Tickingora Privacy Policy
1. Controller
The controller of personal data is sixt4 sp. z o.o., registered office: ul. 1 Sierpnia 53/34, 02-134 Warszawa, Poland, Tax ID (NIP) 522-323-02-60, National Court Register (KRS) 0000980872. Contact for data protection matters: biuro@sixt4.pl.
2. Data we process
- Account data: name or organisation, e-mail address, password (stored only as a cryptographic hash), time zone, language, date of accepting the Terms.
- Monitor configuration: names and descriptions, schedules, URLs, an extra notification e-mail address, HTTP headers (their values are stored encrypted).
- Monitoring data: the time Heartbeat signals are received together with the sender's IP address and User-Agent header, HTTP check results (status codes, timings, error descriptions), incidents, notification delivery status.
- Technical data: IP address and session data when using the dashboard, technical logs needed for security and troubleshooting.
3. Purposes and legal bases
- Creating and maintaining the account and providing monitoring and notifications — Art. 6(1)(b) GDPR (performance of a contract).
- Security, abuse prevention, establishing, exercising or defending legal claims — Art. 6(1)(f) GDPR (legitimate interest).
- Handling complaints and correspondence — Art. 6(1)(b) and (f) GDPR.
- Compliance with legal obligations — Art. 6(1)(c) GDPR.
Providing account data is voluntary but necessary to use the Service. We do not make decisions based solely on automated processing, including profiling, that produce legal effects.
4. Extra notification recipient
If a User adds an extra notification e-mail address, we send it a one-time confirmation request. Alerts and recovery notifications are sent there only after the address owner confirms; every message contains an unsubscribe link, and an unsubscribed address receives no further requests from that account. We keep the address and its confirmation status while the account exists (the "unsubscribed" status so that no new requests are sent). The User is responsible for having a basis to share the address.
5. Retention
- Detailed monitoring history (runs, signals, sender IP addresses, incidents) — 30 days.
- Account data and monitor configuration — until the account or monitor is deleted; deleted monitors are permanently erased after 30 days.
- Database backups — overwritten on a rolling basis (only a limited number of recent copies is kept).
- Data needed to defend claims — until the limitation period expires.
6. Recipients
Data may be shared with processors acting on our behalf, only to the extent necessary to provide the service:
- OVHcloud (OVH group) — server hosting and the e-mail service used to send notifications and account messages; the servers are located in the European Union.
We do not transfer data outside the European Economic Area and do not sell it. Data may be disclosed to public authorities where required by law.
7. Cookies
The Service uses only strictly necessary cookies: a session cookie (keeping you signed in and remembering your language) and a CSRF protection cookie. We use no analytics, advertising or tracking tools. Blocking cookies will prevent you from signing in.
8. Your rights
You have the right to access, rectify and erase your data, to restrict processing, to data portability and to object to processing based on legitimate interest. Please send requests to biuro@sixt4.pl. You may also lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes UODO, ul. Stawki 2, 00-193 Warsaw, Poland).
9. Security
We use encrypted connections (HTTPS), password hashing, encryption of secrets (e.g. HTTP header values) and restricted server access. Secret Heartbeat URLs are not written to access logs.
10. Changes
This policy may be updated as the Service develops. We will inform you about significant changes by e-mail or in the Service. The policy is also available in Polish; in case of discrepancies, the Polish version prevails.