This English version is a courtesy translation. In case of any discrepancy between the Polish and the English version, the Polish version prevails.
1. Controller
The controller of your personal data is Helobrand sp. z o.o., with its registered office in Kraków, Ujastek 1, 31-752 Kraków, KRS (National Court Register) no. 0001076794, NIP (tax identification number) 6793286140, REGON (statistical number) 527245854 (“we”). We run the skrits brand and this website. For personal data matters, write to hi@skrits.com. We have not appointed a data protection officer.
2. Who this policy applies to
This policy applies to people who:
- visit the website, or write to us via the form or by e-mail;
- book a call in the calendar;
- buy our services (including as sole traders);
- represent our clients or are their contact persons;
- take part in sessions and meetings.
This policy does not cover the data of our client’s employees or customers that we process as part of the Implementation (Wdrożenie) or the Partner (Partner) service in the client’s tools. We process that data on the client’s behalf, under a data processing agreement. The controller of that data is our client.
3. Where we get the data and what data it is
We receive data mostly from you. If you are a client’s contact person, we may receive it from your employer or the party that commissioned the work. We check company data in public registers (CEIDG, KRS, the VAT taxpayers’ register).
We process:
- from the contact form (also when you submit a project on the “For startups” page): your first and last name, e-mail, company name (if you give it), the topic you choose and the content of your message, including the description of your idea. We store the message in the Cloudflare service and send us a copy by e-mail through our Google Workspace account;
- identification and contact data from correspondence: first name, last name, e-mail, telephone, job title, company name;
- data from a call booking: the date and time, and the data entered in the booking calendar;
- invoice data: company name, NIP, address;
- payment data (for now you pay by bank transfer on the basis of an invoice; if we launch online payments): amount, date, method and status (the full card data is seen only by the payment operator);
- the content of correspondence and notes from meetings, and, with your consent, also recordings and transcripts;
- technical data: IP address, browser and device information, server logs and signals needed to protect the form against bots.
The result of the free “Business X-ray in 5 minutes” test (“Prześwietlenie firmy w 5 minut”) is calculated in your browser. We do not send or store the answers to the test. You download the free templates without giving an e‑mail address.
4. Purposes, lawful bases and retention periods
| Purpose | Lawful basis (Art. 6(1) GDPR) | How long |
|---|---|---|
| Replying to a message from the form (including an order for a Diagnosis and a project submission), an e-mail or a call | point (b): steps taken at your request before entering into a contract; point (f): legitimate interest in replying, where you write on behalf of a company | form messages for up to 12 months from sending; correspondence until the end of the talks, then for up to 12 months |
| Booking and holding a call | point (b); point (f), where you represent a company | until the call takes place, then for up to 12 months |
| Concluding and performing a contract: payment, sessions, Plan, Implementation, Partner (including with the help of AI tools) | point (b), where you are a party to the contract; point (f), where you represent the client or are a contact person | for the duration of the contract, then until the limitation period for claims expires |
| Invoices, accounting, taxes (including KSeF) | point (c): the Accounting Act (ustawa o rachunkowości), the VAT Act (ustawa o VAT), the Tax Ordinance (Ordynacja podatkowa) | 5 years from the end of the year in which the tax payment deadline expired |
| Establishing, pursuing and defending claims | point (f) | until the limitation period expires, and in the event of a dispute until it is concluded |
| Recording or transcript of a session | point (a): consent | Diagnosis and Decision Day: up to 30 days from delivery of the Result; Implementation and Partner: for the duration of the contract + 30 days, in the client’s accounts; or until consent is withdrawn |
| Website security and protecting the form against bots | point (f): protecting the website | logs for up to 30 days |
5. Whether you have to provide data
Providing data is voluntary. However, without it we cannot reply to a message or conclude and perform a contract. Invoice data is required by tax law.
6. Who we share data with
We share data only to the extent needed for the given purpose.
| Recipient | Role and purpose |
|---|---|
| Cloudflare | website hosting, storing messages from the form, protecting the form against bots (Cloudflare Turnstile); processor |
| e-mail, calendar and call booking, documents, video calls (Meet), Gemini; processor | |
| Anthropic, OpenAI | AI tools supporting analysis and preparation of documents (business plans or API, with no training of models on our data); processors |
| Fakturownia | issuing invoices; processor |
| accounting firm | accounting; processor |
| National Revenue Administration (KSeF), bank, other public authorities | on the basis of legal provisions |
| our associates and advisers (e.g. legal) | only to the extent needed, under a duty of confidentiality |
We do not sell personal data.
7. Transfers of data outside the EEA
Some providers (e.g. Google, Anthropic, OpenAI, Cloudflare) may process data in the USA or other countries outside the European Economic Area. We transfer data only with the safeguards under Chapter V GDPR, in particular on the basis of:
- a decision of the European Commission finding an adequate level of protection, including the EU-US Data Privacy Framework for companies certified under that programme;
- standard contractual clauses adopted by the European Commission (Art. 46(2)(c) GDPR), with supplementary safeguards where necessary.
We store messages from the form in the Cloudflare service, which may replicate data in many locations around the world; the safeguards listed above apply in that case too. You can obtain a copy of the safeguards by writing to hi@skrits.com.
8. Your rights
You have the right to:
- access your data and receive a copy of it;
- rectify your data;
- erase your data;
- restrict processing;
- data portability, where we process the data on the basis of consent or a contract by automated means;
- object to processing based on legitimate interest, on grounds relating to your particular situation;
- withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
Write to hi@skrits.com. We will reply within one month. In complex cases this period may be extended by 2 months; in that case we will inform you of it.
9. Complaint
You may lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO; ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl).
10. AI tools and automated decisions
AI tools support our work, e.g. in analysing messages from the form and preparing the Plan. A human always checks the results. The rules by which we work with AI are described in the AI Policy. We do not take decisions about you based solely on automated processing, including profiling, which produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).
11. Cookies and similar technologies
- We use only cookies and similar technologies necessary for the operation and security of the website: protecting the form against bots (Cloudflare Turnstile) and remembering your choice in the cookie banner (in the browser’s storage). They do not require consent (Art. 399 of the Electronic Communications Law (Prawo komunikacji elektronicznej)).
- We do not collect visit statistics and do not use marketing cookies. If we start to, we will first ask for your consent in the banner. You will be able to withdraw consent at any time in “Cookie settings” in the website footer.
- The Google booking calendar loads only when you click to display it. From that moment Google may use its own cookies in accordance with its policy. Payments, once we launch them, will work on the payment operator’s site under its terms.
- You can delete or block cookies in your browser. Blocking necessary cookies may make it harder to use the website, e.g. to send the form.
12. Security
We apply measures appropriate to the risk, including:
- an encrypted connection to the website (HTTPS);
- two-factor authentication;
- access only for people who need it;
- device encryption;
- business versions of AI tools, in which the provider does not train models on our data.
13. Changes
We update the policy when our services, providers or legislation change. The current version is always on this page. We inform clients of material changes by e‑mail.
The English version of the policy is a courtesy translation. In case of any discrepancy, the Polish version prevails.