WebDisk Backup Privacy Policy
Version: 1.0 · Effective from: the effective date will be given once the document is approved (draft)
The Polish version is the legally binding version. This English translation is provided for convenience only.
This Privacy Policy describes how we process the personal data of Customers of the WebDisk Backup service and of persons visiting the backup.webdisk.io website.
Scope of the document. The Policy concerns data for which the Provider is the controller — WebDisk account data, order and billing data, technical data of the Service and ticket data. Personal data contained in the backups made by the Customer (hereinafter: "Backups") is processed by us solely as a processor, on the Customer's instructions and under the Data Processing Agreement; the Customer is the controller of that data.
1. Data controller
1.1. The controller of personal data is Mazura sp. z o.o. with its registered office in Ząbki, ul. Baśniowa 1C/2, 05-091 Ząbki, entered in the Register of Entrepreneurs of the National Court Register maintained by the District Court for the Capital City of Warsaw in Warsaw, 14th Commercial Division of the National Court Register, under number KRS 0000971559, NIP 1251732787 — owner of the WebDisk brand.
1.2. Contact in personal data protection matters: iod@webdisk.io. Other matters: office@webdisk.io, tel. +48 574 311 332, correspondence address: ul. Baśniowa 1C/2, 05-091 Ząbki.
1.3. The WebDisk account is shared by services provided under the WebDisk brand; its controller is the same Provider. This Policy describes how WebDisk account data is used in the WebDisk Backup service.
2. Scope and categories of data processed
2.1. WebDisk account data: the email address serving as the login, first name and surname if provided, the preferred language, and authentication data stored in a form that makes it impossible to read the password.
2.2. Order and billing data: the name of the Customer or its organisation, address, tax identification number (Polish NIP or EU VAT number) and country, the result of verifying that number in public registers (GUS, VIES), the quantities ordered, the currency, and the history of payments and of invoices issued. We do not store payment card data — it is processed solely by the payment operator.
2.3. Evidence of acceptance of documents: the version and language of the accepted documents (Terms, Privacy Policy, Data Processing Agreement), the IP address, and the date and time of acceptance.
2.4. Data in the backup console necessary to provide the Service: the name of the Customer's Organisation, the login and email address of the Customer's administrator, and technical data collected by the backup software about protected devices — names and parameters of computers, servers and virtual machines, IP addresses, statuses and history of backup jobs, and use of licences and backup storage.
2.5. Technical data of the portal and website: the IP addresses from which connections are made, the log of operations performed in the portal (purchase, change of quantities, cancellation and resumption of the Subscription, setting a password, signing in), and cookies (section 8).
2.6. Ticket data: the content of tickets and correspondence, attachments, and Service data attached to the ticket automatically (Organisation identifier, purchased quantities, Service status).
2.7. Data used to prevent abuse when ordering: the IP address and whether it comes from an anonymising network, the result of checking the email address (disposable mailbox, deliverability, repeated address), the result of a computational task performed by the browser before an order is placed, and attempt counters used for rate limiting.
2.8. Data in Backups is not covered by this Policy. The Provider does not inspect the content of Backups and processes them as a processor — see the Data Processing Agreement.
3. Purposes and legal bases of processing
| Purpose of processing | Legal basis |
|---|---|
| Providing the Service: WebDisk account, Organisation in the backup console, portal, handling the contract | Article 6(1)(b) GDPR — necessity for the performance of a contract |
| Sending transactional messages (password-setting link, payment reminders, notice of permanent deletion of Backups) | Article 6(1)(b) GDPR |
| Billing, issuing and retaining accounting documents, verifying the tax number and the VAT rate | Article 6(1)(c) GDPR — legal obligation (accounting and tax regulations) |
| Recording evidence of acceptance of documents | Article 6(1)(f) GDPR — legitimate interest in demonstrating the content of the concluded contract |
| Security of the Service, logging of operations, preventing abuse when ordering | Article 6(1)(f) GDPR — legitimate interest in protecting the Service, Customers and infrastructure |
| Handling tickets, complaints and correspondence | Article 6(1)(b) and (f) GDPR |
| Establishment, exercise or defence of claims | Article 6(1)(f) GDPR |
| Analytics and measuring marketing effectiveness on the website (non-essential cookies) | Article 6(1)(a) GDPR — consent, given and withdrawn in the consent management mechanism, where such cookies are used |
4. Data recipients
4.1. Data may be made available to processors acting on our instruction, in particular: the supplier of the backup infrastructure, the payment operator (Stripe Payments Europe Ltd.), the email operator, the ticketing system provider and entities providing accounting and legal services. The list of categories of processors is contained in section 12 of the Backup Terms.
