Personal Data Controller
The controller of your personal data processed on bazafirm.online is:
- ZORDON INTELLIGENCE SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ
- KRS: 0001190915
- Tax ID (NIP): 7252358503
- REGON: 542545843
- Address: ul. Piotrkowska 152/30, 90-063 Łódź, łódzkie
- Registry: Sąd Rejonowy dla Łodzi-Śródmieścia w Łodzi, XX Wydział Gospodarczy Krajowego Rejestru Sądowego
- Share capital: 5 000,00 PLN
- Phone: 576 895 831
- kontakt@bazafirm.online
- For data protection matters: kontakt@bazafirm.online
What Data We Process and for What Purpose
User account data
We process your email address, password hash, role, and account verification date. Legal basis: Art. 6(1)(b) GDPR (necessity for the performance of a contract for the provision of electronic services). Account data is stored until the account is deleted.
Order and payment data
We process order history, filter snapshots, net/gross amounts, payment status, and Tpay transaction identifiers. Legal basis: Art. 6(1)(b) GDPR (performance of a sales contract) and Art. 6(1)(c) GDPR (tax obligation). We retain order and invoice data for 10 years from the end of the fiscal year.
Technical data and security logs
We collect IP addresses, User-Agent headers, event timestamps, and session identifier hashes. Legal basis: Art. 6(1)(f) GDPR (legitimate interest — system security and abuse detection). Security logs are retained for 24 months.
CSV sample data (sample downloads)
We process email address, filter hashes, download token, and timestamps. Legal basis: Art. 6(1)(a) GDPR (consent). Data is retained for 2 years from the sample download or until consent is withdrawn.
Marketing data and newsletter
We process your email address and communication preferences solely on the basis of your consent (Art. 6(1)(a) GDPR and Art. 10 of the Act on the Provision of Electronic Services). You may withdraw consent at any time (via the "Unsubscribe" link in the footer of each email or in the user panel).
Business data in the company database catalogue
To operate the Service we process data about businesses and persons representing business activity that we display in the generator, catalogue, and sold CSV/XLSX exports.
What data the catalogue includes
This may include: company name, NIP, REGON, legal form, registered address, industry (PKD), publicly available contact details (email, phone, website), and source/update metadata.
Data sources
Data comes from publicly available registers and lawful sources, in particular CEIDG, KRS, and REGON, as well as publicly published business contact information.
Purposes and legal basis
We process this data to build and maintain the company catalogue, provide search results, generate samples, and fulfil database sales contracts. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in operating a lawful B2B catalogue and selling registry data).
Retention
We retain data while it remains publicly available in registry sources or as necessary to provide the Service, and no longer than until a successful objection (Art. 21 GDPR) or removal from the catalogue after verification.
Information for data subjects in our database (Art. 14 GDPR)
If your contact details or your company’s data appear in our catalogue, we inform you about processing under Art. 14 GDPR. Where individual notification would require disproportionate effort, we provide this general notice (Art. 14(5) GDPR).
