1. Controller and scope of this Policy

The controller of your personal data is Michał Bogdał, a sole trader operating under the business name BBG Michał Bogdał, ul. Gołęszyców 32, 41-608 Świętochłowice, Poland. For data protection matters, you can contact us at [email protected] or by post at the address above.

This Policy covers xhub.systems, its forms, the newsletter and the communications described below. Xhub is in development; apart from the website and its communication features, its intended applications and services are not yet publicly available. This Policy does not describe processing in separate test environments.

This Policy was prepared in Polish. This English version is an automated translation provided for your convenience. In the event of discrepancies, the Polish version prevails, subject to mandatory provisions of law and without restricting the rights of data subjects.

2. Data and its sources

We receive data directly from people who contact us or subscribe to the newsletter. We may also receive an organisation's representative's data from that organisation or another participant in the correspondence. Depending on the matter, this may include a first and last name, email address, telephone number, organisation and role, information about needs, the content of correspondence and attachments, and statements submitted.

Using the website and newsletter also generates technical data, online identifiers, activity information and records of consent and requests to be contacted, as described below.

Enquiries and the sales process

We use data to handle enquiries, understand needs, respond, prepare and discuss proposals, and make arrangements for possible cooperation. The legal basis is Article 6(1)(b) GDPR where we take steps at a person's request before entering into a contract with that person. For other correspondence, including correspondence with an organisation's representative, the basis is Article 6(1)(f) GDPR: our legitimate interest in handling matters and communicating with interested people.

The form requires completion of the marked fields, acknowledgement of receipt of privacy information, and a request to be contacted about the matter by email, telephone and SMS or MMS. Acknowledging receipt of the information is not consent to data processing or acceptance of this Policy. If the required fields are not completed, the form cannot be submitted. You can also contact us by email.

Optional marketing

A separate, optional marketing consent allows us to use your email address, telephone number and information about your stated needs for future communications about our own products and services developed or offered under the Xhub brand. It covers email, telephone, SMS and MMS, including after your enquiry has been resolved. The legal basis is Article 6(1)(a) GDPR and consent to communications under Articles 398 and 400 of the Polish Electronic Communications Law.

Declining or withdrawing this consent does not affect the submission or handling of your enquiry. This consent does not subscribe you to the newsletter or authorise individual message tracking.

Newsletter and activity measurement

The newsletter contains news, educational content and marketing information about Xhub. Subscription requires two separate consents, neither of which is preselected: one for the subscription and one for individual activity measurement and analysis. The subscription will not be activated without both consents.

Measurement covers message-opening signals and clicks linked to your email address. It is used to assess effectiveness, segment recipients, identify interests, personalise content and frequency, and automate communications. This data may be combined with data about website use only to the extent covered by the relevant, separately granted consents.

The legal basis is Article 6(1)(a) GDPR and, for communications and measurement technologies, the relevant consents under Articles 398-400 of the Polish Electronic Communications Law. Each consent can be withdrawn separately. Under the newsletter model we use, withdrawing consent to measurement ends both measurement and further newsletter delivery. Unsubscribing does not restrict access to website content or your ability to contact us.

Obligations, evidence and claims

We process data needed to fulfil our GDPR obligations, including documenting consents and handling the exercise of individuals' rights, under Article 6(1)(c) GDPR. We process records of requests to be contacted and of arrangements made, and data needed to investigate incidents or establish, exercise or defend legal claims, under Article 6(1)(f) GDPR: our legitimate interest in protecting our rights and keeping communications secure.

Records of statements include their content, version, date, source and status, as well as metadata, including the IP address and browser information for the form and newsletter. The server-side record of website privacy settings choices does not contain an IP address or browser information.

4. Website, cookies and similar technologies

Technical data, such as an IP address, the time and address of a request, browser information and anti-spam verification signals, is used to display and secure the website and forms. The legal basis is Article 6(1)(f) GDPR: our legitimate interest in website availability, diagnostics and protection against abuse. Necessary operations on your device do not require consent to the extent covered by the exemption in Article 399(3) of the Polish Electronic Communications Law.

Cookies, local storage, pixels and similar mechanisms allow information to be stored on or read from your device. We use optional technologies on the basis of consent under Article 6(1)(a) GDPR and Articles 399-400 of the Polish Electronic Communications Law:

  • Measurement: Google Analytics and Umami are used to analyse visits, events, traffic sources, approximate location and device data, and to assess the effectiveness of content and campaigns.
  • Experience: Umami session recordings and activity maps capture clicks, scrolling, navigation and the state of the interface. Freely entered text in text fields is masked, but selections from lists and checkboxes may be visible. This feature requires consent to both Measurement and Experience.
  • Marketing: conversion measurement, remarketing and ad personalisation use online identifiers, visit data and interest segments. This feature requires consent to both Measurement and Marketing.

The providers of these tools receive data. For data relating to users in the European Economic Area, Google's advertising features also involve processing by Google Ireland Limited as a separate controller, in accordance with Google's policies.

