1. Data controller

The controller of your personal data is Canpol Bis Spółka z ograniczoną odpowiedzialnością (a Polish limited liability company), with its registered office at ul. Gimnazjalna 2/M501, 85-007 Bydgoszcz, Poland, entered in the register of entrepreneurs of the National Court Register (Krajowy Rejestr Sądowy) under number KRS 0000424054, NIP (tax ID) 5542918412, REGON 341289717 (hereinafter: the “Controller”, “we”). We run the kreatywnaagencja.com.pl website under the “Kreatywna Agencja” brand.

Contact on personal data matters: e-mail biuro@kreatywnaagencja.com.pl, telephone +48 502 811 949, postal address as above. We have not appointed a data protection officer — we handle all matters using the contact details above.

2. What data we process and why

We process data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR, known in Poland as RODO). Below we set out the purposes, legal bases and retention periods.

Contact form, price calculator, correspondence — name, e-mail, telephone, subject and content of your message. Purpose: replying to your enquiry and preparing a quote. Legal basis: Art. 6(1)(b) GDPR (steps prior to entering into a contract) or point (f) (legitimate interest — handling correspondence). Retention: up to 3 years from the last contact or until the limitation period for claims expires.
Entering into and performing a contract, shop orders — identification and address data, invoicing data, order history. Legal basis: Art. 6(1)(b) GDPR. When you conclude a contract through the order form (e.g. for the Chatbot AI and Social Media AI services), we also keep a consent log (date, version of the Terms, type of buyer, declarations made, IP address) as proof that they were given — legal basis: Art. 6(1)(f) GDPR. Retention: for the duration of the contract and then until the limitation period for claims expires; the consent log until the limitation period for claims expires.
Accounting and tax obligations — data contained in invoices and accounting documents. Legal basis: Art. 6(1)(c) GDPR. Retention: 5 years from the end of the tax year in which the tax obligation arose.
User account — e-mail address, username, password (stored in encrypted form). Legal basis: Art. 6(1)(b) GDPR. Retention: until the account is deleted.
Free tools (SEO, GDPR, WCAG, security, AI readiness) — the address of the analysed website and your IP address (to prevent abuse). The address of the analysed website may be passed to external analysis services, including AI model providers (see section 4). Legal basis: Art. 6(1)(f) GDPR. Retention: rate-limit counters for up to 24 hours; the analysis result until it is deleted at your request.
Paid website audit — name, e-mail address, address of the analysed website, brand, industry, city, competitors (if you provide them), IP address and browser data, payment data (processed by Stripe), the generated report. Legal basis: Art. 6(1)(b) GDPR (performance of a contract) and point (c) (tax obligations). Retention: until the limitation period for contractual claims expires (3 years), and for accounting documents 5 years from the end of the tax year.
Newsletter and commercial information — e-mail address. Legal basis: Art. 6(1)(a) GDPR (consent) and the Polish Act on the Provision of Electronic Services (ustawa o świadczeniu usług drogą elektroniczną). Retention: until consent is withdrawn.
Statistics and marketing (cookies and similar technologies) — online identifiers, data on how you use the website. Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 399 of the Prawo komunikacji elektronicznej, the Polish Electronic Communications Law). Details in the Cookie Policy.
Security and operation of the website — IP address, server log data, browser type. Legal basis: Art. 6(1)(f) GDPR (ensuring security and continuity of operation). Retention: up to 12 months.
AI assistant (chat) on the website — the content of the messages you type in the chat (please do not enter sensitive data), a technical conversation identifier kept in the browser tab (sessionStorage, deleted when the tab is closed) and a request-limit counter based on a hash of your IP address (kept for up to 1 minute). Purpose: answering questions about our offer and preventing abuse. Basis: Art. 6(1)(f) GDPR (legitimate interest — handling visitors’ enquiries), and where the question concerns concluding a contract — point (b). The message content is passed to an AI model provider (OpenAI, see sections 3 and 4). Replies are generated by artificial intelligence, not by a person; we make no decisions with legal effect solely on the basis of its answers. Period: 90 days, after which conversations are deleted automatically.
Establishing, pursuing or defending claims — data necessary to establish, pursue or defend claims. Legal basis: Art. 6(1)(f) GDPR. Retention: until the limitation period for claims expires.

