:
- of access to your data and to obtain a copy (Art. 15 GDPR);
- to rectification of inaccurate data or completion of incomplete data (Art. 16);
- to erasure ("right to be forgotten") — where there is no longer a basis for processing (Art. 17);
- to restriction of processing (Art. 18);
- to data portability for data processed on the basis of a contract or consent by automated means (Art. 20);
- to object to processing based on legitimate interest, including at any time to direct marketing (Art. 21);
- to withdraw consent at any time — without affecting the lawfulness of processing before withdrawal;
- to lodge a complaint with the President of the Personal Data Protection Office (UODO); the authority's current contact details: uodo.gov.pl.
Send requests to the address in section 1 (2). We reply without undue delay, at the latest within one month; in complex cases the deadline may be extended by a further two months, of which we will inform you. We may ask for additional information to confirm your identity.
If your data is in the TonMiro Systems system as data of an employee, driver or contractor of our customer — the controller is that customer and requests should be addressed to it. If you contact us, we will forward the request to the customer and help fulfil it.

8. Voluntary provision of data

Providing data is voluntary, but without it we cannot reply to an enquiry, arrange a presentation or conclude an agreement. Providing invoicing data is required by law. Form fields marked as required are necessary to handle the enquiry; the others (e.g. telephone, "how did you hear about the system") are optional.

9. Profiling and automated decisions

We do not make decisions about you based solely on automated processing that would produce legal effects or similarly significantly affect you. We do not profile website visitors. The analytical functions of the TonMiro Systems system (including those based on artificial intelligence) operate on the customer's plant data — machines, fuel, measurements, costs — and serve the customer to assess the process, not to assess people.

10. Security

We apply technical and organisational measures appropriate to the risk, in particular: encrypted connections (HTTPS), passwords stored only as cryptographic hashes, access to infrastructure limited to authorised persons, access logging, daily incremental and weekly full backups stored in a separate location, and an incident response procedure.
Our team includes a person responsible for information security and GDPR compliance. Our experience in data protection comes from running online services handling customer data for almost 20 years.
If a personal data breach is likely to result in a risk to the rights or freedoms of natural persons, we notify the supervisory authority without undue delay and, where feasible, not later than 72 hours after becoming aware of it. If the breach is likely to result in a high risk to your rights or freedoms, we also inform you without undue delay (Articles 33–34 GDPR).

11. Cookies and similar technologies

The tonmiro.com website uses only mechanisms (cookies and browser storage) necessary for the website to function and to remember the settings you choose (language, theme — saved at the moment you change them yourself). We do not use advertising or tracking cookies and do not share cookies with third parties. Mechanisms necessary for the website to function and to provide the service requested by the user do not require consent (Article 399(3) of the Polish Electronic Communications Law of 12 July 2024). The bar on the website is purely informational — the "OK" button closes the notice and does not constitute consent; the fact of closing is stored in browser storage (tonmiro.cookies), and the notice can be shown again via the "Cookies" link in the footer.

List of mechanisms used:

Name	Type	Purpose	Lifetime
`tonmiro.lang`	localStorage	remembering the selected website language (PL / SK / EN / CZ)	until deleted by the user
`tonmiro.theme`	localStorage	remembering the light / dark theme	until deleted by the user
`tonmiro.cookies`	localStorage	remembering that the cookie notice has been closed	until deleted by the user
`tm_auth`	cookie (HttpOnly)	access to the password-protected draft version of the website — only in the draft version, until the public launch	30 days
TonMiro Systems session	cookie (HttpOnly, Secure)	keeping the user logged in to the system (only after logging in)	until logout or session expiry

You can delete cookies and localStorage data in your browser settings and block their storage; the website will still work, but will not remember the language and theme, and logging in to the system will not be possible.
If we enable visit statistics: we will use a tool that does not store cookies and does not identify the user (e.g. Plausible / Matomo in cookieless mode) — in which case a consent banner is still not required. If we choose Google Analytics — we will add it to the table, add a consent banner and a section on transfers to Google.

12. Server logs

The hosting server automatically records request logs: IP address, date and time, page address, response code, browser and system type, referring page address. The logs serve solely to administer the website, detect failures and abuse and ensure security (Art. 6(1)(f) GDPR). We do not combine them with other data to identify individuals. Logs are retained for up to 90 days and then deleted.

13. Social media and video

Videos on the website may be embedded from YouTube (Google Ireland Ltd.) in privacy-enhanced mode (youtube-nocookie.com). The player is loaded only after your action (clicking the thumbnail); once started, technical data may be transferred to Google, which processes it in accordance with its own privacy policy: policies.google.com/privacy. There are currently no embedded videos on the website — this section will apply once they are added.
Links to LinkedIn and YouTube profiles lead to external services. We do not embed social plug-ins ("like", "share") that would transmit data without your action.
If you contact us via LinkedIn or another social network, the controller of data in that service is its operator; we process the content of the correspondence in order to reply (Art. 6(1)(f) GDPR).

14. Changes to the Policy

The Policy may be updated in the event of changes in the law, tools or scope of processing. The current version is always available at tonmiro.com/prawne/polityka-prywatnosci.html with its effective date.
We will inform customers of material changes by e-mail. Change history:
- 1.0 — 15 September 2026 — first version.
- 1.1 — 9 October 2026 — content update (including data of partner programme participants) and the Czech version of the website.
The Policy has been drawn up in Polish. Translations into other languages are for information purposes only; in the event of any discrepancy, the Polish version prevails.

Additional documents

Ready-to-use forms for the employer — employee or contractor relationship. They are not part of this document; we provide them to make it easier to meet GDPR obligations at the site (one copy per person; fields left blank). Adapt each form to the law applicable to you before use; the Polish version is the reference text.

Who signs with whom. The authorisation is signed by the site as data controller and the authorised person — an employee, contractor or driver. The information notice is issued by the site, and the employee, contractor or driver signs to confirm they have read it. TonMiro Systems is not a party to either form — the relationship between the site and us is governed by the data processing agreement.

Polish originals: authorisation · information notice.

Privacy and cookies policy