Privacy Notice

Last updated: 11 October 2026

This notice explains how Yastik processes personal data when you visit yastik.org, contact us about our engineering services, or communicate with us as a business contact. It explains what we use your information for, who receives it and how you can exercise your rights.

1 Who is responsible for your data

The controller is Yastik sp. z o.o., a limited liability company registered in Poland, referred to in this notice as Yastik, we or us.

Registered address: ul. Księcia Witolda 49/15, 50-202 Wrocław, Poland.

KRS: 0001074378. NIP: 8971930898. REGON: 527157682.

For questions about personal data or to exercise your rights, email [email protected] or write to our registered address, marking your correspondence Privacy request.

2 What this notice covers

This notice covers the English and Polish versions of yastik.org, including its service, technology and contact pages. It also covers our handling of business enquiries and professional contact details in our customer relationship management system.

When we process personal data on a client's behalf as an engineering service provider, the client's privacy notice and our agreement with that client govern that processing. Section 13 explains this distinction.

3 Personal data we process

Information you provide to us

For project enquiries and requests for a technical consultation or engineering capacity, we collect your name, work email address, type of enquiry and message. You may also provide your company name, website, professional role and preferred timing. If you discuss a project with us, correspondence may include technical requirements, the requested technology stack, team requirements, scheduling preferences and information needed to prepare a proposal.

If you contact us by email or through a professional social network, we process the information you send and the professional contact information made available in that interaction. Where we agree to a business relationship, we also process the information needed to administer that relationship.

Please do not submit passwords, access tokens, identity documents, payment card details, health information or other sensitive personal data through our general contact forms. Do not include identifiable candidate CVs or unnecessary information about other people. We can agree on an appropriate channel if your request genuinely requires additional information.

Information accompanying a form submission

Our forms can include the submission page URL, referring page, language, form or page type, campaign parameters present in the URL, and the date and time of submission. Campaign parameters may include utm_source, utm_medium, utm_campaign, utm_term and utm_content.

This information helps us handle the enquiry and understand its immediate source. It is not treated as anonymous once associated with your name, email or CRM record. Collecting the source of a submitted enquiry does not mean that we record every page or document you viewed before submitting it.

Technical information

When your browser requests our website, our infrastructure providers process information needed to deliver and protect it. This may include an IP address, request time, requested resource, browser and operating system information, referring page, response status and security-related events.

Browser storage and external resources are described in our Cookie Policy and section 7 below. Form submissions are emailed to us through Amazon SES and do not install CRM tracking code in your browser.

Professional information from other sources

For relevant B2B relationships, we may obtain your name, professional role, employer, publicly available business contact details and relevant professional context from your company's website, public job advertisements, professional networks such as LinkedIn, or a person who introduces us. We do not treat public availability as permission for any use of that information.

We record the source and provide the information required by Article 14 GDPR within the applicable timeframe: normally no later than one month after obtaining the information, at our first communication with you if earlier, or before its first disclosure to another recipient if earlier. Where a specific GDPR exception applies, it must be assessed separately. You can ask us which source we used for your details.

4 Why we use your data and our legal bases

Responding to your enquiry

We use your contact details, message and relevant submission information to understand your request, communicate with you, arrange a discussion and prepare a response or proposal.

If you act on your own behalf and ask us to take steps towards a contract with you, the basis is Article 6(1)(b) GDPR. If you represent a company or another organisation, the basis is Article 6(1)(f) GDPR: our legitimate interest in responding to business enquiries and communicating with its representatives. A company's contract does not automatically make Article 6(1)(b) the basis for processing all of its employees' personal data.

Handling early access requests

We use the details submitted through our corporate early access form to assess your organisation's interest, discuss suitability for the closed test and respond about your request. For company representatives, the basis is Article 6(1)(f) GDPR: our legitimate interest in organising and communicating about a requested B2B product test. Where a person requests steps towards a contract in their own name, Article 6(1)(b) may apply instead.

Submitting this form does not subscribe you to unrelated marketing. Account creation and processing within the product are covered separately before those activities begin.

Managing professional relationships

We use relevant professional contact details and correspondence to administer business relationships, coordinate discussions, maintain accurate CRM records and handle cooperation with clients, suppliers and partners. The basis for processing the details of their representatives is Article 6(1)(f) GDPR. Our legitimate interest is the practical administration of those relationships. Article 6(1)(b) applies where you personally are a party to the relevant contract.

We may assess the relevance of publicly available professional information for potential cooperation under Article 6(1)(f), after considering your reasonable expectations and rights. This does not replace any separate permission required to send commercial electronic messages.

Recording the source of a submitted enquiry

We use limited submission metadata to route your request and understand the immediate source of enquiries. The basis is Article 6(1)(f) GDPR: our legitimate interest in handling requests efficiently and assessing our business communication. We do not use this basis to bypass consent requirements for optional device storage, behavioural tracking or advertising technologies.

