Privacy and Cookie Policy

The data controller is AUTENLY SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ (a Polish limited liability company), ul. Marcina Kasprzaka 31/119, 01-234 Warsaw, Poland.

Tax ID (NIP): 5273206453. National Business Registry Number (REGON): 544045004. National Court Register Number (KRS): 0001224972 (District Court for the Capital City of Warsaw, XIII Commercial Division of the National Court Register). Share capital: PLN 10,000.

Hereinafter the “Controller” or the “Company”.

For any matters concerning personal data processing, contact: contact@autenly.com.

The Controller is not required to appoint a Data Protection Officer under Article 37 GDPR and has not appointed one, as the scale and nature of the processing does not meet the relevant thresholds.

3.1 Contact form. Data provided through the contact form (name, email address, message content and any other data voluntarily provided) is processed to respond to inquiries and to take steps prior to entering into a contract, based on:

– Article 6(1)(b) GDPR – where the contact concerns a prospective contract,

– Article 6(1)(f) GDPR – the Controller’s legitimate interest in handling correspondence and business relationships.

3.2 Newsletter. Data provided when subscribing to the newsletter (email address, optionally name) is processed to send marketing and commercial communications about the Company’s services, based on Article 6(1)(a) GDPR – consent of the data subject – read together with Article 10 of the Polish Act on Providing Services by Electronic Means and Article 172 of the Polish Telecommunications Law, which require separate consent for sending commercial information electronically.

Subscription uses double opt-in: after submitting the form, a confirmation link is sent to the address given, and the address is added to the list only once that link is followed. An unconfirmed address is never stored on the list.

Newsletter consent is voluntary and can be withdrawn at any time, without affecting the lawfulness of processing carried out before withdrawal. Every newsletter message includes an unsubscribe link.

3.3 Entering into and performing contracts with clients. Data of individuals representing clients or business partners (for example in connection with automation or marketing services) is processed to enter into and perform contracts, based on Article 6(1)(b) and (c) GDPR, including tax and accounting obligations.

3.4 Cookies, analytics and marketing. Data processed through cookies and similar technologies is processed for analytics and marketing purposes, based on Article 6(1)(a) GDPR – consent given via the cookie consent banner – and Article 173 of the Polish Telecommunications Law, consent to store and access information on the user’s end device. Details are set out in Section 10 below.

Personal data may be entrusted to or shared with the following categories of recipients, only to the extent necessary for the purposes above:

– website hosting provider – Vercel Inc.,

– analytics provider – Google LLC (Google Analytics 4),

– marketing provider – Meta Platforms, Inc. / Meta Platforms Ireland Ltd. (Meta Pixel, Meta Ads),

– email delivery and newsletter provider – Resend, Inc. (contact form delivery and the subscriber list),

– accounting, legal and advisory service providers to the Company,

– public authorities, where disclosure is required by law.

Where any of the above act as a processor, the Company enters into a data processing agreement compliant with Article 28 GDPR.

Some recipients listed in Section 4 are established or process data in the United States. Such transfers take place on the basis of the European Commission’s adequacy decision under the EU-US Data Privacy Framework, where the given provider participates in it, or Standard Contractual Clauses approved by the European Commission in all other cases.

A copy of the relevant safeguards can be obtained by contacting the Company at the address in Section 2.

– Contact form data: for as long as necessary to respond to the inquiry, and thereafter until any potential claims become time-barred (generally 6 years under Article 118 of the Polish Civil Code).

– Newsletter data: until consent is withdrawn.

– Contract-related data: for the duration of the contract and for the period required by tax and accounting regulations (generally 5 years from the end of the relevant tax year).

– Cookie data: as indicated in the consent banner, not exceeding 13 months for analytics and marketing cookies, unless a shorter period results from the tool provider’s own settings.

Every data subject has the right to:

– access their data (Article 15 GDPR),

– rectify their data (Article 16 GDPR),

– erase their data (Article 17 GDPR),

– restrict processing (Article 18 GDPR),

– data portability (Article 20 GDPR),

– object to processing based on Article 6(1)(f) GDPR, including direct marketing (Article 21 GDPR),

– withdraw consent at any time, without affecting the lawfulness of prior processing,

– lodge a complaint with the President of the Polish Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland.

Providing data via the contact form and newsletter sign-up is voluntary, but necessary to respond to the inquiry or to receive the newsletter, respectively. Providing data necessary to enter into and perform a contract is a contractual requirement – without it, the contract cannot be concluded.

The Controller does not make decisions concerning Website users based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect them. Analytics and marketing cookies are used solely for statistical and advertising profiling as described in Section 10.

10.1 What are cookies. Cookies are small text files stored on a user’s device that enable the Website to function correctly, allow traffic analysis, and enable relevant advertising content.

10.2 Categories of cookies used on the Website:

On first visiting the Website, users are shown a consent banner allowing them to accept all cookie categories, reject non-essential categories, or make a granular choice. Analytics and marketing cookies are not loaded before consent is given.

Consent can be withdrawn at any time via the “Cookie settings” link in the Website footer, or through browser settings.

10.4 Third-party cookies. Google and Meta may also process data collected through their technologies for their own purposes, in accordance with their own privacy policies, available at policies.google.com/privacy and facebook.com/privacy/policy.

The Controller applies technical and organisational security measures appropriate to the risk of processing, including encrypted data transmission (HTTPS), access restrictions, and data processing agreements with service providers.

The Controller reserves the right to amend this Policy, in particular due to changes in law, the scope of services provided, or the tools used. The current version of the Policy is always available on the Website together with the date of the last update.