SK
SubmitKit

Legal

Privacy Policy

Last updated: 2026-09-08

1. Operator (data controller)

The operator of SubmitKit and the data controller for this website is Zordon Intelligence Sp. z o.o. (Zordon Intelligence, sp. z o.o. (limited liability company)), a company registered in Republic of Poland.

KRS
0001190915
NIP
7252358503
REGON
542545843
Address
Łódź, Polska
Email
hi@zordonintelligence.pl

We are not required to appoint a Data Protection Officer under Art. 37 GDPR (no large-scale monitoring, no special-category data, no public authority).

2. What data we collect

SubmitKit sells a digital Google Sheet (308 rows, verified 2026-09-07) via PayPal. We collect and process only the minimum data needed to deliver the product, prevent fraud, and handle support requests.

  • Order data. PayPal transaction ID, payment status, amount, currency, date. We do not see your full card or bank details — PayPal processes those.
  • Contact data. Email address you give PayPal at checkout (or that PayPal returns to us) — used to deliver the product and to handle refunds/support.
  • Buyer notes. Optional message you may include with payment — stored on PayPal's side.
  • Technical data. IP address, user agent, referrer, and a session cookie served by PayPal during checkout. Necessary for fraud prevention.
  • Analytics (opt-in). If you accept the analytics cookie, Vercel Analytics records anonymous pageview + event metadata (URL, referrer, country, device class). No marketing identifiers, no cross-site profile.

We do not collect biometric, health, financial-account, or any special-category data under Art. 9 GDPR.

3. Why we collect it (legal basis)

  • Contract (Art. 6(1)(b) GDPR). Order + contact data are needed to deliver the Google Sheet you bought.
  • Legal obligation (Art. 6(1)(c) GDPR). We retain accounting/transaction records for the period required by Polish tax law (currently 5 years from year-end of the transaction).
  • Legitimate interest (Art. 6(1)(f) GDPR). Fraud prevention and basic site security. Limited to what is necessary.
  • Consent (Art. 6(1)(a) GDPR). Analytics cookies load only after you click "Accept all" on the cookie banner. You may withdraw that consent at any time — see Section 8.

4. Recipients and processors (Art. 28 GDPR)

Data is shared with these processors. Each acts under a written data-processing agreement that satisfies Art. 28(3) GDPR:

  • PayPal. Payment processing and fraud prevention. PayPal acts as an independent controller for payment data. See PayPal's privacy notice and BCR.
  • Vercel Inc. Hosting, edge delivery, and (with your consent) anonymous analytics. Vercel acts as processor under its DPA and Standard Contractual Clauses.
  • Google Sheets (Google LLC). Hosts the deliverable workbook. We share a "view-only" link; you "make a copy" into your own Google account. Google's GDPR terms apply.

We do not sell, rent, or trade your personal data. We may add or change processors in future; the list above represents our current sub-processors.

5. International transfers

Some processors (PayPal, Vercel, Google) are based outside the EEA. Transfers are safeguarded by Standard Contractual Clauses (EU 2021/914) and supplementary measures. Where we have not verified an equivalent mechanism, we do not transfer the data.

6. Retention

  • Transaction records (invoice/order data): 5 years from the end of the tax year (Polish tax law).
  • Support correspondence: up to 2 years after the case is closed, unless we have a legal duty to keep it longer.
  • Analytics (Vercel): aggregated, does not identify you; Vercel's own retention applies (typically 30-90 days).
  • Cookie consent record: stored in your browser (localStorage); cleared if you clear browser data.

7. Your rights

Under GDPR you have the right to:

  • access the personal data we hold about you (Art. 15);
  • rectify inaccurate or incomplete data (Art. 16);
  • erase your data, where the legal basis permits (Art. 17);
  • restrict or object to processing (Art. 18, 21);
  • data portability for data we process by automated means based on consent or contract (Art. 20);
  • withdraw consent at any time (Art. 7(3)) — this does not affect the lawfulness of processing before withdrawal;
  • lodge a complaint with the Polish data-protection authority — Prezes Urzędu Ochrony Danych Osobowych (PUODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.

To exercise any right, email hi@zordonintelligence.pl from the address that made the order. We may need to verify your identity before acting and respond within the 30-day period set by Art. 12(3) GDPR.

8. Consent withdrawal — opt-out as easy as opt-in

Per Art. 7(3) GDPR, withdrawing consent must be as easy as giving it. You can withdraw your analytics consent at any time by:

  • clearing your browser's site data for https://submitkit.online (the consent banner returns on next visit, choose "Essential only");
  • emailing us at hi@zordonintelligence.pl — we apply the change server-side within 7 days.

We do not use opt-out by default; you are opted out of analytics until you click "Accept all".

9. Personal data breach notification

In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will notify affected users without undue delay (Art. 34 GDPR). Where the breach is reportable, we will notify the President of the Personal Data Protection Office (PUODO) within 72 hours of becoming aware of it (Art. 33 GDPR). Documentation includes the facts, consequences, and the measures we took.

10. Cookies

For details on the cookies and similar storage we use, see our Cookie Policy. Analytics consent lives in localStorage (not a tracking cookie); the cookie banner's "Essential only" / "Accept all" choice is the only thing it stores.

11. Children

SubmitKit is a business tool for adult founders. We do not knowingly collect personal data from anyone under 16. If you believe we have, contact us and we will delete it (Art. 8 GDPR).

12. Automated decision-making

We do not use automated decision-making or profiling that produces legal or similarly significant effects on you (Art. 22 GDPR). Fraud scoring is done by PayPal, governed by their privacy notice.

13. Changes to this policy

We may update this policy; material changes will be announced on this page with a new "Last updated" date. Where changes affect your rights, we will give prior notice on the homepage banner for at least 14 days. Continued use of SubmitKit after changes means you accept the updated policy.

© 2026 Zordon Intelligence Sp. z o.o.. All rights reserved.