Privacy notice

How SHEV Software handles personal data, written to be read rather than to be survived. Version consent-copy/2026-08-09.1.

1. Who is responsible

The controller is SHEV Oleksii Shevchenko, trading as SHEV Software — Jednoosobowa działalność gospodarcza (sole proprietorship), registered in Poland (CEIDG).

Address: ul. Wysoka 7 lok. 13, 06-500 Mława, Poland.
NIP: 6030076577 · REGON: 540512756
Privacy contact: privacy@shevsoftware.com

No data protection officer has been appointed, because the criteria in Article 37 GDPR are not met. Privacy questions go to the address above and are answered by the controller personally.

2. This website collects nothing on its own

No cookies are set. No analytics, tag manager, session recorder, heat map, advertising pixel or fingerprinting script runs. Fonts, stylesheets and scripts are served from this domain only, so visiting a page makes no request to any third party.

The hosting provider processes standard connection data (IP address, timestamp, requested path, user agent) in its server logs, which is technically necessary to deliver the page and to defend against abuse. The legal basis is Article 6(1)(f) GDPR — our legitimate interest in a functioning, secure site.

3. Contact form and direct email

Contact form submissions

The bounded form accepts only your name, company, work email address, optional tenant and deadline ranges, the server receive time, and notification status. If — and only if — you tick the optional commercial-information box, the server-owned current consent wording and version are stored alongside it. If the commercial-information box is not selected, no consent wording is stored.

The form does not accept free-text messages, attachments, tenant IDs, application IDs, customer names, credentials, tokens or audit files. This website is not a transfer channel for customer or audit data.

Purpose: answering your enquiry and, if it goes further, scoping and delivering the audit.
Legal basis: Article 6(1)(b) GDPR — steps taken at your request prior to a contract. No consent is asked for this, and none is required: you could not meaningfully refuse consent for the processing needed to answer your enquiry, so requesting it would misdescribe the basis. Where you do give the optional consent below, the record of that consent rests on Article 6(1)(c) GDPR — our accountability obligation.
Retention: the structured form record has an absolute expiry and is retained for no more than 365 days from server receipt. If a contract is concluded, invoice data is retained separately for the statutory accounting period.

The one genuine consent on this site is the optional commercial-information box. If you tick it, the server-owned version and exact wording are stored with the enquiry's server receive time and retained only as part of that structured form record for no more than 365 days. That consent is the basis for sending you commercial information by email. It is entirely optional: declining it does not affect our answer to your enquiry in any way. You can withdraw it at any time, with effect for the future, using any of the routes in section 7.

Abuse control

To defend the two form endpoints from repeated automated submissions, we store a salted digest of the connection IP address only in the short-lived RATE abuse-control counter. It expires after 3600 seconds and is never copied into the enquiry or suppression record. This is best-effort abuse control, not a concurrency-safe quota or a guarantee.

Direct email

Direct email is a separate channel. We process your email address, message body, attachments and correspondence metadata in Google Workspace.

Purpose: corresponding with you and, where requested, taking steps towards a contract.
Legal basis: Article 6(1)(b) GDPR for steps taken at your request before a contract, or Article 6(1)(f) GDPR for other correspondence we have a legitimate reason to retain.
Retention: Email correspondence is retained only as needed for the correspondence and legal obligations. If no legal obligation requires continued retention, you can request deletion by writing to privacy@shevsoftware.com.

4. If we contacted you first

Where we identify a business as a possible fit, we may record a minimal prospect entry: company name, country, a public company contact route, a role hypothesis, the evidence of fit, the public source URL, and the status and content of any exchange.

Source: publicly published company pages. We do not buy lists, harvest addresses, guess mailbox names, scrape private profiles or use third-party marketing data.
Legal basis: Article 6(1)(f) GDPR, our legitimate interest in offering a relevant professional service to a business, assessed and documented before any named contact is processed. Your interests and reasonable expectations are part of that assessment, and you can object at any time under section 7.
Retention: prospect records carry a review-or-delete date no later than 90 days after the final approved contact wave, unless another lawful basis applies.

Separately from data protection law, electronic commercial communication is also governed by communications law in the sender’s and the recipient’s country. Where that law requires prior consent, we do not send without it.

5. Audit engagement data

If you become a client, the files you supply are processed under a separate written engagement and data-handling record. In that relationship we act as a processor for the customer data inside those files. The terms — the approved transfer channel, quarantine, retention window, deletion deadlines and deletion evidence — are agreed in writing before any file is accepted.

We do not request, receive or store Microsoft 365 credentials, tokens or certificates, and we do not connect to your tenant.

6. Who else sees your data

Cloudflare Pages and Cloudflare KV provide this site’s hosting, serverless form handling and bounded form storage. Our email and document infrastructure is provided by Google (Google Workspace). Only when notification is enabled, Resend receives the structured enquiry fields needed to notify the operator. Each provider acts as a processor under Article 28 GDPR. Where those providers process data outside the European Economic Area, the transfer relies on the European Commission’s Standard Contractual Clauses and the provider’s supplementary measures.

We do not sell personal data, we do not share it for advertising, and we do not use it for automated decision-making or profiling.

7. Your rights

Under the GDPR you may request:

• access to your personal data and a copy of it;
• rectification of inaccurate data;
• erasure;
• restriction of processing;
• portability, where processing is based on consent or a contract and is automated;
• objection to processing based on legitimate interests. Where that processing is direct marketing, the objection is absolute: we stop, without weighing anything.

Where processing is based on consent, you can withdraw it at any time with effect for the future. Withdrawal does not affect the lawfulness of processing carried out beforehand.

The fastest routes: reply to any message and say so, use the opt-out register, or write to privacy@shevsoftware.com. We aim to answer within a few working days and in any case within one month.

You also have the right to complain to a supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa. You may also complain to the authority in your own country of residence.

8. Opt-out register

When you ask not to be contacted, we keep the minimum needed to honour that: a persistent suppression record of the address or domain and the date. It has no expiry and is retained precisely so that we cannot contact you again by mistake, on the basis of Article 6(1)(c) GDPR. Asking us to delete it would remove the very thing that protects you, so we keep it and use it for nothing else. Storage propagation can take about one minute.

9. Changes

This notice is versioned. When the wording changes, the version identifier changes with it. New submissions must use the current wording; recorded wording is retained only with its structured enquiry record for no more than 365 days.