Privacy Policy

1. Data Controller

The controller of personal data collected through the website visuality.pl is:

Visuality sp. z o.o.
ul. Gwiaździsta 7C/37, 01-651 Warsaw, Poland
NIP: PL 525 240 75 31 | KRS: 0001154778

Contact for data protection matters: contact@visuality.pl

2. What We Do

Visuality is a software development agency. We design and build web and mobile applications for clients worldwide. Our website serves as an informational and contact point for potential and existing clients.

3. What Data We Process and Legal Basis

3.1. Contact Forms and Email

• Data scope: contact form: name, email address and message. Consultation request form: name, email address, company, topic and description. "Call me" field: the phone number or other contact detail you enter and the page you sent it from. Emails you send to us.
• Processing purpose: responding to inquiries about our software development services. Form submissions are stored on our server and forwarded to our internal Slack workspace so the right person can reply.
• Legal basis: Art. 6(1)(b) GDPR — taking steps at the request of the data subject prior to entering into a contract; Art. 6(1)(f) GDPR — legitimate interest of the controller (handling correspondence).
• Retention period: for the time necessary to handle the inquiry, then for the limitation period of potential claims (3 years).
• Data provision: voluntary, but necessary to handle your inquiry.

3.2. Web Analytics

• Data scope: anonymized IP address, device and browser information, pages visited, time spent on pages, interaction data, including how the AI assistant is used.
• Processing purpose: website traffic analysis and improvement of our website (Google Analytics).
• Legal basis: Art. 6(1)(a) GDPR — user consent.
• Retention period: Google Analytics keeps detailed event data for 2 months and user-level data for 14 months from your last visit.
• Data provision: voluntary — data collected only after consent to analytics cookies.

3.3. AI Assistant

• Data scope: the questions you type or speak to the assistant, whether they were typed or spoken, your browser's language setting, a random identifier that changes daily and, only if you allowed analytics cookies, the page you came from. When you speak, your voice recording is sent for transcription and is not stored by us. We do not link this data to your name, email or IP address, and we do not store the assistant's answers.
• Processing purpose: answering your questions, measuring how the assistant is used, and finding topics it cannot answer well. To answer, your question and the current conversation are sent to our AI service providers (see section 4). Spoken questions are transcribed by a speech-to-text provider or, if your browser's built-in speech recognition is used, by your browser's vendor. Answers read aloud are generated by a text-to-speech provider from the answer text.
• Legal basis: Art. 6(1)(f) GDPR — legitimate interest of the controller (operating and improving the assistant).
• Retention period: 90 days, after which questions are deleted automatically.
• Data provision: voluntary — please do not include personal data in your questions.

3.4. Error Monitoring

• Data scope: when the website hits an error: your IP address, device and browser information, the address and contents of the request that failed, and technical details of the error.
• Processing purpose: detecting and fixing errors and keeping the website secure (Sentry).
• Legal basis: Art. 6(1)(f) GDPR — legitimate interest of the controller (a working and secure website).
• Retention period: 30 days, after which Sentry deletes error reports automatically.
• Data provision: collected automatically when an error occurs.

3.5. Embedded YouTube Videos

• Data scope: your IP address, device and browser information, and your activity in the video player.
• Processing purpose: playing videos hosted on YouTube. Videos load from youtube-nocookie.com only after you click "Load video" or allow marketing cookies. Once loaded, Google may set its own cookies.
• Legal basis: Art. 6(1)(a) GDPR — user consent.
• Retention period: according to Google's policies.
• Data provision: voluntary — the rest of the page works without loading the video.

4. Data Recipients and Processors

Personal data may be shared with the following categories of recipients:

Personal data is not sold to third parties.

5. Data Subject Rights

Under the GDPR, you have the following rights:

• Right of access (Art. 15) — you can obtain information about whether we process your data and receive a copy.
• Right to rectification (Art. 16) — you can request correction of inaccurate data.
• Right to erasure (Art. 17) — you can request deletion of your data.
• Right to restriction of processing (Art. 18) — you can request restriction of processing in certain cases.
• Right to data portability (Art. 20) — you can request your data in a structured format.
• Right to object (Art. 21) — you can object to processing based on legitimate interest.
• Right to withdraw consent (Art. 7(3)) — for processing based on consent (e.g., analytics cookies), you can withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, contact us: contact@visuality.pl

You also have the right to lodge a complaint with a supervisory authority:

President of the Personal Data Protection Office (PUODO)
ul. Stawki 2, 00-193 Warsaw
https://uodo.gov.pl

6. Data Transfers Outside the EEA

Some processors handling data on our behalf are based outside the European Economic Area, mainly in the United States (DigitalOcean, Cloudflare, Google, Sentry, Slack, OpenAI, Anthropic, Voyage AI and ElevenLabs). Data transfers to them are based on:

• European Commission adequacy decision under the EU-US Data Privacy Framework (DPF) — for entities certified under the DPF program.
• Standard Contractual Clauses (SCCs) approved by the European Commission — for other entities and as an additional safeguard.

7. Data Security

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, destruction, or modification, including:

• Data transmission encryption (HTTPS/TLS)
• DDoS and bot protection (Cloudflare)
• Restricted access to databases and personal data, limited to relevant personnel
• Error monitoring to detect and fix problems quickly
• Regular backups

8. Automated Decision-Making

We do not make automated decisions, including profiling, within the meaning of Art. 22 GDPR, that would produce legal effects concerning you or similarly significantly affect you.

9. Cookies

What are cookies?

Cookies are small text files stored on your device when you use our website. We also use your browser's local storage to remember your cookie choice. We use both to keep the website working and, with your consent, to analyze traffic and load embedded videos.

Types of cookies

Managing cookies

You can change your choice at any time using "Cookie Settings" in the website footer. Withdrawing analytics consent also deletes the Google Analytics cookies already set. You can also manage or block cookies in your browser settings. Blocking necessary cookies may affect website functionality. Refusing analytics and marketing cookies does not affect your ability to use the website.

10. Changes to the Privacy Policy

This privacy policy may be updated to reflect changes in our data processing practices or changes in applicable law. The date of the last update is provided at the beginning of this document.

11. Contact

If you have questions about this privacy policy or the processing of your personal data, contact us:

Visuality sp. z o.o.
ul. Gwiaździsta 7C/37, 01-651 Warsaw
Email: contact@visuality.pl