PL EN
Book a call

Legal document

floomi Privacy Policy

Information about the data controller, the purposes and legal bases for processing personal data, and the rights of the people whose data we process.

1. Who is the controller of your data?

The controller of your personal data is FUNDACJA ROZWOJU PRZEDSIĘBIORCZOŚCI „TWÓJ STARTUP” (Foundation for the Development of Entrepreneurship “Twój StartUp”), with its registered office in Warsaw (registered address: ul. Żurawia 6/12 lok. 766, 00-503 Warsaw, Poland).

This privacy policy concerns the services of the Foundation provided through its organised part of the enterprise DatCode, delivered by Andrzej Datta. For matters relating to the floomi service, please contact: hello@usefloomi.com.

2. Why do we process your data?

  1. In connection with the services provided via floomi — i.e. auditing the cost and efficiency of artificial intelligence (AI) usage, advising on the optimisation of AI architecture and costs, implementing AI cost-monitoring tooling, and ongoing oversight (retainer) — that is, in order to enter into or perform a contract (Article 6(1)(b) of the Regulation), your data will be stored until the contract has been performed.
  2. For marketing purposes and the promotion of the floomi services offered by Fundacja Rozwoju Przedsiębiorczości „Twój StartUp”, which constitutes our legitimate interest (Article 6(1)(f) GDPR). Your data will be processed until you object. As part of B2B marketing we also carry out prospecting, i.e. reaching out to people in decision-making roles (e.g. CTO, CFO, Head of Engineering, AI Lead) at companies matching our client profile. We obtain contact data (first and last name, business e-mail address, job title, employer name, professional profile) from publicly available professional sources (including LinkedIn, company websites, business registers) on the basis of our legitimate interest (Article 6(1)(f) GDPR). Your data will be processed until you object, or for a maximum of 24 months from the date it was obtained.
  3. To fulfil any legal obligations incumbent on us in connection with our cooperation (Article 6(1)(c) of the Regulation); this purpose relates to the legal obligations to retain certain documents for the period indicated in applicable law, e.g.:
    • the Accounting Act of 29 September 1994 (Journal of Laws of 2017, item 1858);
    • the Tax Ordinance Act of 29 August 1997 (Journal of Laws of 1997, No. 137, item 926);
    • the Act of 1 March 2018 on counteracting money laundering and the financing of terrorism (Journal of Laws of 2018, item 723).
  4. For the purpose of potentially establishing, pursuing or defending against claims, which is our legitimate interest (Article 6(1)(f) of the Regulation). Data will be processed until claims become time-barred.
  5. Where you have given consent, your data will be processed within the scope and for the purpose stated in that consent (Article 6(1)(a)). Data will be processed until consent is withdrawn.

3. What data do we process?

The scope of data processed depends on the form of contact and the purpose of processing:

  • E-mail contact / audit enquiry: first and last name (or first name only), e-mail address, company name, job title, message content, and any other information you provide voluntarily in correspondence.
  • B2B prospecting (from public professional sources): first and last name, business e-mail address, job title, employer name, professional profile.
  • E-mail correspondence and entering into a contract: all data you decide to provide, as well as data necessary to issue an invoice and deliver the service.
  • Technical and analytics data collected automatically while you use the service: the page visited, entry source (referrer, UTM parameters), device and browser type, operating system, and country-level location. Your IP address is processed by Plausible Analytics only temporarily, as described in section 7.

Providing data in correspondence is voluntary but necessary in order to handle your enquiry or begin cooperation. During the term of an audit or advisory services contract we may come into possession of additional data within the scope arising from the nature and purpose of the cooperation.

4. Who will the data be shared with?

  1. Public authorities, to the extent that they do not receive data as part of specific proceedings under the law, e.g. in connection with counteracting money laundering.
  2. Entities that process your personal data on behalf of the Foundation under a data-processing agreement concluded with the Foundation (so-called processors). These will in particular be: the Foundation’s beneficiary conducting the floomi activity (Andrzej Datta), who actually provides the services and processes data on behalf of the Foundation; the website hosting provider; the e-mail provider used to handle correspondence; the analytics provider (Plausible Analytics — details in section 7); archiving companies and IT specialists providing technical support.
  3. External data controllers (so-called Parallel Controllers to whom data is disclosed, e.g. legal counsel and attorneys, entities providing courier or postal services, entities acquiring receivables — in the event that you fail to pay our invoices on time).
  4. Entities located outside the EEA, but only where this is necessary and with an adequate level of protection ensured, primarily through:
    1. cooperation with entities in countries covered by a relevant adequacy decision of the European Commission;
    2. the use of standard contractual clauses issued by the European Commission.

