Privacy & Cookie Policy
DeepTech sp. z o.o. · Version 1.2 — pending management approval · October 2026
| Field | Value |
|---|---|
| Owner | DeepTech sp. z o.o. — Management Board; data protection coordinator: Kacper Raubo |
| Version | 1.2 |
| Status | Pending management approval (Management Board of DeepTech sp. z o.o.) |
| Effective | On approval — October 2026 (supersedes v1.1, v1.0 and Draft v0.9) |
| Review | Every 12 months or after a material change |
| Classification | Public |
This policy applies to the website audomate.eu and its subpages (including the Trust Center), to our business correspondence and to the recruitment and contracting activities of DeepTech. Audomate is offered to business customers only — the B2B-only model was confirmed by the Management Board on 10 October 2026; registration for the platform includes a declaration that the user acts on behalf of a business, and consumers are therefore not a category of data subjects under this policy. Personal data processed inside the Audomate platform (app.audomate.eu — user accounts, uploaded documents) is processed on behalf of your organisation as controller under a Data Processing Agreement (DPA; in legal review by an external law firm since 10 October 2026); the relevant commitments (subprocessors, data residency, retention) are published in the Trust Center and summarised in section 2.
1. Controller and contact
The controller of personal data collected through this website and in our business relations is DeepTech sp. z o.o., ul. Chmielna 132/134, 00-805 Warsaw, Poland, entered in the register of entrepreneurs of the National Court Register kept by the District Court for the Capital City of Warsaw, XII Commercial Division, under KRS 0001127965, NIP 5273130678, REGON 529687065 ("DeepTech", "we").
| Privacy contact (GDPR matters, data subject rights) | privacy@audomate.eu |
|---|---|
| Data protection coordinator | Data Protection Coordinator (privacy lead): Kacper Raubo, Member of the Management Board — kacper.raubo@deeptech.pl. This is an internal role, not a Data Protection Officer within the meaning of art. 37 GDPR |
| Security contact (vulnerabilities, incidents) | security@audomate.eu |
| Support and legal matters | support@audomate.eu · legal@audomate.eu |
| General and sales contact | contact@deeptech.pl · sales@deeptech.pl · +48 608 499 442 |
| Postal address | DeepTech sp. z o.o., ul. Chmielna 132/134, 00-805 Warsaw, Poland |
Given the current scale of the company (a micro-enterprise), DeepTech has assessed that it is not required to appoint a Data Protection Officer under art. 37 GDPR and has not done so; this assessment will be confirmed with our external auditor at the next review. Privacy matters are coordinated by the data protection coordinator named above and handled through privacy@audomate.eu.
2. What we process, why, and for how long
In line with art. 5(1)(b) and (c) GDPR (purpose limitation, data minimisation) we process personal data only in the scenarios below. Legal bases refer to art. 6(1) GDPR.
| Scenario / channel | Data collected | Purpose and legal basis | Retention |
|---|---|---|---|
| Website visits — server logs | IP address, request time and URL, HTTP status, user agent | Security, abuse prevention and reliability of the website — legitimate interest, art. 6(1)(f) | 30 days, automatic rolling deletion |
| Website analytics (Plausible) | Page views, referrer, country, device and browser type. No cookies; IP address and user agent are hashed in memory with a salt rotated every 24 hours and are not stored | Aggregate statistics on how the site is used — legitimate interest, art. 6(1)(f) | Daily hash is discarded with the 24-hour salt rotation; only aggregated, non-identifying statistics are kept |
| Demo, pilot and contact enquiries (form, e-mail, phone) | Name, business e-mail, company, phone (if given), regulatory frameworks you indicate, content of your message | Responding to the enquiry, arranging a demo or pilot, follow-up — steps prior to a contract, art. 6(1)(b), and legitimate interest in handling business enquiries, art. 6(1)(f) | Duration of handling, then 12 months from our last contact, unless a contract is concluded (then as below). Marketing contact stops on objection |
| SaaS clients, partners and their representatives (contract, billing, correspondence) | Business contact details of representatives, contract parameters, invoices and payment data (incl. bank account numbers), correspondence | Performance of the contract, art. 6(1)(b); tax and accounting obligations, art. 6(1)(c); establishing and defending claims, art. 6(1)(f) | Contract term + 3 years (limitation of claims); accounting and tax records 5 years from the end of the calendar year in which the tax payment fell due |
| Audomate platform users (accounts at app.audomate.eu) | Name, business e-mail, role, authentication logs; personal data contained in documents your organisation uploads (e.g. signatories and contact persons in ICT vendor contracts) | Processed on behalf of your organisation (controller) under the Data Processing Agreement — DeepTech acts as processor, art. 28 | Set by the client in the DPA: active account period; after account deletion at most 3 years for defence against claims, or immediate deletion / anonymisation where no claims are pending |
| Recruitment | Data in your application (CV, cover letter), interview notes | Recruitment — art. 6(1)(b) and art. 22¹ of the Polish Labour Code; data beyond the statutory scope and future recruitments — consent, art. 6(1)(a) | 3 months after the recruitment ends; with your separate consent for future recruitments — 12 months from the application or until consent is withdrawn |
We do not knowingly process special categories of personal data (art. 9 GDPR). Such data may occur incidentally in documents uploaded by clients to the platform; in that case it is processed exclusively on the client's instructions as processor and is covered by our data protection impact assessment for the AI contract-audit module (see the AI & Data Governance Statement).
