AnnexProof
Privacy policy
Draft: requires legal review before publication
1. Data controller
The controller of your personal data is Michał Kosiorek, [adres do uzupełnienia], [NIP do uzupełnienia]. For any data protection matter, write to prywatnosc@annexproof.com.
2. What we process
- Form data: full name, work email, company, role, an optional description of your products, the topic you choose and the consents you give.
- Your readiness check score (percentage and the areas with gaps), only if you send it with the form. The answers themselves are processed in your browser only.
- Campaign parameters from the page address (utm_source, utm_medium, utm_campaign, utm_content, utm_term).
- Technical data in server logs (e.g. IP address, request time), briefly, for security.
3. Purposes and legal bases
- Answering your enquiry, arranging a call and presenting an offer: Art. 6(1)(b) GDPR (steps prior to a contract) and Art. 6(1)(f) GDPR (legitimate interest: business contact).
- Sending CRA updates and AnnexProof news: Art. 6(1)(a) GDPR (consent).
- Measuring LinkedIn campaigns (LinkedIn Insight Tag): Art. 6(1)(a) GDPR (consent given in the banner).
- Site security, abuse prevention and establishing, exercising or defending legal claims: Art. 6(1)(f) GDPR.
4. Recipients
We entrust data to processors acting on our behalf under data processing agreements: website hosting (Vercel Inc.), database and email providers. If you consent to the LinkedIn Insight Tag, visit data is received by LinkedIn Ireland Unlimited Company, a joint controller for its collection.
5. Transfers outside the EEA
Some providers (e.g. Vercel Inc., LinkedIn) may process data in the United States, based on the European Commission’s EU-US Data Privacy Framework decision or standard contractual clauses.
6. Retention
- Form data: up to 24 months after the last contact, unless we enter into a contract.
- Data processed on the basis of consent: until you withdraw it.
- Records of consent: until the limitation period for claims expires.
7. Your rights
You have the right to access, rectify and erase your data, to restrict processing, to data portability and to object to processing based on legitimate interest. You can withdraw consent at any time without affecting the lawfulness of earlier processing. You may also lodge a complaint with a supervisory authority (in Poland: the President of the Personal Data Protection Office, UODO).
8. Cookies and similar technologies
- Necessary: remembering your banner choice (browser storage, key
ap-consent). - Marketing (consent only): the LinkedIn Insight Tag and LinkedIn cookies (including li_sugr, bcookie, lidc, UserMatchHistory, AnalyticsSyncHistory).
You can change your choice at any time via “Cookie settings” in the footer.
9. Voluntary provision and profiling
Providing data is voluntary, but without it we cannot answer your enquiry. We do not make decisions based solely on automated processing, including profiling, that produce legal effects for you.