INFORMATION ABOUT DATA PROCESSING
Your data in NEXORA.
Version November 8, 2026
Administrator and contact
The administrator of account data, inquiries and license services is Dawid Górnicki, operating under the name IT Forterss, NIP 9591716981, ul. Majora Jana Piwnika Ponurego 38, 25-666 Kielce. For data matters, write to service@itfortress.pl.
What data and for what purpose?
For registration, we collect the recipient's name, e-mail address and account type. After confirmation, we store your password hash, registration date, licenses and their history. The data is used to maintain an account, service the trial and license, and contact us regarding the service (Article 6(1)(b) of the GDPR).
Billing details include the business or practice name, country, tax number, optional REGON and address. At your request, we retrieve Polish business details from the GUS REGON register using the NIP. Invoice details are retained with the order. The contact form and Service Desk retain requests and correspondence to respond to and handle requests (Article 6(1)(b) or (f) GDPR, depending on the matter).
Security, operation and error registers are used to protect the service, determine the course of changes and pursue and defend claims (Article 6(1)(f) of the GDPR). When the obligation to document settlements arises, the basis is also Art. 6 section 1 letter c GDPR.
Registration through an individual link may be attributed to a sales representative. This attribution is available only to authorized staff; we do not disclose customer account details to the representative.
Using a discount code attributes the confirmed purchase to a sales representative. We retain the account association and subsequent purchases, discount amounts, payments, refunds and commissions to settle the commercial relationship. Statements are available only to authorized staff. The representative does not receive access to the customer account.
License and patient data
Do not upload images or patient data to the license server. The Media Project provides for linking publications using file identifiers and hashes, without transmitting studies content. Website forms and submissions are not a channel for submitting medical records.
Data recipients
Authorized persons operating the service and maintenance and mail providers have access to the data to the extent necessary to provide them. Data may be made available to authorized bodies if required by law.
We use a Google Cloud service to prevent automated abuse. Google processes technical browser and connection data on our behalf. We do not send form contents or your email address to this service.
The provider’s processing terms are set out in the Google Cloud Data Processing Addendum. Processing may take place outside the EEA with appropriate safeguards. If the form is unavailable, contact us by email.
Google Cloud Data Processing Addendum
Data storage
We store account and license data for the duration of the account or authorization period, and then to the extent needed for settlements, documenting operations and the expiry of appropriate limitation periods. We keep correspondence for the duration of the case and the necessary period to secure claims. Restricted license provisions may also be needed after account closure to protect privileges already issued and to prevent multiple attempts at obtaining the same license.
The confirmation and password recovery links are valid for 30 minutes. A client session expires 30 minutes after it is created or the browser session ends. Backup copies are subject to separate rotation; Deleting data from an active database does not mean immediately deleting every previous copy.
Your rights
Pursuant to the principles set out in the GDPR, you may request access, rectification, deletion, restriction of processing or transfer of data, as well as object to processing based on legitimate interest. You can submit a complaint to the President of the Personal Data Protection Office. The scope of the law depends on the basis and purpose of processing. Send your request to the administrator's contact address.
Voluntariness and cookies
Providing data is voluntary, but the recipient's e-mail address and name are needed to maintain the account and respond to the request. The website uses technical session cookies and CSRF protection. We do not use advertising analytics or marketing tracking files on these websites. We do not make decisions that have legal effects solely on the basis of profiling; reCAPTCHA automatic assessment may refuse to send the form, maintaining an alternative e-mail contact.
We remember the selected language in a technical cookie for one year. Without manual selection, we use browser preferences, and when they do not match the supported languages, we use English.