Effective from 1 October 2026. Earlier versions are available in the version archive in the Service; matters started while an earlier version was in force are governed by that version.
Definitions
Capitalised terms not defined in this Policy have the meaning given in the Website Terms of Use.
Controller (also: Exerizon, we) – Exerizon P.S.A. (a simple joint-stock company under Polish law) with its registered office in Warsaw, ul. Grzybowska 5A, 00-132 Warszawa, Poland, tax ID (NIP): 5223288319, REGON: 527780576, e-mail for data protection matters: privacy@exerizon.com. The Controller decides why and how your data is processed.
Service – the Exerizon website available at exerizon.com, including its subpages and subdomains.
Client – a company or organisation that has concluded, is negotiating or has enquired about a services agreement with Exerizon. Where we say Client representative, we mean a natural person acting for a Client: an employee, board member, contractor or other contact person.
Engagement – a consulting, implementation, engineering or other project performed by Exerizon for a Client under a services agreement.
GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation).
Terms – the Website Terms of Use available in the Service.
§1 Who is responsible for your data and how to contact us
1. Controller. Exerizon is the controller of your personal data. We are an enterprise technology consultancy: we advise organisations on digital strategy, build and modernise their platforms and data architectures, implement low-code and cloud solutions and integrate AI into their delivery. This Policy covers everyone whose data we process in that business: visitors to the Service, people who contact us, Client representatives, business contacts, event participants, job applicants and suppliers. We process data in accordance with the GDPR and Polish data protection law, in particular the Act of 10 May 2018 on the Protection of Personal Data.
2. Two roles: controller and processor. In most situations described here we are the controller. There is one important exception: during an Engagement, Clients often give us access to their systems and data, which may contain personal data of their employees, customers or suppliers. In that case we process the data on the Client's documented instructions and under a data processing agreement; the Client is the controller and this Policy does not govern that processing (see §2, "When we receive data from a Client during an Engagement").
3. Contact. For all matters concerning personal data, write to privacy@exerizon.com or by post to the address given in the Definitions. This address works regardless of the language you write in. For business enquiries, use office@exerizon.com or the contact form in the Service. We respond no later than within the time limits described in §7(9).
4. How we protect your data. We match technical and organisational measures to the risk: we encrypt transmission (TLS), keep data in access-controlled cloud environments, grant access only to the people who need it for their work, bind our staff and subcontractors by confidentiality obligations, and minimise the scope of data passed to each recipient. In particular, we account for the risk of accidental destruction or loss of data, its unauthorised modification or disclosure, and unauthorised access. When we work on Client systems, we additionally follow the Client's security policies.
§2 What data we collect and when
What data we process depends on how you interact with us. Below are all the situations: from visiting the Service, through becoming a Client, to applying for a job with us.
When you browse the Service
We collect technical connection data: IP address, browser and device information, referring page, and event logs (date, time, requested pages). We use them to run and secure the Service. Visit statistics are collected by the platform hosting the Service in a cookieless, aggregated form that does not let us recognise you on subsequent days. Cookies and similar technologies are described separately in the Cookie Policy.
When you contact us through the form or by e-mail
When you use the contact form in the Service, we process the data you enter: name, e-mail address and the content of your message. When you write to office@exerizon.com or to any of our people directly, we process your e-mail address, the content of the correspondence and any data you include in it. We use this data to answer you, to prepare a proposal if you ask for one, and to keep a record of the correspondence. Incoming e-mail is scanned automatically for malware and phishing by our e-mail security tools.
When you request a proposal or become a Client
We process the data needed to prepare, negotiate, conclude and perform a services agreement: the name of your organisation, the names, roles and business contact details of the people involved, the scope of the enquiry, offers and their acceptance, agreements, invoices and payment status. If you are a sole trader contracting with us personally, the contract is with you and we process your data on that basis; if you act for a company, we process your data as a Client representative on the basis of our legitimate interest in performing the contract with your organisation.
When you are a Client representative or a business contact
We keep a record of the people we work with or may work with: name, employer, job title, business e-mail address and phone number, the history of our meetings and correspondence, and notes relevant to the business relationship. This record lets us deliver Engagements, stay in touch and develop our business. Data may come directly from you, from your organisation, from public professional sources (e.g. your organisation's website or LinkedIn profile) or from events we both attend.
When we receive data from a Client during an Engagement
Engagements frequently require access to a Client's systems: CRM, data platforms, code repositories, documents, logs. These may contain personal data of the Client's employees, customers or suppliers. We process such data solely as a processor, on the Client's instructions and under a data processing agreement concluded with the Client, for as long as the Engagement requires. The Client remains the controller; if you are a person whose data we process in this way and you want to exercise your rights, contact the Client. Where we process such data ourselves as a controller (e.g. contact details of the Client's project team), the rules of this Policy apply.
