Data protection policy
GDPR

01Data controller

The controller of personal data is Piotr Kędzierski, conducting business as Piotr Kędzierski Consulting, ul. św. Urszuli Ledóchowskiej 5F/5, 02‑972 Warsaw, Poland, VAT ID: 5372054822, REGON: 146864581 (the “Controller”). GotIt Lab is a trading brand of PKC. This Personal Data Protection Policy (“GDPR Policy”) describes how the Controller meets its obligations under Regulation (EU) 2016/679 (“GDPR”) across its entire activity — not only on gotitlab.eu. Information for website users is provided in the separate Privacy policy.

02Data protection contact

The person responsible for data protection and the single point of contact for all GDPR matters is Piotr Kędzierski. He performs the informational, advisory and monitoring tasks corresponding to the role of a data protection officer: monitoring compliance, keeping the record of processing activities, handling data subject requests and breach reports.

Contact: piotr.kedzierski [at] gotitlab.eu (data protection matters) or by post to the Controller’s address marked “GDPR”. As a natural person running a sole proprietorship, the Controller is not required to designate a data protection officer within the meaning of Art. 37 GDPR; should a DPO be formally designated, their details will be published here and notified to the Polish supervisory authority (UODO).

03Processing principles

Personal data are processed in line with the principles of Art. 5 GDPR:

• lawfulness, fairness and transparency — every operation has an identified legal basis and individuals receive clear information;
• purpose limitation — data collected for one purpose are not used for incompatible purposes;
• data minimisation — we collect only what is necessary and design forms and tools not to ask for more;
• accuracy — outdated data are corrected or erased;
• storage limitation — retention periods are defined in advance (section 08) and enforced;
• integrity and confidentiality — we apply the technical and organisational measures described in section 11;
• accountability — we can demonstrate compliance: a record of processing activities, documented decisions and incidents.

04Categories of individuals and data

The Controller processes data of the following categories of individuals:

• users of the websites gotitlab.eu, gotitlab.pl and gotit.pl — technical data (IP address, request time and URL, browser, error and security information) and, subject to consent, Google Analytics 4 data;
• people who contact us via the form, e‑mail, phone or meeting booking — name, e‑mail address, organisation, topic and message content, selected time slot;
• clients and their representatives — identification and contact details, contract and billing data, project correspondence, data contained in materials entrusted to us within advisory and implementation services;
• investors and recipients of materials who receive personalised links to investor materials — name, e‑mail address, organisation, link‑open log (time, IP address, browser) used to confirm delivery and protect confidentiality;
• contractors, suppliers and collaborators — identification, contact and billing data;
• candidates for collaboration — data provided in the application.

The Controller does not intentionally process special categories of data (Art. 9 GDPR) or children’s data. Should such data reach us within a message, they are deleted unless necessary to handle the matter.

05Purposes and legal bases

• responding to enquiries and conducting correspondence — Art. 6(1)(f) GDPR (legitimate interest), or Art. 6(1)(b) GDPR where the enquiry aims at concluding a contract;
• concluding and performing advisory, implementation or licence agreements — Art. 6(1)(b) GDPR; towards client representatives — Art. 6(1)(f) GDPR;
• sharing investor materials with named individuals and confirming delivery — Art. 6(1)(f) GDPR (protecting confidentiality and the Controller’s interests in a fundraising process);
• billing, accounting and tax obligations — Art. 6(1)(c) GDPR;
• security of systems, abuse prevention, establishing and defending claims — Art. 6(1)(f) GDPR;
• Google Analytics — only with consent, Art. 6(1)(a) GDPR; consent can be withdrawn at any time (“Cookie settings” in the footer);
• direct marketing of our own services to existing clients — Art. 6(1)(f) GDPR, with the right to object at any time; electronic commercial communication — only with consent.

06Recipients and processors

Data may be received by entities supporting the Controller’s activity, solely under data processing agreements (Art. 28 GDPR) or as independent controllers within their own legal obligations:

• Amazon Web Services EMEA SARL — hosting of the websites and the materials panel (Frankfurt region, eu‑central‑1), form e‑mail delivery (Amazon SES);
• Google Ireland Ltd. — Google Workspace (mail, calendar, documents), Google Calendar (bookings) and — with consent — Google Analytics 4;
• GitHub, Inc. — code repositories (no client personal data);
• accounting office, legal and tax advisers, banks and payment operators — for billing and legal obligations;
• IT tool providers and subcontractors engaged in projects — only to the extent necessary for a specific contract, after signing a processing agreement and a confidentiality undertaking.

The Controller keeps a list of processors and verifies their security guarantees before entrusting data. Data are never sold or shared for third‑party marketing.

