Incident help

Document

Privacy policy

How we process personal data of people who use this website, submit a form or write to us.

Effective from 28 September 2026.

Data controller

The controller is DC9 Sp. z o.o., Plac Bankowy 2, 00-095 Warsaw, Poland, KRS 0000770360, NIP 5272881508 (“DC9 Cyber”, “we”). For any matter concerning personal data, write to hello@dc9.io.

What data we collect

  • “Project enquiry” form: full name, organisation, email address, phone number (optional), topic and message.
  • “Report an incident” form: full name, organisation, phone number, email address, type of situation and description.
  • With every form submission: IP address and browser information — to protect against spam and abuse.
  • Email correspondence: the data you choose to send us.
  • Server logs: IP address, date and time, page address, browser information.

Please do not enter passwords, access keys or personal data of people affected by an incident in the forms. Evidence is exchanged through an agreed secure channel.

Purposes and legal bases

  • Replying to your enquiry and preparing an offer — steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) or our legitimate interest in answering correspondence (Art. 6(1)(f) GDPR).
  • Handling an incident report and contacting you about it — pre-contractual steps or performance of a contract (Art. 6(1)(b) GDPR).
  • Protecting forms against spam and abuse, and website security — legitimate interest (Art. 6(1)(f) GDPR).
  • Establishing, exercising or defending legal claims — legitimate interest (Art. 6(1)(f) GDPR).

How long we keep data

  • Contact form enquiries: 180 days from submission, then deleted automatically.
  • Incident reports: 365 days from submission, then deleted automatically.
  • Server logs: up to 90 days.
  • If we enter into a contract, data is kept for its duration and for the period required by law (e.g. tax law) or until claims are time-barred.

Who receives data

Data is processed on our behalf by providers whose services we use: the provider of the server running the website and forms, the email service provider, and Cloudflare, Inc., which proxies traffic to the website and protects it against attacks. Cloudflare may process IP addresses outside the European Economic Area on the basis of the European Commission decision on the EU–US Data Privacy Framework or standard contractual clauses.

We do not sell data or share it for marketing purposes.

Your rights

  • access to your data and a copy of it,
  • rectification,
  • erasure or restriction of processing,
  • data portability,
  • objection to processing based on our legitimate interest,
  • a complaint to the Polish supervisory authority, the President of the Personal Data Protection Office (UODO, ul. Stanisława Moniuszki 1A, 00-014 Warsaw).

To exercise your rights, write to hello@dc9.io.

Voluntary provision and automated decisions

Providing data is voluntary, but without it we cannot answer your enquiry or handle your report. We do not make automated decisions or carry out profiling.

Cookies and analytics

This website does not use cookies or analytics tools and does not load resources from third parties. Forms are submitted without cookies.

Notice for employees and associates of our clients

If your data was provided to us by your employer — our client — in connection with a contract, its processing is described in a separate information notice (in Polish): GDPR information notice (PDF, Polish).

Changes

We may update this policy when our services or the law change. The current version is always available on this page.