Providing your data is voluntary, but necessary for the purposes indicated (e.g. without an e-mail address we cannot reply to your enquiry). We obtain data directly from you. As a rule, we do not take decisions about you based solely on automated processing, including profiling, that produce legal effects; in the AI services ordering process we apply abuse-prevention mechanisms, and if an order is automatically refused you can contact us to have the matter reviewed by a person.

3. Recipients of data

We may entrust or disclose data only to entities necessary to carry out the purposes above:

hosting and IT infrastructure, e-mail and backup providers,
payment operators (Przelewy24, Stripe) — only to the extent necessary to process a transaction,
the provider of the system for issuing invoices and receipts (Fakturownia.pl) — to the extent necessary to issue and send the document,
the accounting firm and legal or tax advisers,
providers of e-mail and newsletter tools,
providers of analytics and advertising tools (Google, Meta) — only after you consent to the relevant cookies,
an AI model provider (OpenAI) — as regards the content of messages typed in the chat assistant,
public authorities, where required by law.

We do not sell your data.

4. Transfers of data outside the EEA

Some providers (including Google, Meta, Stripe and the AI model providers used in our analytical tools) are based in, or process data in, the USA. Transfers take place on the basis of a European Commission adequacy decision (EU–US Data Privacy Framework) or standard contractual clauses. You can request a copy of the relevant safeguards by writing to the address in section 1. This also applies to OpenAI (the model that answers in the chat assistant on this website).

The website’s fonts are hosted on our own server, so loading them does not transfer the visitor’s IP address to third parties.

5. Your rights

You have the right to:

access your data and obtain a copy of it (Art. 15 GDPR),
rectify your data (Art. 16),
erase your data (Art. 17),
restrict processing (Art. 18),
data portability (Art. 20),
object to processing based on legitimate interest (Art. 21) — including for direct marketing purposes,
withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal,
lodge a complaint with the Prezes Urzędu Ochrony Danych Osobowych (the President of the Personal Data Protection Office, the Polish data protection authority; ul. Stawki 2, 00-193 Warsaw).

To exercise your rights, write to biuro@kreatywnaagencja.com.pl. You can change your cookie consent at any time using the “Cookie settings” link in the page footer.

6. Cookies

The website uses cookies and similar technologies. You will find the full list, purposes, expiry periods and how to manage your consent in the Cookie Policy.

7. Data security

We apply technical and organisational measures appropriate to the risk: transmission encryption (HTTPS), access control, regular backups and software updates.

8. Changes to this policy

This policy may be updated, for example due to changes in the law or in the website’s functionality. The current version is always available on this page, together with the date of the last update.

9. Chatbot AI and Social Media AI services

If you buy or use our Chatbot AI and Social Media AI services (terms of the services: Terms of Service), we distinguish between two roles:

