Your data, and what we do with it.

Who is responsible

The controller of your data is Aizen Media sp. z o.o., ul. Ogińskiego 2, 85-092 Bydgoszcz, Poland, KRS 0000889619, NIP 5621814196, share capital PLN 5,000.00. For anything about your data, write to kacper@aizen.one or to the address above. We have not appointed a data protection officer.

When you visit the site

The site is served by Cloudflare. To deliver pages and protect the site from attacks, Cloudflare processes technical data such as your IP address, browser type and the pages requested, and keeps it in short-lived logs. The legal basis is our legitimate interest in running a secure site (art. 6(1)(f) GDPR). We do not use analytics, advertising pixels or tracking, and our pages set no cookies of their own; Cloudflare may set a strictly necessary security cookie when it checks traffic for bots. Fonts and images load from our own server.

If you buy the Operator Pack

What we receive: your email address; the record of the two boxes you ticked on the checkout page with the date, time, your IP address and browser; from the payment page your name, billing address, country and, if you give one, your company name and VAT number; and the payment result and tax calculated. We never receive your full card number.

Why and on what basis: to make and perform the contract, deliver the Pack, send fixes and handle refunds and complaints (art. 6(1)(b) GDPR); to issue invoices and keep accounting and tax records (our legal obligation, art. 6(1)(c)); and to keep evidence of your consent from section 6 of the terms and defend or pursue claims (our legitimate interest, art. 6(1)(f)). The data asked for at checkout is needed to sell and invoice the Pack; without it we cannot accept the order.

How long: invoices and accounting records for as long as Polish tax and accounting law requires, which is generally five years from the end of the year of the sale; the order record and the consent evidence until claims about the purchase can no longer be made. If you start the checkout but do not pay, we keep the email address, the record of the boxes you ticked, your IP address and browser for 30 days, then delete them. Buying the Pack does not put you on any email list. The emails you get are about your order: the confirmation, the invoice and fixes to version 1.

If you sign up for send-guard and the letter

What we receive: your email address, the exact consent text you agreed to, the date and time you signed up and confirmed, your IP address at sign-up and the page you signed up from.

Why and on what basis: to send you the file you asked for and the letters you agreed to (your consent, art. 6(1)(a) GDPR), and to be able to show that you agreed (our legitimate interest, art. 6(1)(f)). You can withdraw your consent at any time with the unsubscribe link in every letter or by writing to us; that does not affect anything we sent before.

How long: until you unsubscribe. An address that is never confirmed is deleted after 30 days. After you unsubscribe we keep your address, the date and the record of your consent (its text, time and IP address) until claims can no longer be made, so that we can show that you agreed and so that we do not write to you again (our legitimate interest, art. 6(1)(f)).

If we emailed you first

We may have found your business email address and company name in a public source, such as your company's website, and written to you once with a business offer. The basis is our legitimate interest in offering our services to businesses (art. 6(1)(f) GDPR). You can object at any time by replying to the email. If you do, or if you ask us not to write again, we keep your address on a do-not-contact list for as long as we send such emails, so that we do not.

Who else processes the data

• Cloudflare (Cloudflare, Inc., USA): hosting of the site, the database with orders and sign-ups, and sending our emails. Cloudflare acts as our processor.
• Stripe (Stripe Payments Europe, Limited, Ireland, with other Stripe group companies): the payment page and card payments. Stripe processes payment data for us, and for some purposes of its own, such as fraud prevention and its legal duties, it is a separate controller under its own privacy policy. The payment page is served by Stripe and may use Stripe's cookies.
• Fakturownia (fakturownia.pl, Poland): issuing and emailing invoices, as our processor.
• Our accounting office in Poland, for bookkeeping, and public authorities where the law requires it, for example the tax office and, for invoices to business buyers in Poland, the Polish National e-Invoice System (KSeF).

Cloudflare and Stripe can process data outside the European Economic Area, mainly in the USA. The transfers rely on the EU-US Data Privacy Framework where the recipient is certified under it, and otherwise on the standard contractual clauses approved by the European Commission. You can ask us for a copy of these safeguards.

Your rights

You can ask us for access to your data and a copy of it, for correction, deletion or restriction of processing, and for your data in a portable format where the processing is based on consent or a contract. You can object at any time to processing based on our legitimate interest. Some data we must keep by law, for example invoices, even if you ask us to delete it; we will tell you which. You can also complain to a data protection authority: in Poland, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl), or the authority in the EU country where you live or work.

Automated decisions

We make no decisions about you by automated means alone. Stripe may decline a payment based on its own fraud checks; you can contact Stripe or us about such a decision.

Changes

If we change how we handle data, we update this page and its date. If a change matters for data we already hold, we tell you by email.