Privacy notice

Who is responsible

The controller of your personal data is:

Company

HOPIN.IT Sp. z o.o.

Registered office

ul. Marsz. Józefa Piłsudskiego 74/320, 50-529 Wrocław, Poland

KRS

0001117479

Registry court

District Court for Wrocław-Fabryczna in Wrocław, 6th Commercial Division of the National Court Register

NIP (tax ID)

8971940626

REGON

529197668

Email

[email protected]

For any question about your data or to exercise your rights, write to the e-mail address above.

Visiting the website

Our website is delivered through Cloudflare’s network and served from our own server. To deliver the pages and protect the site against attacks and abuse, these systems process technical data of each request: your IP address, the date and time, the page requested, the referring page, and your browser and operating system.

Legal basis: our legitimate interest in running a secure and working website (Art. 6(1)(f) GDPR).

Retention: server logs are deleted after 30 days.

Information stored on your device

The site stores a few settings in your browser’s local storage: your cookie choice, the industry you selected on the site and whether you switched off animations. These settings stay on your device, are not sent to us and serve only the functions you chose.

When we test two versions of the home page, a cookie named “hp_ab” records which version you were shown, so that you see the same one on your next visit. It contains only the version name and expires after 30 days.

Analytics (only with your consent)

If you click “Allow analytics” in the cookie banner, we use Google Analytics 4 to understand which pages and features help visitors. Without your consent the Google Analytics script is not loaded at all.

With your consent, Google Analytics sets cookies and records the pages you view and actions such as clicks on buttons, starting or sending a form, switching the language and how far you scroll, together with device, browser and approximate location data. We do not send the content of our forms to Google Analytics.

Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time with “Cookie settings” at the bottom of every page. Withdrawal does not affect processing carried out before it.

Retention: Google Analytics data is deleted after 2 months.

Recipient: Google, as our processor. Google may process the data in the United States (see “Transfers outside the EEA”).

Contact, blueprint and startup forms

When you send one of our forms, we process the data you enter. Depending on the form, this is your name, work e-mail address, company name, company website, the description of your process or project, the service you are interested in, budget and timeline ranges, startup name and stage, and a link to your deck.

With the form we also receive: the page you sent it from, the referring page, campaign parameters (UTM) in the link, the version of the page you saw, the language, and your choice in the optional marketing checkbox with its date. Our server uses your IP address and e-mail address to limit repeated submissions, and notes whether the address belongs to a free e-mail service.

To block automated spam, the forms use Cloudflare Turnstile. It checks signals from your browser to tell people from bots, and our server confirms the result with Cloudflare together with your IP address.

Purpose: to answer your enquiry, prepare the blueprint or proposal you asked for, and follow up with you about it.

• Legal basis for preparing a blueprint or proposal at your request: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR).
• Legal basis for answering business enquiries and corresponding with you as a representative of your company: our legitimate interest in responding to requests and developing our business (Art. 6(1)(f) GDPR).
• Legal basis for spam protection and submission limits: our legitimate interest in keeping our forms secure (Art. 6(1)(f) GDPR).

Retention: enquiries sent through our forms are deleted 12 months after our last contact with you. E-mails with people who do not become clients are deleted from our inbox after 24 months. If we enter into a contract, we keep the data for its duration and 3 years after it ends (the limitation period for business claims); invoices and accounting records are kept for 5 years from the end of the tax year, as tax law requires. You can ask us to delete your enquiry at any time.

Research and proposals

To prepare a useful answer, we research your company from public sources. An AI service (Anthropic) reads pages of the company website you gave us and may use web search for public information about your company. When our knowledge base does not yet cover your industry, the AI also researches public information about the industry in general; this research does not collect data about individuals.

Based on your request and this research, the AI drafts a proposal. A person on our team reviews every draft, corrects it where needed and decides whether it is sent. No decision that has legal or similarly significant effects on you is made solely by automated means.

Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR); for researching public information about your company, our legitimate interest in preparing a relevant answer (Art. 6(1)(f) GDPR).

Retention: in our proposal system, your name, e-mail address, request and the proposal file are deleted 90 days after the proposal was sent or declined, unless we start working together. After that we keep only the company name, for statistics.

E-mails we send you

We send the following e-mails about your request:

• a short confirmation that we received your request. We send it only when our research could identify your company;
• the proposal or blueprint you asked for, after a person on our team has approved it;
• our replies to your messages.

These e-mails are sent through Resend, an e-mail delivery service, from its EU region. Resend is a company based in the United States (see “Transfers outside the EEA”).

Legal basis: steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in replying to business enquiries (Art. 6(1)(f) GDPR).

Marketing e-mails

Our forms include a separate, unticked checkbox for news and updates. We send such e-mails only if you tick it. We store your choice together with its date and the version of the consent text.

Legal basis: your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time by writing to [email protected]; withdrawal does not affect e-mails sent before it. We keep your consent record until you withdraw it, and for 3 years afterwards, to show that we had it.

Who receives your data

We do not sell your data. We use the following service providers, who process data on our behalf and under our instructions:

• Cloudflare (content delivery network, security and the Turnstile spam check);
• DigitalOcean (hosting of our server in Frankfurt, Germany, including the form database and our proposal system);
• Anthropic (AI service used for research and for drafting proposals);
• Resend (delivery of our e-mails);
• Google (Google Analytics, only with your consent);
• Zoho (our e-mail inbox, for messages you send to us).

We disclose data to public authorities only where the law requires it.

Transfers outside the EEA

Some of these providers are located outside the European Economic Area, mainly in the United States, or may process data there. In such cases the transfer is based on an adequacy decision of the European Commission, including the EU–US Data Privacy Framework where the recipient is certified under it, or on the European Commission’s standard contractual clauses. You can ask us for a copy of the safeguards at [email protected].

Your rights

Under the GDPR you have the right to:

• access your data and receive a copy of it;
• have inaccurate data corrected;
• have your data erased;
• restrict the processing;
• receive the data you gave us in a portable format, where processing is based on consent or a contract;
• object at any time to processing based on our legitimate interest, for reasons relating to your particular situation, and to any processing for direct marketing;
• withdraw your consent at any time, without affecting processing before the withdrawal.

To use these rights, write to [email protected].

You also have the right to lodge a complaint with a supervisory authority. In Poland this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl). You can also complain to the authority in the EU country where you live or work.

Do you have to provide data?

No. Providing data is voluntary. Without your name and e-mail address, however, we cannot reply to your enquiry or send you a blueprint or proposal.

Changes to this notice

We update this notice when our processing changes. The date at the top shows the current version.