Privacy Policy
Effective from: June 1, 2026
This Privacy Policy describes how Cerium (IT Maciej Bodnar, ul. Deszczowa 9, 03-673 Warszawa, NIP: 5243050733) processes your personal data.
1. Data controller
The controller of your personal data is IT Maciej Bodnar based in ul. Deszczowa 9, 03-673 Warszawa, NIP: 5243050733, REGON: 542769287.
GDPR contact: [email protected].
If you use Cerium as a school's software — the school is a separate controller of its students/parents/teachers data, and Cerium acts as a processor (DPA available in the panel).
2. What data we collect
Account data: first/last name, email, password (bcrypt-hashed), role in organization.
School data: name, VAT ID, address, billing details.
Operational data: lessons, grades, attendance, notes, invoices, messages, materials — entered by Users.
Technical data: IP address, session ID, browser type, login timestamp (stored in login_audit_logs for 90 days — for account security).
Payment data: handled exclusively by Stripe Payments Europe Ltd. — Cerium does not store card numbers.
Cookies: see section 8.
3. Purposes and legal bases
Service provision (art. 6(1)(b) GDPR — contract performance): account, lessons, invoices, communication.
Security (art. 6(1)(f) GDPR — legitimate interest): login logs, abuse monitoring.
Own marketing (art. 6(1)(f) GDPR): existing Users only, regarding service improvements. You may object at any time.
Newsletter (art. 6(1)(a) GDPR): only after explicit consent. Consent revocable at any time.
Legal obligations (art. 6(1)(c) GDPR): accounting, taxes, KSeF.
4. Retention
Account data: contract duration + 90 days after termination (archive), then permanent deletion.
Invoices and accounting data: 5 years (Polish Accounting Act).
Login logs (IP, user-agent): 90 days, then auto-deleted.
Complaint data: up to 3 years (statutory limitation).
Database backups: rotation up to 30 days.
5. Recipients (processors)
Stripe Payments Europe Ltd. (Ireland) — card payments; transfer outside EEA to Stripe Inc. (USA) under SCC.
Hetzner Online GmbH (Germany) - hosting of files (S3) and the Jitsi server (video lessons); Cerium's main application server is located in Poland. No transfer outside the EEA.
Zoho Corporation (ZeptoMail, EU) — transactional email. No transfer outside EEA.
Cloudflare, Inc. (USA) — CDN and Cloudflare Tunnel (HTTPS proxy). Transfer outside EEA under SCC and DPF.
fire-gem.com (Poland) — Cerium technical operator, under processing agreement.
6. Your rights
Right of access (art. 15 GDPR).
Right to rectification (art. 16 GDPR).
Right to erasure (art. 17 GDPR) — except data we must retain by law (e.g., invoices).
Right to restriction (art. 18 GDPR).
Right to data portability (art. 20 GDPR).
Right to object (art. 21 GDPR) — for processing based on legitimate interest.
Right to withdraw consent at any time (art. 7(3) GDPR).
Right to lodge a complaint with the Polish DPA (https://uodo.gov.pl).
7. How to exercise rights
Email [email protected] with your request.
We respond within 30 days — extended to 90 days in exceptional cases (with notice).
Free of charge — except for unfounded or excessive requests (we may charge a reasonable administrative fee).
9. Security
Passwords hashed with bcrypt (10 rounds).
HTTPS (TLS 1.3) on all endpoints.
Rate limiting on critical endpoints (login, contact, support, chat).
Tenant isolation at the SQL query level (tenantId filtering).
Daily database backups with 30-day rotation.
Breach monitoring (login_audit_logs, limit_events).
10. Contact
Privacy matters: write to [email protected].
Mailing address: IT Maciej Bodnar, ul. Deszczowa 9, 03-673 Warszawa.
Full Policy effective from June 1, 2026.