Data controller
The controller of your personal data is AIBC sp. z o.o., with its registered office in Warsaw (00-867), al. Jana Pawła II 27, entered in the National Court Register under KRS number 0001182095, tax number NIP 5273172145 and statistical number REGON 542156870 (“AIBC”, the “Controller”).
Contact about personal data
AIBC Sp. z o.o. has not formally appointed a Data Protection Officer. For matters concerning the processing of personal data and the exercise of rights under the GDPR, you may contact the data controller at [email protected].
AIBC sp. z o.o., al. Jana Pawła II 27, 00-867 Warsaw, Poland
Data we process
The data involved depends on how you use the website:
- contact form: full name, email address, optionally company and phone number, subject and message content;
- website protection: IP address, request time and parameters, information required for anti-bot verification and abuse prevention;
- AIBC assistant: your question, selected language and a limited conversation history sent with the next question.
Purposes and legal bases
- replying and taking steps at your request before a possible contract is concluded — Article 6(1)(b) GDPR;
- handling other correspondence and documenting contact — the Controller’s legitimate interests, Article 6(1)(f) GDPR;
- protecting the website, form and assistant against abuse — the Controller’s legitimate interests, Article 6(1)(f) GDPR;
- establishing, pursuing or defending legal claims — the Controller’s legitimate interests, Article 6(1)(f) GDPR.
After the form has been submitted successfully, an automated confirmation containing the subject, reference and a copy of the enquiry may be sent to the email address provided. Please check the address before submitting.
AIBC assistant
Messages entered in the assistant are sent to a secured AIBC endpoint and then to the language-model provider Anthropic to generate a response. AIBC does not store conversation content in operational logs; the history shown in the widget is held in session storage for the current browser tab.
Do not enter passwords, special-category data or other confidential information in the assistant. If your matter requires sharing client data, contact AIBC directly.
Protecting the form and website
The form uses a CSRF token, request rate limiting and Cloudflare Turnstile. Security state may include cryptographic digests of identifiers and timestamps, but it does not contain the submitted message. Strictly necessary technical mechanisms are used only to keep the service secure and available.
Recipients of data
Data may be processed by organisations supporting AIBC with hosting, website protection and anti-bot verification, email, IT maintenance and legal services. These include AIBC infrastructure providers, Cloudflare, the Proton email service and — for the assistant — Anthropic. The website also loads fonts from Google Fonts, which causes the browser to connect directly to Google servers and transmit technical connection data. Access is limited to what is necessary to provide the relevant service.
Transfers outside the EEA
Using Cloudflare, Anthropic or Google Fonts may involve processing outside the European Economic Area. Where such a transfer occurs, it should rely on a mechanism provided by Chapter V GDPR, in particular an adequacy decision or standard contractual clauses.
How long we keep data
- contact-form data and related correspondence — for up to 24 months after the correspondence ends;
- data processed for marketing purposes — until consent is withdrawn or an objection is made, depending on the legal basis for processing;
- accounting data — for 5 years, taking into account the applicable rules governing how that period is calculated;
- form rate-limiter identifier digests and timestamps — for no longer than 24 hours; the key preventing a duplicate autoresponder — for 7 days;
- widget history — in the session storage of the current tab; question content is not written to AIBC operational logs, while provider-side retention follows the service terms applicable to AIBC;
- data required for legal claims or statutory duties — for the period required by applicable law.
Your rights
Subject to the conditions in the GDPR, you may have the right to access, rectify or erase data, restrict processing, receive portable data and object to processing. The scope of each right depends on the legal basis and purpose of processing.
Complaint to the supervisory authority
If you believe that your data is being processed unlawfully, you may lodge a complaint with the President of the Personal Data Protection Office: Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl.
Additional information
Providing data is voluntary, but fields marked as required are necessary to submit the form and receive a reply. Company and phone number are optional.
Your data is not used to make decisions about you based solely on automated processing that would produce legal effects or similarly significantly affect you.
The website uses browser session storage to retain assistant history and the source of a visit to the form, together with a strictly necessary CSRF cookie for the form. The website loads fonts from Google Fonts. No analytics or marketing tools were identified in the current website code; this does not confirm the status of features enabled outside the code, including in the Cloudflare dashboard. Enabling them requires a renewed consent assessment and an update to this policy.