BlueWato Privacy Policy
Last updated: 2026-08-23 · Print
This Privacy Policy explains what personal data we process in connection with the BlueWato service (technical name: myRemDe) and the websites bluewato.com, bluewato.pl, myremde.com and the panel panel.bluewato.com, for what purpose, on what legal basis and for how long, as well as the rights of data subjects. We apply Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR).
- Data controller
- What data we process and for what purpose
- What we do not process — content of remote sessions
- Recipients of data
- Transfers of data outside the EEA
- Retention period
- Rights of data subjects
- Security
- Cookies
- Third-party data on Devices
- Changes to this Policy
1. Data controller
The data controller is Nadmorskie Centrum Internetowe, ul. Bławatkowa 10, 84-100 Puck, Poland, VAT ID (NIP) PL 586-103-86-56. Contact for data protection matters: privacy@bluewato.com or kontakt@nci.pl, tel. +48 58 733 97 00, or by post to the registered office address.
2. What data we process and for what purpose
| Category of data | Purpose | Legal basis |
|---|---|---|
| Account data: e-mail address, display name, password (stored solely as an Argon2id hash), role, interface language, account creation date | Creating and maintaining the account, logging in, providing the service | Article 6(1)(b) GDPR (contract) |
| Authentication data: one-time 2FA codes (hashed), session identifiers, trusted browser identifiers, number of failed login attempts, lock-out time | Secure login, protection against account takeover | Article 6(1)(b) and (f) GDPR (security of the service) |
| Device data: name assigned by the user, category, operating system and its version, processor architecture, agent version, whether a display is present, status (online/standby/offline), time of last contact, public IP address of the device (as seen by the server), agent token (hashed) | Managing devices, establishing sessions, agent updates, enforcing plan limits | Article 6(1)(b) GDPR |
| Session data: device identifier, session type (desktop/console), start and end time, browser IP address, connection type (direct / via TURN relay), amount of data relayed via TURN | Establishing the connection, accounting for plan limits, diagnostics, security | Article 6(1)(b) and (f) GDPR |
| Event log (audit): logins, failed attempts, password changes, pairing and disconnection of devices, plan changes — with date, IP address and browser identifier (user agent) | Security, abuse detection, handling complaints, ability to evidence events | Article 6(1)(f) GDPR (legitimate interest: security and defence of claims) |
| Server logs (nginx, signalling server, TURN): IP address, date, requested address, response code, user agent | Maintaining the infrastructure, security, technical statistics | Article 6(1)(f) GDPR |
| Billing data (once payments are activated): selected plan, subscription history, invoicing details (name, address, VAT ID), customer and transaction identifiers in the Stripe system, last 4 digits of the card and card type. Full card details are processed solely by Stripe. | Processing payments, issuing invoices, tax and accounting obligations | Article 6(1)(b) and (c) GDPR |
| Correspondence: content of e-mails, complaints and technical support requests | Handling requests and complaints | Article 6(1)(b) and (f) GDPR |
| E-mails sent by us: 2FA codes, account security notifications, information about changes to the terms, prices and the activation of payments | Providing the service, information obligations | Article 6(1)(b) and (c) GDPR |
Providing an e-mail address and password is necessary to create an account; the remaining data is provided voluntarily or is generated automatically in the course of using the service. We do not send marketing communications without separate consent. We do not make decisions based solely on automated processing, including profiling, which produce legal effects.
3. What we do not process — content of remote sessions
Desktop and console sessions are established using WebRTC technology directly between the user's browser and their device and are encrypted with the DTLS-SRTP protocols, using keys negotiated exclusively between those two endpoints. We do not record, store or have any insight into the screen image, keystrokes, mouse movements, clipboard contents, or console commands and their output. Where a direct connection is not possible, the traffic is relayed through our TURN server in encrypted form; in that case the server sees only the IP addresses of the parties and the amount of data, not its content.
4. Recipients of data
Data may be entrusted to processors acting on our behalf, solely to the extent necessary to provide the service:
- OVH SAS (France / servers in the EU) — hosting of the panel, signalling and TURN servers;
- e-mail service provider (SMTP server in the EU) — sending 2FA codes and notifications;
- Stripe Payments Europe, Ltd. (Ireland) — payment processing, once paid plans are activated; Stripe is also an independent data controller for fraud prevention purposes (stripe.com/privacy);
- accounting firm — in respect of data on invoices;
- bodies authorised under the law (e.g. law enforcement authorities) — upon their justified request.
We do not sell personal data and do not share it for advertising purposes.
5. Transfers of data outside the EEA
We store data on servers in the European Union. In the case of providers that may process data outside the European Economic Area (e.g. the Stripe group), transfers take place on the basis of a European Commission adequacy decision or standard contractual clauses (Article 46 GDPR).
6. Retention period
- account and device data — for as long as the account exists; after the account is deleted, the data is erased within 30 days (backups — up to 90 days);
- 2FA codes — up to 10 minutes; login sessions — up to 7 days from last use; trusted browsers — 30 days;
- WebRTC session tickets — 2 minutes; session data (metadata) — 12 months;
- security event log — 12 months;
- server logs — 30 days (longer only in the event of a security incident, for the time needed to investigate it);
- billing data and invoices — 5 years from the end of the tax year in which the document was issued (statutory obligation);
- correspondence and complaints — 3 years from the closure of the matter (limitation period for claims);
- free accounts unused for 12 months — may be deleted after prior notification.
7. Rights of data subjects
Every data subject has the right to: access their data and obtain a copy of it; rectification; erasure ("right to be forgotten"); restriction of processing; data portability (account and device data can be downloaded in the panel or, on request, in JSON format); object to processing based on legitimate interest; withdraw consent at any time (without affecting the lawfulness of processing carried out before the withdrawal). Please send requests to privacy@bluewato.com; we respond within one month. You also have the right to lodge a complaint with a supervisory authority — in Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl); persons from other EU countries may contact the authority in their own country.
8. Security
We apply, among other measures: encryption of transmission (TLS for the panel and signalling, DTLS-SRTP for sessions), storage of passwords solely as Argon2id hashes, two-factor authentication, limiting the number of login attempts and temporary lock-outs, short-lived HMAC-signed session tickets, hashed device tokens, a firewall, system updates, administrative access control and an event log. We notify data subjects without undue delay of any personal data breach likely to result in a high risk to their rights.
9. Cookies
We use only strictly necessary cookies (login session, CSRF token, trusted browser, language selection). We do not use analytics or advertising cookies. Details: Cookie Policy.
10. Third-party data on Devices
Where a user accesses, through BlueWato, devices that contain the personal data of other persons (e.g. an employee's computer, a kiosk, a client's computer), the user is the controller of that data and is responsible for the lawfulness of the access, including for informing those persons. Owing to the architecture of the service (direct connection, end-to-end encryption), we have no access to that data and are not its processor. At the request of a business user, we enter into a data processing agreement covering account data and device metadata.
11. Changes to this Policy
We give notice of material changes to this Policy by e-mail and in the panel at least 14 days in advance. The current version is always available at bluewato.com/en/privacy. This version applies from 23 August 2026.
See also: Terms of Service · Cookie Policy