Categories of personal data and retention
The table below groups the same information by category of data subject, as required for transparency under art. 13 and 14 GDPR. Data categories: ordinary — name, surname, business e-mail, phone, position, company; confidential — bank account numbers on invoices, PESEL number in personnel files.
| Category of data subjects | Categories of data | Where processed | Retention |
|---|---|---|---|
| Clients or their representatives | Ordinary; confidential (bank account numbers on invoices) | EEA — business e-mail (provider listed in section 4); invoicing in mOrganizer finansów (mBank S.A., Warsaw, Poland); bookkeeping by the external accounting office EasyTaxes Sp. z o.o. (Warsaw, Poland) | Billing / accounting data: 5 years from the end of the calendar year in which the tax payment fell due. Contact and contractual data: for the term of the contract and until the limitation period for claims expires (3 years after the contract ends) |
| Users of the Audomate platform (SaaS) | Ordinary (name, business e-mail, role); authentication logs; data in uploaded documents | EEA — Google Cloud (Belgium, Germany, Netherlands); identity provider Auth0 EU (Frankfurt). DeepTech acts as processor | For the period the account is active; after deletion at most 3 years for defence against claims, or immediate deletion / anonymisation where no claims are pending |
| Representatives of cooperating companies (vendors, partners) | Ordinary; confidential (bank account numbers on invoices) | EEA — business e-mail; invoicing in mOrganizer finansów (mBank S.A., Warsaw, Poland); bookkeeping by the external accounting office EasyTaxes Sp. z o.o. (Warsaw, Poland) | For the duration of the cooperation or until the contact person changes / an effective objection is raised; after the cooperation ends — 3 years (limitation of claims); accounting data 5 years as above |
| Employees and contractors | Ordinary; confidential (PESEL, bank account); data required by labour law | EEA — HR and payroll records (paper and electronic) | Personnel files: 10 years from the end of the calendar year in which employment ended (employees hired from 2019), art. 94(9b) of the Polish Labour Code; B2B contractors — as for cooperating companies |
| Prospective clients (demo / pilot form, leads) | Ordinary; content of the enquiry | EEA — business mailbox (sales@deeptech.pl / contact@deeptech.pl); no CRM system is used | Until consent is withdrawn or an objection is raised; where no cooperation follows — at most 12 months from the last contact |
| Job candidates | Ordinary; application documents | EEA — recruitment mailbox | 3 months after the recruitment ends; with separate consent for future recruitments — 12 months or until consent is withdrawn |
| General enquiries (contact) | Ordinary; content of the message | EEA — business e-mail | Duration of handling + 12 months |
| Website visitors | IP address, technical connection data (logs); anonymised statistics (Plausible) | EEA — Vercel edge network (EEA points of presence) and Google Cloud (EEA); Plausible Insights OÜ (EU, Germany) | Server logs: 30 days. Analytics: no personal data retained beyond the 24-hour hash rotation |
3. Hosting, server logs, cookies and analytics
Hosting and server logs
The website front end is delivered through Vercel from edge points of presence located in the EEA, with geo-restriction to the EEA; back-end services and storage run on Google Cloud in EEA regions only (europe-west1 Belgium, europe-west3 Germany, europe-west4 Netherlands). Technical server logs (IP address, request time, user agent) are kept for 30 days for security and reliability (art. 6(1)(f) GDPR) and are not used to profile visitors.
Cookies and similar storage
- Strictly necessary storage — used only where required for the website or the Trust Center access gate to function (e.g. session or security tokens). Such storage does not require consent under art. 5(3) of Directive 2002/58/EC (ePrivacy) as implemented in Polish law (art. 399 of the Electronic Communications Law of 2024, formerly art. 173 of the Telecommunications Law).
- Advertising and marketing cookies — none are in use. We do not sell or share personal data for marketing purposes and we do not use cross-site tracking.
- Analytics — we use Plausible Analytics (see below). It sets no cookies and stores nothing on your device, so no cookie banner is required. Correction to the previous version: Draft v0.9 stated that no analytics were in use; Plausible has in fact been active on audomate.eu and this policy now describes it.
