This policy explains what personal data the Lukrena platform processes, why, for how long and who receives it, and what rights people have over their data. It covers lukrena.com, the dashboard, registration pages, viewer rooms and the messages the platform sends. Capitalised terms have the meaning given in our Terms of Service.
1. Who is responsible for your data
- Lukrena is run by Katarzyna Górecka, ul. Nowogrodzka 31, 00-511 Warszawa, Poland, tax ID (NIP) 7412060624 ("Provider", "we", "us").
- For anything to do with personal data, write to [email protected] or by post to the address above. We have not appointed a data protection officer, as we are not required to.
2. Our two roles: controller and processor
Lukrena acts in one of two roles, depending on whose data is involved:
- Controller - for the data of our Customers and Users (people who sign in to the dashboard), people who contact us or request access, and visitors to lukrena.com. We decide how this data is used and are responsible for it, and most of this policy is about it.
- Processor - for the data of Participants and Buyers, meaning people who register for our Customers' webinars, watch them and buy the products offered there. The controller of this data is the Customer running the webinar; we process it on the Customer's behalf and instructions under a data processing agreement (Annex 1 to the Terms). The organiser's details, privacy policy and terms can be found on the registration page and in the footer of their emails.
- If you registered for a webinar and want to exercise your rights (for example to delete your data or unsubscribe), please contact the organiser first. If your request reaches us, we will pass it on to the organiser and help them carry it out.
3. What data we process
3.1. Customers and Users
- Account data: name or business name, email address, password hash (we never store the password itself), role within the account, sign-up date and Plan.
- Business and billing data: company name, address, tax ID, payment history and invoices.
- Configuration data: brand and email sender settings, the business footer, links to the Customer's own privacy policy and terms, time zone, keys and tokens for Third-Party Services (stored encrypted) and the ID of the connected Stripe account.
- Usage data: counters of emails sent and AI replies used, bounce and spam complaint rates, sending status and security events.
- Correspondence: the content of messages, complaints and reports.
3.2. Visitors to lukrena.com
- Technical data sent by your browser with every request: IP address, date and time, the page requested, and the browser and operating system type. We use the IP address to prevent abuse (rate limiting) and to diagnose errors.
- We do not use third-party analytics or advertising tools on lukrena.com.
3.3. Participants and Buyers (on behalf of Customers)
- Registration data: first name, email address, optionally phone number and SMS consent, time zone, registration source (such as campaign parameters) and registration date.
- Participation data: the Personal Link token, entry times, live viewing intervals and replay position, total viewing time, reactions, poll answers, offer clicks, and chat messages and questions.
- Messaging data: email and text message send status, email opens and clicks (measured by SendGrid) and unsubscribes.
- Purchase data: product name, amount, currency, status and the Stripe payment ID. We do not process payment card details; payments are handled by Stripe on the Customer's own account.
- Exactly which data is collected depends on the Customer's setup, including the fields on its registration form and the integrations it has enabled.
4. Purposes, legal bases and retention
This section covers data for which we are the controller:
| Purpose | Legal basis (GDPR) | Retention |
|---|---|---|
| Opening and running the Account, providing the service, support | Art. 6(1)(b) (contract); for Users acting for a Customer, Art. 6(1)(f) (legitimate interest in dealing with the Customer's representatives) | for the term of the contract plus 30 days after it ends to allow data export |
| Billing, invoicing, tax and accounting obligations | Art. 6(1)(c) (legal obligation) | 5 years from the end of the calendar year in which the tax payment deadline fell |
| Handling access requests, questions and correspondence | Art. 6(1)(f) (replying to messages, developing business relationships) | until the matter is closed; if no contract follows, no longer than 12 months |
| Complaints, appeals and reports of illegal content | Art. 6(1)(c) (obligations under the Terms, the DSA and consumer law) and Art. 6(1)(f) | until the matter is closed and the limitation period for claims has expired |
| Service notices: changes to the Terms, paused sending, security | Art. 6(1)(b) and (c) | for the term of the contract |
| Security, preventing abuse, protecting the sending domain's reputation | Art. 6(1)(f) (protecting the Platform, Customers and Participants) | rate-limit counters: in server memory, for tens of minutes at most; sending metrics: for the term of the contract; technical logs: up to 30 days |
| Establishing, pursuing and defending legal claims | Art. 6(1)(f) | until the limitation period for claims has expired |
We process Participant and Buyer data for the purposes and periods set by the Customer, who can delete it in the dashboard at any time. When a Customer's contract ends, we delete this data within the period set out in Section 22 of the Terms. The temporary copy of a live broadcast recording, kept on our server in case the host's browser fails, is deleted automatically, as a rule after about 24 hours.
