Privacy and data handling

Controller and processing on customer instructions

The product operator is the controller for its customer contacts, orders, service security and support. Where Workspace processes personal data on an organisation's behalf, the organisation determines the purposes and its instructions must be covered by data-processing terms. Upload only information you are authorised to process. The payment or merchant-of-record entity identified in Checkout has its own privacy notice and responsibilities.

Purposes and legal bases

We use contact and order data to supply the purchased service, manage access and handle support. The basis is performance of a contract where applicable, or legitimate interests in serving business contacts and securing the service. Legally required records rely on the applicable legal obligation. Optional marketing and analytics rely on the required consent, which can be withdrawn without affecting earlier lawful processing. Access is not conditional on optional marketing consent.

Data collected and required information

Purchases record email, organisation, offer, amount and currency, terms acceptance and payment identifiers. These are needed for delivery; card details are not stored by CRACompliance. Assessment answers concern process readiness: do not enter vulnerability details, incident data, source code or SBOMs. Workspace stores authorised customer records, evidence and audit history. We do not use automated assessment scores to make decisions producing legal or similarly significant effects on individuals.

Recipients and international transfers

Hetzner provides hosting, Brevo transactional email and Stripe/Link the configured payment services. Email delivery processes recipient addresses, message content and delivery metadata; avoid confidential attachments in support email. Brevo's DPA is included in its terms. EU storage does not exclude overseas access: its terms provide for international processing using applicable safeguards such as standard contractual clauses and, where valid and applicable, the EU-US Data Privacy Framework. Applicable vendor roles and safeguards must be recorded for the services used; contact the operator for information or copies of relevant safeguards.

Retention and export

Under the accepted retention policy, Workspace data is kept for the service term, followed by a 30-day administrator export window after definitive termination. Switching off renewal or a temporary payment issue is not itself a deletion trigger. Deletion is blocked by documented legal holds, evidence-retention requirements or unresolved regulatory cases. Existing organisations must accept the policy; it is not silently imposed on historical records. Self-service export is tenant-scoped JSON/GZIP with attachments and checksums. Protected records or exports over 64 MiB require operator-assisted review before the export window closes.

Other retention periods and backups

Assessment answers and reports are retained through the purchased access period plus 30 days. Confirmed closed unpaid orders are deleted after 30 days; unresolved payment states are reviewed instead. The operator reviews ordinary support correspondence for deletion 12 months after case closure, unless documented legal retention applies; this is a manual support control, not automatic mailbox deletion. Technical logs are configured for up to 30 days and separately retained security logs for up to 90 days. Necessary accounting and dispute records follow their applicable legal period. Brevo delivery logs are limited to one month and new message previews are disabled. Rotating service backups expire within 30 days after primary deletion. Before restored data is served, the current independent deletion ledger and retention rules are reapplied. Documented legal holds and unresolved retention questions require operator review, not an indefinite automated retention decision. The Workspace Data Processing Agreement separately records the customer's instructions and acceptance.

Cookies and rights

Essential access/session cookies and an explicitly chosen language support the service. This EN/DE experience loads no GA4 or Clarity trackers. Where applicable, you may request access, correction, erasure, restriction and portability, object to legitimate-interest processing, or withdraw consent. Legal retention may limit erasure. Contact the operator; you may complain to the Polish supervisory authority, UODO, or another competent authority. Data is not sold or shared with a referral partner without the separate applicable authorisation.

Configured product operator

Bartosz Kowalczyk · ul. Gieysztora 4/161, 02-999 Warszawa · kontakt@cracompliance.pl

Next steps

Official sources and review context

Regulation (EU) 2024/2847 · European Commission · ENISA SRP

CRA-I18N-RETENTION-2026-10-16-REVIEW-2