- Web fonts — fonts are served from our own infrastructure; no request is made to Google Fonts or any other third-party font provider; no cookies or other data are stored on or read from your device for this purpose. Apart from our own domain (audomate.eu), the website connects only to plausible.io for the cookieless statistics described below. Change in this version: until October 2026 fonts were loaded from Google Fonts; they have been self-hosted since 10 October 2026.
Plausible Analytics — cookieless statistics
Website statistics are produced by Plausible Insights OÜ, Västriku tn 2, 50403 Tartu, Estonia, acting as our processor, with data hosted in the EU (Germany). Plausible writes no cookies, local storage keys or persistent identifiers to your device. Your IP address and user agent are processed only in memory, together with a random salt, to produce a daily hash that counts unique visits; the salt is destroyed and regenerated every 24 hours, so visits cannot be linked across days and no persistent profile exists. We receive only aggregated figures (page views, referrers, countries, device types). Legal basis: legitimate interest in understanding how the site is used (art. 6(1)(f) GDPR). You may object at any time (section 6).
4. Recipients of data
We do not sell personal data. Personal data is disclosed only to the providers below, each bound by a data processing agreement under art. 28 GDPR, and to public authorities where the law requires it. The full list of platform subprocessors, with legal entities, processing regions and transfer mechanisms, is maintained in the Subprocessor List in the Trust Center.
| Recipient (legal entity) | Role for DeepTech | Purpose | Location of processing |
|---|---|---|---|
| Google Cloud EMEA Limited, 70 Sir John Rogerson's Quay, Dublin 2, Ireland (contracting entity confirmed against invoice, 10 October 2026) | Processor (infrastructure) | Hosting of the Audomate platform and website back end: compute, database, object storage, key management, logging | EEA — Belgium, Germany, Netherlands |
| Vercel Inc., Covina, CA, USA | Processor (hosting) | Delivery of the website and platform front end via edge network | EEA points of presence; geo-restricted to EEA |
| Plausible Insights OÜ, Tartu, Estonia | Processor (analytics) | Cookieless website statistics | EU (Germany) |
| Okta, Inc. (Auth0), San Francisco, CA, USA | Processor (identity) | Login, SSO and MFA for platform users | EU tenant (eu.auth0.com — Frankfurt) |
| OpenAI Ireland Ltd, 1st Floor, The Liffey Trust Centre, 117–126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland (OpenAI API) | Processor (AI inference) | Analysis of documents uploaded to the platform by clients — transient processing, Zero Data Retention, no training | EU data residency (EU-region project, eu.api.openai.com) |
| PagerDuty, Inc., San Francisco, CA, USA | Processor (alerting) | On-call alerting for platform incidents — alert metadata only, no client content | EU data residency (enabled on our account) |
| mOrganizer finansów — a service of mBank S.A., ul. Prosta 18, 00-850 Warsaw, Poland, KRS 0000025237 (service delivered by mBank in cooperation with CashDirector S.A., Warsaw; data processing agreement with CashDirector S.A.) | Processor (invoicing and accounting) | Issuing invoices and keeping invoice records: invoice data of clients and vendors (company name, NIP, address, contact person, bank account numbers) | Poland / EEA |
| Home.pl — home.pl sp. z o.o., ul. Zbożowa 4, 70-653 Szczecin, Poland | Processor (e-mail) | Business mailboxes used for enquiries (sales@deeptech.pl, contact@deeptech.pl), support (support@audomate.eu), privacy, security and legal contacts. Leads from the demo / pilot form are handled in the sales@deeptech.pl mailbox — no CRM system is used. Support requests are handled by e-mail (support@audomate.eu); no third-party ticketing tool is used | Poland / EEA |
| EasyTaxes Sp. z o.o., ul. Warszawska 58C/56, 02-496 Warsaw, Poland, NIP 522-300-38-77 (external accounting office) | Processor (bookkeeping and accounting) | Bookkeeping and accounting services: accounting documents, invoices and payment records of clients and vendors, and personnel and payroll accounting data where within the engagement | Poland / EEA |
| Professional advisers (legal, tax) | Independent controllers or processors bound by professional secrecy | Legal and tax advice (including the external law firm reviewing our DPA and Terms since 10 October 2026) | Poland / EEA |
5. Transfers outside the EEA
The Audomate platform processes and stores client data exclusively within the EEA: Google Cloud regions in Belgium, Germany and the Netherlands, the OpenAI API with EU data residency (OpenAI Ireland Ltd) and the Auth0 EU tenant. No client content is transferred to a third country and platform operations do not depend on international transfer mechanisms.
