Privacy policy

In force from 21 August 2026. Last updated: 21 August 2026.

We collect as little as possible. No cookies, no analytics, no tracking. Here is the whole thing, written out in plain words.

1. Who the data controller is

The data controller is Grzegorz Jaworek, who runs the Anat Access project. A company for the Anat Access brand is being registered. Once that is done, we will add the full registration details here. For anything about data protection, write to check@anataccess.com.

2. The free test: what happens to the address you type in

This is the most important part of this policy, so it goes near the top and not at the bottom. We do not store the website address you type into the free test.

When you run the free test, our server fetches the page you named, analyses its HTML code in memory, and sends the result straight back to your browser. That is the end of it. Nothing is written to a database. There is no history of checks. We keep neither the address nor the result. We do not even know if someone checked the same page twice.

We store one thing, and we say so openly: a rate counter. So that nobody can block the service with hundreds of requests, we keep a short list of request times labelled with a hash of the IP address, not with the IP address itself. The counter lives for 10 minutes at most and then it is gone. The legal basis is Article 6(1)(f) GDPR, our legitimate interest: protecting the service from abuse.

The three-question checklist runs entirely in your browser. Your answers never leave your device and never reach us.

3. What data we collect

  • Contact form — your website address and your e-mail. Giving them is voluntary. Without them we cannot reply or run a human check.
  • Correspondence and paid work — if we start working together, the scope grows to the data needed to agree and settle a contract: company details, contact details of people on your side, invoicing data. We collect these by e-mail and in conversation, not through the form.
  • Server logs — the hosting server keeps standard access logs: IP address, date and time of the request, the page requested, browser type. These are technical data and we do not link them to the form.

4. Why we process data, and on what legal basis

  • Replying to a form enquiry — Article 6(1)(b) GDPR (steps taken at your request before a contract).
  • Answering your questions — Article 6(1)(f) GDPR (legitimate interest: handling an enquiry).
  • Agreeing and delivering an audit, monitoring or repair contract — Article 6(1)(b) GDPR.
  • Tax and accounting duties — Article 6(1)(c) GDPR.
  • Protecting the free test from abuse, and site security — Article 6(1)(f) GDPR.
  • Public certificate verification — Article 6(1)(b) GDPR (it is part of the service you order) and Article 6(1)(f) GDPR (so an old seal can still be checked).

We do not use your data for marketing without separate consent, and we do not profile you automatically.

5. Who else processes the data

  • cyber_Folks S.A. — hosting for the site and the mail.
  • Web3Forms — technical delivery of the form. Form data passes through this service and arrives in our mailbox.

Each of them processes data only on our instructions, and only as far as their service needs. We do not sell data and we do not share it with anyone else.

6. Data during an accessibility audit

An accessibility audit works on your website, not on your customers' data. We test public views. Where an account is needed, we use a test account that you set up for us. We do not need your customers' real data, and we ask you not to send it.

If access to the live system ever proves necessary, we agree it separately and in writing. You stay the controller of that data, and we act as a processor under a data processing agreement.

Audit results, including the list of barriers we find, are confidential. We do not publish them and we do not use them as marketing material without your clear consent.

Testing with real users is a separate matter. If you order it, each participant gets their own privacy notice and signs a separate consent for taking part and for the recording. Information about a disability is a special category of data (Article 9 GDPR), so we process it only with the participant's explicit consent. You get the recording for internal use. You may not publish it without separate consent from the person recorded.

7. How long we keep data

  • Form enquiries that did not lead to work — 12 months from the last contact.
  • Audit documents and client correspondence — for the term of the contract and 6 years after it ends (limitation periods and accounting duties).
  • Data shown in a certificate verification entry — for the validity period and after it expires, so an old seal can still be checked. We agree the scope of that data with you before we issue the certificate.
  • The free test rate counter — 10 minutes at most.
  • Recordings from user testing — for the period agreed with the participant, and 24 months if nothing else is agreed.
  • Server logs — as per the hosting provider's policy.

8. Your rights

You have the right to access your data, correct it, erase it, limit how we process it, move it, and object to processing based on legitimate interest. Just write to check@anataccess.com. We reply within one working day and handle the request within the GDPR time limits.

You can also complain to the President of the Personal Data Protection Office in Poland (ul. Stawki 2, 00-193 Warsaw).

9. Cookies and analytics

This site uses no cookies and no analytics that track users. We embed no ad scripts and no social pixels. That is why there is no consent banner here. There is nothing to consent to, and a banner would only be one more thing to click through.

We serve our typefaces from our own server, not from an external CDN. So visiting the site does not hand your IP address to a font provider.

10. Security

The site runs over HTTPS only. Only the people delivering the work can reach the mailbox and the audit documents, and access is protected by two-factor authentication. We keep to data minimisation: we do not collect what we do not need.

11. Contact

Questions about privacy, requests about your data, doubts about a certificate or a seal: check@anataccess.com. If this page makes it hard for you to use your rights, tell us. That is a bug for us to fix, and we describe how in our accessibility statement (Polish).