TraceScam Privacy Policy

Data controller

The data controller is NGITECH Sp. z o.o. with its registered office in Wrocław, Poland. Privacy contact: office.pl{'@'}ngitech.org.

Data scope

Depending on how the service is used, we may process e-mail address, account data, billing data, materials submitted for analysis, URLs, domains, technical metadata and data needed for payments and contact.

• E-mail, SMS, links and shop URLs are processed to perform risk analysis.
• Payments are handled by a payment provider; TraceScam stores data needed to confirm purchases, invoices and limits.
• Technical data such as IP address, error logs and session identifiers may be processed for system security.

Purposes and legal bases

Data is processed to provide the service, manage accounts, handle payments, ensure security, support requests, meet accounting obligations and — where consent is given — for analytics or contact.

• performance of a contract or pre-contract steps — Article 6(1)(b) GDPR
• legal obligations, including accounting and tax duties — Article 6(1)(c) GDPR
• legitimate interests, including security, claims and fraud prevention — Article 6(1)(f) GDPR
• user consent — Article 6(1)(a) GDPR, for optional consent-based activities and selected cookies

Recipients

Data may be shared with hosting, mail, infrastructure, payment, security, accounting and technical support providers, as well as entities authorized by law.

Retention

Data is stored for the duration of service use, periods required by law or periods needed to protect claims. Materials submitted for analysis should have retention configured in the application and users should be able to delete or anonymize data unless it must be preserved as evidence.

User rights

Users have the right to access, rectify, erase, restrict processing, data portability, object to processing, withdraw consent and lodge a complaint with a supervisory authority.

Automated analysis and AI

TraceScam may use automated rules and AI models to assess risk of messages, links and pages. The score is an auxiliary risk assessment and is not a guarantee of safety or a public authority decision.