Privacy Policy

1. Data Controller

The data controller is Bentfly (Tomasz Pijanowski TORU), VAT ID PL8943247066, registered address ul. Na Ostatnim Groszu 52 lok. 4, 54-207 Wrocław, Poland.

Contact for data protection matters: [email protected] [email protected]

2. Scope of Data Processing

Bentfly processes personal data collected through the following channels:

• Contact Form

  First name, email address, company name, message content. Data is sent by email to [email protected] via an SMTP server.

• Chat (Robin)

  Email address, first name, last name, company name, conversation content. Data is forwarded to the KoroMind/ToruAI API and Google Apps Script as a lead.

• Analytics (Google Analytics 4, PostHog, Vercel Analytics)

  Behavioural data and Web Vitals metrics (pageviews, clicks, time on page). Collected only after user consent.

3. Purposes and Legal Basis

• Responding to enquiries submitted via the contact form — legal basis: Art. 6(1)(f) GDPR (legitimate interests of the controller in responding to the enquiry).

• Handling chat conversations and registering leads — legal basis: Art. 6(1)(b) GDPR (steps prior to entering into a contract).

• Analysing site traffic and improving services — legal basis: Art. 6(1)(a) GDPR (user consent).

4. Cookies

This site uses cookies. Detailed information and consent settings are available in the cookie settings panel in the site footer.

5. Retention Periods

Data is retained for periods necessary to fulfil the purposes for which it was collected:

• Contact form messages: up to 24 months from last contact.

• Chat data (leads): up to 24 months from collection.

• PostHog analytics data: 14 months by default (platform setting). Google Analytics 4: up to 14 months (property setting). Vercel Analytics: aggregated, without personal identifiers.

6. Recipients of Data

Data may be shared with the following processors acting on behalf of the controller:

• PostHog Inc. — analytics (data stored in EU region: eu.i.posthog.com).

• Vercel Inc. — hosting and Vercel Analytics.

• KoroMind / ToruAI — Robin chat handling (API).

• Google LLC — Google Analytics 4 (site traffic analytics) and Google Workspace / Apps Script (chat lead registration).

• SMTP service provider — sending contact form emails.

7. International Data Transfers

• PostHog: data stored in EU infrastructure (eu.i.posthog.com) — transfer within EEA.

• Google LLC: US-based — data (including Google Analytics 4 data) transferred under Standard Contractual Clauses (SCCs) approved by the European Commission.

• Vercel Inc.: US-based — transfer under SCCs. Vercel Analytics processes only aggregated Web Vitals metrics without personal data.

8. Your Rights

You have the following rights:

• Right of access to your data and to obtain a copy.

• Right to rectification of inaccurate data.

• Right to erasure ("right to be forgotten").

• Right to restriction of processing.

• Right to data portability.

• Right to object to processing based on legitimate interests (Art. 6(1)(f) GDPR).

• Right to withdraw consent at any time (without affecting the lawfulness of processing before withdrawal).

• Right to lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl.

Submit requests to: [email protected]. The controller responds within one month.

9. Automated Decision-Making and Profiling

Personal data is not used for automated decision-making or profiling that produces legal effects or similarly significantly affects the individuals concerned.

10. GDPR Contact

For all data protection matters, please contact us at: [email protected] [email protected]