PRIVACY POLICY
Last updated: 12/10/2026 (DD/MM/YYYY)
1. Controller
The controller of the personal data described in this Privacy Policy is the following company (we, us, our):
- Company name: 3K33 spółka z ograniczoną odpowiedzialnością
- Address: ul. Bierutowska 57B/31, 51-317 Wrocław, Poland
- KRS number: 0001125143
- NIP (tax ID): 8952277397
- REGON: 529571486
- Contact for privacy matters: support@strike.bz
We have not appointed a Data Protection Officer; please send all privacy questions to the address above.
2. Scope
This Privacy Policy explains how we process the personal data of our customers, visitors to strike.bz and clientarea.strike.bz, and people who contact us or report abuse, under Regulation (EU) 2016/679 (GDPR). Terms such as Server, Services and Client Area have the meaning given in our Terms and Conditions.
We collect as little data as possible. We do not ask for identity documents. To open an account we need only your email address and billing details, such as your name and address.
This policy does not cover personal data that customers store or process on their Servers. The customer decides what that data is and is responsible for it; we do not access it in the ordinary course.
3. Personal Data We Process
We process the following categories of personal data:
- Account data: your email address, password (stored only as a hash), two-factor authentication settings, and billing details, such as your name, address and phone number, plus company name and tax ID if you order as a business.
- Billing data: orders, invoices, amounts, currency, payment method, transaction identifiers, cryptocurrency transaction hashes and wallet addresses, and, for refunds by bank transfer, the account holder's name and IBAN.
- Tax location data: the country you indicate and the IP address used to place an order, kept as evidence for VAT.
- Service data: your Servers, their configuration, assigned IP addresses, and usage figures such as CPU, bandwidth and traffic volumes.
- Technical and log data: IP addresses, login times, browser and device information, and server logs of the Website and Client Area.
- Network data: traffic metadata, such as volumes and flows, used to detect attacks and abuse. We do not inspect the content of traffic.
- Communications: support tickets, emails and their attachments.
- Abuse reports: the content of reports, the name and email address of the person reporting, our correspondence with the customer concerned, and statements of reasons.
- Marketing preferences: your consent to marketing emails and its withdrawal.
- Affiliate data: referrals and Store Credit earned in the affiliate program.
We do not ask for identity documents and do not collect special categories of personal data, such as health data or political opinions.
4. Purposes, Legal Bases and Retention
We use each category of data only for the purposes below, on the legal basis shown, and delete it when the retention period ends.
|
Purpose |
Data |
Legal basis (GDPR) |
Retention |
|---|---|---|---|
|
Creating and managing your account, providing the Services, support |
Account, service data, communications |
Contract, Art. 6(1)(b) |
Duration of the Agreement, then until claims are time-barred |
|
Invoicing, accounting and tax |
Billing, account data |
Legal obligation under Polish tax and accounting law, Art. 6(1)(c) |
5 years from the end of the year in which the tax payment deadline expired |
|
Evidence of your country for VAT |
Tax location data |
Legal obligation under EU VAT rules, Art. 6(1)(c) |
10 years from the end of the year of the transaction |
|
Refunds by bank transfer, including sanctions and anti-money laundering checks |
Billing data (bank details) |
Contract, Art. 6(1)(b); legal obligation, Art. 6(1)(c) |
Until the refund is made, then with the accounting records |
|
Security of our network and Services, preventing fraud and abuse |
Technical, log and network data |
Legitimate interest in protecting our infrastructure and customers, Art. 6(1)(f) |
As long as needed to detect and investigate incidents, then deleted |
|
Handling abuse reports and authority orders |
Abuse reports, account and service data |
Legal obligation under the Digital Services Act (EU) 2022/2065, Art. 6(1)(c) |
Duration of the Agreement, then until claims are time-barred |
|
Establishing, exercising or defending legal claims |
Any category, as needed |
Legitimate interest, Art. 6(1)(f) |
Until claims are time-barred |
|
Marketing emails |
Email address |
Consent, Art. 6(1)(a) |
Until you withdraw consent |
|
Affiliate program |
Affiliate data |
Contract, Art. 6(1)(b) |
Duration of participation, then until claims are time-barred |
Claims become time-barred after the periods set by the Polish Civil Code, generally up to 6 years.