You can reject optional purposes or disable them later through Privacy settings in the footer. Without consent, these purposes are not activated, and access to basic content and the form is not restricted.

Privacy, language and theme choices are remembered for up to 365 days. Google Analytics cookies last for up to 2 years from being set or renewed during a subsequent visit, and Google conversion measurement cookies last for up to 90 days. Google's ad personalisation cookies may last for up to 13 months in the EEA, Switzerland and the United Kingdom, and up to 24 months in other countries; some expire earlier. Further details are provided by Google. We use optional technologies only within the scope of consent; browser settings may shorten their duration.

A cookie's duration is not the same as the period for which data is stored on a server. Those periods are described in section 6.

5. Recipients and transfers outside the EEA

Depending on the purpose, recipients of data may include providers of hosting, data storage, security and IT support; email, telephony, contact management and newsletter services; analytics and advertising; legal advisers; and authorised authorities and other entities receiving data under the law. Providers act on our behalf or as separate controllers, as applicable.

In connection with our use of IT, communication, analytics and advertising services, data may be transferred outside the European Economic Area, in particular to the United States, including as part of technical support. Transfers are based on an applicable European Commission adequacy decision, including for US recipients covered by the EU-U.S. Data Privacy Framework, or on appropriate safeguards, in particular standard contractual clauses adopted by the European Commission. For information about the safeguards used and to obtain a copy of them, contact [email protected].

If you follow a link to an external website, processing by its operator is governed by that website's privacy information.

6. Retention periods

  • Enquiries and correspondence: until the matter has been resolved, including any agreed sales-related activities, or until an earlier valid request for erasure or objection takes effect. Once the matter is closed, further marketing requires separate consent.
  • Marketing and newsletter: contact details and information about needs are retained until the relevant consent is withdrawn, an objection is made, or the activities covered by the consent end earlier. Newsletter open and click measurement data is retained for up to 14 months from the event or until earlier withdrawal of consent to measurement. An unconfirmed newsletter subscription is retained for up to 31 days from submission.
  • Analytics: event and activity map data is retained for up to 14 months from the event, and user analytics profile data for up to 14 months from the last activity. In Google Analytics, data covered by this setting is deleted in the next monthly cycle after the period expires. This does not cover all aggregated reports; statistics that no longer allow a person to be identified may be retained for longer.
  • Website session recordings: for up to 30 days from the recording.
  • Remarketing audiences for our campaigns: for up to 180 days from the last activity qualifying the person for the audience, but no longer than until the relevant consent is withdrawn or the person objects to marketing.
  • Privacy settings and logs: the server-side record of a privacy decision is retained for up to 730 days from being recorded; local server logs are retained for up to 7 days. The periods for remembering settings on a device are described in section 4.
  • Obligations, disputes and evidence: data needed to fulfil a legal obligation or for a specific legal claim, including necessary records of statements, is retained for the duration of that obligation, until the applicable limitation period expires or until the proceedings end. For civil claims, these periods are generally 3 years for claims connected with business activities or 6 years in other cases, taking into account specific provisions and any suspension or interruption of the limitation period. After an individual opts out of marketing, a minimal suppression record may be retained for as long as needed to ensure that subsequent activities do not result in contact contrary to that person's decision.

Once the purpose ceases to apply, data is deleted or irreversibly anonymised, except for data still needed on a separate basis specified in this Policy. A maximum period does not require data to be kept for that entire period if earlier deletion is lawful.

7. Profiling

On the basis of the relevant consents, we may automatically tailor communications and advertising to stated needs or activity data that we are permitted to use. This results in adjustments to content, proposals or contact frequency. Marketing consent given through the form does not cover individual tracking of opens and clicks.

We do not make decisions concerning website users or recipients of communications that are based solely on automated processing and produce legal or similarly significant effects.

8. Your rights

Subject to the GDPR, you have rights of access to and a copy of your data, rectification, erasure, restriction of processing, and portability of data processed by automated means on the basis of consent or a contract.

You may object to processing based on legitimate interests on grounds relating to your particular situation. You may object to direct marketing, including related profiling, at any time without giving a reason.

You may withdraw consent at any time without affecting the lawfulness of earlier processing:

  • website technologies: through Privacy settings in the footer;
  • newsletter and its measurement: through the relevant links in a message or by contacting us;
  • marketing consent given through the form: by replying to an email, informing the person you are speaking to during a telephone call, or writing to [email protected]. Withdrawal covers email, telephone and SMS/MMS without affecting the handling of the ongoing matter.

Requests can be sent to [email protected] or the controller's postal address. We respond without undue delay, generally within one month; in cases provided for by the GDPR, this period may be extended by two months, of which we will inform you within the first month.

You also have the right to lodge a complaint with a supervisory authority, in particular in the country of your habitual residence, place of work or the alleged infringement. In Poland, this is the President of the Personal Data Protection Office.

Providing data is voluntary. Failure to provide data necessary to respond or to contact you as requested may prevent us from handling the matter. Refusing optional consents does not restrict the website's other features, subject to the newsletter subscription conditions described above.