Privacy policy
Last updated: 10 August 2026
Document version: en-2026-08-10. The Polish version at chemready.eu/pl/polityka-prywatnosci/ is the source text; this English version is kept in semantic parity with it.
1. Controller
The controller is LMW Jacek Kubas, ul. Rodzynkowa 30, 92-709 Łódź, Poland, VAT PL7272587939. Data contact: contact@chemready.eu.
We have not appointed a data protection officer — we are not required to. All matters are handled directly by the controller.
2. What we process and why
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Running the account and providing the service | name, e-mail, username, company details (name, VAT ID, address, phone) | Art. 6(1)(b) GDPR — contract | account lifetime + 30 days |
| Billing and invoices | company details, payment history (no card data) | Art. 6(1)(c) GDPR — tax obligation | 5 years from the end of the tax year |
| Compliance documentation (dossier, UFI, change archive) | data entered by the customer, including contact details given in a notification | Art. 6(1)(b) GDPR; for the customer also a CLP obligation | account lifetime; the customer controls export and deletion |
| Correspondence and support | e-mail address, message content | Art. 6(1)(f) GDPR — legitimate interest | up to 24 months from last contact |
| Security and system logs | IP address, request time, session identifier | Art. 6(1)(f) GDPR — service security | up to 12 months |
| Visit statistics (consent only) | visit data within the analytics tool's scope | Art. 6(1)(a) GDPR — consent | until consent is withdrawn |
3. Who receives the data
We use only the providers below. The list reflects the actual state of the service — we do not list providers speculatively.
| Recipient | Role | Location |
|---|---|---|
| Hetzner Online GmbH | application and database hosting | Germany (EEA) |
| Cloudflare, Inc. | CDN, attack protection, marketing-site hosting | USA / global network — see section 4 |
| Stripe Payments Europe, Ltd. | payments and invoicing | Ireland (EEA) |
| SeoHost.pl (Netster sp. z o.o.) | outgoing mail server (SMTP) | Poland (EEA) |
The European Chemicals Agency (ECHA) is not our subprocessor. Data reaches ECHA only when the customer deliberately triggers a submission from their own ECHA account, and only to the extent the notification form requires. In test mode the data goes to ECHA's test environment.
Large language model providers
We use external large language model providers to read the safety data sheet you upload and to independently re-validate the data extracted from it. This covers the content of the uploaded safety data sheet and product names and data — it does not cover login credentials or payment data.
| Provider | Used for |
|---|---|
| OpenAI | extracting composition and classification from the safety data sheet; independent re-extraction during validation |
| Anthropic | independent re-extraction during validation; product name suggestions for individual markets |
| independent re-extraction during validation |
The models are used to process content you supply, not to make regulatory decisions — the output always goes into a dossier that you approve before any notification.
The processing region and the retention terms on the side of these providers are still being established by us. We do not state anything here that we have not confirmed with the provider; once those points are settled we will complete this section together with the update date. Until then, please assume that processing may take place outside the EEA.
We do not sell data and do not share it for third-party marketing.
4. Transfers outside the EEA
Cloudflare, Inc. is based in the USA and serves traffic through a global network. Transfers rely on the European Commission's standard contractual clauses together with the provider's supplementary safeguards. Hetzner, Stripe and SeoHost.pl process data within the EEA. For the large language model providers the processing region is still being established — see the section on those providers above.
5. Your rights
You have the right of access, rectification, erasure, restriction, data portability, objection to processing based on legitimate interest, and withdrawal of consent at any time (without affecting the lawfulness of processing before withdrawal).
Write to contact@chemready.eu. Logged-in users can also export or delete their data from account settings.
You may lodge a complaint with the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, Poland.
6. Is providing data mandatory
An e-mail address and password are required to create an account. Company details (VAT ID, address) are required to generate a UFI and to notify — without them those functions do not work. Analytics consent is voluntary and does not affect the service.
7. Profiling
We do not make decisions about you based solely on automated processing that produce legal effects.
8. Cookies
Cookies and browser storage are covered by the separate Cookie policy.
9. Changes
Material changes are announced by e-mail to the account address and through the update date on this page.