When we send you marketing or a newsletter
If you are a Client representative or a business contact, we may send you information about our services, insights and events by e-mail on the basis of our legitimate interest in business development, within the limits of the Polish Electronic Communications Law; where the law requires it, we ask for your consent first. If you subscribe to our newsletter in the Service, we process your e-mail address and name only with your consent. You can object or withdraw consent at any time via the link in every message or by writing to us. Doing so does not affect the handling of any Engagement.
When you take part in our events or webinars
When you register for an event, webinar or workshop, we process your name, e-mail address, employer and job title, your registration status and, for on-site events, the information needed to organise your participation. Events may be recorded and photographed; we tell you before the event if this is the case, and we use the recordings to make the event available afterwards and to promote our work.
When we meet online
We hold meetings on video-conferencing platforms. The platform processes your name, e-mail address, connection data and what you share during the meeting. If we intend to record or transcribe a meeting, including with AI assistants that generate notes or summaries, we tell you before recording starts and you can decline to participate. Recordings and transcripts are used to document the meeting and to prepare deliverables.
When you visit our social media pages
We run pages on LinkedIn and YouTube. When you visit or interact with them, the platform operator processes your data under its own privacy policy, and we see your public profile data and your interactions with our content. For statistics about our LinkedIn page, LinkedIn and Exerizon are joint controllers under the arrangement LinkedIn publishes; the platform is your first point of contact for rights relating to its processing. The Service contains only links to these pages, not embedded social plugins.
When you apply for a job with us
Our job openings are published on an external recruitment platform (Workable) linked from the Service. When you apply, we process the data you provide in your application: name, contact details, CV, work history, education, skills, and the information collected during interviews and any assessments. Employment law limits which data we may ask an employee candidate for; anything beyond that scope (e.g. a photo or hobbies in your CV) is processed on the basis of your consent, which you express by sending it. We keep applications for future recruitment only if you agree to it. The recruitment platform processes your data on our behalf under its own terms, which you see when applying.
When you are a supplier or subcontractor
We process the data of our suppliers, subcontractors and associate consultants (and the people acting for them): name, business contact details, contract and invoicing data, and the data needed to grant you access to our or a Client's systems. Subcontractors working on Engagements are bound by confidentiality and data protection obligations equivalent to ours.
When we issue accounting documents
Data from concluded contracts and from invoices goes into our tax and accounting records. The law requires us to keep them for 5 years from the end of the tax year.
When we establish or defend claims
Where a dispute arises or is likely, we process the correspondence, contract documents and other evidence needed to establish, pursue or defend claims, for as long as the claims may be pursued.
§3 Purposes, legal bases and retention periods
Overlapping periods rule. The same data may fall under several periods at once. We keep it until the longest one expires, then delete or anonymise it.
§4 Who we disclose your data to
1. Two groups of recipients. We distinguish entities that process data solely on our instructions (processors) from entities to which we disclose data and which are then independently responsible for it (separate controllers). For the former, we are responsible; for the latter, they are.
2. Processors acting on our instructions (data processing agreements, minimum data scope). These are entities that:
host the Service and handle the contact form (the website platform provider),
provide our e-mail, calendar, document storage and video-conferencing (productivity suite provider),
provide our CRM and marketing e-mail tools,
provide the recruitment platform,
provide accounting and invoicing software and services,
provide cloud infrastructure for our internal systems and development environments,
work as our subcontractors and associate consultants on Engagements, under confidentiality and data protection obligations.
If you ask, we will tell you who specifically receives your data.
3. Separate controllers to whom we disclose the data necessary for their role:
Clients, where we share the contact details of our project team and, within an Engagement, the data needed to perform it,
banks and payment institutions (invoice settlements),
professional advisors: lawyers, tax advisors, auditors, insurers,
operators of social media platforms on which we run pages, to the extent you interact with them,
public authorities (e.g. tax authorities, courts, law enforcement), only where the law requires it.
4. Business transfers. If Exerizon or its business is reorganised, merged or sold, the data needed for the transaction and its due diligence may be disclosed to the parties involved, under confidentiality, and transferred to the successor, who will be bound by this Policy.
§5 Transfers outside the EEA
1. Principle: data stays in Europe. We process data within the European Economic Area and choose providers with EEA data centres where possible.
2. Exceptions. Some of our providers, in particular the website platform, the recruitment platform and elements of our productivity and cloud tooling, are headquartered or run parts of their infrastructure (including support) in the United States. Transfers to them are based on the European Commission's adequacy decision on the EU-US Data Privacy Framework where the recipient is certified, and otherwise on Standard Contractual Clauses (SCC) with supplementary measures.
3. Engagements abroad. If a Client is based outside the EEA or asks us to work in systems located outside the EEA, the transfer is governed by the services agreement and data processing agreement with that Client.
