1. Data controller
The controller of personal data processed in connection with the website lubisoftware.com and contact under the LuBi-Software brand is:
- Business: LuBi-Software Łukasz Biedak
- NIP (tax ID): 7671654347
- REGON: 364429793
- Address: ul. Żeglarska 8, 78-400 Szczecinek, West Pomeranian Voivodeship, Poland
- Email: [email protected]
- Phone: +48 601 949 602
For data protection matters write to the email above with the subject “GDPR / RODO” or call during the hours shown on the site.
No Data Protection Officer (DPO) has been appointed — data matters are handled directly with the controller.
2. What data we collect
In connection with the website and contact we mainly process:
- Contact form — name or company name, email address, optional phone number, message content, selected topic, and technical data related to sending (including IP address for anti-spam).
- Email replies — correspondence goes to the controller’s Gmail inbox; content and email address you provide.
- Contract data — if we start working together, data needed for the contract and billing (set out in a separate client agreement).
- Technical data / logs — standard hosting logs (IP, date and time, browser type, requested URL) as needed to run and secure the site.
- Cookies — cookies necessary for the site and, with your consent, analytics cookies (Google Analytics). Details: Cookie policy.
- Draft at /mtg — if you use the draft tool, the server keeps the match state: the card list and the draft, under a random id in the link. We do not ask for a name, email or account there. If you load a CubeCobra cube, the save also stores that cube’s public id.
We do not run a newsletter or marketing CRM. No account is required on the site. We do not intentionally collect special categories of data (GDPR Art. 9).
3. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Answering form or email inquiries; pre-contract correspondence | Art. 6(1)(b) (steps prior to contract) and (f) (legitimate interest — contacting a person who reached out to us) |
| Entering into and performing an IT services agreement (if we work together) | Art. 6(1)(b) GDPR |
| Accounting and tax duties (where required by law or contract) | Art. 6(1)(c) GDPR (where applicable) or (b)/(f) depending on the nature of billing |
| Protecting the site from spam and abuse (tokens, limits, honeypot) | Art. 6(1)(f) GDPR — controller’s legitimate interest |
| Keeping a draft save at the link in the /mtg tool | Art. 6(1)(f) GDPR — legitimate interest (running the tool you are using). The save has no account and no contact details. |
| Visit statistics (Google Analytics) — only with consent | Art. 6(1)(a) GDPR — consent |
| Establishing, exercising or defending legal claims | Art. 6(1)(f) GDPR |
Providing data in the form is voluntary but necessary for us to reply. You may withdraw analytics cookie consent at any time (cookie settings on the site).
4. Recipients
Only the controller (Łukasz Biedak) has access to form inquiry content. Data may be processed by the following processors or independent service providers:
- Website hosting — MIKR.US (infrastructure in Poland / EU),
- Email — Google (Gmail) — delivery and storage of form and email correspondence,
- Google Analytics (Google Ireland Limited / Google LLC) — only after analytics cookie consent; Measurement ID is configured on the site,
- entities authorised by law (e.g. public authorities).
For client projects, the scope of data and any processing agreements are set out in separate contracts — not the same as data collected only via the website form.
We do not sell your data. Using Google services may involve transfers outside the EEA; Google applies GDPR mechanisms (including standard contractual clauses where applicable).
5. Retention
- Contact inquiries (form, lead correspondence) — for the time needed to handle the matter, then up to 6 months after contact ends (unless you request deletion earlier, or a contract or dispute begins).
- Contract and billing data — up to 5 years (or longer if required by law), from the end of the year in which cooperation / settlement ended.
- Server logs / anti-spam data — as long as needed for security, usually no more than a few months unless law requires otherwise.
- Cookies — as in the Cookie policy and browser settings; consent preferences are stored locally in your browser.
- Draft save (/mtg) — while the tool is online, or until you ask us to delete it. Email the controller and include the link.
6. Your rights
Under the GDPR you have rights including:
- access to your data,
- rectification,
- erasure (“right to be forgotten”) — where provided by law,
- restriction of processing,
- data portability (where processing is based on contract or consent and is automated),
- objection to processing based on legitimate interest,
- withdrawal of consent at any time (without affecting lawfulness before withdrawal),
- complaint to a supervisory authority: President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl.
More on GDPR rights: GDPR notice. We handle requests after identity verification, at: [email protected].
8. Security
We apply technical and organisational measures appropriate to risk — including HTTPS encryption, access limits, form anti-spam and data minimisation. Approach: Data security.
9. Policy changes
This policy may be updated when laws, tools or processing scope change. The current version is always published on this page with the last update date.