Data subject rights (draft)
How to use the rights you have under the GDPR (RODO).
Last updated: 14 October 2026
Draft version. This text is under legal review, and square brackets mark details still to be completed. This English version is a courtesy translation of the Polish text, provided for information. Once approved, the Polish version will prevail if the English and Polish versions differ.
Who can use these rights
Every person whose data is processed by Faktuwa, including a user, a person named on an invoice as the buyer or business contact, and a person who contacts us.
If you have sent an invoice containing data of other people, remember that you (or your company) are the controller of that data in your business. For matters concerning data from invoices, contact us, and we will pass the request on to the appropriate controller if we act only as a processor.
Your rights
• Access to data (Article 15 GDPR).
• Rectification of data (Article 16 GDPR).
• Erasure of data ("right to be forgotten", Article 17 GDPR).
• Restriction of processing (Article 18 GDPR).
• Data portability (Article 20 GDPR).
• Objection to processing based on legitimate interest (Article 21 GDPR).
• Withdrawal of consent at any time, where we process data on the basis of consent (Article 7(3) GDPR).
• Right not to be subject to a decision based solely on automated processing (Article 22 GDPR). We do not make such decisions; every field is approved by a person.
How to make a request
Write to [E-MAIL DO SPRAW DANYCH]. In your message, state:
• the type of request,
• at least the information that allows us to find you (for example the approximate time of the conversion, and the invoice number concerned, if possible).
We cannot identify most users of the free version, because they do not create an account, and the identifiers (token and IP hash) are pseudonymous and deleted after a month.
Identity verification
To protect your data, we may ask for additional information to confirm your identity. We do not request a copy of an identity card unless there is a clear need.
Time limit for reply
We reply without undue delay, and no later than one month after receiving the request. If needed, this period may be extended by two months, and we will inform you of this within the first month.
Handling the request is free of charge, unless the request is manifestly unfounded or excessive.
Complaint to the supervisory authority
You have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), [ADRES UODO]. You may complain if you believe that the processing infringes the GDPR.
Date
Draft of 14 October 2026. Last updated: [DATE].