Privacy Policy

Notice: The Polish version of this Privacy Policy is binding. A full English translation is in progress. Please refer to the Polish version or contact us at [email protected].

Summary of key points

Data Controller: Gurgul Investment sp. z o.o., ul. Polna 3, 44-285 Kobyla, Poland NIP: 6392018818, KRS: 0000812023 Contact: [email protected]

Data processed:

• Form submissions: name, email, phone, VAT-ID, business details
• Technical data: IP address, User-Agent, GDPR consent timestamp
• AI chat: content of the conversation, language, page address, random session ID (no IP address)

Purposes:

• Processing distributor application (Art. 6(1)(b) GDPR)
• Confirming receipt of the application (Art. 6(1)(b) GDPR)
• AI chat assistant answering questions about the brand and products (Art. 6(1)(f) GDPR)
• Free online trainings: performance of a free-of-charge agreement (Art. 6(1)(b) GDPR); phone contact based on consent
• Cookie-free aggregate visit statistics (Cloudflare Web Analytics) and anti-abuse logging (Art. 6(1)(f) GDPR)

No commercial e-mails or calls are sent without a separate consent (Art. 398 of the Polish Electronic Communications Act); the forms do not currently collect such consent.

Data processors:

• Cloudflare, Inc. (USA) - hosting, EU-U.S. Data Privacy Framework
• Resend, Inc. (USA) - email delivery, Standard Contractual Clauses
• Supabase, Inc. (data in EU - Frankfurt) - database
• Technical operator of the website (Poland) - maintenance, hosting and system administration under a data processing agreement (Art. 28 GDPR); the providers listed here act as its sub-processors
• Whereby AS (Norway, EEA) - video room for free online trainings (Polish only)
• Map base layer providers (independent controllers, receive only your IP address, only when you open the distributor map): OpenStreetMap Foundation (UK), CARTO (USA), Esri (USA)
• Language model provider for the AI chat: one of Anthropic PBC (USA), Google (USA / Ireland), Mistral AI (France), OpenAI (USA / Ireland) or xAI (USA), depending on current configuration; commercial API only, no model training on conversations; EU-U.S. DPF or Standard Contractual Clauses

Retention periods:

• Rejected submissions (invalid data, spam): 30 days
• Submissions without cooperation: 12 months
• Active distributors: until end of cooperation + 6 years (tax law)
• Online training sign-ups: 12 months after the training
• AI chat conversations: 90 days

Your rights (GDPR): Access, rectification, erasure, restriction, objection, data portability, withdrawal of consent, complaint to the Polish Data Protection Authority UODO.

Contact for data protection inquiries: [email protected]

Full information is available in the Polish version of this document.