07Transfers outside the EEA

The core infrastructure runs in the European Union (AWS Frankfurt). Using global providers (Google, AWS, GitHub) may involve access to data from third countries, in particular the United States. Transfers then rely on a European Commission adequacy decision (EU‑US Data Privacy Framework — for providers certified under it) or standard contractual clauses under Art. 46(2)(c) GDPR, supplemented by a transfer impact assessment. A copy of the safeguards applied is available from the contact in section 02.

08Retention periods

• enquiries and correspondence — for the duration of the matter, then up to 3 years for defence against claims unless the law provides a longer period;
• contracts, invoices and billing records — 5 years from the end of the tax year in which the tax obligation arose;
• investor data and the materials‑open log — for the duration of the fundraising process and 12 months after its completion, then erasure or anonymisation;
• meeting bookings — for the time needed to organise the meeting, then per the Google Workspace account retention;
• server and security logs — as a rule up to 30 days; longer only when an incident requires evidence preservation;
• GA4 analytics data — per the configured retention period (14 months at most) or until consent is withdrawn;
• candidate data — until the recruitment process ends, unless the person agrees to longer storage.

After the period ends, data are erased or anonymised; backups are overwritten in a cycle no longer than 7 days.

09Your rights and how to exercise them

Everyone has the right of access to their data and to obtain a copy, to rectification, erasure (“right to be forgotten”), restriction of processing, data portability (where processing is based on consent or contract and carried out by automated means), to object to processing based on legitimate interest, and to withdraw consent at any time — without affecting the lawfulness of earlier processing.

How to submit a request: by e‑mail to the address in section 02 or by post. We respond without undue delay and at the latest within one month; for complex matters the deadline may be extended by a further two months, of which we will inform you. Exercising your rights is free of charge. Where we have reasonable doubts about the requester’s identity, we may ask for additional information needed to confirm it — we do not request copies of identity documents unless necessary.

10Personal data breaches

The Controller has a breach‑handling procedure: every event is assessed for risk to the rights and freedoms of individuals, documented in an internal breach register (Art. 33(5) GDPR) and, where a risk is likely, notified to the Polish supervisory authority (UODO) within 72 hours of becoming aware of it. Where the risk is high, we also inform the data subjects in plain language with recommended actions (Art. 34 GDPR).

Suspected breaches — including those spotted by outsiders, security researchers or clients — can be reported to the address in section 02. Good‑faith reports will not be met with legal action by the Controller.

11Security measures

We apply technical and organisational measures appropriate to the risk (Art. 32 GDPR), including:

• TLS encryption with automatically renewed certificates and enforced HTTPS (HSTS), a Content‑Security‑Policy, no third‑party scripts or fonts beyond those explicitly allowed;
• administrative access to servers only via SSH keys from a restricted list of addresses; no publicly reachable admin panels; the investor materials panel behind authentication and single‑use tokens;
• secrets (mail credentials, form tokens) stored outside the web directories and outside code repositories;
• daily automated backups and instance snapshots; tested restores;
• minimisation and pseudonymisation — analytics only with consent, short log retention, a form without unnecessary fields;
• organisational rules: least privilege, vendor review, documented configuration changes, data protection by design and by default (Art. 25 GDPR).

No internet transmission is absolutely secure; the measures are, however, reviewed regularly and adapted to evolving threats.

12Automated decisions and profiling

The Controller does not make decisions based solely on automated processing that would produce legal effects or similarly significantly affect individuals (Art. 22 GDPR). We do not carry out marketing profiling. Google Analytics statistics are aggregated and serve only to evaluate how the site performs.

13Records and accountability

The Controller maintains a record of processing activities (Art. 30 GDPR) covering purposes, categories of individuals and data, recipients, transfers, retention periods and a general description of security measures, as well as a list of processors, a breach register and a register of data subject requests. Before launching new services or tools with elevated risk, a data protection impact assessment is carried out (Art. 35 GDPR). The documentation is made available to the supervisory authority on request.

14Complaint to the supervisory authority

Anyone who believes their data are processed unlawfully may lodge a complaint with the President of the Personal Data Protection Office (UODO): ul. Stanisława Moniuszki 1A, 00‑014 Warsaw, Poland, uodo.gov.pl. We encourage you to contact us first — most matters can be resolved directly.

15Related documents and changes

This GDPR Policy is complemented by the Privacy policy and GDPR notice (information for website users under Art. 13 GDPR), the Cookie policy and the Terms of service. The document is reviewed at least once a year and whenever services, providers or the law change materially. The version date appears at the top of the page; earlier versions are available on request.