What personal data CREHLER Sp. z o.o. processes in connection with the useaxon.io website, the panel.useaxon.io panel and the Axon application, for what purposes and on what terms.
This is an English translation provided for convenience. In case of any discrepancy between language versions, the Polish version prevails. Read the binding Polish version →
This document describes what personal data CREHLER Sp. z o.o. processes in connection with the useaxon.io website, the panel.useaxon.io panel and the Axon application, for what purposes and on what terms.
Controller: CREHLER Sp. z o.o. with its registered office in Zielona Góra, ul. Generała Władysława Sikorskiego 4/120, 65-454 Zielona Góra, Poland, entered in the Register of Entrepreneurs of the National Court Register kept by the District Court in Zielona Góra, 8th Commercial Division of the National Court Register, under KRS number: 0000589243, share capital PLN 48,000.00, NIP: 9731024669, REGON: 363109359.
Contact in matters relating to personal data: [email protected], correspondence address as above.
Controller – CREHLER. Data of persons who create and operate an account in the Panel, billing data, correspondence, support requests, data of visitors to the useaxon.io website.
Processor – CREHLER. Personal data processed using the Axon application on behalf of the Customer. The controller of this data is the Customer – it is the Customer who determines the purposes and means of processing. The rules and the actual scope are set out in the data processing agreement.
If a data subject addresses to us a request concerning data in the second group, we forward it to the relevant Customer and inform the requester accordingly.
Axon is an application running in the browser that connects directly to the Customer's Shopware instance. Business data – quotes, orders, invoices, customer and product data – does not pass through our infrastructure and is not stored in it. We also do not receive users' passwords: login is handled by the Customer's Shopware.
Our infrastructure, located in the OVH data centre in Warsaw, contains only:
| Category | Content |
|---|---|
| Panel Account | First name and surname, email address, password stored in hashed form |
| Store billing data | Company name, address, NIP, country, currency, invoice history. Payment card data is not stored |
| Store configuration | Shopware instance address, technical name, custom domain, sales channel API access key, colour scheme settings |
| Correspondence and requests | Content of messages, contact details, attachments |
We do not keep server access logs. Request logging is disabled in the production environment, so we do not collect the IP addresses of users of the application or the Panel.
Interface settings of individual users – column layout, number of items per page, scrolling mode – are saved in the Customer's Shopware instance, not with us.
A local cache of catalogue data and search suggestions is stored on the user's device, enabling work over a poor connection. The customer data cache is deleted upon logout.
| Purpose | Legal basis | Retention period |
|---|---|---|
| Conclusion and performance of the agreement, maintaining the Account, provision of the Service | Article 6(1)(b) GDPR | Term of the agreement |
| Billing, issuing and storing invoices | Article 6(1)(c) GDPR in conjunction with tax and accounting regulations | 5 years from the end of the year in which the tax payment deadline expired |
| Handling support requests and complaints | Article 6(1)(b) and (f) GDPR | 3 years from closure of the request |
| Establishment, exercise and defence of claims | Article 6(1)(f) GDPR – legitimate interest | Until expiry of the limitation period, as a rule 3 years |
| Direct marketing of our own services to customers | Article 6(1)(f) GDPR and Article 398 PKE | Until an objection is raised |
| Sending commercial information to the designated address | Article 6(1)(a) GDPR – consent, in conjunction with the Polish Electronic Communications Law (PKE) | Until consent is withdrawn |
| Analytics of the useaxon.io website | Article 6(1)(a) GDPR – consent | Until consent is withdrawn, no longer than the periods specified in the Cookie Policy |
| Accounts after the Trial Period and inactive accounts | Article 6(1)(b) and (f) GDPR | 30 days from suspension, followed by deletion |
The sales channel API access key is deleted without delay, no later than within 7 days of termination of the agreement or deletion of the Store.
| Recipient | Role | Scope | Location |
|---|---|---|---|
| OVH | Processor | Infrastructure of the application, Panel and configuration database | Warsaw, Poland |
| Stripe Payments Europe, Ltd. | Independent controller and processor with respect to payment processing | Billing data, transaction data | Ireland; transfers outside the EEA on the basis of standard contractual clauses |
| Google Ireland Limited – Google Workspace / Gmail | Processor | Email address, content of system messages | Ireland (contracting entity). Data covered by the data regions policy is stored in Google data centres in the European Union. Other data and some processing operations may take place outside the EEA, including in the USA, on the basis of the EU–US adequacy decision (Data Privacy Framework) or standard contractual clauses – in accordance with the Cloud Data Processing Addendum. |
| Google Ireland Limited – Google Analytics 4 | Processor | Analytics data of the marketing website only, only after consent has been given | Transfers to the USA on the basis of the EU–US Data Privacy Framework and standard contractual clauses |
| Microsoft Ireland Operations Limited – Clarity | Processor | Analytics data and session recordings on the marketing website only, only after consent has been given | Transfers outside the EEA on the basis of standard contractual clauses |
| Accounting firm, law firm, auditor | Processors or independent controllers | To the extent of the services provided | Poland |
We do not use external error monitoring tools or user behaviour tracking tools in the application or in the Panel.
Data processed in the Axon application and in the Panel remains in Poland. The infrastructure is located in the OVH data centre in Warsaw.
Transfers outside the EEA occur only with respect to the analytics tools operating on the useaxon.io marketing website and payment processing by Stripe. They take place on the basis of an adequacy decision or standard contractual clauses adopted by the European Commission, together with supplementary safeguards. We provide a copy of the safeguards upon request sent to the contact address.
You have the right to:
You should send your request to [email protected]. We respond without undue delay and no later than within one month; in complex cases the time limit may be extended by two months, of which we will inform you.
Providing data is voluntary but necessary to conclude and perform the agreement. Without billing data we will not issue an invoice, and without an email address we will not create an account. Providing a NIP number by a Customer from Poland is required by tax regulations.
We do not make decisions about you based solely on automated processing which would produce legal effects or similarly significantly affect you. We do not carry out profiling within the meaning of Article 4(4) GDPR.
We apply technical and organisational measures appropriate to the risk, described in Annex B to the data processing agreement. In particular:
We assess personal data breaches in accordance with Articles 33 and 34 GDPR. If a breach is likely to result in a risk to the rights or freedoms of natural persons, we notify it to the President of UODO without undue delay and, where feasible, within 72 hours of becoming aware of it, unless the breach is unlikely to result in such a risk. If a breach is likely to result in a high risk to the rights or freedoms of data subjects, we also notify those persons, taking into account the exceptions provided for in Article 34 GDPR.
The rules for the use of cookies and similar technologies are described in a separate Cookie Policy.
We may update the Privacy Policy, in particular when the scope of services, providers or regulations change. We give notice of material changes to the email address assigned to the Account 30 days in advance. The version history is available at useaxon.io.