GDPR - Your Rights
Effective from: June 1, 2026
Cerium respects your privacy. Below is a summary of your rights under GDPR. The full policy is in the Privacy Policy document. This is a courtesy translation - the Polish version is legally binding.
1. Your rights
You have the right to know what data we process about you (art. 15 GDPR).
You have the right to rectification of inaccurate data (art. 16 GDPR).
You have the right to erasure - "right to be forgotten" (art. 17 GDPR).
You have the right to restrict processing (art. 18 GDPR).
You have the right to receive your data in machine-readable format and transfer it to another controller (art. 20 GDPR).
You have the right to object to processing (art. 21 GDPR).
2. Data Protection Officer (DPO)
The controller (IT Maciej Bodnar) has not appointed a Data Protection Officer (DPO). For all personal data protection matters, you can contact the controller directly.
Contact: [email protected].
The controller answers all GDPR questions and handles user requests.
3. Data transfers outside EEA
Application data (database, files, video) does not leave the EEA: most is stored in Poland on our own server infrastructure, some in the EU (Hetzner Online GmbH, Germany). Exceptions below.
Stripe Inc. (USA) - payments: transferred under Standard Contractual Clauses (SCC) and Data Privacy Framework.
Cloudflare, Inc. (USA) - HTTPS proxy: SCC + DPF.
Google LLC (USA) - visit statistics (Google Analytics, only with consent): DPF.
Meta Platforms, Inc. (USA) - ad performance measurement (Meta Pixel, only with consent): SCC + DPF.
ZeptoMail (Zoho EU) - email: no transfer outside EEA.
Full processor list in Privacy Policy (section 5).
4. How to file a request
Email [email protected] with your request (e.g., "I'd like a copy of my data", "please delete my account").
Attach identity confirmation (an email from the address linked to your account is sufficient).
We respond within 30 days. In complex cases we may extend to 90 days - we'll notify you.
Handling requests is free of charge. Only manifestly unfounded or excessively repeated requests may be subject to a reasonable administrative fee.
6. For schools (data controllers)
If you use Cerium as a school (SaaS client), your school is the controller of student/parent/teacher data, and Cerium acts as a processor.
We conclude a Data Processing Agreement (DPA) upon signing the services contract - you will receive it from us; a copy is available on request: [email protected].
You as controller are responsible for informing your users about processing and handling their GDPR requests.