Privacy and cookie policy

Version 1.0, effective from 13 November 2026

§ 1 Controller

1. The controller of your personal data is Mateusz Stachowicz conducting a sole-trader business under the firm name "Mateusz Stachowicz", ul. Adama Mickiewicza 29, 40-085 Katowice, NIP 6351848428, REGON 380986179, operating under the "Jointhubs" brand (hereinafter: the "Controller", "we").
2. In matters concerning personal data you can contact the Controller by e-mail at office@jointhubs.com or in writing at the address indicated in item 1. The Controller has not appointed a data protection officer, because there is no such obligation (Art. 37(1) GDPR).
3. The Policy concerns the jointhubs.com website (hereinafter: the "Website") and contacts established through it: the contact form, booking an appointment, the free consultation, the workshop and the AI Demo.

§ 2 Purposes and legal bases of processing

1. In connection with the use of the Website we process technical data (IP address, browser and device data, server logs) in order to ensure the operation and security of the Website, on the basis of our legitimate interest (Art. 6(1)(f) GDPR).
2. Only after consent has been given in the cookie panel do we process data on how the Website is used (the subpages visited, the source of entry, the duration of the visit, the approximate location, device identifiers) in order to analyse traffic using Google Analytics 4, on the basis of your consent (Art. 6(1)(a) GDPR in connection with Art. 399 of the Polish Electronic Communications Law of 12 July 2024 (the "ECL")).
3. Only after consent to advertising cookies has been given do we process data on a click on our advertisement and on actions taken on the Website after that click (e.g. submitting a form, booking an appointment) in order to measure the effectiveness of Google Ads campaigns, on the basis of your consent (Art. 6(1)(a) GDPR in connection with Art. 399 ECL). We do not use remarketing. In this scope Google acts as a separate controller of the data.
4. If you do not give the consent referred to in items 2 and 3, the Google tools do not store cookies on your device; Google then receives only cookie-less and identifier-less signals, with the consent denial status, used for aggregate modelling of statistics (Consent Mode). The legal basis is our legitimate interest in the aggregate measurement of the effectiveness of the Website and campaigns (Art. 6(1)(f) GDPR); you may object on the terms set out in § 6.
5. Data provided in the contact form (e-mail address, the selected area of interest, company size, role in the company and, optionally, a description of the need, and in the form on the subpages about process automation and AI implementation: the e-mail address and a description of the process) or when booking a consultation appointment in Cal.com (first and last name, e-mail address, the selected time slot and an optional note) we process in order to respond to the enquiry and arrange the free consultation, on the basis of Art. 6(1)(b) GDPR (actions taken at your request before entering into a contract), and where you act on behalf of a company, on the basis of our legitimate interest consisting in contact with a representative of a potential client (Art. 6(1)(f) GDPR). Together with the enquiry or the booking we receive information about the source of the visit (campaign parameters, the ad click identifier, the address of the referring page and the entry page), and in the case of a booking also information about your decision regarding advertising cookies; we process this data in order to know which activities lead to contact, on the basis of our legitimate interest (Art. 6(1)(f) GDPR).
6. Data of participants of the free consultation and the workshop (first and last name, e-mail address, position or role, image and voice during the video call, the content of statements) we process in order to hold the meeting, prepare a recommendation or an offer and perform the workshop contract, on the basis of Art. 6(1)(b) GDPR where you are a party to the contract or the person concluding it, or Art. 6(1)(f) GDPR where you participate as a representative or an employee of a client. The rules on recording and transcription are set out in the Information for meeting participants.
7. The content of questions entered in the AI demo "Ask a great mind" and the generated answers we process in order to provide an answer through the language model, on the basis of Art. 6(1)(b) GDPR (provision of the service at your request). Do not enter personal data into the demo, neither your own nor that of other persons.
8. If you conclude a contract with us, we process the data in order to perform it (Art. 6(1)(b) GDPR) and to issue invoices and keep tax records (Art. 6(1)(c) GDPR in connection with the provisions of the Act on Goods and Services Tax and the Tax Ordinance).
9. We may process data in order to establish, pursue or defend claims and to demonstrate compliance with the law, including keeping records of the acceptance of documents, consents given and objections raised (Art. 6(1)(f) in connection with Art. 5(2) and Art. 7(1) GDPR).
10. Providing the data is voluntary, however:
    • a) without an e-mail address we cannot respond to the enquiry or arrange a consultation;
    • b) without data identifying the parties we cannot conclude a contract;
    • c) failure to give consent to analytics or advertising cookies does not affect the ability to use the Website or the consultation.

