01
Data Controller
The controller of your personal data is:
For matters related to personal data protection, you may contact us at the e-mail address above.
02
What Data We Collect
Depending on how you use the Service, we collect the following categories of data:
Data provided during registration
- e-mail address (required),
- first name, last name or company name (required),
- password (stored as an encrypted hash — never in plain text).
Vendor / Expert profile data
optional
- description, bio, avatar / logo,
- website address, LinkedIn,
- country, languages, hourly rate (for Experts),
- VAT number / company details (if provided voluntarily).
Technical data
automatic
- IP address (anonymised after 90 days),
- browser User-Agent,
- server access logs (Nginx),
- session and preference cookies.
03
Purpose of Data Processing
| Purpose | Example Activities |
|---|
| Service provision | Account management, module publishing, API access |
| Security | 2FA verification, abuse detection, session logs |
| Communication | Login code e-mails, moderation notifications |
| Analytics (anonymous) | Module view statistics, category popularity |
| Legal obligations | Retention of billing data (where applicable) |
04
Legal Basis for Processing
Art. 6 ust. 1 lit. b
Performance of a contract — providing the Service to the User.
Art. 6 ust. 1 lit. c
Compliance with a legal obligation (e.g. tax and accounting regulations).
Art. 6 ust. 1 lit. f
Legitimate interests of the Controller — security, fraud prevention, anonymous analytics.
Art. 6 ust. 1 lit. a
Consent — e.g. newsletter, if launched.
05
Data Retention Period
- Account data: until the account is deleted by the User or the Administrator, plus a 30-day safety buffer.
- Public profile data (modules, portfolio): until deleted by the Vendor or the Administrator.
- Server logs: 90 days, followed by automatic IP anonymisation.
- Transactional e-mails: 12 months in the mail provider's archive (Mailgun).
- Legally required data: for the period required by law (e.g. 5 years for accounting documents).
06
Your Rights
Under the GDPR you have the right to:
Access
Obtain information about what data we process and receive a copy of it.
Rectification
Correct inaccurate or incomplete data.
Erasure
Request deletion of your data (right to be forgotten) when no other legal basis for processing exists.
Restriction
Request restriction of processing in certain situations.
Portability
Receive your data in a structured, machine-readable format (e.g. JSON) suitable for transfer.
Objection
Object to processing based on legitimate interests.
To exercise these rights, send a message to kontakt@addonshub.eu. We will respond within 30 days. kontakt@addonshub.eu.
You also have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw.
07
Data Sharing
We do not sell users' personal data. Data may be shared only with:
- Hosting provider (Hetzner/OVH) — as a processor for infrastructure maintenance, under a data processing agreement.
- Mailgun — transactional e-mail service provider, for sending notifications and 2FA codes. Data stored on servers within the EU.
- Public authorities — on the basis of a legal obligation (e.g. at the request of a court or prosecutor's office).
We do not transfer data to third countries (outside the EU/EEA) without appropriate safeguards.
08
Cookies
The Service uses the following categories of cookies:
| Type | Example Names | Purpose | Lifetime |
|---|
Session
required |
PHPSESSID | Maintaining the logged-in User's session, 2FA | Browser session |
Security
required |
admin_deauth_profile_token | CSRF protection in the admin panel | 1 year |
Preferences
optional |
locale | Remembering the selected language | 30 days |
Required cookies are essential for the Service to function and do not require user consent. You can manage cookies in your browser settings — disabling session cookies will prevent you from logging in.
09
Data Security
Passwords stored exclusively as a hash (bcrypt/argon2).
Two-factor authentication (2FA via e-mail) for all accounts.
Encrypted TLS connection (HTTPS) — Let's Encrypt certificate.
Database access restricted to the application server.
Regular backups stored in encrypted form.
API keys generated cryptographically (32 bytes, hex).