5. Recipients and subprocessors
- We share data only as far as necessary to provide the service, and only with parties committed to protecting it. We use the following processors:
| Company | Role | Where data is processed |
|---|---|---|
| OVH SAS (France) | server, database and Platform files | data centre in the EU |
| Twilio Inc. (SendGrid) | sending email from the shared sending domain, tracking delivery, opens and clicks | USA, see Section 7 |
| Anthropic PBC | AI Features, when the Customer uses the Provider's key | USA, see Section 7 |
- We use GitHub (Microsoft) to host source code, automated tests and deployment images. No Customer, Participant or Buyer data is sent to these services.
- Website fonts are served from our own server; your browser does not connect to Google for them.
- Data may be disclosed to public authorities where the law requires, for example at the request of a court, a prosecutor or the Polish data protection authority.
- Participant and Buyer data is available to the Customer running the webinar, as its controller.
6. Services connected by Customers
Customers can connect third-party services to their account under their own agreements with those providers. Participant and Buyer data is then sent to those services on the Customer's instructions, and their providers act for the Customer, not for us. These include:
- video: Cloudflare Stream (Cloudflare, Inc.) or Bunny Stream (BunnyWay d.o.o., Slovenia), for playing broadcasts and recordings and for transcripts; the provider's player receives the viewer's IP address and browser details;
- payments: Stripe (Stripe Payments Europe, Ltd., Ireland), processing payments on the Customer's account;
- text messages: SMSAPI.pl (LINK Mobility Poland sp. z o.o.), sending SMS reminders from the Customer's account;
- email from the Customer's own domain: the Customer's own SendGrid account;
- AI: the Customer's own Anthropic API key;
- email marketing and automation tools: GetResponse, MailerLite, ActiveCampaign and webhooks chosen by the Customer, receiving the first name, email address and funnel events;
- notifications: Telegram, where the Customer's own bot sends it alerts, such as the text of a chat question and the first name of the person asking;
- advertising: the Meta Pixel and Meta Conversions API (Meta Platforms Ireland Ltd.), described in Section 9.
These providers handle data under their own privacy policies. A Customer who connects them must tell Participants about them in its own privacy policy.
7. Transfers outside the European Economic Area
- The Platform's servers and database are located in the European Union.
- Some subprocessors (Twilio SendGrid, Anthropic) are based in the USA or may process data outside the EEA. Such transfers take place only with the safeguards required by Chapter V GDPR: the European Commission's adequacy decision of 10 July 2023 on the EU-US Data Privacy Framework, where the recipient is certified, or the Standard Contractual Clauses adopted by the European Commission, with supplementary measures where needed.
8. Cookies and browser storage
- The Platform stores on your device only what is strictly necessary to provide the service you ask for, which does not require consent (Article 399(3) of the Polish Electronic Communications Law). We do not set our own analytics or advertising cookies.
| Name | Type | Purpose | Duration |
|---|---|---|---|
sf_session | cookie, HttpOnly, Secure | keeping you signed in to the dashboard | 30 days or until you sign out |
sf_jezyk_panelu | cookie | remembering the dashboard language | 12 months |
lang | cookie | remembering the language of lukrena.com | 12 months |
sf-sound-on | localStorage | remembering that a viewer turned on the stream sound | until browser data is cleared |
sf_poz_<token> | localStorage | replay position, so a refreshed page resumes at the same point | until browser data is cleared |
sf-just-ended | sessionStorage | showing the right screen after a broadcast ends | until the tab is closed |
- The video player of the provider chosen by the Customer (Cloudflare Stream or Bunny Stream) and, when you buy something, the Stripe payment page may store their own technical information on your device, as described by those providers.