Operating and protecting the website

We process technical request and security information under Article 6(1)(f) GDPR. Our legitimate interests are delivering the website, maintaining availability, identifying errors, preventing abuse and protecting our systems and visitors. Only storage or access that meets the applicable necessity exemption is used without prior consent; other device storage requires the consent described in the Cookie Policy.

Optional website features and external fonts

Where optional navigation storage or Google-hosted fonts are enabled, we rely on your consent under Article 6(1)(a) GDPR for their associated personal data processing. We explain the optional features before activation and keep a version of the website available without them. The Cookie Policy explains their operation and your choices.

Marketing communications

If we offer a marketing subscription and you choose to subscribe, we use your email address, any name you provide and your subscription preferences on the basis of consent under Article 6(1)(a) GDPR. We also obtain the prior permission required by applicable electronic communications law, including Article 398 of the Polish Electronic Communications Law where applicable.

We distinguish a response to a request you made from a separate newsletter or unsolicited commercial campaign. Providing a business email address or appearing in a public directory does not by itself authorise every marketing use. Marketing consent is separate, optional and not a condition of submitting an enquiry. You can withdraw it using the option provided in a message or by contacting us.

Legal obligations and protection of rights

We process information necessary to meet applicable legal duties, including responding to data protection requests and maintaining evidence of consent, under Article 6(1)(c) GDPR in connection with the relevant duty. We use information necessary to establish, exercise or defend legal claims under Article 6(1)(f), based on our legitimate interest in protecting our rights.

We may retain a minimal record of an objection or withdrawal under Article 6(1)(f) to respect your preference and avoid contacting you again for a purpose you have refused. Such a record is not used to continue marketing.

5 Whether you must provide information

Providing information through our website is voluntary. Required fields are marked on each form. Without the information needed to identify your request and contact you, we may be unable to respond or assess an early access request. Optional fields help us understand your needs but are not a condition of consent to marketing.

Refusing optional website features or marketing does not prevent you from viewing the main website or sending an enquiry. Some optional presentation or navigation conveniences may be unavailable.

6 Who receives your information

Information is available to authorised Yastik personnel and, where necessary for the relevant purpose, the following recipients or categories of recipients:

• Amazon Web Services (Amazon SES), which delivers enquiry emails from our website forms to our sales inbox. This does not require a visitor tracking script to be installed on our website.
• Cloudflare, which provides website delivery and security services and processes technical request information in providing those services.
• Providers of the website's underlying hosting, business email and supporting IT systems, to the extent needed to operate the website and manage communications.
• Google, where you enable externally hosted Google Fonts, for the technical requests needed to deliver the fonts, as explained in section 7.
• Professional advisers, such as lawyers and accountants, where their work requires the information, and competent authorities where disclosure is required or otherwise lawfully justified.

We use processor agreements where a provider processes data on our behalf. Providers may act as independent controllers for some processing under their own notices; their role depends on the service and purpose. We do not make enquiry information publicly available or disclose it to a potential engineering partner simply because you submit a form. If your request requires a separate recipient or a materially different use, we explain that use and its basis before proceeding.

7 Website resources and cookies

Our Cookie Policy at https://yastik.org/cookies explains cookies, browser storage, optional features and the controls available to you.

When enabled with your permission, external Google Fonts are requested from fonts.googleapis.com and fonts.gstatic.com to display the Inter and Sora typefaces. These requests communicate your IP address, requested resource and browser request headers, which may include browser information and a referring page, to Google. Google states that its Fonts API does not set or log cookies and does not use information collected by Google Fonts to create user profiles or for targeted advertising. The absence of a cookie does not mean that no personal data is processed.

If you decline external fonts, the website uses locally available fallback fonts. If fonts are hosted on our own infrastructure instead, there is no Google Fonts request from your browser for that delivery. Google's explanation is available at https://fonts.google.com/faq#privacy.

8 Processing outside the European Economic Area

Some service providers operate globally. Technical processing, support or access may therefore involve countries outside the European Economic Area, including the United States. Hosting a service in the EU does not, by itself, guarantee that every processing activity stays in the EU.

Where a transfer is subject to Chapter V GDPR, it must have an applicable transfer mechanism. Depending on the recipient and processing, this may be a European Commission adequacy decision or appropriate safeguards such as the Commission's Standard Contractual Clauses, together with supplementary measures where needed. The EU–US Data Privacy Framework is relevant only where the recipient has an applicable, valid certification and the transfer falls within its scope.

We do not rely on your acceptance of this notice or ordinary website use as a blanket authorisation for international transfers. You can contact us for information about the countries and safeguards relevant to your information and to obtain a copy of applicable safeguards, with lawful redactions where necessary.

9 How long we keep information

Retention depends on the purpose and the following criteria. We do not keep a contact record merely because storage is available.