- Controller: Zordon Intelligence Sp. z o.o. (see “Personal Data Controller”)
- Purpose: B2B company catalogue, search, database generator, sale of data exports
- Legal basis: Art. 6(1)(f) GDPR (legitimate interest)
- Recipients: Service customers who purchase databases (they become separate controllers for their own use)
- Rights: access, rectification, erasure, restriction, objection (Art. 21), complaint to the supervisory authority
- Objection: submit via /rodo-sprzeciw form or contact email listed in the controller section
- Data source: public CEIDG, KRS, REGON registers and publicly available contact sources
Processors (data recipients)
Your data and technical Service data may be entrusted to the following processors. We conclude data processing agreements (Art. 28 GDPR) where required:
- Krajowy Integrator Płatności S.A. (Tpay), Poznań, Poland — payment processing (BLIK, bank transfers)
- Resend Inc. (USA) — transactional email (confirmations, sample links, password reset); transfer based on SCC
- Hosting / IT infrastructure provider (server in the EEA) — application, databases, backups
- Google LLC (USA) — Google Analytics 4 only after analytics cookie consent; transfer based on SCC
- Accounting office / tax advisor — bookkeeping and settlements
- Law firms — disputes or supervisory proceedings only
- Public authorities — as required by law
- After purchase: the buyer becomes controller of exported data under B2B licence terms
Transfers outside the European Economic Area
Some processors process data in third countries (in particular the USA). Transfers occur only with appropriate safeguards under GDPR Chapter V:
- EU Standard Contractual Clauses (SCC) — including Resend, Google
- Information on the transfer mechanism and a copy of SCC — on request (GDPR contact)
- Analytics (GA4) is activated only after analytics cookie consent in the cookie banner
Data retention schedule
We retain data only as long as necessary for the purposes described in this policy (Art. 5(1)(e) GDPR):
- User account data — until account deletion
- Orders and invoice data — 10 years from the end of the fiscal year
- Accounting records — 5 years (Polish Accounting Act)
- Security and audit logs — 24 months
- Cookie preferences — up to 14 months from consent or change
- Consent records — 2 years from withdrawal
- CSV sample downloads — 2 years or until consent withdrawal
- Global opt-out list — until objection is effective; entries are not deleted without legal grounds
- User data export file (self-service) — 7 days from generation
Your Rights (Art. 15–22 GDPR)
You have the following rights. Account holders may exercise them in the user panel. Other requests (access, rectification, erasure, etc.) can be submitted at /rodo-zadania. Persons whose data appear in the company catalogue (without an account) may use the objection form at /rodo-sprzeciw or contact us by email:
- Right of access (Art. 15 GDPR)
- Right to rectification (Art. 16 GDPR)
- Right to erasure (Art. 17 GDPR) — account deletion or removal from the catalogue
- Right to restriction of processing (Art. 18 GDPR)
- Right to data portability (Art. 20 GDPR) — export of your account data
- Right to object (Art. 21 GDPR) — to processing based on legitimate interest or marketing
- Right to withdraw consent at any time
Exercising your rights and response times
We respond without undue delay, within 30 days of receipt (extendable by 60 days in complex cases with notice, Art. 12(3) GDPR):
- Account holders: /konto/ustawienia — data export, marketing and cookie consents, account deletion
- Arts. 12–22 requests: /rodo-zadania form (access, rectification, erasure, restriction, portability)
- Persons without an account (catalogue data): /rodo-sprzeciw form or GDPR contact email
- Art. 21 objection regarding the catalogue: identity verification; usually within 30 days
- Account deletion: email confirmation link; account data deleted after verification, subject to tax/accounting obligations
- Account data export: generated in the panel; download link valid 7 days
Data protection contact
For GDPR matters, data subject requests, and objections regarding catalogue data, contact us by email (address in the controller section) with subject “GDPR”. We respond without undue delay, within GDPR time limits (usually up to 30 days).
Data Protection Officer (DPO)
The controller has not appointed a Data Protection Officer as it is not required for the scope and nature of processing. For data protection matters, contact the controller at the email address in the “Personal Data Controller” section.
Right to Lodge a Complaint
You have the right to lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, Poland, tel. +48 22 531 03 00, email: kancelaria@uodo.gov.pl.
Controller Status After Database Purchase
After purchasing a company database, you become the controller of the personal data contained in that database to the extent that you use it for your own business purposes (e.g. cold outreach). The data originates from public registers CEIDG, KRS, and REGON, but its further use requires compliance with the GDPR. See our guide "How to Use a B2B Database Legally".
Cookies
Our Service uses cookies for essential functionality (session, security), analytics (optional, with consent), and marketing (optional, with consent). Detailed information is available in the Cookie Policy.
Document Versioning
This privacy policy is versioned. Each change receives a new version number and publication date. Previous versions are archived. We notify you of material changes 14 days in advance via email and a notice in the user panel.
- Version: 2026-10-22-v1
- Publication date: 10 June 2026
- Last updated: 22 October 2026