The controller always informs you of any intention to transfer personal data outside the EEA at the stage of collecting it.

5. Is your data profiled?

Your data is not subject to automated decision-making producing legal effects, nor to profiling within the meaning of Article 22 GDPR. As part of the service’s analytics we analyse aggregated entry sources and the popularity of subpages; however, this does not constitute automated profiling affecting a person’s legal situation, nor does it serve to make decisions producing legal effects.

6. What rights do you have?

  1. The right to access the personal data we process (Article 15 of the Regulation).
  2. The right to rectify the personal data entrusted to us, including correcting it (Article 16 of the Regulation).
  3. The right to erasure of personal data from our systems, the so-called “right to be forgotten” — if in your view there is no basis for us to process your data, you may request that we delete it (Article 17 of the Regulation).
  4. The right to restrict the processing of personal data — you may request that we restrict processing solely to storage or to actions agreed with you, if we hold incorrect data about you or process it without basis; or you do not want us to delete it because you need it to establish, pursue or defend claims; or for the duration of an objection raised against processing (Article 18 of the Regulation).
  5. The right to data portability — you have the right to receive from us, in a structured, commonly used, machine-readable format (e.g. “.csv”), the personal data concerning you that we hold on the basis of a contract or consent. This right applies where we hold the data in electronic form — where we hold data only on paper you will not be able to exercise this right. You may instruct us to send this data directly to another entity (Article 20 of the Regulation).
  6. The right to withdraw consent to the processing of personal data — at any time you have the right to withdraw consent to the processing of personal data that we process on the basis of consent (Article 7(3) of the Regulation). Withdrawing consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal. Consent is withdrawn by sending an e-mail to: hello@usefloomi.com.
  7. The right to object (Article 21 GDPR) — you may object to the processing of data where the basis for using the data is our legitimate interest. In such a case, after considering the request, we will no longer be able to process the data covered by the objection on that basis, unless we demonstrate the existence of compelling legitimate grounds for processing that override your interests, rights and freedoms. Where processing is carried out for direct marketing purposes, the objection is unconditional — it is enough to raise it and we will immediately cease processing the data for that purpose.
  8. If, in your opinion, the processing of personal data infringes the provisions of the Regulation, you have the right to lodge a complaint with the supervisory authority, i.e. the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych).

7. Site analytics (Plausible Analytics)

On the floomi service we use the analytics tool Plausible Analytics (provider: Plausible Insights OÜ, Estonia — EU territory), which helps us understand how users interact with the site.

Plausible works without cookies and without identifiers that would allow a specific user to be recognised across visits. In particular:

  1. We do not collect personal data or data identifying the User. The IP address is processed solely in volatile memory in order to generate an anonymous daily hash and is not stored.
  2. We do not use cookies or other tracking technologies requiring consent under Article 173 of the Polish Telecommunications Law and Article 6(1)(a) GDPR — and therefore the service does not display an analytics-cookie consent banner.
  3. The scope of data collected is limited to: the page visited, entry source (referrer, UTM parameters), device and browser type, operating system, and country-level location.
  4. The purpose of collection is solely traffic statistics and the effectiveness of marketing channels — which constitutes our legitimate interest (Article 6(1)(f) GDPR).
  5. Server location: Plausible hosts data in the EU (Germany); no data transfer outside the EEA takes place.
  6. Custom events (Goals): we record anonymous interaction events (e.g. clicking a contact link, clicking a CTA button) that are not linked to a User’s identity.

Detailed information on how Plausible processes data can be found in the provider’s privacy policy: plausible.io/privacy and plausible.io/data-policy.

8. Contact

If you need additional information related to the protection of personal data, or wish to exercise your rights, please contact us by e-mail at: rodo@twojstartup.pl. For matters concerning the operation of the floomi service you can also write to: hello@usefloomi.com.