Legal
Privacy Policy
How Lemko Automation handles personal data on this website and in connection with Lemko Automation accounts, and the rights you have under the GDPR and Polish law.
Version 1.5 · Last updated: 14 November 2026
Draft — operator details missing
Fields shown as [●] are placeholders. Set LEGAL_COMPANY_NAME, LEGAL_COMPANY_ADDRESS, LEGAL_NIP, LEGAL_REGISTER in the site environment before publishing these documents.
This is a translation provided for convenience. If it differs from the Polish version, the Polish version prevails. Read the Polish version
01Who is the controller
The controller of the personal data described in this policy is [●], [●], tax ID (NIP): [●], REGON: [●], [●] (“Lemko Automation”, “we”).
We operate the website https://construction.lemko.tech (the “Website”) and the Lemko Automation service (the “Service”). For anything about personal data, write to support@lemko.tech.
02What this policy covers
This policy applies to: (a) visitors to the Website; (b) people who contact us; (c) prospective and current customers of Lemko Automation and the people they invite to their workspace (users); (d) people who pay for, or receive invoices for, the Service.
It does not describe the personal data that our customers enter into Lemko Automation about their own clients, leads, staff and contacts. For that data the customer is the controller and we act as its processor under the Data Processing Agreement — see section 13.
03What we process, why, and on what legal basis
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Running and securing the Website | IP address, date and time of the request, requested address and response code (server logs). | Art. 6(1)(f) GDPR — our legitimate interest in the security and stable operation of the Website. | Up to 30 days; longer only for a specific security incident while it is being investigated. |
| Remembering your language | Your language choice in the cookie lemko_construction_locale (not personal data we can attribute to you). It is set only after you choose a language yourself. | Art. 399(3) of the Polish Electronic Communications Law — a setting you requested, so no consent is needed; see the Cookie Policy. | 12 months, or until you choose “Automatic”. |
| Answering your messages and requests | Name, phone number, company, the content of your message and attachments, e-mail address if you give it. For a request sent through the form on the Website also: the number of people working on your sites, if you state it, and a salted hash of your IP address, kept with the request so that one network cannot flood the form. | Art. 6(1)(f) GDPR — our interest in handling enquiries; Art. 6(1)(b) where the message concerns concluding or performing a contract. | Until the matter is closed and for 12 months afterwards; if a dispute is possible, until claims become time-barred. |
| Creating and running your account; concluding and performing the contract | Name, e-mail, phone and job title (optional), company name and address, tax ID / VAT number, chosen plan and number of seats, language and time zone, data of workspace users (role, status). | Art. 6(1)(b) GDPR — performing the contract with you; Art. 6(1)(f) GDPR where the contract is with your employer or organisation and we process your details as its representative or user. | For the duration of the contract, and then as stated in the billing and claims rows and in section 7. |
| Payments, invoicing and accounting | Billing name and address, tax ID, e-mail, amount, plan, payment status, Stripe customer and subscription identifiers, last four digits and expiry date of the card (the card number is processed by Stripe and never reaches us). | Art. 6(1)(b) GDPR; Art. 6(1)(c) GDPR — tax and accounting obligations (e.g. the VAT Act and the Accounting Act). | 5 years from the end of the calendar year in which the invoice was issued (longer where the law requires). |
| Account security and preventing abuse | Sign-in events, IP address, device and browser identifiers, session data, one-time codes and passkey public keys, phone number if you enable SMS verification. | Art. 6(1)(f) GDPR — our interest and our duty to keep accounts secure under Art. 32 GDPR; Art. 6(1)(b) GDPR. | Session records are deleted 30 days after the session expires; sign-in and security logs for up to 12 months. |
| Signing in with Google or Microsoft | The identifier of your account at the provider and the e-mail address the provider shares with us. | Art. 6(1)(b) GDPR. | Until you unlink the provider or the account is closed. |
| Service messages | E-mail address and name; content of receipts, security notices, trial and billing notices, changes to the terms and material changes to the Service. | Art. 6(1)(b) and (f) GDPR. | As for the account. |
| Establishing, exercising or defending legal claims; compliance | Data needed to evidence the contract, payments, consents and correspondence. | Art. 6(1)(f) and (c) GDPR. | Until claims become time-barred (generally 3 years for claims connected with business activity and 6 years otherwise, counted to the end of the calendar year). |
| Marketing | E-mail address and name, only if you subscribe or consent. | Art. 6(1)(a) GDPR and Art. 398 of the Polish Electronic Communications Law (consent). | Until you withdraw consent. We do not currently send marketing newsletters. |
04Where the data comes from
Mostly directly from you. A workspace owner or administrator may also add colleagues, in which case we receive their name, e-mail address and role from that person. If you sign in with Google or Microsoft, we receive the data described above from that provider. Stripe tells us the status of a payment or subscription.
05Who receives the data
We share personal data only where needed and on the basis of contracts:
- Payments — Stripe Payments Europe, Ltd. (Ireland) and its group companies: processes payment data to collect subscription fees. Stripe is an independent controller for payments, fraud prevention and its own legal obligations, and our processor for other services. See Stripe's privacy policy.
