Legal Documents at a Glance

This document is published in several languages. In the event of any discrepancy between the language versions, the Polish version is binding.

Last updated: 22 October 2026

This page is for legal departments, data protection officers and procurement teams who review formexposed before their company uses it. All documents are public, available in all official languages of the European Union (the Polish version is binding), and none requires you to log in. You can forward this page; whoever receives it can start reading straight away.

This page is a summary and does not establish any rights or obligations of its own. The linked documents are authoritative, in the order of precedence laid down in the Terms of Service; where a short answer here deviates from them, they prevail.

1. The documents

What our crawler does on third-party websites is described at /bot; any operator can exclude their domain at /opt-out.

2. Who we are and what role we have

The provider is LW IT Solutions Company Lukas Wójcik, a sole proprietorship based in Łódź, Poland (NIP 7252266190). We have not appointed a data protection officer because, having examined the matter, we are not required to (Art. 37(1) GDPR); data protection questions are answered by the owner at contact@lukaswojcik.com. The competent supervisory authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO) in Warsaw.

For most data we are controller ourselves: your account, billing, the security of the service, the checks without an account. This is described in the Privacy Policy. We are a processor where you bring in third-party data: above all in the delivery check, where copies of the form e-mails from your visitors go to our control mailbox, in the client portal and monthly report for an agency’s clients, in alert destinations and for data visible in screenshots of your domains, once you have provided proof of control for the domain; before that, we check the domain only passively and under our own responsibility. The exact split per function is set out in the Data Processing Agreement.

The WordPress plugin and the TYPO3 extension send us only daily figures, versions (for the WordPress plugin, the plugin inventory) and settings characteristics, and, with the swarm protection of the WordPress plugin, which is enabled by default, also the domains of links from blocked messages. Beyond that, they send no form content and never names, addresses or IP addresses of your visitors. What they store locally, such as the quarantine, stays on your website; you alone are responsible for it.

3. How the Data Processing Agreement is concluded

There is no PDF to sign and send back. The Data Processing Agreement is concluded on registration, together with the Terms of Service, and with every Customer, even one who uses no function in which we process on their behalf. Art. 28(9) GDPR permits electronic form for this.

On registration you tick a box beneath a sentence that links the Terms of Service, the Data Processing Agreement and the Privacy Policy. We record:

• which text: the full wording of each document as it was displayed, with a hash. Even years later it can be shown which wording applied, not just on which day consent was given;
• when and from where: time, IP address and browser identification.

If one of the documents is missing, registration is closed. Which version you agreed to is shown in your data export. We keep the record for as long as the account exists; after the account has been deleted, we delete it as soon as the consent is four years old.

If your company needs a confirmation for its own files, write to us; we will confirm by e-mail which version your account agreed to and when.

4. What happens when something changes

We change the Terms of Service and the Data Processing Agreement only for the reasons exhaustively listed there and announce such changes at least 30 days in advance by e-mail, with content, reason and effective date; without this notice period, we make changes only in the cases that both documents specify for this, for example changes solely to your advantage or on the order of an authority. Silence does not count as consent; if a change affects your rights or obligations, we obtain your consent separately, and without it the previous terms continue to apply to you. If you object to an announced change, a contract for a paid plan ends at the end of the current billing period, and on the free plan when the change takes effect; until then the previous terms apply. We also announce new or replacement sub-processors 30 days in advance; if you object and we find no solution, you have a right to terminate with a pro rata refund of fees paid in advance. All changes are listed on the page Changes to the Contract Documents.

5. Where the data is located

formexposed runs on our own servers in Poland: a web server with the database and a server for the checks, which also runs the language model, in the same internal network. No hosting or cloud provider is involved, and no text, code or screenshot goes to an AI provider.

Apart from that, only these recipients receive personal data:

• Namecheap, Inc. (Private Email), Phoenix, Arizona, USA for sending e-mails and for the delivery check mailbox; the place of processing and the basis for any transfer are still to be verified;
• Namecheap, Inc. (USA) as registrar and DNS provider and, until the mailbox has been set up, also for forwarding general e-mails to addresses at our domain; control copies from the delivery check do not pass through this forwarding;
• Stripe (Stripe Payments Europe in Ireland, Stripe, Inc. in the USA) for payments, for parts of them as an independent controller;
• Google (reCAPTCHA) when our own forms are submitted, for example for login, registration and the free check;
• the chat and webhook services you choose yourself as an alert channel (such as Slack, Discord, Microsoft Teams, Google Chat, Telegram), with the content of the alerts; we send Telegram messages via our own bot.

For individual checks we also query services that receive no data about persons: public DNS blocklists (SpamCop, PSBL, Mailspike, SURBL) with domains and IP addresses of servers, Google Web Risk (only if set up) with the address of the home page, the timestamping services Certum and DigiCert with a hash value, the RDAP directory via IANA and the rdap.org service with the domain name, wpvulnerability.net with the identifiers of plugins (without version) and themes and the WordPress version, and providers’ status pages, to which nothing is transmitted.

Which basis applies to transfers to the USA or other third countries, and where an agreement is still outstanding, is stated for each recipient in the list of Sub-processors.

6. Typical questions and where to find the answer

7. What is still open

The texts on this page are the versions in force. A legal review is still pending; if it leads to changes, we will publish new versions and list them in the change log. The documents themselves name open points instead of keeping quiet about them, such as the contract with the mail service provider in the list of sub-processors. A list that contains only good news has not been checked by anyone.

If your legal department finds a gap or is missing a piece of information, write to contact@lukaswojcik.com. We will reply, and if the gap is in the text, we will close it there.