Privacy policy
How FluenceSecurity processes personal data on fluencesecurity.com, in the contact forms, on the blog and when you write to us or apply for a job.
Who is responsible for your data
The controller of personal data collected through this website is Fluence Security - Paweł Mierzwa (sole proprietorship — jednoosobowa działalność gospodarcza), place of business ul. Partyzantów 65B/1, 80-254 Gdańsk, Poland, entered in the Central Register and Information on Economic Activity (CEIDG), NIP 9571182795, REGON 540533818 ("FluenceSecurity", "we").
You can reach us about privacy at privacy@fluencesecurity.com, or by post at the address above. That address handles every data protection matter, including the requests set out below.
This policy covers fluencesecurity.com, including the blog, the contact forms and correspondence you start with us. Personal data we process while delivering a security service to a client, for example logs from the client's systems, is governed by the agreement and the data processing agreement with that client, not by this document.
What we collect and where it comes from
- Contact form data you provide: first and last name, work email address, phone number, company, country, job title if you give one, the services you are interested in, anything you write in the message field and, for the SOC enquiry form, the approximate number of endpoints. We also record which page the form was sent from.
- Correspondence: your email address, phone number and whatever you tell us when you email or call us.
- Job applications: what you send to careers@fluencesecurity.com, usually a CV, contact details and links to your work.
- Technical data generated when you visit: IP address, browser type and version, requested pages, referring page, timestamps and error logs. It is processed by our hosting providers to deliver the site and protect it from abuse.
- Browser storage limited to what the cookie policy describes.
We do not buy data about you and we do not enrich enquiries with data from third-party sources.
Why we process it and on what legal basis
| Purpose | Data | Legal basis |
|---|---|---|
| Answering your enquiry and preparing an offer | Contact form data, correspondence | Steps taken at your request before entering into a contract (art. 6(1)(b) GDPR) and our legitimate interest in responding to business enquiries (art. 6(1)(f)) |
| Following up on an enquiry with relevant information about our services | Contact form data, correspondence | Our legitimate interest in direct business communication (art. 6(1)(f)); you can object at any time |
| Running a recruitment | Job applications | Steps before entering into an employment or service contract (art. 6(1)(b) GDPR) and art. 22¹ of the Polish Labour Code for the data it lists; your consent (art. 6(1)(a)) for anything else you choose to send |
| Considering you for future openings | Job applications | Your consent (art. 6(1)(a) GDPR), only if you give it in your application |
| Operating and securing the website | Technical data, browser storage | Our legitimate interest in providing a working, secure site (art. 6(1)(f)); for storage in your browser, art. 399 of the Polish Electronic Communications Law, which allows storage that is strictly necessary for a service you use |
| Establishing, exercising or defending legal claims | Any of the above | Our legitimate interest (art. 6(1)(f)) |
We do not make decisions about you based solely on automated processing, and we do not profile you. We do not send marketing newsletters.
Who receives your data
We share personal data only with providers who process it on our behalf under a written agreement, and only to the extent needed:
- Cloudflare, Inc. hosts this website, serves it through its network and runs the function that relays contact form submissions to us. Cloudflare may process technical data at the location nearest to you.
- Our email provider receives contact form submissions, correspondence and job applications so that a person can answer them.
We do not sell personal data and we do not share it with advertisers. The site loads no third-party scripts, fonts or tracking pixels; links to our GitHub, LinkedIn and X profiles are plain links, and those services only receive data if you follow them.
We may disclose data when the law requires it, for example to a court or a public authority acting within its powers.
Transfers outside the European Economic Area
Some providers, notably Cloudflare, operate globally. Where personal data leaves the EEA we rely on the European Commission's adequacy decision for the EU-US Data Privacy Framework where the provider participates in it, and otherwise on the standard contractual clauses adopted by the Commission, supplemented by technical measures such as encryption in transit and at rest. You can ask us for a copy of the safeguards in place.
How long we keep it
- Contact form submissions and correspondence: for as long as the conversation is active, then for up to 24 months from the last exchange so that we can pick up a paused discussion. If it leads to a contract, for the duration of the contract and afterwards for as long as the law requires, in particular for tax and accounting purposes.
- Job applications: until the recruitment ends, and for up to 12 months afterwards if you agreed to be considered for future openings.
- Technical logs: up to 30 days, unless a log is needed to investigate a security incident.
When data is no longer needed we delete it or anonymise it.
Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and receive a copy;
- have inaccurate data corrected and incomplete data completed;
- have your data erased where there is no longer a legal ground to keep it;
- restrict processing while a dispute about accuracy or lawfulness is resolved;
- receive the data you provided in a structured, machine-readable format and have it transmitted to another controller;
- object to processing based on our legitimate interests, including direct business communication, at any time;
- withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.
To exercise a right, write to privacy@fluencesecurity.com. We answer within one month; for complex requests we may extend this by a further two months and will tell you if so. We may ask you to confirm your identity before acting on a request.
You also have the right to lodge a complaint with a supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl.
Is providing data mandatory?
Providing data is voluntary. Without the fields marked as required in a form we cannot answer the enquiry, and without contact details we cannot consider a job application. Technical data is generated automatically by your browser; you can limit it with browser settings, at the cost of some functionality.
How we protect it
Form submissions travel over encrypted connections only. Access to enquiries and applications is limited to the people who need them to do their job, and we do not write the content of submissions to application logs.
Children
This website is addressed to businesses and their staff. We do not knowingly collect data from anyone under 16. If you believe a child has sent us data, write to us and we will delete it.
Changes to this policy
We may update this policy when the site, our providers or the law change. The version number and the date at the top tell you which version you are reading. Material changes are announced on this page before they take effect.