§ 3 Data retention periods

1. We store data for the periods indicated in the table below:

2. After the periods referred to in item 1 expire, we delete the data or anonymise it.

§ 4 Recipients of data

1. We use the services of providers who process data on our behalf as processors (Art. 28 GDPR):
   • a) hosting of the Website: Google Cloud Poland Sp. z o.o., Rondo Daszyńskiego 2C, 00-843 Warszawa (Firebase Hosting, Google Cloud); the application server operates in the us-central1 region (USA);
   • b) e-mail, calendar, video calls, meeting recording and file storage: Google Cloud Poland Sp. z o.o., address as in item a) above (Google Workspace, including Gmail, Google Calendar, Google Meet and Google Drive);
   • c) transcription of meeting recordings: OpenAI Ireland Limited, 1st Floor, The Liffey Trust Centre, 117-126 Sheriff Street Upper, Dublin 1, D01 YC43, Ireland (OpenAI API, processing in the EU region);
   • d) scheduling of consultations: Cal.com, Inc., 2261 Market Street #4382, San Francisco, CA 94114, USA (Cal.com); together with the booking Cal.com receives the information about the source of the visit referred to in § 2 item 5;
   • e) analytics: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (Google Analytics 4);
   • f) the AI demo "Ask a great mind": OpenRouter, Inc., 169 Madison Avenue #2404, New York, NY 10016, USA; the question entered by the user is passed by OpenRouter to the language model provider selected in the demo interface;
   • g) accounting: Vinci & Vinci Sp. z o.o., ul. Adama Mickiewicza 29, 40-085 Katowice, NIP 9542298437.
2. The contact form does not store data in a database. The message from the form goes by e-mail to our mailbox in Google Workspace.
3. As regards the measurement of the effectiveness of Google Ads campaigns (§ 2 item 3), the recipient of the data is Google Ireland Limited, acting as a separate controller.
4. Data may be disclosed to public authorities where this follows from the provisions of law.
5. We do not sell data and we do not disclose it to other entities for marketing purposes.

§ 5 Transfers of data outside the European Economic Area

1. Some of the providers process data in the United States. The transfer takes place on the following bases:

2. You can obtain a copy of the safeguards by writing to the address indicated in § 1 item 2.

§ 6 Your rights

1. You have the right:
   • a) of access to the data (Art. 15 GDPR);
   • b) to rectification of the data (Art. 16 GDPR);
   • c) to erasure of the data (Art. 17 GDPR);
   • d) to restriction of processing (Art. 18 GDPR);
   • e) to portability of data processed on the basis of consent or a contract (Art. 20 GDPR);
   • f) to object to processing based on a legitimate interest (Art. 21(1) GDPR);
   • g) to withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal (Art. 7(3) GDPR).
2. You have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa (Art. 77 GDPR).
3. We do not make decisions about you based solely on automated processing, including profiling, that produce legal effects for you or similarly significantly affect you (Art. 22 GDPR). If you give consent to advertising cookies, Google, as a separate controller, may use the data also for its own advertising purposes, in accordance with its privacy policy.

§ 7 Cookies and similar technologies

1. Cookies are small files stored on your device; browser storage (localStorage and sessionStorage) works in a similar way. We use:
   • a) necessary cookies: required for the operation of the Website, remembering the language version and your choices in the cookie panel, the operation of the AI demo when you use it, and the protection of the booking window; they do not require consent (Art. 399 ECL);
   • b) analytics cookies (Google Analytics 4): stored only after consent has been given;
   • c) advertising cookies (Google Ads): stored only after consent has been given;
   • d) entries in the browser's session storage that remember the source of the visit for as long as the tab is open, passed together with an enquiry or a booking (§ 2 item 5); removed when the tab is closed.
2. On the first visit we display a panel in which you can accept or reject analytics and advertising cookies. The reject button is as visible as the accept button.
3. You can change or withdraw your consent at any time using the "Cookie settings" link in the footer of the Website.
4. The following cookies and browser storage entries are used on the Website:

5. You can also change the cookie settings in your browser. Blocking necessary cookies may make it difficult to use the Website.

§ 8 Changes to the Policy

1. We update the Policy when the tools or the manner of processing data change. The current version is always available on the Website.
2. The Policy applies from 13 November 2026.