Some providers are companies headquartered in the United States or have a US parent (Okta/Auth0, Vercel, PagerDuty, OpenAI). They are contracted through EU entities or configured for EU/EEA processing (EU tenant, EEA points of presence, EU data residency). To the extent residual access from outside the EEA could occur — for example remote support or service telemetry — it is covered by the provider's certification under the EU-U.S. Data Privacy Framework and, in addition, by the Standard Contractual Clauses (Commission Decision 2021/914) incorporated in the provider's data processing agreement. The DPF status of Okta, Inc., Vercel Inc. and PagerDuty, Inc. was verified on 10 October 2026 (screenshots on file); OpenAI, L.L.C., the parent of OpenAI Ireland Ltd, is likewise certified under the DPF (relevant to support and telemetry only). You may request a copy of the relevant safeguards at privacy@audomate.eu.
6. Your rights
Under art. 15–21 GDPR you have the right to: access your data and obtain a copy (art. 15); have it rectified (art. 16); have it erased (art. 17); restrict its processing (art. 18); receive data you provided to us in a portable, machine-readable format where processing is based on contract or consent (art. 20); and object at any time to processing based on our legitimate interest, including analytics and business contact (art. 21). Where processing is based on consent (e.g. future recruitments) you may withdraw it at any time without affecting prior processing (art. 7(3)).
To exercise your rights write to privacy@audomate.eu or to our postal address. Requests are free of charge. We may ask you to confirm your identity where reasonably necessary (art. 12(6)). We respond without undue delay and at the latest within one month of receipt; for complex or numerous requests this may be extended by a further two months, in which case we will inform you of the reason (art. 12(3)). For data we process on behalf of a client organisation (platform users, data in uploaded documents) we will forward your request to that organisation as controller and assist it in responding.
7. No automated decision-making
DeepTech does not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (art. 22 GDPR), and does not profile visitors or users. The AI features of the Audomate platform analyse ICT vendor contracts and compliance documents to support the client's compliance work; DeepTech provides them as processor, every AI output requires human approval by the client's staff, and the platform does not take decisions about natural persons. Details are in the AI & Data Governance Statement in the Trust Center.
8. Right to lodge a complaint
You may lodge a complaint with a supervisory authority, in particular in the Member State of your residence, workplace or the place of the alleged infringement (art. 77 GDPR). The competent authority for DeepTech is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, PUODO), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl. We encourage you to contact privacy@audomate.eu first so that we can resolve the matter directly.
9. Changes to this policy
We publish updates on this page with a new version number and effective date. Material changes affecting platform clients are additionally communicated under the applicable agreement. Questions about how Audomate handles client documents, AI processing, retention or DORA vendor duties are answered in the Audomate Trust Center.
Document control
| Version | Date | Author | Approved by | Changes |
|---|---|---|---|---|
| 0.9 | September 2026 | DeepTech (CTO / CEO) | — (working draft, not adopted) | Working draft published for transparency; items marked "to confirm". |
| 1.0 | October 2026 | DeepTech (CEO / CTO) | — (superseded by 1.1) | Changes after the GDPR (RODO) / NIS2 audit of 7–8 October 2026: restructured into controller / processing matrix / hosting / recipients / transfers / rights / art. 22 / PUODO / changes; added table of personal data categories and retention by category of data subject; corrected analytics statement (Plausible in use, cookieless); demo / pilot enquiry retention aligned to 12 months (was 24); server-log retention set to 30 days; privacy contact changed to privacy@audomate.eu; recipients and transfer safeguards specified; self-hosted fonts. |
| 1.1 | 10 October 2026 | DeepTech (CEO / CTO / data protection coordinator) | Management Board — pending | Updates after Management Board decisions of 10 Oct 2026: Data Protection Coordinator named (Kacper Raubo); privacy@/security@/legal@/support@audomate.eu mailboxes live; web fonts self-hosted (section 3 rewritten); mOrganizer finansów (mBank S.A.) named as invoicing provider; support by e-mail only (no ticketing tool), leads in the sales@ mailbox (no CRM); Google Cloud EMEA Limited confirmed against invoice; AI provider corrected to OpenAI Ireland Ltd (OpenAI API, EU data residency, Zero Data Retention); DPF status of Okta, Vercel and PagerDuty verified 10 Oct 2026; B2B-only model confirmed; DPA in legal review (law firm) since 10 Oct 2026. |
| 1.2 | 11 October 2026 | DeepTech (CEO / CTO / data protection coordinator) | Management Board — pending | Open items closed on the basis of Management Board answers of 11 Oct 2026: business e-mail provider named (Home.pl); external accounting office named (EasyTaxes Sp. z o.o.); EU data residency in PagerDuty confirmed; mOrganizer data processing agreement counterparty named (CashDirector S.A.). |