- Hosting and infrastructure — Amazon Web Services EMEA SARL (Frankfurt, Germany (eu-central-1)) and providers of storage, backup, monitoring and e-mail delivery; they process data on our behalf under data processing agreements (the current list is in Annex 3 to the Data Processing Agreement).
- Encrypted backups — Google Cloud EMEA Limited (Google Cloud Storage, Warsaw): keeps the backups of the database and of the uploaded files (such as photos and signatures) outside our server; we encrypt them on the server before they leave it, with a key only we hold, so the provider stores nothing but encrypted data.
- SMS delivery — only if you enable SMS verification or SMS reminders (for example Twilio or Amazon Web Services).
- Sign-in providers (Google, Microsoft) — only when you choose to sign in with them; they act as independent controllers.
- Advisers — accounting, tax, legal and IT-security advisers bound by confidentiality.
- Public authorities — where the law requires (for example tax authorities, courts, law enforcement).
We do not sell personal data and we do not use it for advertising.
06Transfers outside the EEA
Wherever possible we process data within the European Economic Area. Some providers (for example Stripe, Twilio or Amazon Web Services) belong to groups that may process data in the United States or other third countries. In that case we rely on a European Commission adequacy decision (including the EU–U.S. Data Privacy Framework for certified recipients) or on standard contractual clauses under Art. 46(2)(c) GDPR, supplemented with additional measures where needed. You can obtain a copy of the safeguards by writing to support@lemko.tech.
07How long we keep data
We keep data only as long as the purpose requires — the table in section 3 gives the period for each purpose. In addition:
- when a workspace is closed we make the customer's data available for export for 30 days and then delete it from production systems; copies in backups (including the encrypted copies kept outside our server) are overwritten in the regular backup cycle, which does not exceed 35 days;
- invoices and accounting documents are kept only to the extent the law requires, separately from the workspace;
- data needed to establish, exercise or defend legal claims may be kept until the limitation period ends.
08Your rights
You have the right to:
- access your data and obtain a copy (Art. 15 GDPR);
- rectify it (Art. 16);
- erase it (Art. 17);
- restrict processing (Art. 18);
- data portability — for data you gave us that we process by automated means on the basis of a contract or consent (Art. 20);
- object to processing based on our legitimate interests, on grounds relating to your situation (Art. 21) — we will stop unless we show compelling legitimate grounds or need the data for legal claims;
- withdraw consent at any time (Art. 7(3)), without affecting the lawfulness of processing before withdrawal.
To exercise your rights write to support@lemko.tech. We answer within one month (Art. 12(3) GDPR); for a complex request we may extend that by two further months and will tell you so. We may ask for information needed to verify your identity.
09Complaints to a supervisory authority
You have the right to lodge a complaint with a supervisory authority. In Poland it is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl. You may also complain to the authority of the EU country where you live or work. We would appreciate the chance to resolve a concern first.
10Is providing data mandatory
Providing data is voluntary, but without the data marked as required for an account, billing or contact we cannot conclude or perform a contract or answer you. Providing billing data follows from a legal obligation (tax and accounting law).
11Automated decisions and profiling
We do not make decisions based solely on automated processing that produce legal effects on you (Art. 22 GDPR). Our payment provider Stripe applies automated fraud checks to payments; if a payment is declined you can contact us or Stripe to have it reviewed by a person.
12Security
We protect personal data with technical and organisational measures appropriate to the risk (Art. 32 GDPR), including:
- encrypted connections (TLS);
- passwords stored only as Argon2id hashes;
- optional and enforceable multi-factor sign-in (authenticator app, SMS code, passkeys);
- encryption of stored secrets such as API keys and mailbox passwords;
- separation of each customer's data;
- session controls, remote sign-out of devices and rate limiting;
- an audit trail of changes;
- least-privilege access for our staff, and daily backups, checked by test restores and also kept, encrypted, outside the server.
Details are in Annex 2 to the Data Processing Agreement. If a personal data breach is likely to result in a risk to your rights or freedoms we will notify the supervisory authority within 72 hours and, where the risk is high, you without undue delay (Arts. 33–34 GDPR).
13Data that customers enter into Lemko Automation
The data that you or your organisation enter into Lemko Automation about your own clients, contractors, staff and contacts is yours. The customer is the controller of that data and decides why and how it is used; we process it only on the customer's instructions as its processor under the Data Processing Agreement.
If your data is in a workspace run by another company, please address your request to that company; we will help it to respond. We do not use customers' CRM data for our own purposes or for advertising.
14Children
The Website and the Service are intended for businesses and are not directed at people under 16. We do not knowingly collect data from children.
15Changes to this policy
We update this policy when our processing changes or the law requires. The current version and its date are at the top of the page. Where a change is material for you we will tell you by e-mail or in the Service before it takes effect.
16Contact
[●], [●]. E-mail: support@lemko.tech.