Skip to main content

Privacy Policy

1. Data controller

The controller of personal data is Mateusz Mrugała, running a sole proprietorship under the business name EngiLEAN AI Mateusz Mrugała, os. Jana III Sobieskiego 40/2N, 60-688 Poznań, Poland, NIP (tax ID) 781 211 18 39, REGON 544 896 564 (the Controller).

Contact in data protection matters: mrugala@engileanai.com.

2. Contact form and email correspondence

Data: name, e-mail address and, if provided, company name, phone number, selected topic and message content.

Purpose and legal basis: replying to the enquiry and conducting correspondence (Article 6(1)(f) GDPR, the Controller's legitimate interest) and, where the enquiry concerns entering into a contract, taking steps at the request of the data subject prior to entering into a contract (Article 6(1)(b) GDPR).

How the data is processed: data from the form is sent by e-mail to the Controller's mailbox. The website does not store it in a database or in files. The Controller conducts business correspondence in the HubSpot CRM system, into which contact details and correspondence history are entered.

Retention: until the correspondence ends and then no longer than 12 months after the last message. If the correspondence leads to cooperation, for the duration of the cooperation and until the expiry of limitation periods for claims and of statutory document retention obligations.

3. Sign-up for the webinar recording and readiness test

Data: e-mail address and first name. If you arrived on the website from a Google ad and gave consent to ad performance measurement, the ad click identifier (gclid, gbraid or wbraid) that Google adds to the page address is sent together with the sign-up. Without this consent the identifier is not sent.

How the data is processed: data from the sign-up form is sent by e-mail to the Controller's mailbox and entered into the HubSpot CRM system. The website does not store it in a database or in files. The CRM also records the source of the sign-up (the form on engileanai.com, marked with the language version) and the sign-up date.

Confirmation of marketing consent: if consent to information about services was given, the Controller sends a message with a link to a confirmation page. The consent applies from the moment the "I confirm" button on that page is clicked; opening the link alone is not a confirmation. The date and time of the confirmation are recorded, and the confirmation is sent by e-mail to the Controller's mailbox as proof that consent was given. Legal basis: Article 6(1)(f) GDPR (the Controller's legitimate interest in demonstrating that consent was given and in defending against claims). Proof of consent is kept for as long as the consent applies and, after it is withdrawn, until the expiry of limitation periods for claims.

Purposes and legal bases:

  • sending the link to the recording and the readiness test (PDF) and handling the sign-up: Article 6(1)(b) GDPR (steps taken at the request of the data subject). The request is made by submitting the form;
  • ad performance measurement, i.e. informing Google that the sign-up came from an ad click: Article 6(1)(a) GDPR (consent). Consent is voluntary. Not giving it does not affect receiving the recording. Without consent the click identifier reaches neither the Controller nor Google;
  • sending information about the Controller's services (direct marketing): Article 6(1)(a) GDPR (consent), in connection with Article 398 of the Polish Electronic Communications Law (Prawo komunikacji elektronicznej). Consent is voluntary and separate from consent to ad performance measurement.

Retention:

  • sign-up data: until marketing consent is withdrawn or, if it was not given, no longer than 12 months after the last contact;
  • ad click identifier: until it is passed to Google, no longer than 90 days after the click.

4. Protecting forms against abuse

To limit automated submissions, the website creates a hash (HMAC function) of the IP address of the person submitting a form. The hash is kept on the server for no longer than 1 hour and is used only to limit the number of submissions. Legal basis: Article 6(1)(f) GDPR (website security).

5. Server logs

On every visit the hosting server records standard technical information, including the IP address, date and time, the address of the visited page and browser information. It is used to keep the website running and secure (Article 6(1)(f) GDPR). Logs are kept for the period set by the terms of the OVH hosting service. The Controller does not combine them with other data and does not use them for marketing analysis.

6. Recipients of data

  • OVH SAS, France: provider of website hosting, e-mail and storage of the webinar recording file, acting on behalf of the Controller. The servers are located in the European Union (France).
  • HubSpot, Inc. and its group companies: CRM system provider, acting on behalf of the Controller.
  • Google Ireland Limited and Google group companies, including Google LLC: only the ad click identifier and the information about the sign-up (conversion), and only with the data subject's consent. For this data Google acts as a separate controller under the Google Privacy Policy: policies.google.com/privacy.

7. Transfers outside the European Economic Area

Data processed in HubSpot and data passed to Google may be transferred to the United States. The transfer is based on Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 on the adequate level of protection of personal data under the EU-US Data Privacy Framework, in which HubSpot, Inc. and Google LLC participate. In addition, both companies use standard contractual clauses approved by the European Commission. A copy of the safeguards can be requested at mrugala@engileanai.com.

Data processed by OVH remains in the European Union.

8. Cookies and analytics

The website does not use cookies or any other technology that stores information on, or reads it from, the user's device (such as localStorage or sessionStorage). For this reason it does not show a consent banner. The website does not use analytics tools, advertising pixels or Google tags.

The ad click identifier is read only from the page address (URL) at the moment the form is submitted and is sent with it only if consent to ad performance measurement was given. It is not stored in the browser.

The webinar recording is served from the website's server, without embedded third-party players. Fonts are loaded from the website's server, without third-party services.

The website contains links to LinkedIn. After clicking such a link, LinkedIn's privacy rules apply.

9. Rights of data subjects

Every person has the right to access their data, to rectification, erasure or restriction of processing and, for data processed on the basis of a contract or consent, to data portability. For processing based on legitimate interest, the right to object applies.

Consent can be withdrawn at any time by writing to mrugala@engileanai.com or by replying to any message received. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal (Article 7(3) GDPR).

You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, Poland).

10. Voluntary provision of data and automated decisions

Providing data is voluntary. Without a name and e-mail address the enquiry cannot be answered, and without a first name and e-mail address the recording and readiness test cannot be sent. The Controller does not make automated decisions and does not profile website visitors.

11. Changes to this policy

The current version of this policy is always available on this page. Last updated: 30 October 2026.