4.2. We send the tax identification number given in the order to public registers (GUS, VIES) to verify it.
4.3. The content of this clause will be completed before the document takes effect.
4.4. Data may be made available to public authorities where such an obligation arises from the provisions of law. We inform the Customer about a request from an authority if the law permits it.
5. Transfers of data outside the European Economic Area
5.1. The content of this clause will be completed before the document takes effect.
5.2. A transfer of data outside the European Economic Area may occur in connection with the handling of payments by the payment operator — on the basis of standard contractual clauses approved by the European Commission (Article 46 GDPR).
5.3. The content of this clause will be completed before the document takes effect.
6. Data retention period
| Category of data | Retention period |
|---|---|
| WebDisk account data | for as long as any WebDisk service is used; the end of the WebDisk Backup contract does not delete the WebDisk account |
| Organisation data and technical data from the backup console | for the duration of the contract and the 30-day Retention period after it ends |
| Order and billing data | for the duration of the contract; accounting documentation — for the period required by accounting and tax regulations, as a rule 5 years from the end of the financial year |
| Evidence of acceptance of documents | until the limitation period for claims under the contract expires |
| Operations log | 12 months |
| Ticket data | to be completed before the document takes effect |
| Data used to prevent abuse | to be completed before the document takes effect |
| Data processed for the purpose of establishing, exercising or defending claims | until the expiry of the limitation period for claims |
7. Rights of data subjects
7.1. You have the right to: access the data (Article 15 GDPR), rectification (Article 16), erasure (Article 17), restriction of processing (Article 18), portability of the data (Article 20) and objection to processing based on a legitimate interest (Article 21). Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before its withdrawal.
7.2. Rights are exercised through the Customer portal or upon a request submitted to iod@webdisk.io.
7.3. You have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO) (ul. Stawki 2, 00-193 Warsaw).
7.4. Requests concerning data contained in Backups should be directed to the Customer, who is the controller of that data. The Provider assists the Customer in handling such requests under the Data Processing Agreement.
7.5. The provision of data is voluntary, but necessary for the conclusion and performance of the contract and for the issuance of accounting documents.
8. Cookies
8.1. The backup.webdisk.io website uses cookies necessary for its operation, in particular: a session cookie shared by WebDisk services in the webdisk.io domain (signing in with one WebDisk account), cookies remembering the chosen language and currency, and cookies used for the security of orders. Their use does not require consent.
8.2. Other cookies, including analytical and marketing cookies, are used solely after consent has been given via the consent management mechanism available on the website. Consent may be withdrawn at any time in the settings of that mechanism.
8.3. Detailed information is contained in the Cookie Policy.
9. Data security
9.1. We apply technical and organisational measures corresponding to the risk, referred to in Article 32 GDPR, in particular:
- encryption of connections to the portal and the backup console with the TLS protocol,
- access control to the infrastructure of the Service application (administrative access only for authorised persons, with authentication),
- a separate Organisation in the backup console for each Customer, with its own storage limit,
- storing WebDisk account passwords in a form that makes it impossible to read them,
- logging of administrative operations and monitoring of the Service,
- regular security updates.
9.2. This Policy does not declare additional measures on the side of the backup infrastructure, in particular encryption of Backups or their immutability; the rules in this respect are set out in the Backup Terms (clauses 9.3 and 9.4).
9.3. The security of the backup job configuration, including any encryption of Backups with the Customer's password, is ensured by the Customer (Backup Terms, clause 4.4).
10. Automated decision-making
10.1. The data is not used for profiling or for automated decision-making producing legal effects concerning you or similarly significantly affecting you.
10.2. When an order is placed, we apply automated abuse safeguards (clause 2.7) that may stop the order. In that case you can contact us at support@webdisk.io and the order will be reviewed by a person.
11. Amendments to the Privacy Policy
11.1. The Policy may be updated. The version and the date of effect are indicated at the beginning of the document. We inform about material amendments by email or in the Customer portal 30 days in advance.
11.2. The Policy is available in Polish, English, Ukrainian and German. In the event of discrepancies between the language versions, the Polish version is binding.
Mazura sp. z o.o. · WebDisk Backup · Privacy Policy · version 1.0 · draft — effective date after approval