Legal

Privacy Notice

Effective 18 September 2026 · Version 1.0

Wersja polska tego dokumentu jest w przygotowaniu. Do czasu jej publikacji obowiązuje wersja angielska. Pytania: kontakt@profitforce.cc.

This notice explains what personal data ProfitForce processes, why, who receives it, how long we keep it, and what rights you have. It covers this website (profitforce.cc) and the ProfitForce application (app.profitforce.cc).

1. Who we are
2. What ProfitForce is
3. Our two roles
4. The data we process and why
5. Bank account information
6. Legal bases
7. Who receives your data
8. Transfers outside the EEA
9. How long we keep data
10. Your rights
11. Security
12. Cookies
13. Changes to this notice
14. Contact

1. Who we are

ProfitForce is provided by:

Luminous Software Andrii Zhezhel
a sole proprietorship registered in Poland (CEIDG)
ul. Pokorna 2/1152, 00-199 Warszawa, Poland
NIP (tax id) 5272830712 · REGON 523650121
E-mail: kontakt@profitforce.cc

ProfitForce is the trade name of the software this business provides. Write to the same address for anything about your personal data.

2. What ProfitForce is

ProfitForce is an accounting and business administration application for small companies: invoices, bills, business partners, payments, bank accounts and statements, books, tax filings and staff records. You use it on behalf of a business. Most of what is in it is your company's business records. Some of that is personal data: yours, your staff's and your business partners'.

3. Our two roles

We act in two different roles, and your rights depend on which one applies.

Controller for your account data, for this website, for messages you send us and for technical logs. We decide why and how that data is processed, and this notice describes it.
Processor for the contents of your books: the personal data of your staff, customers, suppliers and other people that you enter, import or fetch from your bank. Your company is the controller of that data. We process it only to provide the service, on your instructions, under the data processing terms in our Terms of Service. People whose data is in your books should address their requests to your company; we help you answer them.

4. The data we process and why

Data	Where it comes from	Why we process it
Account data: name, e-mail, sign-in identity, role, sign-in times	You, when you sign up or are invited	To run your account, keep it secure and contact you about the service
Company data: name, tax identifiers, address, register entries, tax settings	You, and public registers (CEIDG, GUS, KRS, VIES and their counterparts abroad)	To keep your books and filings correct
Business records: invoices, bills, contracts, payments, staff and payroll records, attached files	You, your imports, and systems you connect, such as KSeF	To provide the service: bookkeeping, invoicing, filings
Bank account information: account holder name, IBAN, currency, balances, transactions	Your bank, through Enable Banking, after you authorise it (section 5)	To match bank movements to invoices, bills and payments and keep your books current
Business partner data: names, tax ids, addresses, bank accounts, representatives as published in registers	You, and public registers	To identify partners on documents and verify them, for example against Poland's VAT white list
Contact form messages	You, on this website	To answer you
Technical data: IP address, browser, request logs, error reports	Your device	Security, abuse prevention and fixing faults

We do not sell personal data, do not use it for advertising and do not profile anyone.

5. Bank account information (open banking)

ProfitForce can read your company's bank accounts so that bank movements land in your books without manual statement uploads. This works under the EU payment services rules (PSD2) and only with your explicit authorisation.

How the connection works

In the application you choose your bank and start a connection.
You are taken to Enable Banking and then to your bank, where you sign in and approve read access. ProfitForce never sees your bank credentials.
Your bank returns you to the application. From then on ProfitForce fetches the approved accounts' balances and transactions, normally once a day.

Who provides the access

The technical access is provided by Enable Banking Oy, Otakaari 5, 02150 Espoo, Finland, a registered Account Information Service Provider supervised by the Finnish Financial Supervisory Authority (FIN-FSA). Enable Banking processes this data as our processor and under its own terms and privacy notice, published at enablebanking.com. ProfitForce itself is not a bank, a payment institution or an account information service provider.

What we fetch

the account identifier (IBAN), currency, product name and account holder name;
balances;
transactions: booking date, amount, currency, the counterparty's name and account number, the transfer title and the bank's transaction reference.

Access is read-only. ProfitForce cannot move money, initiate payments or change anything at your bank.

