← Back to the qualifier

Wersja polska · English version

Privacy Policy

NIS 2 / KSC Qualifier — nis2.guardiso.com · Effective date: 14 June 2026 · Version 1.0

1. Who is the controller of your data

The controller of personal data collected on nis2.guardiso.com (the "Service" or the "Qualifier") is Guardiso, based in Poland — Michał Lewandowski, sole proprietor (CEIDG registry), ul. Święty Marcin 29/8, 61-806 Poznań, Poland, Tax ID (NIP) 6060011996, REGON 381263810, operating under the Guardiso brand ("we" or "Guardiso").

You can contact us about personal data matters at:

2. How the Qualifier works — data minimisation

We designed the Qualifier in line with the data minimisation principle (Art. 5(1)(c) GDPR) and privacy by design (Art. 25 GDPR). In practice this means:

  • Your answers to the qualification and self-assessment questions are processed exclusively locally, in your browser. The qualifier logic runs client-side (JavaScript) — your answers are not transmitted to our servers or anywhere else.
  • Your progress is saved only in your browser's session memory (sessionStorage) — so a page refresh does not lose your progress. This data disappears when you close the browser tab and never leaves your device.
  • The tax ID (NIP) you may optionally use to auto-fill your company details is processed only transiently, on your browser's side. The company lookup request itself is sent by your browser directly to the public API of the Polish Ministry of Finance VAT taxpayer registry ("Biała Lista", wl-api.mf.gov.pl) — we do not proxy or see that request. However, if you request the PDF report, the NIP and company name you provided are sent to our server together with your submission and stored with it (to personalise the report).
  • The only personal data we actually collect is an email address — and only if you voluntarily provide it at the end to receive the free PDF report and tick the consent checkbox.
ℹ️Technical note: if you run a sole proprietorship, registry data (your name within the business name, the address) may constitute personal data. In that case the data stays in your browser and is not transmitted to us — unless you request the PDF report, in which case the NIP and company name are sent to our server with your submission.

3. What data we process, for what purposes and on what legal basis

DataPurposeLegal basis
Email address (provided voluntarily in the report request form) Sending the free PDF report with your qualification and self-assessment result, and sending information about Guardiso products and services related to NIS 2 / KSC compliance Art. 6(1)(a) GDPR — your consent. Consent is voluntary and may be withdrawn at any time (see section 7)
Technical connection data (IP address, basic HTTP request data) — in hosting infrastructure logs Service security, abuse prevention (DDoS, bots), error diagnostics Art. 6(1)(f) GDPR — our legitimate interest in ensuring the security and availability of the Service
Anonymised visit statistics (if we enable cookieless analytics, e.g. Cloudflare Web Analytics — no cookies, no fingerprinting, no identification of individuals) Measuring traffic and improving the Service Art. 6(1)(f) GDPR — our legitimate interest in developing and improving the Service

If you do NOT request the PDF report, we do not send your answers, tax ID or company details to our server — everything stays in your browser. When you request the report, the scope of data is exactly as listed in the table above (email, classification result, self-assessment answers, optionally tax ID and company name). We collect no data beyond that scope.

4. Recipients of the data

We may entrust your email address for processing only to providers who technically support the service, under data processing agreements (Art. 28 GDPR):

RecipientPurposeLocation
Resend Inc. (email delivery provider) Technical delivery of emails containing the PDF report and product information Emails are sent from servers located in the EU (Ireland, eu-west-1 region); the service is provided by Resend Inc., headquartered in the US and certified under the EU–US Data Privacy Framework (see section 5)
Cloudflare, Inc. (hosting and protection) Serving the Service's pages, DDoS protection, CDN; technical connection logs Traffic is served from data centres in the EU (including Warsaw); the service is provided by Cloudflare, Inc., headquartered in the US and certified under the EU–US Data Privacy Framework (see section 5)

The company lookup by tax ID is sent by your browser directly to the public API of the Polish Ministry of Finance (wl-api.mf.gov.pl). The Ministry of Finance is not a recipient of data from us — it is an independent controller of a public registry that your browser contacts at your request.

We may also disclose your data to competent public authorities where required by law.

5. Transfers outside the European Economic Area

As a rule we process data within the European Economic Area. To the extent our providers (Resend, Cloudflare) process data in the US, the transfer is based on:

  • the European Commission's adequacy decision for entities certified under the EU–US Data Privacy Framework (Art. 45 GDPR), or
  • Standard Contractual Clauses approved by the European Commission (Art. 46(2)(c) GDPR), together with supplementary technical and organisational measures.

