Service Provider / Operator: Brillnet Piotr Adamski, ul. Henryka Sienkiewicza 73/6, 90-057 Łódź, Polska, NIP 7321779060, REGON 101551294
Service contact: kontakt@wm-admin.pl
Privacy and breach contact: privacy@brillnet-app.com
Website: wm-admin.pl
Version: 2026-10-12-beta.2
This is an informational translation. The Polish version is binding.
1. Urgent channel
Report a suspected breach to privacy@brillnet-app.com with the subject URGENT — WM Administrator — breach. Do not attach unencrypted databases, passwords, tokens or complete documents.
2. Information to provide
- Customer and Community names;
- reporter's details and a safe contact number;
- discovery time and, if known, the start of the incident;
- description, affected accounts/systems and correlation identifier;
- categories of data and individuals, estimated number of records;
- actions taken; and
- whether availability, confidentiality or integrity remain at risk.
Missing information should not delay the initial report.
3. Brillnet's actions
- Record and classify the incident; cut off the active attack path.
- Preserve evidence with access controls and integrity protection.
- Identify Communities, data, timing and effects.
- Brillnet notifies the Customer without undue delay upon becoming aware of a Customer Data breach. The internal target is a first useful notification within 24 hours; it does not justify waiting when earlier information is available. Information is supplied in stages without awaiting full confirmation of every circumstance.
- Provide updates, remediation, recovery and monitoring.
- Analyse the cause and prepare a corrective action plan.
4. Customer notification content
As available: nature, date, system, categories and approximate numbers of individuals/records, effects, measures taken and planned, contact details, indicators of compromise and recommended actions. Information may be provided in stages.
5. Allocation of responsibilities
- Brillnet, as processor, reports a breach to the Customer without undue delay.
- The Customer, as controller, assesses the risk and decides on notification to the President of the Polish Personal Data Protection Office (UODO) without undue delay, where feasible within 72 hours of becoming aware, and on informing individuals.
- Brillnet provides information and assistance, but does not notify on the Customer's behalf without a documented instruction or its own legal obligation.
- Where the incident affects data for which Brillnet is controller, Brillnet fulfils the controller's obligations itself.
6. After the incident
The final report contains a timeline, cause, impact, notification decisions, recovery, action owners and deadlines. Incident documentation is subject to a legal preservation hold for the period required for compliance and claims.
7. Not every event is a breach
A report does not determine classification. An availability outage without personal data, a failed sign-in or a false alarm may not be a breach, but remains logged for security.
Readiness for KSC/NIS2
KSC/NIS2 readiness rests on security measures, supplier controls and incident procedures relevant to WM Administrator. Statutory duties are qualified by entity, sector, service, size and exceptions. Operator duties, customer duties and contractual commitments are separate. On a justified request, relevant service information is supplied with confidentiality safeguards. Using WM Administrator does not itself ensure customer compliance, registration or certification.
> Contact details and domains in this presentation were updated on 2026-09-08. The original document and previous acceptances remain unchanged.