Privacy policy

1. Data controller

The controller of personal data processed on the Blueward Digital website is [DO UZUPEŁNIENIA: pełna nazwa firmy] (the “Controller”). Contact for personal data matters: echostudio697@gmail.com.

[DO UZUPEŁNIENIA: registered address, tax identification number and — where applicable — company register number of the Controller]

We have not appointed a data protection officer. For data protection matters, please write to the address above.

2. What data we process, why and on what legal basis

We process only the data necessary for the purposes below:

• Contact form — first name, email address, message content, the selected plan and the advertising budget range; optionally phone number and company name or website. Purpose: answering your enquiry and taking steps prior to entering into a contract. Legal basis: Art. 6(1)(b) GDPR (steps taken at your request before entering into a contract) and Art. 6(1)(f) GDPR (our legitimate interest in handling correspondence). Ticking the box confirming that you have read the privacy policy is an acknowledgement that the information was provided — it is not consent within the meaning of Art. 6(1)(a) GDPR.
• Marketing consent (separate and entirely optional) — email address, in order to send commercial information electronically. Legal basis: Art. 6(1)(a) GDPR and electronic communications law. Withholding this consent has no effect on how we handle your enquiry.
• Chat with the assistant — the conversation content, in order to answer questions about our services. Legal basis: Art. 6(1)(f) GDPR. The assistant does not ask for contact details or any other personal data, and we ask you not to enter them in the chat.
• Website protection — IP address and technical request data, used for rate limiting (protection against spam and abuse). Legal basis: Art. 6(1)(f) GDPR.
• Analytics and marketing — only after consent is given in the cookie banner and only where the tool is actually enabled on the website. Legal basis: Art. 6(1)(a) GDPR. Details are described in the cookie policy.

3. Recipients and processors

We entrust data to the providers we actually use to run the website:

• Vercel Inc. — website hosting and server functions (including the contact form and the chat). The provider processes technical request data and, temporarily, the content sent to our endpoints.
• Resend (transactional email provider) — delivery of contact form messages to our address and, if we enable that option, confirmations to the sender.
• Anthropic PBC — provider of the language model used by the assistant on the website (the /api/chat endpoint). The conversation content is passed to the provider solely to generate a reply. When no provider key is configured, the chat runs in FAQ mode and no data leaves the website.
• Analytics and marketing providers (Google, Microsoft, Meta) — only after your consent and only for tools actually enabled on the website. If the tool identifiers are not configured, no scripts are loaded and no data reaches those companies.
• [DO UZUPEŁNIENIA: remaining recipients — e.g. accounting office, invoicing provider, payment operator — to be completed before sales go live]

4. Transfers outside the European Economic Area

Some of the providers listed above are established outside the EEA (including in the United States) or use infrastructure outside the EEA. This means data may be transferred outside the EEA.

[DO UZUPEŁNIENIA: for each provider, the legal basis for the transfer outside the EEA — standard contractual clauses (SCC), participation in the EU-U.S. Data Privacy Framework or another mechanism — as confirmed in the signed data processing agreements]

5. Retention period

We keep contact form data for as long as is needed to handle the enquiry and then for the limitation period of any potential claims. Data processed on the basis of consent — until the consent is withdrawn. The content of a conversation with the assistant is not stored in our systems: it lives only in your browser tab's memory and disappears when the tab is closed.

[DO UZUPEŁNIENIA: specific retention periods for the mailbox, accounting records and client data]

6. Your rights

In connection with the processing of your data you have the right to:

• access your data and obtain a copy of it,
• rectification, erasure or restriction of processing,
• data portability,
• object to processing based on legitimate interest,
• withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal,
• lodge a complaint with the President of the Personal Data Protection Office in Poland (ul. Stawki 2, 00-193 Warsaw).

7. Providing data is voluntary; no automated decisions

Providing data is voluntary, but without an email address and a message we cannot answer your enquiry. Phone number and company name are optional.

We do not take decisions about you based solely on automated processing, including profiling, that would produce legal effects or similarly significantly affect you. The AI assistant answers questions about our offer; it does not assess or qualify people.

8. Cookies

Necessary cookies and browser local storage always work, because the website cannot function correctly without them. Analytics and marketing tools are activated only after consent is given; until then their scripts are not downloaded at all. The cookie policy describes all categories and how to change or withdraw consent.

9. Security

We use an encrypted connection (HTTPS), limit access to data and do not write form contents or assistant conversations to server logs — only a submission reference and an event code are logged. Your cookie decision is stored locally in your browser; the record contains no personal data and is not sent to the server.

10. Changes to this policy

We update this policy whenever the scope of processing or the list of providers changes. The date of the last change is shown at the top of the document. If an important change concerns optional tools, we will ask you again for your cookie decision.