Scope and duration

Your authorisation is valid for the period your bank allows, at most 180 days, and covers the history your bank hands over at the time of connection, usually 90 days. After it lapses, nothing more is fetched until you connect again. You can end the access at any time: disconnect the account in the application, or revoke the consent at your bank. Data already fetched stays in your books as part of your records (section 9).

Other people's data in your transactions

Bank transactions carry the names and account numbers of the people and companies you pay and are paid by. We process that data only to keep your books accurate, on the basis of your and our legitimate interest in correct accounting, and we use it for nothing else.

6. Legal bases

Under the General Data Protection Regulation (GDPR) we rely on:

Performance of a contract (Art. 6(1)(b)) for everything needed to provide ProfitForce to you, including reading the bank accounts you connected.
Legal obligation (Art. 6(1)(c)) where the law requires us to keep records, for example accounting and tax law, and the duty to keep evidence of authorisations.
Legitimate interest (Art. 6(1)(f)) for security, abuse prevention, fixing faults, processing counterparty data present in your records, and answering your messages.

The authorisation you give your bank under PSD2 is separate from consent under the GDPR. Withdrawing it stops further fetching but does not undo processing that already happened lawfully.

7. Who receives your data

We use a small number of service providers. Each one processes data only on our instructions and under a data processing agreement.

Provider	Role	Location
Enable Banking Oy	Bank account access (open banking)	Finland (EU)
Hetzner Online GmbH	Servers and storage for the application and its database	Germany and Finland (EU)
Cloudflare, Inc.	Network, TLS, DNS, access protection and hosting of this website	EU edge locations; a US company (section 8)
Telegram	Delivery of contact form messages from this website to us	Outside the EEA (section 8)

Some data also goes to public bodies and registers when you use the features that need them: the Polish Ministry of Finance's KSeF when you send or receive e-invoices, and business registers (GUS, KRS, CEIDG, the VAT white list, VIES and their counterparts abroad) when you look up or verify a partner. Those bodies are independent controllers.

We disclose data to authorities only when the law requires it.

8. Transfers outside the EEA

Your data is stored in the European Union. Two providers are established outside the EEA. Cloudflare, Inc. (United States) carries traffic under the EU Standard Contractual Clauses and takes part in the EU-US Data Privacy Framework. Messages you send through the contact form on this website reach us through Telegram. If you prefer not to use it, e-mail us instead.

9. How long we keep data

Account data: for as long as you have an account, then deleted within 30 days of closure.
Business records, including bank data: they are your books, and we keep them for as long as your account holds them. Accounting and tax law requires records to be kept for a period after the year they concern; in Poland that is generally five years counted from the end of the year in which the tax became due. Records you delete, and that we have no duty to keep, are removed from live systems within 30 days and from backups on their normal rotation.
Bank connection records: the fact that you authorised access, its scope and its dates, for five years after the access ends, as evidence.
Contact form messages: up to 12 months.
Technical logs: up to 90 days, unless needed to investigate an incident.

10. Your rights

For data we hold as controller you can ask us to:

tell you what data we hold about you and give you a copy (access);
correct it (rectification);
delete it (erasure), where we have no duty or overriding reason to keep it;
limit how we use it (restriction);
hand it over in a machine-readable form (portability);
stop processing based on legitimate interest (objection).

You can end bank access at any time, as described in section 5. You can also complain to a supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl. You may also complain to the authority of the country where you live or work.

We answer requests within one month. To protect your data we may ask you to confirm your identity first.

11. Security

All traffic is encrypted in transit (TLS).
Data is stored in data centres in the European Union.
Inside the application, access follows the roles you assign. Our own staff access production data only when needed to run the service or to help you.
The keys that let us fetch bank data are held on our servers and never reach your browser.
Every change to your records is recorded with who made it and when.

12. Cookies

This website sets no cookies. The application stores only what is needed to keep you signed in and protect your session. We use no advertising or analytics cookies and no third-party trackers.

13. Changes to this notice

When we change this notice we publish the new version here with a new effective date. If a change matters to you, for example a new provider or a new purpose, we tell account holders by e-mail before it takes effect.

14. Contact

Questions, requests and complaints about personal data: kontakt@profitforce.cc, or by post to the address in section 1.