Controller and contact
This document has been prepared in Polish and English. In the event of any discrepancy between the language versions, the Polish version shall prevail, unless mandatory law provides otherwise.
The controller of data relating to accounts, billing, security, the website and ContentDeliver’s own marketing is Adam Płotkowski, a sole trader, VAT/tax identification number PL9691618924, ul. Domeyki 19, 44-105 Gliwice, Poland. Contact: [email protected].
For data submitted by a Client about staff, Partners, invitees and persons appearing in Materials, the Client is generally the controller and ContentDeliver acts as processor under the DPA.
Data categories
We may process: name, business email, password hash, roles, language, time zone, company name, tax and EU VAT number, address, country, billing data, Stripe identifiers, payment and document history, IP address and User-Agent for selected operations, legal acceptances, marketing and cookie consents, communications, invitations, logs, settings and account-deletion data.
For Meta integrations we process Facebook Page or Instagram Business account names and identifiers, the Meta user identifier of the connecting person, encrypted token, granted permissions, connection status, publication identifiers and URLs, and diagnostic information. Statistics are retrieved to the extent available through the API and may not be stored permanently.
Materials may contain texts, images, recordings, documents and other data selected by the Client. We do not request special-category data; it should not be submitted unless lawful and necessary.
For analytics and advertising, after obtaining appropriate consent, we may process cookie identifiers, IP address, device and browser data, visited pages, registration, trial, checkout and subscription events, and transaction value and currency without transmitting Material content.
Purposes and legal bases
Account, company, Materials, integrations and subscription data are processed to enter into and perform the Agreement and take pre-contractual steps.
Tax, accounting and payment data are processed to comply with legal obligations and settle the Agreement.
Security logs, acceptance evidence, abuse handling, diagnostics, establishment and defence of claims, service integrity and service communications rely on the legitimate interests of the controller or Client.
Marketing email and analytics/marketing cookie technologies are used on the basis of voluntary consent. Consent may be withdrawn without affecting prior lawful processing.
Where data are processed as processor, the Client as controller determines the legal basis and purpose.
Data sources
We receive data directly from the User, Client, inviting person, Stripe, Meta, the browser and device, system logs and actions performed in the Service.
Where a Manufacturer provides a Partner’s or employee’s email, the data come from the Manufacturer. The Manufacturer is responsible for having a legal basis and providing required information.
Recipients
Data may be disclosed to providers of hosting, storage, email, security, CDN/WAF, payments, accounting, analytics and advertising, to Meta for publication, and to authorities where required by law.
Key recipients include home.pl S.A. or the Homecloud service in two data centres in Poland, nazwa.pl for email, Cloudflare for DNS/CDN/WAF, Stripe for payments, an external accounting office, Meta for integrations and advertising, Google for GA4 and Google Ads, and LinkedIn for the Insight Tag.
The current list of sub-processors and recipients is published with the legal documents or in a dedicated section of the Service.
Transfers outside the EEA
Hosting and primary storage are located in Poland. Stripe, Meta, Google, LinkedIn and Cloudflare may also process data outside the EEA, particularly in the United States.
Transfers are made under the legal mechanisms used by the relevant provider, such as an adequacy decision, the EU–US Data Privacy Framework or standard contractual clauses. Information and copies of applicable safeguards may be obtained from us or directly from the provider.
Analytics and advertising tools are activated only after appropriate consent, except technically necessary external checkout or OAuth login processes initiated by the User.
Retention
Active-account data are retained for the Agreement term. After effective account or company deletion, operational data are deleted or anonymised generally within 30 days, taking account of the seven-day grace period and backups retained for up to 30 days.
Email and communication log content is retained for up to 12 months; application and infrastructure logs for up to 90 days; failed queue messages for up to 30 days; technical marketing-event records for up to 90 days.
Cookie-consent evidence is retained for up to 24 months after withdrawal, change or replacement; deletion-request records for up to 3 years after completion; legal-document acceptance evidence for up to 6 years after termination.
Accounting documents, transactions and data required for tax obligations are retained for the period required by law. Data needed for claims may be retained until the limitation period expires.
An active Meta integration token and data are retained until disconnection, expiry or integration deletion. “Disconnect and delete data” deletes the integration record and related external publication identifiers.
Data subject rights
A person has the rights of access, rectification, erasure, restriction, portability, objection to legitimate-interest processing and withdrawal of consent.
A request may be sent to [email protected]. We may request information necessary to verify identity. Where we act as processor, the request may be forwarded to the relevant Client as controller.
A User may request account deletion in settings and an owner may request company deletion. A Meta integration may be disconnected or disconnected together with deletion of integration data.
A person may lodge a complaint with the President of the Polish Personal Data Protection Office or another competent EU supervisory authority.
Automated decisions
ContentDeliver does not make decisions producing legal effects for Users solely by automated means and does not conduct profiling in that sense. Advertising providers may create audiences under their own rules after marketing consent.
Security
We apply measures including password hashing, encryption of Meta tokens, HTTPS, access control and organisation isolation, CSRF protection, rate limiting, signature verification, secret redaction in logs, retries, idempotency and multi-stage data deletion.
No system provides absolute security. Users should use strong passwords, protect devices and not share login credentials.
Marketing and cookies
Marketing email is sent only with voluntary consent. Consent may currently be recorded even where a dedicated marketing channel is not active. Consent may be withdrawn by contact or available settings.
GA4 operates after analytics consent. Google Ads, Meta Pixel and the LinkedIn Insight Tag operate after marketing consent and only after activation by the system administrator. Details are in the Cookie Policy.
Meta Conversions API, LinkedIn Conversions API, Google Tag Manager and TikTok are not currently active ContentDeliver tools and are not represented as operating. This Policy will be updated before activation.
Policy changes
This Policy may be updated due to changes in law, functionality, providers or processing. Material changes will be communicated with appropriate notice, generally at least 14 days, unless earlier effect is required by law or security.