- You can change cookie settings in your browser, including deleting stored cookies. Blocking the
sf_sessioncookie prevents you from signing in to the dashboard.
9. Marketing pixels on Customers' pages
- A Customer may add its own Meta Pixel to its registration pages, confirmation pages and Viewer Room. The pixel loads a script from Meta's servers, stores identifiers on your device (such as
_fbp) and sends Meta information about visits and events, such as registering for a webinar. - A Customer may also enable the Meta Conversions API. After the webinar, the Platform then sends Meta an event (for example, attended or did not attend) together with the email address converted into a SHA-256 hash, which lets Meta match the event to a person's account without receiving the address in readable form.
- The Customer, as controller, is responsible for these tools, including informing Participants and obtaining consent where required, jointly with Meta to the extent the law provides. We do not use marketing pixels on lukrena.com.
10. Your rights
You have the right to:
- access your data and receive a copy (Art. 15 GDPR);
- have inaccurate data corrected and incomplete data completed (Art. 16 GDPR);
- have your data erased (Art. 17 GDPR);
- restrict processing (Art. 18 GDPR);
- data portability for data processed under a contract or consent, in a structured format (Art. 20 GDPR);
- object to processing based on legitimate interests, on grounds relating to your particular situation (Art. 21 GDPR), and to processing for direct marketing at any time;
- withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal.
Please send requests to [email protected]. We reply without undue delay and within one month at the latest; for complex requests this may be extended by two further months, and we will tell you if so. We may ask for information to confirm your identity. Participants and Buyers should primarily contact the webinar organiser (Section 2(3)), and can unsubscribe from emails at any time using the link at the bottom of each message.
11. Complaints to a supervisory authority
If you believe your data is being processed unlawfully, you may lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, Poland (uodo.gov.pl), or with the supervisory authority in the EU Member State where you live or work.
12. Automated decision-making and profiling
- We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).
- On the Customer's instructions, the Platform groups Participants into segments based on their behaviour (for example "stayed to the end", "clicked the offer", "did not attend") to choose the content and timing of follow-up messages. This is marketing profiling for which the Customer, as controller, is responsible. It has no legal effect on Participants.
- The automatic pause on a Customer's email sending after bounce or spam complaint thresholds are exceeded (Section 10 of the Terms) is reviewed by a person at the Customer's request.
13. How we protect data
We apply technical and organisational measures appropriate to the risk, in particular:
- encryption of connections to the Platform (TLS);
- encryption of Third-Party Service API keys and tokens with AES-256-GCM, with the key kept outside the database;
- storing passwords only as bcrypt hashes;
- signed session cookies with the HttpOnly, Secure and SameSite flags;
- strict separation of data between Customer accounts, checked by automated tests before every deployment;
- random, hard-to-guess Personal Link tokens and limits on entries per link;
- rate limits that protect against password guessing and form flooding;
- running uploaded HTML presentations in an isolated sandbox;
- sending email addresses to Meta only as SHA-256 hashes;
- database backups taken before every change to its structure;
- server access restricted to authorised people.
14. Do you have to provide data?
- Customers and Users provide data voluntarily, but it is necessary to conclude and perform the contract. Billing data is required by tax law.
- Participants provide data voluntarily. An email address is needed to register for a webinar and receive a Personal Link. A phone number is needed only to receive an SMS reminder.
15. Changes to this policy
- We update this policy when the Platform's features, our list of subprocessors or the law change. We notify Customers of material changes by email in advance and publish the upcoming version on this page with its effective date.
- All earlier versions of this policy, with the periods during which they applied, are listed below under "Previous versions".