1. Personal data controller
The controller of your personal data is:
Mateusz Konieczny — BALANCE IT
ul. Święty Marcin 29 lok. 8
61-806 Poznań, Poland
NIP: 7812090221
REGON: 541862820
Legal form: Sole trader
Contact for data protection matters:
Email: kontakt@balanceit.pl
Website: balanceit.pl
2. What data we collect
We process only the data necessary for a specific purpose. Depending on your interaction with the website, we collect:
2.1. Contact form data
- Full name — so that we can address you by name
- Email address — so that we can respond to your enquiry
- Phone number — optional, for faster contact
- Message — information about your project/needs
2.2. Client portal data (after creating an account)
- Login details (email, encrypted password)
- Company details (name, NIP, address) — for invoices
- Project history, invoices and documentation shared through the portal
2.3. Technical data (collected automatically)
- IP address, device model, browser version
- Pages you visit on our website
- Time spent on the website, traffic source (e.g. Google, referral)
- Cookie identifiers and browser storage
3. Purposes and legal bases of processing
| Goal | Legal basis (GDPR) | Period |
|---|---|---|
| Responding to a contact form enquiry | Article 6(1)(b) (contract) / (f) (legitimate interests) | Until correspondence ends + 1 year |
| Performance of a service agreement | Article 6(1)(b) (contract) | Duration of the agreement + limitation period for claims (up to 6 years) |
| Issuing invoices and tax obligations | Article 6(1)(c) (legal obligation) | 5 years from the end of the financial year |
| Marketing our own services | Article 6(1)(f) (legitimate interests) or (a) (consent) | Until consent is withdrawn / an objection is raised |
| Website analytics and optimisation | Article 6(1)(a) (cookie consent) | Up to 26 months (analytics cookies) |
| Security and abuse detection | Article 6(1)(f) (legitimate interests) | Up to 12 months |
4. Who we share data with (processors)
Your data may be shared with the following categories of recipients acting on our behalf under data processing agreements:
- Supabase Inc. — client portal database hosting (USA, under EU Standard Contractual Clauses)
- Stripe Payments Europe Ltd. — online payment processing (Ireland/EU)
- Cal.com Inc. — booking consultation appointments (USA, SCC)
- Daily.co (Pluot Inc.) — video conferencing (USA, SCC)
- Google LLC / Google Ireland Ltd. — Google Analytics 4, Google Tag Manager, Google Workspace (Ireland/USA, SCC)
- Microsoft Corporation — Microsoft Clarity (heatmap analytics, USA, SCC)
- Contabo GmbH — website server hosting (Germany, EEA)
- Banks, accounting firms, law firms — to the extent required by legal obligations
A full list of current processors is available on request at kontakt@balanceit.pl.
5. Transfers of data outside the EEA
Some of our tools (e.g. Supabase, Stripe, Google, Microsoft) may process data on servers in the USA. Each such transfer takes place on the basis of:
- Standard Contractual Clauses (SCC) the European Commission
- An adequacy decision (e.g. the Data Privacy Framework for selected recipients in the USA)
- Internal security policies approved by processors
You can request a copy of the safeguards used for a specific transfer by emailing kontakt@balanceit.pl.
6. Your rights
Under the GDPR, you have the following rights:
- Right of access — you can find out what data we process about you (Article 15 GDPR)
- Right to rectification — you can request the correction of inaccurate data (Article 16)
- Right to erasure ("right to be forgotten") — in certain circumstances, you can request the erasure of data (Article 17)
- Right to restriction of processing (Article 18)
- Right to data portability — in a structured, commonly used format (Article 20)
- Right to object — to processing based on legitimate interests or for direct marketing purposes (Article 21)
- Right to withdraw consent — at any time, without affecting the lawfulness of processing before withdrawal (Article 7(3))
- Right to lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office (uodo.gov.pl, ul. Stawki 2, 00-193 Warszawa)
To exercise any of these rights, email kontakt@balanceit.pl. We respond within 30 days (with a possible extension of a further 60 days for complex matters).
7. Voluntary provision of data
Providing data is voluntary, but necessary for:
- receiving a response to an enquiry (contact form)
- entering into and performing a service agreement
- issuing an invoice (to the extent required by tax law)
Failure to provide the necessary data will prevent us from carrying out the activities above.
8. Automated decision-making
We do not make decisions about you based solely on automated processing (including profiling) that produce legal or similarly significant effects. Website analytics are used only to measure content performance in aggregate.
9. Cookies and tracking
We use cookies and similar technologies (local storage) on our website. For details, see our Cookie Policy.
10. Data security
We use technical and organisational measures to protect data in accordance with Article 32 GDPR, including:
- Connection encryption (HTTPS/TLS 1.3)
- Password encryption (bcrypt, argon2)
- Role-based access control (RBAC) and Row-Level Security in the database
- Regular backups and recovery tests
- Team training in security and the GDPR
- Data processing agreements with processors
11. Changes to the Privacy Policy
We may update this Policy. We will inform you of significant changes through the website and (if you are our client) by email, with appropriate notice. The current version is always available at balanceit.pl/polityka-prywatnosci.
12. Contact
Any questions about the processing of your personal data can be sent to:
Email: kontakt@balanceit.pl
Address: Mateusz Konieczny — BALANCE IT, ul. Święty Marcin 29 lok. 8, 61-806 Poznań
Website: balanceit.pl
Noticed a problem or have concerns? Email us at kontakt@balanceit.pl. We take every matter seriously and respond within 48 hours.