4. Fallback plan. If a transfer basis ceases to apply, we will switch to another lawful mechanism (in particular SCC with supplementary measures) or end the transfer.
5. Details on request. Write to privacy@exerizon.com and we will name the specific recipient and send you a copy of the transfer safeguards applied.
§6 How long we keep your data
1. Retention rhythm. Contact and correspondence data live as long as the matter, then a short period afterwards. Relationship data lives as long as we work together, then until the last contact grows stale or you object. Contract and invoice data lives longer: tax law requires 5 years, and in case of a dispute we keep it until claim limitation periods expire. Auxiliary data (technical logs, unused recordings) is deleted soonest.
2. Limits of the right to erasure. If you ask us to delete your data, we will delete everything not covered by a retention obligation. Data of concluded contracts will, however, remain in our tax records until the required periods end. After that, we delete it without your request.
3. Data held for Clients. Personal data we process as a processor is deleted or returned at the end of the Engagement, as the Client instructs, unless the law requires us to keep it.
§7 Your rights: what they mean and how to use them
1. Access and copy (Art. 15 GDPR). You can ask whether and what data of yours we process, and receive a copy. The first copy is free of charge.
2. Rectification (Art. 16 GDPR). You can correct inaccurate data and complete incomplete data. Tell the person you usually deal with at Exerizon or write to privacy@exerizon.com.
3. Erasure (Art. 17 GDPR). You can request deletion of data that is no longer needed for the purposes we collected it for, or where you withdraw the consent that was its only basis. The limits are described in §6(2): we cannot delete concluded-contract data before the tax retention periods expire.
4. Restriction of processing (Art. 18 GDPR). You can request that we only store your data, e.g. while your objection is being considered or the accuracy of the data is being checked.
5. Portability (Art. 20 GDPR). Data you provided to us that we process on the basis of a contract or consent will be delivered in a structured, commonly used, machine-readable format (e.g. JSON or CSV): to you or to a controller you designate.
6. Objection (Art. 21 GDPR). Available against processing based on legitimate interest. The effect depends on the type of objection:
1. Withdrawal of consent (Art. 7(3) GDPR). You can withdraw any consent (newsletter, recordings, future recruitments, optional application data) at any time: via the link in a message or by writing to us. Withdrawal works for the future and is as easy as giving consent.
2. Complaint (Art. 77 GDPR). You can lodge a complaint with the President of the Polish Personal Data Protection Office (Prezes UODO, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl). If you live in another EU country, you can also complain to your local supervisory authority. We encourage you to write to us first; we resolve most matters directly.
3. How and when we respond. We accept requests at privacy@exerizon.com. We respond without undue delay, at the latest within one month. In particularly complex matters we may extend this by two further months; we will warn you of this within the first month, with reasons. If we are not sure of your identity, we may ask additional verification questions.
4. Data we hold for a Client. If your request concerns data we process as a processor for a Client, we will forward it to the Client and tell you we have done so, unless the Client has instructed us to handle such requests directly.
§8 Automated decisions and profiling
1. No automated decisions about you. We do not make decisions about you based solely on automated processing that would produce legal or similarly significant effects on you (Art. 22 GDPR). Recruitment decisions are taken by people.
2. AI in our work. We use AI tools, including our own products, to analyse systems, generate documentation and support delivery during Engagements. Where such tools process personal data, they do so within the Engagement, on the Client's instructions and under the applicable data processing agreement; we do not use personal data from Engagements to train models for other purposes.
3. No marketing profiling. We do not build behavioural profiles of visitors to the Service, and we do not use tracking to target advertising.
§9 Do you have to provide your data
1. Voluntary, but no data means no contact. Providing data is voluntary, but: without your contact details we cannot answer your enquiry or prepare a proposal, without the data of your organisation's representatives we cannot conclude or perform an agreement, and without an application we cannot consider you for a job. Consents (newsletter, recordings, future recruitments) are fully optional; not giving them takes nothing away from you.
2. Age. The Service is addressed to businesses and professionals. It is not directed at persons under 16 years of age and we do not knowingly collect their data. If you believe a person under 16 has provided us with data, write to privacy@exerizon.com and we will delete it.
§10 Cookies and similar technologies
Reference. The rules for cookies, browser memory and similar technologies, together with a full inventory and instructions for managing your choices, are described in the Cookie Policy available in the Service.
§11 Changes to this Policy and version history
1. When we change it. We update the Policy when the law, our providers or the features of the Service change. Each version has a number, an effective date and a short description of changes, and earlier versions are archived and available for download in the Service.
2. How we inform you. We will inform you of significant changes in the Service and, where we have your e-mail address in an ongoing relationship, by e-mail before they take effect.
3. Language. This document is drawn up in English, which is its sole binding version.