Privacy Policy

1. Introduction

Sustainable Software sp. z o.o. ("we", "our", "the Company"), with its registered office at ul. Aleja Solidarności 117, biuro 615, Warsaw, Poland, is committed to protecting your personal data and respecting your privacy.

This Privacy Policy explains how we collect, use, store, and protect your personal information when you visit our website or contact us through any of our communication channels. It applies in accordance with the General Data Protection Regulation (GDPR) and applicable Polish data protection law.

2. Data Controller

The data controller responsible for your personal data is:

3. What Data We Collect

We may collect the following categories of personal data:

• Contact information — your name, email address, and company name when you submit our contact form
• Communication data — the content of messages you send us through our website or by email
• Technical data — IP address, browser type, device information, pages visited, and time spent on our website (collected via cookies and analytics tools)
• Usage data — how you interact with our website, which sections you visit, and which links you click

We do not collect sensitive personal data (such as health data, political opinions, or biometric data).

4. How We Use Your Data

We use your personal data for the following purposes:

• To respond to your enquiries and provide information about our services
• To prepare and send project estimates upon your request
• To fulfil contractual obligations when you become a client
• To improve our website and user experience through analytics
• To comply with legal obligations under Polish and EU law

5. Legal Basis for Processing

We process your personal data on the following legal bases under GDPR Article 6:

• Consent (Art. 6(1)(a)) — when you submit our contact form or subscribe to communications
• Contract (Art. 6(1)(b)) — when processing is necessary for the performance of a contract with you
• Legitimate interests (Art. 6(1)(f)) — for website analytics and improving our services
• Legal obligation (Art. 6(1)(c)) — when we are required to process data by law

6. Data Retention

We retain your personal data only for as long as necessary for the purposes stated in this policy:

• Contact form enquiries — up to 2 years from the date of last contact
• Client project data — up to 5 years after project completion for legal and accounting purposes
• Website analytics data — up to 26 months

After these periods, your data is securely deleted or anonymised.

7. Sharing Your Data

We do not sell, rent, or trade your personal data. We may share it only in the following circumstances:

• With trusted service providers who help us operate our website and business (e.g. email services, analytics tools), bound by data processing agreements
• With legal or regulatory authorities when required by law
• In the event of a business merger or acquisition, subject to equivalent privacy protections

All third-party processors are selected carefully and are GDPR-compliant.

8. International Data Transfers

Your data is primarily stored and processed within the European Economic Area (EEA). If any transfer outside the EEA is required, we ensure it is protected by appropriate safeguards such as Standard Contractual Clauses approved by the European Commission.

9. Cookies

Our website uses cookies to improve your browsing experience and analyse website traffic. Cookies are small text files stored on your device. We use:

• Essential cookies — necessary for the website to function correctly
• Analytics cookies — to understand how visitors interact with our site (e.g. Google Analytics)

You can control cookies through your browser settings. Disabling certain cookies may affect website functionality.

10. Your Rights Under GDPR

As a data subject, you have the following rights:

• Right of access — to request a copy of your personal data we hold
• Right to rectification — to request correction of inaccurate data
• Right to erasure — to request deletion of your data ("right to be forgotten")
• Right to restriction — to request we limit how we use your data
• Right to data portability — to receive your data in a structured, machine-readable format
• Right to object — to object to processing based on legitimate interests
• Right to withdraw consent — at any time, where processing is based on consent

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

11. Complaints

If you believe we have not handled your personal data in accordance with applicable law, you have the right to lodge a complaint with the Polish supervisory authority:

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. The latest version will always be available on this page. We encourage you to review it periodically.

13. Contact Us

If you have any questions about this Privacy Policy or how we handle your data, please contact us: