Privacy Policy

The FIRMSET web service and application are provided by Dash Stack sp. z o.o., and it is that company that acts as the controller of your personal data within the meaning of Article 4(7) GDPR, meaning it decides why and how your data is processed — to the extent described in section 2.

• FIRMSET is a product of Dash Stack sp. z o.o.
• Registered address: ul. Generała Henryka Dąbrowskiego 18, 64-600 Oborniki, Poland
• Registered name: DASH STACK SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ
• VAT ID (NIP): 6060122069
• Statistical number (REGON): 543650418
• Register number (KRS): 0001215484
• Registry court: Sąd Rejonowy Poznań – Nowe Miasto i Wilda w Poznaniu, IX Wydział Gospodarczy Krajowego Rejestru Sądowego
• Share capital: 5 000,00 PLN

Data protection matters are handled by a person designated for that role by the management board. A message sent to biuro@dashstack.pl reaches that person directly.

We are not required to appoint a data protection officer and we have not appointed one. This changes nothing about your rights: every request described in section 9 is handled through the contact channels listed in section 14.

Your data can reach us in three ways, and our role differs in each of them. That distinction decides who you should address a request to.

• You visit firmset.pl. We then process only the technical data needed to display the page and maintain your session. We are the controller.
• You have an account in the FIRMSET application, either as a business owner or as an employee added to the account by the owner. We process account data, billing data and logs. We are the controller.
• Your data ended up in FIRMSET because our customer entered it there or an integration with a sales platform imported it. You are then their business contact, buyer or employee. That customer is the controller, and we are a processor acting on their documented instructions under Article 28 GDPR.

In the third situation, address your request primarily to the company that entered the data into FIRMSET. If it reaches us, we will pass it on to that company and tell you where it went. We do not change or delete our customers’ data on our own initiative without their instruction, unless the law requires it.

We collect only what is needed to run your account, bill the service and operate the integrations you switch on yourself.

Account data:

• first and last name or user name, and email address;
• password, stored only as an irreversible cryptographic hash and never in plain text;
• role and permissions within the company account, and whether the account is active;
• two-factor authentication data if you enable it, and the QR sign-in token if you use it;
• the date your email address was confirmed.

Billing data:

• company invoicing details: name, tax identification number, address;
• the list of active modules together with the history of switching them on and off and the billing dates;
• evidence of consent to activate a paid module: date, wording of the consent and the IP address it was given from.

Data arriving from services you connect yourself:

• Allegro, EmpikPlace, Erli.pl, WooCommerce and Dashshop: order and buyer data to the extent the given platform exposes it, including invoicing and delivery details;
• TikTok Shop: the scope is described separately in section 5, because it is far narrower than in the other integrations;
• InPost: the data needed to dispatch a parcel, including the recipient address and phone number;
• the Polish National e-Invoicing System (KSeF): invoices you send through it or download from it;
• CEIDG (dane.biznes.gov.pl) and dataport.pl: company data retrieved by tax identification number when you fill in a business contact;
• the warehouse, sales, CRM and HR modules: the data you enter into them yourself.

Technical data and logs:

• IP address, browser information and session identifier, recorded when you sign in and while the session is maintained;
• an application event log: who changed what in company data, and when;
• an integration API call log: method, path, response code, duration and the request identifier issued by the platform, without access tokens and without request signatures;
• the content of the tickets and correspondence you send us.

We do not collect special categories of data for our own purposes, such as data about health, opinions or trade union membership, and we do not ask for them in any form on the website.

We state the legal basis from Article 6(1) GDPR next to each purpose, because it determines which rights you can exercise.

• Creating and running the account, providing the ordered modules and technical support: performance of a contract, Article 6(1)(b) GDPR. For employees added to an account by a customer, the basis is the legitimate interest in enabling them to work in the service ordered by their employer, Article 6(1)(f) GDPR.
• Billing the subscription, issuing and storing invoices and keeping accounting records: a legal obligation, Article 6(1)(c) GDPR in conjunction with Polish accounting and tax law.
• Answering questions and requests sent by email or through another contact channel published on the website: performance of a contract or the legitimate interest in handling correspondence, Article 6(1)(b) or (f) GDPR.
• Security of the service: event logging, detection of abuse and unauthorized access, and error diagnostics: legitimate interest, Article 6(1)(f) GDPR.
• Establishing, pursuing and defending claims: legitimate interest, Article 6(1)(f) GDPR.
• Meeting obligations under the GDPR and other laws, including handling requests and reporting personal data breaches: a legal obligation, Article 6(1)(c) GDPR.

We do not send a newsletter or commercial messages to people who did not ask for them. If we ever start sending them, we will ask for consent first, on the basis of Article 6(1)(a) GDPR and Article 398 of the Polish Electronic Communications Law, and withdrawing that consent will be as easy as giving it.

We do not take decisions about you based solely on automated processing that would produce legal effects or similarly significantly affect you, and we do not profile users of the website. Artificial intelligence features in the application, such as suggesting an offer description, are a tool in the hands of the user and do not decide about anyone’s rights.

Providing account and invoicing data is voluntary but necessary to conclude and perform the contract. Without it we cannot create an account or issue an invoice.

You switch integrations on yourself and you decide which account to connect. The data arriving through them belongs to your business: you are the controller of it, and we are a processor acting on your instructions under Article 28 GDPR. The same applies to data obtained through the TikTok Shop API.

Once a TikTok Shop store is connected, the application retrieves and stores only:

• the access token and refresh token issued by TikTok Shop for your account, stored encrypted in the database, omitted from logs and never shown in the interface;
• the list of shops you authorized: shop identifier, name, region and the shop cipher required for API calls;
• the TikTok Shop category dictionary together with category attributes and requirements, which is platform catalogue data containing no personal data;
• an API call log: method, path, response code and the request identifier used by platform support when handling tickets.

This scope is deliberately narrow and matches what the module actually does: it authenticates the shop, keeps the authorization valid and downloads the category dictionary needed to prepare a listing. We do not retrieve orders or buyer data from TikTok Shop.

We do not aggregate data obtained from the platform with data of other sellers, we do not use it for our own purposes, we do not disclose it to third parties without your consent and we do not sell it.

You can withdraw the authorization at any time, without giving a reason:

1. in the FIRMSET panel, in the TikTok Shop integration section, using the disconnect button next to the account: this deletes the stored tokens and stops API calls for that shop while keeping your settings;
2. in the same place, using the delete button next to the account: this removes the whole integration account together with the stored data of the connected shops;
3. on the TikTok Shop side, in the seller panel, on the list of installed applications: cancelling the authorization there also removes the application’s access to your shop.

If, after disconnecting, you want us to delete the remaining data related to that integration, write to the address in section 14. We will delete it or remove its link to you, except for what we must keep in order to meet tax and accounting obligations.

The next steps are described on the Data deletion page at firmset.pl/data-deletion: what exactly disappears once you disconnect, how to delete the whole FIRMSET account and what we will not delete even on request.

The other integrations work the same way: each can be disconnected in the panel, and data retrieved from a platform remains your business data. The only difference is scope, because for Allegro, EmpikPlace, Erli.pl, WooCommerce, InPost and Dashshop it also covers order and buyer data.

We do not sell data and we do not share it for third-party marketing. Data goes only where it has to go for the service to work:

• the provider of the infrastructure and hosting on which the application and its backups run;
• the outbound email provider used for system messages; depending on the configuration of the installation this is either an own mail server or the Postmark, Resend or Amazon SES service;
• the platforms and services you connect your account to: Allegro, TikTok Shop, WooCommerce, EmpikPlace, Erli.pl, InPost, Dashshop, to the extent you instruct us to send data to them;
• the Polish National e-Invoicing System operated by the Ministry of Finance, when you send invoices to it;
• company data registers and verification services: CEIDG (dane.biznes.gov.pl) and dataport.pl, to which we send a tax identification number or company name in order to retrieve business contact details;
• the language model provider, OpenAI or Azure OpenAI depending on the configuration of the installation, when you use artificial intelligence features; we then transfer the content you send for processing;
• providers of accounting and legal services to us, to the extent necessary for settlements and for pursuing or defending claims;
• public authorities and courts, where the obligation to disclose follows from the law.

With entities that process data on our behalf we conclude data processing agreements compliant with Article 28 GDPR. We provide customers with the current list of such sub-processors on request.

We aim to process data on infrastructure within the European Economic Area, and wherever we choose the region ourselves, we choose a European one.

A transfer outside the EEA may happen in two situations. The first is using features based on a language model provider located outside the EEA. The second is connecting a sales platform whose infrastructure is outside the EEA: the data travels there on your instruction, and the platform processes it under its own rules, described in its own documents.

Every such transfer relies on a mechanism from Chapter V GDPR: either a European Commission adequacy decision or standard contractual clauses. We provide information about the mechanism applied to a specific provider, and a copy of the safeguards or the place where they are made available, on request at the address in section 14.

• Account and company data: for the duration of the contract and, after it ends, until the limitation periods for related claims expire.
• Invoices and accounting documents: for 5 years counted from the end of the calendar year in which the tax payment deadline fell. We cannot shorten this period on request, because it follows directly from the law.
• Evidence of consent to activate paid modules: for the duration of the subscription and the limitation period for claims.
• Data retrieved from connected platforms: for as long as the integration is active and you have not deleted it yourself. Access tokens are deleted the moment the account is disconnected.
• API call logs and the event log: for the period needed for diagnostics, demonstrating accountability and handling tickets with the platform operator, after which we delete them.
• Correspondence: for the time needed to handle the matter and the limitation period for any claims.

