Privacy Policy

The main controller of your personal data in connection with registration, account administration in the FIXER Service, technical communication and network security is:

Mariusz Woźniak
Contact: [email protected]
(hereinafter: the “Controller”, the “Provider” or “We”).

Regardless of the situation, we undertake not to sell, commercialise or disclose your personal data to third parties for marketing purposes.

In matters relating to the processing of personal data, the exercise of your rights under the General Data Protection Regulation (GDPR) or to raise privacy concerns, you can contact the Controller directly at the dedicated e-mail address: [email protected], adding the note: “Personal Data Protection”.

The Controller responds to requests without undue delay, and no later than within one month of receiving them.

The FIXER application operates in a hybrid model, in which the legal status of data depends on its source and function in the system:

• the User’s own data (account, login, telemetry):
  • as regards the data necessary to set up an account, authenticate, verify identity, send technical notifications and ensure the continuity of the infrastructure, we act as an independent Controller of Personal Data (Article 4(7) GDPR).
• project content and data entered into the application (comments, tasks, quotes) — entries in renovation projects may contain personal data of participants in the construction process, investors, contractors or subcontractors:
  • The controller of this data is the Project Owner (the entity that creates the given project and manages permissions);
  • the FIXER Provider acts in this respect solely as a Processor within the meaning of Article 28 GDPR. The terms of the technical processing of this data are governed by a separate Data Processing Agreement (DPA) made available before a project is created.
• payments and subscription settlements:
  • Once payments are launched, payment processing will be carried out by an external Partner. As regards payment authorisation, the Partner will act as an independent, separate data controller.

We have organised the purposes, legal bases and scopes of processing according to the roles and situations in which you interact with FIXER:

1. You are a registered User or Project Owner

• Scope of data: e-mail address, system identifier, role in the project, login history, account status.
• Purpose of processing: creating and maintaining the account, logging in, providing FIXER features and synchronising data.
• Legal basis: performance of the agreement for the provision of services by electronic means — Article 6(1)(b) GDPR.
• 1a. You sign up for the tests on fixerapp.eu
• Scope of data: e-mail address, information on acceptance of the Terms (version number and date), optional consent to news and promotions.
• Purpose of processing: confirming the sign-up, contact about the tests (invitation, reminders, requests for feedback), documenting acceptance of the Terms and, with your separate consent, sending information about FIXER news and promotions.
• Legal basis: conclusion and performance of the agreement on taking part in the tests — Article 6(1)(b) GDPR; information about news and promotions — your consent, Article 6(1)(a) GDPR (you can withdraw consent at any time).

2. You take part in the Test programme or fill in development surveys

• Scope of data: answers in evaluation surveys, feedback, feature reports, test-version telemetry.
• Purpose of processing: evaluating how PWA features work, satisfaction research, optimising the application.
• Legal basis:
  • performance of the terms of the free test — Article 6(1)(b) GDPR;
  • voluntary qualitative surveys — the Controller’s legitimate interest in developing the software — Article 6(1)(f) GDPR.

3. You order a paid subscription plan (payments and settlements)

• Scope of data: data of the company/person placing the order, order history, transaction identifier, payment status.
• Purpose of processing: fulfilling the subscription order, activating the licence in the system, handling financial complaints, handling accounting and tax obligations.
• Legal basis:
  • performance of the subscription agreement — Article 6(1)(b) GDPR (for persons representing B2B entities — the Controller’s legitimate interest — Article 6(1)(f) GDPR);
  • fulfilment of legal tax and accounting obligations — Article 6(1)(c) GDPR.

FIXER does not process or store full payment card data or CVV codes. The transaction takes place directly on the payment operator’s secured platform.

4. You have received an invitation to a renovation project

• Scope of data: your e-mail address, details of the person inviting you, the assigned role (Investor, Designer, Contractor).
• Purpose of processing: sending a notification about the invitation and enabling you to join the project structure.
• Legal basis: the legitimate interest of the Controller and the Project Owner in enabling team collaboration — Article 6(1)(f) GDPR.

5. You contact us (e-mail, form, social media)

• Scope of data: e-mail address, first name/surname, social media profile name, content of the enquiry, technical error identifiers.
• Contact channels: e-mail, the dedicated bug-report module, the official profiles on Facebook and Instagram, and Messenger.
• Purpose of processing: answering the enquiry, fixing a technical fault, conducting correspondence.
• Legal basis: taking steps at the user’s request (Article 6(1)(b) GDPR) or the Controller’s legitimate interest in building relationships and supporting users (Article 6(1)(f) GDPR).

Commercial communication: we do not send unsolicited marketing information through Messenger or other messaging apps without separate, prior consent (Article 6(1)(a) GDPR in conjunction with Article 398 of the Polish Electronic Communications Law).

6. Network logs, security and incident prevention

• Scope of data: public IP address, timestamps, browser headers (User-Agent), device type, session identifiers, HTTP error codes.
• Purpose of processing: protection against DDoS attacks, prevention of unauthorised access, integrity of the IT environment.
• Legal basis: the Controller’s legitimate interest in ensuring cybersecurity — Article 6(1)(f) GDPR in conjunction with Article 32 GDPR.

Providing personal data is entirely voluntary, however:

• providing an e-mail address is a contractual requirement necessary to set up an account, to authorise and to take part in projects;
• if you buy a paid subscription, providing billing data is a statutory requirement arising from tax law;
• contact through social media channels (Facebook, Instagram, Messenger) is entirely optional.

