Privacy policy
1. Controller
The controller of your personal data is Headframe spółka z ograniczoną odpowiedzialnością, a limited liability company registered in the Polish National Court Register (KRS) under number KRS 0001227801, tax ID (NIP) 8971969073. Its registered address is public and shown in the KRS entry (wyszukiwarka-krs.ms.gov.pl).
For anything about personal data, write to kontakt@headframe.pl. We have not appointed a data protection officer.
Headframe's products (Compilore, tothecent.ai, GapRoll) and paygapnews.pl have their own websites and their own privacy policies. This document does not cover them.
2. What data we process, why, and for how long
a) Loading the website
When you open headframe.pl, your browser connects to our server. The server receives technical data: your IP address, the date and time, the page requested, the referring page, and information about your browser and operating system. Without this the page cannot be delivered to your browser.
- Purpose: serving the website, keeping it secure and diagnosing errors.
- Legal basis: Article 6(1)(f) GDPR, our legitimate interest in providing the website and protecting it from abuse.
- Retention: technical data may be written to server logs, which are deleted automatically after 30 days at the latest.
b) Visit statistics (Cloudflare Web Analytics)
The website runs the Cloudflare Web Analytics script, loaded from a Cloudflare server (static.cloudflareinsights.com). It sends Cloudflare the page you visit, the referring page, your browser, operating system and device type, and page load timings. Cloudflare also sees the IP address your browser connects from and derives your country from it.
According to Cloudflare, the service does not use cookies or browser storage for analytics and does not track users over time by IP address or browser characteristics. We only see aggregate numbers, such as how many people opened the page and from which countries. We do not combine them with other data and do not try to find out who you are.
- Purpose: knowing whether the website is read, which parts of it, and where visitors come from.
- Legal basis: Article 6(1)(f) GDPR, our legitimate interest in measuring the reach of our own website.
- Retention: Cloudflare gives us the statistics in aggregate form and keeps them under its own service terms.
- How to opt out: block the script in your browser settings or with a content blocker. The website works the same without it.
c) E-mail
If you write to kontakt@headframe.pl, we process your e-mail address, the content of your message and any data you include in it (for example your name, company, job title or phone number).
- Purpose: replying to your message and continuing the conversation, including about a pilot or an order.
- Legal basis: Article 6(1)(f) GDPR (our legitimate interest in answering correspondence and in contacts with people representing companies), and where you write on your own behalf about entering into a contract, Article 6(1)(b) GDPR (steps taken at your request before entering into a contract).
- Retention: up to 12 months after the last message on the matter. If we have concluded a contract, or the correspondence may be needed to establish, exercise or defend legal claims, we keep it until those claims become time-barred.
3. Cookies and information on your device
headframe.pl sets no cookies and stores nothing in browser storage (localStorage, sessionStorage). Fonts are served from our own server. The website loads no Google or advertising resources and has no social media plugins. The only external resource is the analytics script described in section 2b.
4. Who processes data on our behalf
We do not sell data or share it for marketing. We use providers who process data on our behalf under data processing agreements:
- Hetzner Online GmbH (Germany): the server that runs the website, in a data centre in Helsinki (Finland).
- Cloudflare, Inc. (USA): DNS, visit statistics (section 2b) and forwarding mail sent to kontakt@headframe.pl to our mailbox.
- Google (Google Ireland Limited, Ireland, and Google LLC, USA): the Google Workspace mailbox where we receive and keep correspondence.
We may also disclose data to public authorities where the law requires it.
5. Transfers outside the European Economic Area
Cloudflare, Inc. and Google LLC are based in the USA. Data is transferred to them under the European Commission's adequacy decision for the EU-U.S. Data Privacy Framework (Commission Implementing Decision (EU) 2023/1795 of 10 July 2023), in which both companies participate, and additionally under the standard contractual clauses approved by the Commission. The list of participants is at dataprivacyframework.gov. You can get a copy of the safeguards by writing to us.
6. Your rights
You have the right to:
- access your data and get a copy of it (Article 15 GDPR),
- have your data rectified (Article 16 GDPR),
- have your data erased (Article 17 GDPR),
- restrict processing (Article 18 GDPR),
- data portability for data we process in connection with a contract (Article 20 GDPR),
- object to processing based on our legitimate interest (Article 21 GDPR); after an objection we stop processing the data unless we demonstrate compelling legitimate grounds or the data is needed to establish, exercise or defend legal claims.
To use these rights, write to kontakt@headframe.pl. We reply without undue delay and within one month at the latest. The statistics in section 2b are aggregate, so we usually cannot single out one person's data in them; if so, we will tell you (Article 11 GDPR).
You also have the right to lodge a complaint with the supervisory authority: Prezes Urzędu Ochrony Danych Osobowych (President of the Personal Data Protection Office), ul. Stawki 2, 00-193 Warszawa, Poland, uodo.gov.pl, or with the authority in the EU country where you live or work.
7. Is providing data required
Providing data in an e-mail is voluntary, but without an e-mail address we cannot reply. The technical data in section 2a is necessary for the page to load.
8. Automated decisions
We do not make decisions about you based solely on automated processing, including profiling, within the meaning of Article 22 GDPR.
9. Changes
If we change how we process data, we will update this document and the date at its top.