5. Recipients
We share personal data only when needed for the purposes above:
- Service providers acting on our behalf (processors): data centre and hosting providers, email delivery providers, and accounting and bookkeeping services. They process data only on our instructions.
- Payment providers and banks: we operate our own cryptocurrency payment gateway. If you pay through a third-party exchange or payment provider, that provider processes your data as a separate controller under its own privacy policy. Banks process data needed for bank transfers.
- The customer concerned by an abuse report: we forward reports to the customer without the reporter's identity, unless it is strictly necessary.
- Public authorities: only when required by law binding on us, on the basis of an order of a competent authority.
- Professional advisers: lawyers and auditors bound by confidentiality.
- A buyer or successor: if our business or part of it is sold or merged, with the same protections.
We do not sell personal data and do not share it for advertising. Cryptocurrency transactions are recorded on public blockchains; those records are public and permanent, and we cannot change or delete them.
6. Transfers Outside the EEA
We store our main customer data in the European Economic Area.
If you order a Server outside the EEA, the data needed to provide it are processed in that country: your email address, the IP addresses you use and the data on the Server. When the Server is deleted, its data outside the EEA are deleted within 24 hours. Backups may be kept for up to 60 days under the Terms and Conditions, and you can ask us to delete them earlier.
For these transfers we rely on an adequacy decision where one exists, such as the EU-US Data Privacy Framework for certified recipients, or on Standard Contractual Clauses adopted by the European Commission. Where neither applies, the transfer is necessary to provide the Service you ordered (Art. 49(1)(b) GDPR). You can ask us for a copy of the safeguards we use.
7. Cookies
The Website and Client Area use only cookies that are necessary for them to work: session cookies that keep you logged in, security cookies that protect logins and forms, and preference cookies that remember settings such as language and currency. These cookies do not require your consent.
We do not use analytics, advertising or tracking cookies. You can block or delete cookies in your browser, but the Client Area will not work without them.
8. Your Rights
Under the GDPR you have the right to:
- access your data and receive a copy (Art. 15);
- have inaccurate data corrected (Art. 16);
- have your data erased, for example by deleting your account; we keep only what the law requires us to keep (Art. 17);
- restrict processing (Art. 18);
- receive data you gave us under a contract or consent in a machine-readable format (Art. 20);
- object to processing based on our legitimate interest, and to direct marketing at any time (Art. 21);
- withdraw your consent at any time, without affecting processing before the withdrawal.
Send requests from your account email address or through a ticket in the Client Area. Because we do not verify identity, we can act only on requests we can link to an account; otherwise we may be unable to identify you (Art. 11 GDPR). We reply within one month, which we may extend by two months for complex requests, telling you why.
You can lodge a complaint with a supervisory authority: in Poland, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl, or the authority in the EU country where you live or work.
9. Whether You Have to Provide Data
Your email address and billing details, such as name and address, are required to create an account; without them we cannot conclude the Agreement. Your country is required by VAT law, your company name and tax ID are required for a business VAT invoice, and bank details are required for a refund by bank transfer. Other data are required only where the order form marks them as required.
10. Automated Decision-Making
We do not make decisions based solely on automated processing that have legal or similarly significant effects on you (Art. 22 GDPR). Our systems may automatically limit traffic to stop an ongoing attack, but decisions to suspend or terminate a Service are taken by a person.
11. Security
We protect personal data with measures appropriate to the risk, including encrypted connections (TLS), passwords stored only as hashes, optional two-factor authentication, access limited to people who need it, and timely security updates. No system is completely secure; if a personal data breach is likely to result in a high risk to you, we will inform you without undue delay (Art. 34 GDPR).
12. Children
The Services are not intended for children under 13, and we do not knowingly collect their data. Users aged 13 to 17 may use the Services only with the consent of a parent or legal guardian. If you are under 16, do not consent to marketing emails without your parent's or guardian's authorisation. If you believe a child under 13 has given us personal data, contact us and we will delete it.
13. Changes to This Privacy Policy
We update this Privacy Policy when our processing or the law changes. We announce material changes by email and in the Client Area before they take effect. The date at the top shows when this version was last updated.
