Spectrum privacy policy
How we process data when you contact us, order a licence or use the website, and what stays in your Spectrum installation.
Draft version 1.4, updated 16 September 2026.
Before publication, providers, processing locations and retention periods must be confirmed. Fields to be completed are marked with brackets.
1. Controller and contact
The controller for data relating to the Spectrum website, sales and licence management is Jacek Pietsch, trading as Platinum iT Jacek Pietsch, ul. Łąkowa 5, 62-052 Komorniki, Poland, tax ID (NIP) 7773170021, REGON 301562788. Privacy contact: info@spectrumpro.pl. Correspondence address: ul. Łąkowa 5, 62-052 Komorniki, Poland.
If the controller has appointed a data protection officer, their contact details must be provided here: [[DPO CONTACT OR STATEMENT THAT NO DPO HAS BEEN APPOINTED]].
This policy covers website visitors, people requesting a presentation, price list, quote or trial, licence purchasers and customer contact persons. Use of the software is governed by the Spectrum licence agreement.
2. Data, purposes and legal bases
We receive data from you, from the organisation you represent, and when handling connections to the website and licence server. Billing data may also come from the payment provider. If your employer or client provided your contact details, these usually include your name, position, work email and correspondence.
| Situation and data | Purpose and legal basis |
|---|---|
| Presentation and price list request. Email, role (customer or partner) and number of users or clients. Quote or trial request. Company, full name, email, selected edition, number of users or clients, optional tax ID and message. | Preparing a response, agreeing terms and handling the request: Article 6(1)(b) GDPR if you are a party to a prospective contract; Article 6(1)(f) GDPR if you represent an organisation — the legitimate interest is maintaining business contact. |
| Issuing and managing licences. Customer name, email, plan, licence number and key, update period, trial end date, activation identifiers and service history. | Performing the contract and documenting software entitlements: Article 6(1)(b) GDPR; contact with customer representatives and prevention of abuse: Article 6(1)(f) GDPR. |
| Licence activation and verification. Key on activation, licence number on renewal, hashed installation identifier, software version, counts of users, workspaces and environments, connection dates. The offline file also contains the edition, creation time, installation public key and signature. | Checking activations and limits and protecting licences against abuse: Article 6(1)(b) and (f) GDPR. Requests do not contain WEBCON configuration content or environment and user names. Technical data is not considered anonymous if it can be linked to a customer. |
| Billing. Company, tax ID, billing address, email, order, payment and invoice information; for card payments, transaction identifiers and statuses supplied by Stripe. | Contract performance and tax and accounting obligations: Article 6(1)(b) and (c) GDPR. We do not receive your full card number or CVC. |
| Downloading the software. Email and licence linked to the download link, download token, its validity and download count. | Providing the correct edition and protecting the link: Article 6(1)(b) and (f) GDPR. |
| Support and complaints. Contact details, licence number, request content and attachments provided. | Contract support, handling complaints and establishing or defending claims: Article 6(1)(b), (c) or (f) GDPR, as applicable. Do not send passwords, private keys or unnecessary third-party personal data. |
| Website and server security. IP address, time, request URL, response status and browser information available in infrastructure logs. | Maintaining availability, diagnosing errors and preventing abuse: Article 6(1)(f) GDPR. |
Requests for materials, quotes or trials do not subscribe you to a newsletter. Replies and licence messages are used to handle your matter. Any marketing requiring consent needs a separate, voluntary choice.
3. How long we retain data
- Enquiries without a contract: up to 6 months after correspondence ends.
- Trials: issued licence data and restrictions on repeat trials: up to 12 months after the trial ends; unfulfilled enquiries: as above.
- Paid licences: data needed to verify entitlements during the annual subscription and to manage its renewal or termination, including the grace period. After the contract ends: until the applicable limitation period for claims expires.
- Tax and accounting records: for the period required by law, calculated under the rules applicable to the document and obligation. Ending software maintenance does not automatically start a new tax retention period.
- Support: up to 3 years after closing the case, unless specific material must be kept longer to handle an ongoing dispute.
- Download links: valid for 30 days; after expiry, we retain identifiers and counters for [[DELETION PERIOD FOR EXPIRED TOKENS]].
- Logs: [[CONFIRMED RETENTION PERIOD FOR WEB AND LICENCE SERVER LOGS]]. Backups are overwritten on a cycle of [[BACKUP RETENTION PERIOD]].