Deleting data from the production system is not always immediately reflected in backups. Backups are overwritten on a cycle and, until they are, remain protected and are used for nothing other than restoring the system after a failure.

To the extent that we are the controller of your data, you have the right to:

• access your data and obtain a copy of it;
• have inaccurate data rectified and incomplete data completed;
• have your data erased, where we have no basis to continue processing it;
• have processing restricted, for example while we verify whether the data is accurate;
• data portability, for data we process on the basis of a contract or consent, in a machine-readable format;
• object to processing based on legitimate interests, on grounds relating to your particular situation;
• withdraw consent at any time where processing is based on consent; withdrawal does not affect the lawfulness of what we did before.

A practical, step-by-step guide to deleting your data is published at firmset.pl/data-deletion.

To exercise any of these rights, a message to the address in section 14 is enough. There is no mandatory form. We may ask for information that lets us confirm your identity, but only to the extent necessary and without collecting additional data on that occasion.

We respond without undue delay and no later than one month from receiving the request. If the matter is complex, we may extend that period by a further two months, informing you and giving the reason, in line with Article 12(3) GDPR. Handling a request is free of charge.

If a request concerns data whose controller is our customer rather than us, we will pass it on to that customer and tell you where it went. Section 2 describes this rule.

If you believe we process data unlawfully, you can lodge a complaint with a supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw. Information on how to lodge a complaint is available at uodo.gov.pl.

A complaint to the authority does not rule out contacting us and closes nothing. If you tell us first, we will try to resolve the matter straight away.

The firmset.pl website and the FIRMSET application use only cookies that are necessary for the service to work. We do not use external analytics, advertising pixels or tracking cookies, and for that reason we do not display a cookie consent banner.

We store three kinds of files:

• a session cookie: keeps you signed in and preserves form state, and expires after the inactivity period configured in the application, 120 minutes by default, and on sign-out;
• XSRF-TOKEN: protects forms against cross-site request forgery, that is against a request being sent in your name from another site;
• a remember-me cookie: stored only if you tick that option when signing in, and it lets you return to your account without typing the password again.

All three are necessary to deliver the service you request, so storing them does not require consent under Article 399(1) of the Polish Electronic Communications Law. You can block or delete them in your browser settings, but without them signing in to the application is not possible.

If we ever add analytics or marketing cookies, we will ask for consent before storing them, refusing will be as easy as agreeing, and withdrawing consent will be as easy as giving it.

We apply technical and organizational measures appropriate to the risk. The most important ones are:

• an encrypted HTTPS connection between the browser and the application;
• passwords stored only as an irreversible hash, and two-factor authentication available for every account;
• access tokens for sales platforms encrypted in the database, hidden in the interface and omitted from API call logs;
• separation of data between businesses: each customer’s data is filtered by their account at the database query level, not only in the interface;
• a roles and permissions system that lets the account owner limit employee access to individual modules;
• an event log that makes it possible to establish who changed data and when.

The way we act in the event of a personal data breach is described in a separate Personal Data Breach Notification Procedure, and the internal rules and staff duties, including access control and encryption, are described in the Privacy and Personal Data Protection Policy. Both documents are published on this site; you will find links in the related documents section and in the site footer.

This document does not claim conformity with any security standard or certification. If we obtain one, we will say so explicitly and state its scope.

We update this policy when the scope of the service, the way data is processed or the law changes. A new version appears at the same address, with an increased version number and a new effective date. Both values are shown in the metadata at the top of the page; the current version is 1.0, effective from 1 September 2026.

We give advance notice of changes that materially affect your rights or the scope of processing, by email to the address linked to your account or by a message in the application. We send the text of an earlier version on request.

You can contact us about any personal data matter. We correspond in Polish and in English.

• Email: biuro@dashstack.pl
• Phone: +48 602 518 615
• Postal address: Dash Stack sp. z o.o., ul. Generała Henryka Dąbrowskiego 18, 64-600 Oborniki, Poland

If you are writing about deleting data, start with the Data deletion page at firmset.pl/data-deletion — it lists the steps you can take yourself and says what we will not delete even on request, because the law requires us to keep it.

Read this document together with the other documents of the service: the Terms of Service, which set out the rules for using the service, the Personal Data Breach Notification Procedure, which describes how we act in the event of a breach, and the Privacy and Personal Data Protection Policy, which describes the internal rules we follow. You will find links to them below and in the footer of every page of the site.

The Polish version of this policy is the binding one. This English version is an informational translation.