No intrusive analytics or advertising trackers. The FIXER website and application do not use commercial tracking pixels or external profiling scripts (e.g. Meta Pixel, Google Analytics). They do, however, use external technical resources: fonts from the Google Fonts service, the Cloudflare Turnstile protection of the sign-up form and (in the application) the OneSignal notification service. When these are loaded, the provider may receive your IP address.

PWA (Progressive Web App) technology and offline work. To enable uninterrupted work without internet access, the application uses your browser’s local storage. This storage holds only technical data: the local session state, the most recently loaded data of the active project and draft entries waiting to be sent to the database once the connection is restored.

Legal basis for local technologies. Data is written to and read from the device storage solely for strictly technical purposes necessary to provide a service expressly requested by the user (operation of the web application).

In accordance with Article 399 of the Polish Electronic Communications Law and Article 5(3) of the ePrivacy Directive, using these resources does not require a cookie banner or prior consent.

The user can clear the browser cache themselves, bearing in mind that deleting data before synchronisation will permanently lose entries made in offline mode.

In accordance with the principles of minimisation and transparency, personal data is shared only to the extent strictly necessary to achieve the stated purposes with the following categories of recipients: cloud infrastructure providers, network security service providers, e-mail and transactional notification service providers, payment operators, entities providing legal, accounting and audit services, and authorised public authorities and state institutions — solely in cases strictly defined by generally applicable law and on the basis of a binding request.

Sub-processors and transfers of data outside the European Economic Area

The following technical service providers process data on our behalf under data processing agreements or the data processing terms of the given provider: Supabase Pte. Ltd. (Singapore) — database and login to the application; we store data in the European Union (region eu-west-1), and the provider may also process data outside the EU, for example when providing technical support; Cloudflare, Inc. (USA) — hosting of the application and website and a content delivery network that operates globally, so technical connection data (e.g. the IP address) may be processed in various countries; Brevo (France) — sending e-mail messages, the provider’s servers are located in the European Union; OneSignal, Inc. (USA) — push notifications, data stored in the EU (the Netherlands); GitHub, Inc. (USA, Microsoft) — storage of encrypted database backups; only we hold the key to read them.

Data is transferred outside the EEA on the basis of the mechanisms provided for in the GDPR: for Supabase — standard contractual clauses approved by the European Commission (Implementing Decision (EU) 2021/914), for Cloudflare and GitHub — the provider’s certification under the EU-U.S. Data Privacy Framework (for Cloudflare, standard contractual clauses additionally). You can obtain a copy of the safeguards by writing to [email protected].

The data retention period is limited to the necessary operational and legal minimum:

In connection with our processing of personal data, you have the rights set out in Articles 15–22 GDPR:

• The right to withdraw consent (where processing is based on consent) — without affecting the lawfulness of processing carried out before its withdrawal;
• The right to request access to your data and to receive a copy of it (Article 15 GDPR);
• The right to rectification (correction) of your data if it is inaccurate or incomplete (Article 16 GDPR);
• The right to erasure (“right to be forgotten”) (Article 17 GDPR) — to the extent that the data is not necessary for the performance of tax obligations or the establishment of claims;
• The right to restriction of processing of data (Article 18 GDPR);
• The right to data portability in a commonly used, machine-readable format (Article 20 GDPR);
• The right to object to processing based on a legitimate interest (Article 21 GDPR).

To exercise these rights, send the relevant request to: [email protected].

If you believe that the processing of your personal data infringes the law, you have the right to lodge a complaint with the competent supervisory authority in the Member State of your habitual residence, place of work or place of the alleged infringement:
The President of the Personal Data Protection Office (PUODO)
ul. Stawki 2, 00-193 Warsaw
Website: uodo.gov.pl

If you use external platforms linked with FIXER, their operators process data as independent controllers:

• Once payments are launched: Paddle Payments Limited (payments and invoicing): information on the processing of transaction data can be found in the Paddle Privacy Policy.
• Meta Platforms Ireland Limited (Facebook, Instagram, Messenger): information on data processing and privacy management can be found in the Meta Privacy Centre.

The Controller does not make decisions about you based solely on automated processing, including does not use profiling within the meaning of Article 22(1) and (4) GDPR.

Any automatic restriction of permissions to edit a project (switching to a mode that only allows downloading a report) after the end of the trial period follows directly from the performance logic of the agreement set out in the Terms and does not constitute profiling or an assessment of you as a person.

To protect personal data we have implemented advanced technical and organisational measures that meet the requirements of Article 32 GDPR, including:

• Enforced encryption of connections using the TLS protocol with an HSTS policy,
• Encryption at rest of the database (AES-256),
• Logical separation of data at the database engine level based on Row-Level Security (RLS) rules (including protection of entries in comments and quotes),
• Asymmetrically encrypted backups (GPG) with the private key kept separate in an offline environment,
• Mandatory multi-factor authentication (MFA) for access to the administration panel.

We develop the service, modify the infrastructure and adapt processes to changes in the law, so this document may be updated periodically.
The current version of the document is always available at:
https://fixerapp.eu/polityka-prywatnosci

If significant changes are introduced (affecting your rights or the scope of processing), registered Users will be notified by e-mail or by a message in the application at least 14 days in advance.