In the event of a dispute or legal obligation, we retain only the necessary data for the required period. Once the retention basis ends, data is deleted or irreversibly anonymised. Expiry of a link or disabling an account is not the same as deletion of a record.
4. Recipients and transfers outside the EEA
Data may be received by authorised customer service personnel and providers to the extent necessary for the service:
- Website, database and licence server hosting: [[HOSTING PROVIDERS AND PROCESSING REGIONS; THE LICENCE SERVER USES RAILWAY]].
- Transactional email: Resend — sending replies, keys and links. Resend data processing terms.
- Card payments, where available for the order: Stripe — transaction processing and payment provider obligations. Stripe may act as a separate controller for these purposes. Stripe privacy policy.
- Invoicing and accounting: Fakturownia, accounting service provider [[ENTITY DETAILS]] and authorised authorities, including KSeF to the extent required by law.
- Legal services and complaints: advisers and authorities entitled to receive data when required by the particular case.
Infrastructure and email providers may use subcontractors or technical access from outside the European Economic Area. Such transfers require an appropriate basis: a European Commission adequacy decision or safeguards under Article 46 GDPR, such as standard contractual clauses, together with any required supplementary measures. Contact the controller for information about the basis used and how to obtain a copy of the safeguards.
We do not sell data or share it with third parties for their own advertising purposes.
5. Your rights
Within the limits of the GDPR, you may request access and a copy of your data, rectification, erasure and restriction of processing. Data portability applies to data processed automatically on the basis of a contract or consent. You may object to processing based on legitimate interests for reasons relating to your situation; objection to direct marketing is unconditional.
Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of earlier processing. Reading this policy is not consent to marketing.
Write to the address in section 1. We will respond without undue delay and within one month at the latest. For complex matters, this may be extended by a further two months; we will explain the reason and extension within the first month. If we have reasonable doubts about your identity, we will request only the information needed to confirm it.
Erasure does not cover data we must still retain under another legal basis. Before deleting data needed for activation, we will explain the effect on licence management and the available options. We do not make consideration of a request conditional on waiving rights.
You may complain to the President of the Polish Personal Data Protection Office or another competent supervisory authority. Contact details and complaint procedures: uodo.gov.pl.
6. Providing data and automated checks
Providing form data is voluntary, but required fields are necessary to handle your request. Invoice details may be required by law. Without data necessary for licensing or activation, we cannot provide the relevant service. Optional fields may be left blank.
The server automatically checks key validity, activation limits and previous trial use. The quote form helps select a plan based on user or client counts; a person prepares the final offer. We do not conduct advertising profiling. If an automatic check rejects your request or activation, contact us for a human review by licence support.
7. Cookies and browser storage
We protect forms against automated spam using Cloudflare Turnstile. On pages with a form, Cloudflare processes technical signals such as IP address, browser and connection information, and website domain. Our server checks the verification result before accepting a request; it does not send form contents or email addresses for this verification. Details: Cloudflare Turnstile privacy information.
The sales website uses Vercel Web Analytics for aggregate visit and page-view statistics. The service does not use cookies or localStorage to identify visitors. Statistics include pages visited, referral source, approximate location, device and browser type. We remove query parameters and fragments from the visited URL before sending it. Form contents are not transmitted as analytics events. More information: privacy in Vercel Web Analytics.
We do not use advertising cookies or tracking pixels. Fonts and illustrations are loaded locally. Forms use the infrastructure and email services described above.
When you open an external service, such as Stripe payments, its privacy rules also apply. A Spectrum Server installation has its own user session mechanism; its administrator is responsible for information about data processing within their organisation.
8. Data in your Spectrum installation and AI
Packages, configuration snapshots, user accounts and analysis results are stored on infrastructure managed by the customer or their service provider. Granting a licence does not give us access to that database. The organisation using the software may act as controller or processor for its customer, depending on how it actually works.
AI descriptions are optional. When enabled, configuration material is sent to the model provider selected by the installation administrator; it may contain personal data or confidential information stored in the configuration. The organisation must assess the provider, material scope, retention rules and any transfers. Do not assume that every external model operates only in the EU or refrains from using data for its own purposes.
If support requires a database, logs containing personal data or remote access, we first agree the scope, a secure channel and the parties' roles. Where we act as processor, an appropriate processing agreement is required before data is shared. Connection details are described on the Spectrum security.
9. Policy changes
We publish the current version and date on this page. We also notify existing customers of material changes through the appropriate contact channel. A policy update does not automatically extend consent or authorise data use for a new purpose.