We are the controller of the Customer’s (the buyer’s) data: first and last name or company name, e-mail address, address, NIP (tax ID), invoicing data, payment and licence history, order data and consent log data. Purposes and legal bases: entering into and performing the contract (Art. 6(1)(b) GDPR), accounting and tax obligations (point (c)), security, prevention of abuse and establishing or defending claims (point (f)). We keep a minimal consent log from the order form (date and time, version of the Terms, type of buyer, declarations, transaction identifier and, for 12 months, also the IP address and browser data) as proof that they were given. If a consumer withdraws from the contract, we record the data needed for settlement and proof of the refund: the date and manner of the statement, the e-mail address, the payment and refund amounts and the payment identifiers (points (c) and (f)). Payments are handled by Stripe, and we issue invoices and sales documents in the Fakturownia.pl system; each of these providers processes data in accordance with its own rules and its agreement with us. Retention periods are set out in the table below.
We are a processor (under the data processing agreement contained in the Terms) of the data of people who use the chatbot on our Customer’s website or whose data is contained in materials supplied by the Customer. The controller of this data is our Customer (the website owner) — it is the Customer who informs its visitors about the processing, and requests concerning this data should be addressed to the Customer. The content of messages typed into the chat is stored for 90 days and then deleted automatically.
Social Media AI: to publish content, we connect the Customer’s Facebook/Instagram account through the official Meta login. We do not learn the account password; access tokens are stored in encrypted form, and access can be revoked at any time in your Meta account settings or in the Panel. Meta is a separate controller of the data published on the accounts. Deleting data originating from Meta: disconnect the account in the Panel (Accounts tab) or revoke the app’s permissions in your Facebook/Instagram account settings — we will delete the stored tokens and related data; you can also send a deletion request to biuro@kreatywnaagencja.com.pl.
AI providers: to operate the services, we pass content (queries, knowledge fragments, content-generation instructions) to providers of artificial intelligence models — OpenAI (chat replies and search) and fal.ai (images and video). These providers are based in the USA; transfers take place on the basis of a European Commission adequacy decision (EU–US Data Privacy Framework) or standard contractual clauses. The chatbot’s knowledge base (vectors and text fragments) is stored on a search server operated by us, and each Customer’s data is kept separate from the others.
Files and product catalogues supplied to the chatbot are not made available to other customers; product images are not copied — they are displayed from the address specified by the Customer.

Data retention periods — AI services

Data	Purpose and basis	Period
Invoices and accounting documents	tax and accounting obligations (Art. 6(1)(c))	5 years from the end of the tax year
Licence record, payments and usage counters	settlements, defence of claims (points (b) and (f))	the duration of the contract and, after it ends, until the limitation period for claims expires — no longer than 6 years; a review of the need for further retention after one year
Consent log: date and time, version of the Terms, type of buyer, declarations, transaction identifier	proof of the conclusion of the contract and of the declarations (point (f))	until the limitation period for claims expires — no longer than 6 years after the end of the contract
IP address and browser data in the consent log	security and proof that the declaration was given (point (f))	12 months, then deleted automatically
Withdrawal entry: date, amounts, payment and refund identifiers, e-mail address	proof of settlement and refund (points (c) and (f))	until the limitation period for claims expires — no longer than 6 years; auxiliary technical data (normalised e-mail key, domains) deleted after 12 months
Customer content: knowledge base, chatbots, connected accounts, keys of the Customer’s own AI providers	provision of the service (entrustment)	deleted automatically within 30 days of the end of access to the service
Chatbot conversations	provision of the service (entrustment)	90 days, then deleted automatically
Usage and cost log	settlements and limit control (points (b) and (f))	400 days
Backups of the chatbot knowledge base (all Customers combined)	continuity of the service and restoring it after a failure (entrustment)	up to 14 days from the creation of the backup, then deleted automatically

Backups. To be able to restore the service after a failure, we make a daily backup of the chatbot knowledge base (it covers the content of all Customers combined; it does not include chatbot conversations). We keep backups on two servers — the knowledge-base server and the server of this website — for no longer than 14 days from creation, after which they are deleted automatically. Customer content deleted after access to the service ends (see the table) may therefore remain in backups for up to a further 14 days. If the database is restored from a backup, we delete again, immediately after the restore, the data of Customers who have stopped using the service and for whom the deletion period has elapsed.

We determine roles for individual operations, not for the service as a whole: we are the controller of the data needed for sales, settlements, documentation and security (account, payments, consent log, withdrawals), and the processor of the data contained in the Customer’s content and in the conversations of visitors to its website.

We handle data subjects’ rights in accordance with section 5; for entrusted data, we assist the Customer as the controller.

10. Controller details

Canpol Bis Sp. z o.o.
ul. Gimnazjalna 2/M501, 85-007 Bydgoszcz
KRS 0000424054 · NIP 5542918412 · REGON 341289717
E-mail: biuro@kreatywnaagencja.com.pl · Tel.: +48 502 811 949

Privacy policy.