You can obtain a copy of the safeguards by contacting us at privacy@guardiso.com.

6. How long we keep the data

DataRetention period
Email address (consent to the report and product information) Until you withdraw consent, but no longer than 24 months from when it was given. After that we delete the data or ask for consent again
Technical infrastructure logs Up to 90 days
Proof of consent (date, consent wording) For the duration of processing and the limitation period of potential claims — to demonstrate GDPR compliance (Art. 5(2) and Art. 7(1) GDPR)

Data in your browser's sessionStorage (answers, progress) disappears when you close the tab — it remains solely under your control and never reaches us.

7. Your rights

In connection with the processing of your personal data you have the following rights:

  • the right to withdraw consent at any time (Art. 7(3) GDPR) — without affecting the lawfulness of processing carried out before the withdrawal. You can withdraw consent by clicking the unsubscribe link in the footer of every email from us or by writing to privacy@guardiso.com;
  • the right of access to your data and to receive a copy of it (Art. 15 GDPR);
  • the right to rectification (Art. 16 GDPR);
  • the right to erasure (Art. 17 GDPR);
  • the right to restriction of processing (Art. 18 GDPR);
  • the right to data portability (Art. 20 GDPR) — for data processed on the basis of consent;
  • the right to object to processing based on legitimate interest (Art. 21 GDPR).

To exercise these rights, write to privacy@guardiso.com. We will respond without undue delay, at the latest within one month.

You also have the right to lodge a complaint with the supervisory authority — the President of the Polish Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl.

8. Voluntary nature of providing data

Providing your email address is entirely voluntary. You can complete the whole qualification and see your result without providing any personal data. The email address is needed only if you want to receive the PDF report — without it we would have no technical means of sending it.

9. No profiling or automated decision-making

We do not make decisions about you based solely on automated processing, including profiling, that would produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). The qualification result is generated algorithmically in your browser, is purely informational, and is not stored or analysed by us.

10. Cookies, local storage and analytics

The Service uses cookies and local browser storage to a limited, necessary extent and, on your first visit, displays a cookie consent banner where you can manage categories. You can change your choice at any time via the "Privacy settings" link in the footer. We do not use third-party advertising or tracking cookies.

We use the following mechanisms:

  • Strictly necessary — storing your consent decision (the guardiso_cc cookie) and protecting forms against bots (Cloudflare Turnstile). Required for operation and security; legal basis: necessity to provide the service (Art. 399(2) of the Electronic Communications Law) and legitimate interest (Art. 6(1)(f) GDPR).
  • Preferences (functional) — remembering your chosen language and colour theme (local storage). Enabled with your consent; disabling does not affect security.
  • Analytics — we use Cloudflare Web Analytics: cookieless traffic analytics, with no fingerprinting and no identification of individuals. Legal basis: our legitimate interest in measuring and improving the Service (Art. 6(1)(f) GDPR). Data is processed within the European Union.

In addition, the Service uses two local browser storage mechanisms necessary to provide the service you request:

MechanismWhat it storesFor how long
sessionStorage Your answers and progress in the qualifier — so that a page refresh does not erase your progress Until you close the browser tab
localStorage Your chosen colour theme (light/dark) — only if you switch the theme yourself Until you clear your browser data

This data is stored solely on your device and is never transmitted to our servers. This storage is necessary to deliver a service explicitly requested by you, and therefore — pursuant to Art. 399(2) of the Polish Electronic Communications Law of 12 July 2024 (previously Art. 173(3) of the Telecommunications Law), implementing the ePrivacy Directive — it does not require your consent.

11. Security

We apply technical and organisational measures appropriate to the risk (Art. 32 GDPR), in particular: encryption in transit (TLS), an architecture that minimises data collection (browser-side processing), access to data restricted to authorised persons only, and hosting on infrastructure with attack protection. Guardiso is a company professionally dedicated to information security compliance — we apply the same standards to our own services.

12. Changes to this policy

We may update this policy, for example when the Service's features or the law change. The current version with its effective date is always available at nis2.guardiso.com/legal/privacy-policy.html. We will communicate material changes concerning the processing of email addresses to the data subjects by email.

13. Contact