1. Controller
- The controller of your personal data is Bartosz Gertych, a sole trader operating as BARTOSZ GERTYCH, ul. Stoczkowska 7 lok. 10, 04-147 Warsaw, Poland, tax ID (NIP) 7011057177, REGON 520286755 ("we").
- Data protection contact: [email protected] or by post to the address above. We have not appointed a data protection officer, as we are not required to.
- This policy explains how we process data on the SkillMeBaby platform in accordance with Regulation (EU) 2016/679 ("GDPR").
2. What we process, why and on what basis
| Purpose | Data | Legal basis |
|---|---|---|
| Creating and keeping your Account, signing in, session security | e-mail address, first name or display name, password hash (we never store your password in plain text), preferred language, device session data (browser type, hashed IP address, sign-in dates), Google or Apple account identifier when you sign in with them | Art. 6(1)(b) GDPR (contract for keeping the Account) |
| Verification codes and transactional e-mails (sign-up, password reset, e-mail change, security notices, document changes) | e-mail address, name, message content; the delivery log stores only a pseudonymised tag of the address | Art. 6(1)(b) and (c) GDPR |
| Organizer profile and Activities in Studio | profile data (name, description, city, address, website, contact e-mail and phone, social media profiles, logo and photos), Activity descriptions, members of the organizer's team | Art. 6(1)(b) GDPR |
| AI assistant that helps fill in the organizer profile | what you type in the conversation and the profile data it concerns | Art. 6(1)(b) GDPR (the feature runs at your request) |
| Finding the nearest city | approximate browser location (rounded to about 100 m), only after you click "Use my location" or when your browser already allows it; we do not store it or log coordinates | Art. 6(1)(a) GDPR (consent given in the browser) |
| Measuring which sources and pages lead to activities and registration links (analytics, only with your consent) | page views and clicks with page type, category, skill or activity, language, device type and the source of the visit (channel, campaign, entry page, referring site's domain); no IP address, browser details, identifiers or Account link | Art. 6(1)(a) GDPR; Art. 399 of the Polish Electronic Communications Law |
| Recording acceptance of legal documents (version and date) | Account identifier, document version, date and method of acceptance | Art. 6(1)(c) and (f) GDPR (demonstrating the terms of the contract) |
| Consent to marketing e-mails (if you give it) | e-mail address, history of giving and withdrawing consent | Art. 6(1)(a) GDPR; Art. 398 of the Polish Electronic Communications Law |
| Handling requests, complaints and enquiries | data given in the request | Art. 6(1)(c) and (f) GDPR |
| Content moderation and notices of illegal content | data of the reporting person and about the reported content | Art. 6(1)(c) GDPR (Digital Services Act) |
| Establishing, pursuing and defending claims | data needed in the case | Art. 6(1)(f) GDPR |
Providing data is voluntary, but we cannot keep an Account without the data required to create it. We do not make decisions based solely on automated processing that produce legal effects for you. We do not send marketing e-mails at the moment; we record consent so that, in the future, we only send them to people who agreed.
3. Recipients
We share data only with parties that help us run the Platform, under data processing agreements or as separate controllers:
- DigitalOcean, LLC (USA) — hosting of the Platform's application and database on servers in Frankfurt (Germany);
- Cloudflare, Inc. (USA) — storage of files such as logos and photos (Cloudflare R2);
- Amazon Web Services EMEA SARL (Luxembourg), using infrastructure of Amazon Web Services, Inc. (USA) — delivery of transactional e-mails (Amazon SES) from servers in Frankfurt (Germany): your e-mail address and the message content;
- OpenAI Ireland Ltd. (Ireland), using infrastructure of OpenAI, L.L.C. (USA) — only when you use the AI assistant in Studio;
- Google (Google Ireland Ltd.) and Apple (Apple Distribution International Ltd.) — when you sign in with them; they act as separate controllers under their own privacy policies;
- providers of legal, accounting and advisory services — to the extent necessary;
- public authorities — when required by law.
We send e-mails through Amazon SES; if an address permanently rejects our messages or a message is reported as spam, we stop sending to it and keep only a pseudonymised tag of the address for that purpose. Data in public organizer profiles and Activities is visible to everyone visiting the Platform.
4. Transfers outside the European Economic Area
Some recipients (DigitalOcean, Cloudflare, Amazon Web Services, OpenAI, Google and Apple) may process data in the United States. Transfers rely on the European Commission's adequacy decision (EU-US Data Privacy Framework) for entities certified under it, and otherwise on standard contractual clauses adopted by the European Commission. You can obtain a copy of the safeguards by contacting us.
5. How long we keep data
- Account data — until the Account is deleted. We delete the Account at your request within 30 days at the latest, together with its sessions, history of document acceptances and consents. We keep data longer only where the law requires it or where it is needed to defend against a specific claim that has been raised.
- Device session data — until the Account is deleted. A session gives access to the Account only until you sign out or it expires (max. 30 days); you can see your sessions in your Account settings.
- Verification codes — until used or expired (15 minutes) and briefly afterwards.
- History of document acceptances and consents — for the life of the Account and the limitation period of claims.
- Organizer profile and Activities — until the Organizer deletes them or the last team member's Account is deleted, subject to legal obligations.
- AI assistant conversations — we do not store them on our servers; the conversation draft stays in your browser's storage until you save the profile or clear browser data. OpenAI may keep submitted content for up to 30 days to detect abuse and does not use it to train models.
- Analytics events — 90 days; afterwards only daily totals without any detail about single visits, for 13 months. The source of your visit stays in the browser tab only until you close it or withdraw consent.
6. Your rights
You have the right to access your data and obtain a copy, to rectification, erasure, restriction of processing, data portability, to object to processing based on legitimate interests, and to withdraw consent at any time (without affecting the lawfulness of processing before withdrawal). You can withdraw marketing consent in your Account settings, and analytics consent in Cookie settings (footer); measurement stops at once. To exercise your rights, write to [email protected].
You may also lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl).
7. Security
We apply technical and organisational measures appropriate to the risk, including encrypted connections, storing passwords and codes only as cryptographic hashes, session tokens in cookies that page scripts cannot read, and the option to sign out of all devices.
8. Cookies
Information about cookies and similar technologies is in the Cookie Policy.
9. Changes
We update this policy when the way we process data changes. Each version has a number and an effective date, and previous versions remain available on the Platform. We inform Account holders of material changes by e-mail.