• Enquiries and proposals are kept while we assess and respond to the request and while there is an active, relevant discussion about cooperation. When the request or negotiations are closed and no further action is expected, we remove information no longer needed. Records relevant to a legal obligation or an actual or reasonably anticipated claim follow the separate criteria below.
• Early access requests are kept while we assess the request and organise the relevant invitation or closed test. If the request is declined, withdrawn or no longer relevant, we remove information that is not needed for another disclosed purpose. A waitlist for a later launch is not maintained indefinitely without explaining its purpose and retention criteria. Moving into a product account is subject to the separate product notice.
• Professional contact records are kept while the person remains a relevant contact for an active relationship or a concrete opportunity under assessment. We remove or update records when the role, contact details or business relevance cease to be valid. Direct marketing objections end processing for that purpose, apart from a minimal suppression record.
• Contract, accounting and legally required records are kept for the retention period prescribed by the legislation applicable to that record. Information needed for a claim is kept for the relevant limitation period and, if proceedings are started, for the period needed to conclude them and fulfil resulting duties. An unrelated record is not kept simply because another record is subject to a longer period.
• Marketing subscription information is kept while the subscription remains active and relevant. Withdrawal ends sending under that consent. Limited evidence of consent and withdrawal is retained only while needed to meet accountability duties or address a relevant claim.
• Technical logs are kept only for the period needed to operate the relevant service, identify faults and investigate security incidents. Incident records may need a longer period where necessary to resolve the incident or protect legal rights.
• Browser storage expires or is removed as described in the Cookie Policy. The lifetime of browser storage is different from the retention of personal data already received by a provider or stored in our CRM.

When a purpose ends and no other lawful reason remains, we delete the information or irreversibly anonymise it. Restricted backup copies are not used as an active contact database and are removed through the applicable backup lifecycle.

10 Your rights

Depending on the circumstances and conditions in the GDPR, you can request access to your personal data and a copy, correction of inaccurate information, completion of incomplete information, erasure, or restriction of processing.

You have a right to data portability for information you provided where processing is based on consent or a contract and is carried out by automated means. You can withdraw consent at any time without affecting the lawfulness of processing before withdrawal.

You can object, on grounds relating to your particular situation, to processing based on legitimate interests. We then stop that processing unless we demonstrate overriding compelling grounds or the processing is needed for legal claims.

You can object to direct marketing at any time, without having to explain your circumstances. This includes profiling connected with direct marketing. We stop using your data for that purpose when you object.

To make a request, contact [email protected] or our registered address. Please explain the request and give enough information for us to locate the relevant records. We request proportionate additional identification only where we have reasonable doubts about who is making the request; we do not routinely require a copy of an identity document.

We respond without undue delay and normally within one month of receiving a request. Where its complexity or the number of requests justifies an extension, the GDPR allows up to two additional months. We inform you within the initial month of the extension and its reasons. Requests are generally free; the GDPR permits a reasonable fee or refusal in limited cases involving manifestly unfounded or excessive requests. If we do not act on a request, we explain the reason and the available complaint and judicial remedies.

11 Complaints

You can complain to a competent data protection supervisory authority, including in the EU or EEA country of your habitual residence, place of work or alleged infringement. You do not have to contact us before lodging a complaint.

In Poland, the authority is the President of the Personal Data Protection Office, Prezes Urzędu Ochrony Danych Osobowych. Its address is ul. Stanisława Moniuszki 1A, 00-014 Warszawa, Poland. Current contact information and complaint instructions are available at https://uodo.gov.pl and https://bip.uodo.gov.pl/pl/p/kontakt.

12 Security and automated decisions

We apply technical and organisational measures appropriate to the processing risks. They include limiting access to those who need information for their work and protecting website communications. No internet service can guarantee absolute security. Please contact us if you believe that information submitted to our website has been compromised.

The corporate website enquiry process does not involve solely automated decisions producing legal or similarly significant effects on you within Article 22 GDPR. Organising an enquiry in the CRM or routing it to a responsible person is not, by itself, such a decision.

13 Processing on behalf of clients

If we act as a processor for a client, we process personal data under documented instructions and the applicable client agreement. The binding terms required by Article 28 GDPR must be in place before the relevant processing starts, whether in a separate data processing agreement or within another binding contract. A request to discuss a project is not a substitute for those terms.

For personal data controlled by a client, the client normally handles requests about that processing. We assist in accordance with our processor obligations. We remain a controller for our own necessary business administration, as described in this notice.

14 Other websites and changes

Links to professional networks, client resources or product websites lead to services with their own privacy arrangements. Please review the notice relevant to that service. This does not remove Yastik's responsibility for processing for which we are the controller.

We update this notice when our processing or applicable requirements change and display the revision date. Where necessary, we provide additional information directly or seek new consent before a new consent-based purpose starts. Continuing to use the website is not treated as consent to new optional processing.

For any questions, contact Yastik sp. z o.o. at [email protected] or ul. Księcia Witolda 49/15, 50-202 Wrocław, Poland.