Privacy Policy

01 Data controller

The controller of personal data is:

Contact for data protection matters: biuro@innovix.pl.

The controller is not required to appoint a Data Protection Officer within the meaning of Article 37 GDPR. All data protection enquiries are handled directly by the controller at the e-mail address indicated above.

02 What data we process and for what purpose

Contact form

When you contact us through the form on our website, we process:

• your full name,
• e-mail address,
• the content of your message,
• IP address and the time of submission (in anonymised form - SHA-256 hash - to protect against abuse).

Legal bases:

• Article 6(1)(b) GDPR - responding to your enquiry and taking steps towards the conclusion of a contract;
• Article 6(1)(f) GDPR - legitimate interest (handling business correspondence, direct marketing of our own services, protection against abuse);
• Article 6(1)(f) GDPR - the establishment or defence of legal claims.

Business cooperation and the performance of contracts

In connection with the conclusion and performance of contracts (custom software, security audits, consultancy), we process the contact data of persons representing the client as well as the data set out in contracts and accounting documents.

• Article 6(1)(b) GDPR - the conclusion and performance of a contract;
• Article 6(1)(c) GDPR - obligations arising from tax and accounting regulations;
• Article 6(1)(f) GDPR - the establishment or defence of legal claims.

Security audits and penetration testing (pentest)

Data processed during audits (test accounts provided by the client, test results, technical system data) are processed solely on the basis of a written instruction from the system owner. If, in the course of an audit, we access personal data within the client's systems, we process it on the basis of a data processing agreement (Article 28 GDPR) and only to the extent necessary to carry out the audit.

03 Data retention period

• Data from the contact form, where no further cooperation has taken place - 3 years from the last contact (the limitation period for claims, Article 118 of the Polish Civil Code).
• Data of clients and business partners - for the duration of the contract and for the limitation period for claims; data on invoices and in accounting records - 5 years from the end of the financial year, in accordance with tax regulations.
• Technical logs (including anonymised form logs) - for no longer than 12 months.

04 Recipients of data

We may disclose personal data only to the following categories of recipients:

• providers of hosting and e-mail services with whom data processing agreements have been concluded - entirely within the European Union;
• accounting offices and tax advisors in relation to bookkeeping services;
• law firms in relation to the establishment or defence of claims;
• state authorities or other authorised entities, where the obligation to disclose arises from the provisions of law.

We do not sell personal data. Nor do we transfer it to third countries (outside the European Economic Area) or to international organisations - the entire infrastructure (hosting, e-mail, databases, model training) is located in data centres within the European Union.

05 Your rights

In connection with the processing of your personal data, you have the following rights:

• the right of access to your data (Article 15 GDPR);
• the right to rectify inaccurate data or to complete incomplete data (Article 16 GDPR);
• the right to erasure of data - the "right to be forgotten" (Article 17 GDPR) - to the extent that this does not conflict with the controller's legal obligations;
• the right to restriction of processing (Article 18 GDPR);
• the right to data portability (Article 20 GDPR);
• the right to object to processing based on legitimate interest (Article 21 GDPR);
• the right to withdraw consent at any time, where processing is carried out on the basis of consent.

We fulfil requests without undue delay, no later than within one month. To exercise your rights, please write to biuro@innovix.pl.

06 Right to lodge a complaint

You have the right to lodge a complaint with the supervisory authority - the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl.

07 Automated decision-making

We do not make decisions in relation to you that are based solely on automated processing of data, including profiling, that would produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR).

08 Voluntariness of providing data

Providing data in the contact form is voluntary but necessary in order to respond to your enquiry. Where a contract is concluded, the provision of certain data is a statutory or contractual requirement.

09 Cookies

The innovix.pl website uses only cookies that are technically necessary to ensure the proper and secure operation of the service - in particular session cookies that protect the contact form against abuse. They expire when the browser is closed.

These cookies are stored with the HttpOnly, Secure and SameSite=Strict attributes and are exempt from the consent requirement pursuant to Article 173(3)(2) of the Polish Electronic Communications Law (they are strictly necessary for the provision of the service).

We do not use tracking, analytical or marketing cookies. We do not use Google Analytics, Tag Manager, Facebook Pixel or similar tools. Web fonts (Montserrat, Roboto) are served from our own infrastructure - they are not downloaded from Google's servers.

10 Changes to the policy

This policy may be updated periodically - the effective date is stated at the beginning of the document. We will communicate material changes in a prominent place on the home page.