Privacy Policy
This document is an educational starting point, not legal advice. It was generated from this website’s technical setup and has not been reviewed by a lawyer. It does not cover every obligation that applies to this business, and it may be incomplete or wrong for your situation.
Known gaps this template does not close: records of processing activities (Art. 30 GDPR), data processing agreements with each processor, UK GDPR representation, US state privacy laws and the Australian Privacy Act for customers in those markets, terms of service, and consumer withdrawal rights for online payments.
Before this page goes live and before a single payment is taken, it must be reviewed by a qualified data protection lawyer in the relevant jurisdiction.
This policy explains what personal data we collect through this website, why we collect it, who we share it with, and what you can do about it.
1. Who is responsible for your data
The controller of your personal data is:
- Business
- AEC Digital Ignacy Łoziński
- Registered address
- ul. Jasnogórska 3, 05-270 Marki, Poland
- Tax ID (NIP)
- 1132576186
- Registry no. (REGON)
- 527385868
- ignacy.lozinski@bimcorner.com
We have not appointed a Data Protection Officer. There is no legal requirement to do so for a business of this type and scale, and all data protection questions go to the email address above.
2. What data we collect
2.1 Data you give us directly
| Where | What we collect | Status |
|---|---|---|
| Fit call booking form | Name, work email, company name, role, and anything you write in the message field. | Planned — not live yet |
| Email list / lead magnet | Email address, and first name if you provide it. Delivered through Kit (formerly ConvertKit). | Planned — not live yet |
| Scheduling | Name, email, chosen time slot, time zone, and anything you add when booking. | Planned — provider TBC |
| Purchase | Billing details required to issue an invoice: company name, address, tax number, contact person. Card details are handled by the payment provider and never reach us. | Planned — provider TBC |
| Email correspondence | Whatever you choose to write to us, plus your email address. | Live |
2.2 Data collected automatically
- Server logs. Your IP address, browser type, the pages you requested and when. Created by the hosting provider as a normal part of serving a website.
- Cookies and similar technologies. Only with your consent, except for the ones strictly necessary to run the site. See the cookie policy for the full list.
3. Why we process it, and on what legal basis
| Purpose | Legal basis (GDPR) | Notes |
|---|---|---|
| Responding to your enquiry and running a fit call | Art. 6(1)(b) — steps at your request before entering a contract | You asked to talk to us; we need your details to talk back. |
| Delivering the program you bought, and invoicing it | Art. 6(1)(b) — performance of a contract | — |
| Keeping accounting records | Art. 6(1)(c) — legal obligation | Polish tax and accounting law. |
| Sending you emails about the program and related content | Art. 6(1)(a) — consent | You opt in. You can withdraw at any time; every email carries an unsubscribe link. |
| Measuring how the website is used | Art. 6(1)(a) — consent | Analytics cookies run only if you accept them in the cookie banner. |
| Advertising and remarketing | Art. 6(1)(a) — consent | Marketing cookies run only if you accept them in the cookie banner. |
| Keeping the site secure and available | Art. 6(1)(f) — legitimate interest | Our interest in a working, non-abused website. |
| Establishing or defending legal claims | Art. 6(1)(f) — legitimate interest | — |
4. How long we keep it
- Enquiries that do not lead to a contract: up to 24 months from the last contact, then deleted.
- Client records and correspondence: for the duration of the contract, then for as long as claims could still be brought under Polish law.
- Invoices and accounting records: 5 years from the end of the tax year in which the invoice was issued, as required by Polish law.
- Email list: until you unsubscribe or ask to be removed.
- Server logs: as retained by the hosting provider. To be confirmed — hosting provider
- Cookie consent record: 12 months, then you are asked again.
5. Who else sees it
We do not sell personal data and we do not share it for anyone else’s marketing. We do use service providers who process data on our behalf, under written agreements:
| Type of provider | What they handle | Provider |
|---|---|---|
| Website hosting | Serving the site, server logs | To be confirmed |
| Email marketing | Email list, campaign delivery | Kit (formerly ConvertKit) |
| Scheduling | Fit call bookings | To be confirmed |
| Payments | Card processing, transaction records | To be confirmed |
| Analytics | Aggregate website usage | Google Analytics 4 — only with consent |
| Advertising | Remarketing audiences | Meta and LinkedIn — only with consent |
| Program delivery | Course access for enrolled participants | Skool |
| Accounting | Invoices and tax records | To be confirmed |
Data may also be disclosed to public authorities where the law requires it.
6. Transfers outside the EEA
Some of the providers above are based in the United States or process data there. Where that happens, the transfer relies on one of the following: the EU–US Data Privacy Framework where the provider is certified, or the European Commission’s Standard Contractual Clauses, together with additional safeguards where needed.
You can ask us for details of the safeguards in place for any specific transfer.
7. Your rights
Under the GDPR you have the right to:
- Access — ask what data we hold about you and get a copy.
- Rectification — have inaccurate data corrected.
- Erasure — have your data deleted, where no legal obligation requires us to keep it.
- Restriction — ask us to limit how we use your data while a dispute is resolved.
- Portability — receive data you gave us in a machine-readable format, or have it sent to another controller.
- Objection — object to processing based on our legitimate interest, including any profiling.
- Withdraw consent — at any time, without affecting anything done before you withdrew it.
To exercise any of these, email ignacy.lozinski@bimcorner.com. We answer within one month; if a request is complex we may extend that by two further months and will tell you why.
Complaints. If you think we have handled your data badly, you can complain to the Polish supervisory authority: Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, Poland — uodo.gov.pl. If you are in another EEA country, you may also complain to your local authority.
8. Automated decisions and profiling
We do not make decisions about you by automated means alone, and nothing here produces a legal effect on you.
If you accept marketing cookies, advertising platforms may build a profile of your interests and use it to show you advertisements. That is profiling in the GDPR sense. It happens only with your consent, and switching marketing cookies off in cookie settings stops it.
9. Cookies and tracking
Cookies, what each category does, how long it lasts and how to change your mind are covered in a separate document: Cookie Policy.
You can reopen the cookie settings panel at any time from the link in the footer of any page.
10. How we protect the data
- The site is served over HTTPS.
- Access to systems holding personal data is limited to people who need it, and protected by strong, unique passwords and two-factor authentication where the provider supports it.
- We keep the amount of data we collect to what the purpose actually requires.
No system is perfectly secure, and we will not claim otherwise. If a breach occurs that is likely to put your rights at risk, we will notify the supervisory authority and, where required, you.
11. Changes to this policy
When this policy changes, the version number and date at the top of the page change with it. Material changes — a new category of data, a new purpose, a new processor — will be announced to anyone on our email list before they take effect.