Privacy and data protection policy
This policy describes what personal data we process in connection with P3Space, for what purpose and on what basis. The Polish version is the binding one; this translation is provided for information.
01Controller
The controller for data provided in connection with the purchase and use of this website is Jacek Bobowik „JCBSOFT", ul. Jabłoniowa 9, 39-400 Tarnobrzeg, contact: biuro@jcbsoft.pl.
We have not appointed a data protection officer — none of the conditions requiring one applies. For all data protection matters please use the contact address above.
For data entered by a customer into their workspace, the CUSTOMER is the controller and we act as a processor under a data processing agreement.
02What we process
Trial registration: e-mail address, full name and organisation name.
Purchase: the details required to issue an invoice, as provided by the buyer.
Use of the service: account data, audit log entries and the content entered by users.
IP addresses: trial registration stores a TRUNCATED, network-level address (/24 or /64). The sign-in attempt counter, which protects against password guessing and account scanning, stores the FULL address — without it the limit could not tell an attacker from everyone else on the same network. Counter entries are deleted when the rate-limit window expires.
Infrastructure providers and the identity provider also record full IP addresses in their own technical logs, independently of us.
03Purposes and legal bases
Performance of a contract (Art. 6(1)(b) GDPR): account, service, payments and support.
Legal obligation (Art. 6(1)(c) GDPR): issuing and keeping invoices.
Legitimate interest (Art. 6(1)(f) GDPR): preventing abuse and securing the service.
04Retention
Account data and workspace content: for the duration of the subscription, then 14 days of read-only access and a further 6 months, after which it is deleted from live systems.
DATABASE backups: taken daily, kept for no longer than 7 days. Data deleted from live systems may still exist in a backup during that time, and after an earlier backup is restored we re-apply the deletion instructions.
File content (attachments, documents) is held in object storage and is NOT covered by the database backup. Deleting a file is therefore immediate and irreversible.
Audit logs: by default for the duration of the subscription and up to 24 months afterwards, but no longer than the workspace itself exists. The customer may shorten this within their own workspace — the application allows deleting entries older than a chosen number of days, no fewer than 30. Deleting an entire workspace also removes its audit log, so the 24-month period is an upper bound, not a guarantee.
Deleting an entire workspace also deletes its audit log; the operator trail then retains only the workspace code, its name, the reason and counts of deleted rows — never the content of events.
Invoices and accounting records: 5 years from the end of the calendar year in which the tax payment fell due, as required by tax law; this is not subject to erasure requests.
Trial requests not completed with a registration: 90 days, solely for abuse-prevention limits.
Contact form correspondence: 12 months from the last message.
05Payment operator — separate controller
To process payments we pass the operator the data required for the transaction. For payment services and the legal obligations attached to them the operator acts as a SEPARATE CONTROLLER, not as a processor on our behalf. Its own privacy policy applies.
06Processors
We use the following providers, who process data on our behalf:
• Vercel Inc. (Delaware, Stany Zjednoczone) — hostowanie warstwy frontowej (statyczne strony i aplikacja przeglądarkowa).
• Scaleway SAS (Francja) — hostowanie usług serwerowych i dostawcy tożsamości, w regionie Warszawa.
• Supabase Pte. Ltd. (Singapur) — baza danych i składowanie plików, w regionie Unii Europejskiej.
• Prociv Sp. z o.o. (Wrocław, NIP 8971776931) — serwis domenomania.pl — wysyłka wiadomości systemowych pocztą elektroniczną.
Server services and the database operate within the European Union.
07Transfers outside the EEA
Server services, the database and file storage operate within the European Union.
AI FEATURES ARE DIFFERENT. If the customer enables them, the content covered by a request is sent to the provider the customer has chosen, and that provider may process it outside the EEA — according to the terms review of 17 July 2026, Anthropic processes in the United States, while OpenAI and Microsoft Azure OpenAI Service process in the European Union or the United States depending on the configuration chosen. The basis for such a transfer is set by the agreement the customer concludes with the provider.
We cannot rule out access from a third country as part of technical support provided by vendors established outside the EEA. Such access takes place under the European Commission’s standard contractual clauses, which form part of our agreements with those vendors.
A copy of the safeguards is available on request at biuro@jcbsoft.pl.
08Your rights
You have the right of access, rectification, erasure or restriction of processing, the right to data portability and the right to object.
Requests: biuro@jcbsoft.pl.
You may also lodge a complaint with the Polish supervisory authority (UODO).
09Cookies and browser storage
We use no analytics, marketing or tracking cookies, no traffic analytics tools and no social media pixels.
The information pages store one value in the browser — the chosen interface language.
After signing in, the application uses a single session cookie, strictly necessary for the service. It is not accessible to page scripts (HttpOnly) and is not used for tracking.
The stakeholder portal uses a separate cookie per shared item, so that a verified identity does not open the remaining ones.
10Special category data
The absence module allows an absence to be marked as sick leave. Such information, attached to a named person, is health data within the meaning of Article 9 GDPR. The note field on an absence is free text and may contain such data as well.
The CUSTOMER remains the controller of that data. They decide whether and to what extent they use the feature, and it is on them to secure a basis for the processing and to inform the data subjects.
We process it only to the extent needed to run the service, on the same terms as the remaining workspace content, and we use it for no other purpose.
11Artificial intelligence
AI-supported features are OFF BY DEFAULT and work only when the customer enables them in their own workspace.
THE CUSTOMER CONTRACTS THE AI PROVIDER. The access key belongs to the customer’s workspace, the customer buys access from the provider and is the party to that agreement. We are not a party to it and do not sign it on anyone’s behalf. Data reaches the provider through our service, on the instruction of the customer’s user.
Our role is to check the provider’s own terms and to inform. We admit only providers meeting three conditions at once: they do not use the data sent to them to train models, they make a processing agreement available, and the retention of query content is KNOWN and documented. An attempt to approve a provider failing any of these is rejected by the database — this is not a declaration but a condition written into integrity constraints.
We verify the conditions in the provider’s own terms and record the source link and the date of the check. Without a source and a date a provider cannot be approved.
The review of 17 July 2026 admitted three providers: Anthropic PBC, OpenAI and Microsoft Azure OpenAI Service. None of them trains models on customer content, each makes a processing agreement available, and retention follows from their terms — at OpenAI and Azure query content may be retained temporarily for abuse detection (up to 30 days). The exact period and place of processing follow from the agreement the customer concludes with the provider.
Only the content covered by a specific user request reaches an AI feature (for example the descriptions and indicators of the projects included in a report). It is sent at the moment the user invokes the feature, never in the background.
By enabling these features the customer takes responsibility for the content being eligible to be passed to a processor — this applies in particular to third-party personal data.