1. Controller
MISNET Michał Chojaczyk
Bulwar Ikara 11/18, 54-130 Wrocław, Poland
NIP / EU VAT ID: PL8971614358
REGON: 361107853
Email: contact@misnet.pl
For any question regarding this policy or your personal data, contact us at the address above. We have not appointed a Data Protection Officer; enquiries are handled directly by the controller.
Security and incident contact: Michał Chojaczyk, michal@misnet.pl
2. Controller vs. Processor - an important distinction
This policy covers data for which MISNET acts as controller: website visitors, business enquiries, and user accounts.
Client production data is different. Weld images, measurement results, and reports uploaded to WeldAI Scan by our clients are processed by MISNET strictly as a processor, acting on the client's documented instructions under a separate Data Processing Agreement (DPA). We do not determine the purposes of that processing, we do not use client images to train models unless expressly permitted in writing, and all data remains the client's property. See our Procurement & Security page for hosting, subprocessor, and retention details.
3. What we collect, why, and on what legal basis
| Data | Purpose | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Name, business email, company, phone, message content - submitted via email or contact form | Responding to enquiries, preparing quotes, pre-contractual contact | Art. 6(1)(b) - steps prior to contract; Art. 6(1)(f) - legitimate interest in B2B communication | 24 months from last contact, or duration of the business relationship |
| Contract and billing data | Performance of contract, invoicing | Art. 6(1)(b); Art. 6(1)(c) - legal obligation | 5 years from end of the tax year (Polish accounting law) |
| Application account data - name, email, organisation, role | Providing access to WeldAI Scan, authentication, audit trail | Art. 6(1)(b) | Duration of the account plus the period agreed in the DPA |
| Audit log entries - user ID, timestamp, action performed | Traceability required by IATF 16949 (who / when / what / result) | Art. 6(1)(b); Art. 6(1)(f) - legitimate interest in integrity of quality records | As agreed in the DPA, aligned with the client's quality-record retention rules |
| Server logs - IP address, user agent, request time | Security, abuse prevention, diagnosing faults | Art. 6(1)(f) - legitimate interest in securing our systems | 1 month |
| Cookies and similar technologies | See section 7 | See section 7 | See section 7 |
We do not process special categories of personal data, and we do not knowingly collect data from anyone under 16.
4. Recipients and subprocessors
Personal data may be disclosed to:
- OVH SAS - application server, PostgreSQL database and DNS, Frankfurt am Main, Germany (EU)
- Amazon Web Services (S3) - storage of weld images and generated PDF reports, Frankfurt, Germany (eu-central-1, EU)
- Google (Google Workspace) - business correspondence only; no access to weld images, measurement results or reports
- Netlify - hosting of this marketing website
- Accounting, legal, and IT service providers bound by confidentiality obligations
- Public authorities, where required by law
A current list of subprocessors handling client production data is maintained on our Procurement & Security page.
5. Transfers outside the EEA
Application data is hosted exclusively within the European Union. Some communication tools (Google Workspace) may involve transfers to third countries; these are covered by the European Commission's Standard Contractual Clauses and the provider's supplementary safeguards. On request, we can provide a copy of the relevant transfer mechanism.
6. Your rights
Under the GDPR you have the right to: access your data; obtain rectification; request erasure; request restriction of processing; data portability; and object to processing based on legitimate interest. Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out beforehand.
To exercise any of these rights, write to contact@misnet.pl. We respond within one month.
You also have the right to lodge a complaint with the supervisory authority:
Prezes Urzędu Ochrony Danych Osobowych
ul. Stawki 2, 00-193 Warszawa, Poland
uodo.gov.pl
7. Cookies
This website uses only technical cookies strictly necessary for it to function. We do not use
analytics, advertising, or tracking cookies, and therefore no consent banner is displayed. The
application at app.weldaiscan.com uses
a session cookie required for authentication.
8. Automated decision-making
We do not carry out automated decision-making producing legal or similarly significant effects concerning you, and we do not profile visitors. Note that the AI analysis performed on weld images concerns physical objects, not people.
9. Is providing data mandatory?
Providing data is voluntary, but necessary to contact us, receive a quote, or use the application. Without it we cannot provide these services.
10. Changes
We may update this policy - for example when we add a subprocessor or launch a new feature. The current version is always published at this address, with the date of the last update shown at the top. Material changes affecting existing clients are communicated by email.