Privacy notice

This notice explains how we process data when you visit obligix.com or use an Obligix account.

Who is responsible

Expanding Web Marcin Dancewicz, ul. Malinowskiego 1, 59-600 Lwówek Śląski, Poland, VAT ID PL6161455447 (the controller). Contact: support@expandingweb.com.

What we collect and why

• Account: your email address, password stored as a cryptographic hash, account-verification and password-reset tokens. Purpose: account access and security. Legal basis: performance of the service you request (art. 6(1)(b) GDPR) and our legitimate interest in security (art. 6(1)(f)).
• Company profile: company name, country, legal form, activities, markets, employment and other business traits you enter. We use it for automated analysis, including AI-assisted analysis, and to present source-verified obligations. Legal basis: performance of the service (art. 6(1)(b) GDPR).
• Portal activity and evidence: session data, obligations shown to the company, completion notes and links to confirmation that you choose to add, and files you upload as proof (photos, PDF documents). Purpose: to operate the company’s trail and keep its record. Uploaded files are kept until you delete them in the portal or your account is deleted. Legal basis: performance of the service (art. 6(1)(b) GDPR).
• Server logs: request data such as IP address, time, path and browser identifier, used for security and troubleshooting. Legal basis: our legitimate interest (art. 6(1)(f) GDPR).

We use no analytics scripts or advertising pixels. The portal uses one essential session cookie to keep an authenticated account signed in; it is not used for advertising or analytics.

Where the data goes

We use hosting, email and automated-analysis/AI service providers to operate the portal. Processing may take place outside the European Economic Area where a provider uses appropriate safeguards. We do not send your company profile, obligations or evidence to any authority, registry or office. Access is limited to people and providers who need it to operate the service.

How long we keep it

We retain account and company data while the account is active and as needed to operate the service, resolve security issues and meet applicable obligations. You can request deletion by writing to the address above; we will assess the request and remove data unless law requires us to retain it.

Account confirmation and password reset tokens are deleted once they expire. Sent messages from the notification queue (recipient address and content) are deleted after 90 days. Abuse-protection counters (linked to an IP address or account) are deleted when the limit window ends.

Your rights

Access, rectification, erasure, restriction, portability and objection, as set out in articles 15 to 21 GDPR, by email to the address above. You may also lodge a complaint with the President of the Personal Data Protection Office (UODO) in Poland or your local supervisory authority.

Last updated: 7 September 2026.