Privacy & Cookies Policy

This Policy sets out the rules for processing personal data and for storing and accessing data on the Devices of Users using the Website, including data processed as part of functions based on artificial intelligence.

§ 1. Definitions

1. Website — the website available at https://notberg.com.

2. Controller — Notberg Sp. z o.o. with its registered office in Warsaw, ul. Wspólna 50A/22, 00-684 Warsaw, tax identification number: 1132993659, register number: 0000772427.

3. User — a natural person using the Website, or a natural person acting on behalf of a Client that is a legal entity.

4. Client — an entity for which the Controller provides services (a natural person, legal entity, or organisational unit).

5. GDPR — Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.

6. Device — an electronic device with software through which the User accesses the Website.

7. Cookies — text data collected in the form of files stored on the User’s Device.

8. AI Systems — artificial intelligence algorithms supporting the provision of services on the Website.

§ 2. Data controller and contact

1. The data controller within the meaning of Article 4(7) GDPR is Notberg Sp. z o.o.

2. For all matters relating to the processing of personal data, the Controller may be contacted:

   • in writing: ul. Wspólna 50A/22, 00-684 Warsaw,

   • by e-mail: [email protected],

   • by phone: +48 22 243 43 43.

3. The Controller has not appointed a Data Protection Officer. Any queries concerning personal data should be addressed directly to the Controller.

§ 3. Purposes and legal bases for processing data

The Controller processes the personal data of Users and Clients for the following purposes:

1. Conclusion and performance of a contract for the provision of services (including visa assistance, document legalisation, apostille, translations) — legal basis: Article 6(1)(b) GDPR.

2. Fulfilment of legal obligations imposed on the Controller (including accounting and tax obligations) — legal basis: Article 6(1)(c) GDPR.

3. Marketing of the Controller’s own services and handling contact enquiries — legal basis: Article 6(1)(f) GDPR (legitimate interest of the Controller) or Article 6(1)(a) GDPR (User’s consent).

4. Analytics and improvement of the Website based on statistical data (e.g. Google Analytics) — legal basis: Article 6(1)(a) GDPR (consent expressed through cookie settings) or Article 6(1)(f) GDPR (legitimate interest).

5. Establishing, exercising and defending legal claims — legal basis: Article 6(1)(f) GDPR.

6. Use of AI features on the Website (e.g. preliminary document analysis) — legal basis: Article 6(1)(b) GDPR (where this forms part of the provision of a service) or Article 6(1)(a) GDPR (where consent is required).

§ 4. Data retention period

1. Data processed for the purpose of performing a contract is stored for the duration of the contract and, after its termination, for the period necessary for settlements, complaint handling and the establishment, exercise or defence of legal claims (as a rule, until the expiry of the limitation period for claims, usually 6 years).

2. Data processed for the purpose of fulfilling tax and accounting obligations is stored for 5 years from the end of the tax year in which the obligation arose.

3. Data processed on the basis of consent is stored until such consent is withdrawn.

4. Statistical and analytical data is processed in accordance with the retention periods of external providers (e.g. Google Analytics), no longer than 26 months from the last activity.

5. Data entered into AI Systems is processed for the period necessary to handle the specific query or service. Query history may be stored in the User’s account until it is deleted.

§ 5. Data recipients

1. Personal data may be transferred to the following categories of recipients:

   • government offices, embassies, consulates and other public authorities, to the extent necessary to provide the service (e.g. visa assistance, legalisation, apostille),

   • courier companies, to the extent necessary to send and deliver shipments,

   • cloud and hosting infrastructure providers (including Google Cloud),

   • providers of analytical tools (including Google Analytics),

   • payment service providers processing online payments,

   • providers of AI Systems (in accordance with § 7 of this Policy),

   • law firms, tax advisers, accounting office, auditors,

   • sworn translators cooperating with the Controller.

2. All external recipients process data on the basis of data processing agreements that meet the requirements of Article 28 GDPR or on the basis of their own legal grounds.

§ 6. Transfer of data outside the European Economic Area

1. The Controller processes and stores Users’ personal data on servers located in the European Economic Area (EEA).

2. Insofar as some analytical or cloud service providers may transfer data outside the EEA (e.g. in the case of the global infrastructure of Google), such transfer is based on standard contractual clauses approved by the European Commission or other mechanisms provided for in Chapter V GDPR.

§ 7. Processing of data using artificial intelligence (AI)

1. The Website provides functionalities based on artificial intelligence algorithms.

2. The Controller processes queries (prompts), files and other information entered by the User into AI modules in order to generate responses, provide the service and improve the functioning of the Website.

3. Location of processing: AI Systems used on the Website operate on cloud infrastructure located in the European Economic Area (EEA).

4. Prohibition on training external models: Data entered into AI Systems is not used to train external providers’ public foundation models in a manner that would breach the confidentiality of the User’s data.

5. Prohibition on entering special category data: The User undertakes not to enter into the AI Systems any special categories of personal data within the meaning of Article 9 GDPR (including data concerning health, political opinions, biometric data) relating to himself/herself or third parties, unless this is necessary for the provision of the service and the User has an appropriate legal basis for this. The Controller is not liable for the processing of such data entered in breach of this provision.

6. No fully automated decision-making: The Controller does not take decisions concerning the User that are based solely on automated processing which would produce legal effects concerning the User or similarly significantly affect the User within the meaning of Article 22 GDPR. Content generated by AI is verified by the Controller’s staff before taking any decision affecting the Client, except for services that are expressly marked as fully automated.

7. Compliance with the AI Act: The Controller monitors the requirements arising from Regulation (EU) 2024/1689 of the European Parliament and of the Council on artificial intelligence (AI Act) and adjusts the Website’s AI functions to the obligations in force at any given time.

§ 8. User’s rights

The User has the following rights under the GDPR:

1. Right of access (Article 15 GDPR) — to obtain information on what data is processed and to receive a copy thereof.

2. Right to rectification (Article 16 GDPR) — to request that data be corrected or completed.

3. Right to erasure (Article 17 GDPR) — subject to cases where the Controller is obliged to continue storing the data (e.g. accounting and tax obligations).

4. Right to restriction of processing (Article 18 GDPR).

5. Right to data portability (Article 20 GDPR) — to receive the data in a structured, commonly used and machine-readable format.

6. Right to object (Article 21 GDPR) — where data is processed on the basis of the Controller’s legitimate interest and for marketing purposes.

7. Right to withdraw consent at any time where processing is based on consent. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

8. Right not to be subject to a decision based solely on automated processing (Article 22 GDPR).

9. Right to lodge a complaint with a supervisory authority, namely the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, www.uodo.gov.pl), if the User considers that the processing of data infringes the GDPR.

To exercise the above rights, the User should contact the Controller in the manner indicated in § 2(2).

§ 9. Cookies

Types and operation

1. First-party cookies — files placed on and read from the User’s Device by the Website’s IT system.

2. Third-party cookies — files placed by IT systems of external services (including Google Analytics).

3. Session cookies — files deleted after the Device session ends.

4. Persistent cookies — files stored until they are manually deleted or until a defined period expires.

5. Functional and login cookies — created during login to store login information and selected screen options. Login cookies expire after two days, screen options after one year, and, if the “Remember me” option is selected, after two weeks.

6. Personalisation cookies — stored when editing or publishing content on the Website, expiring after 1 day, not containing personal data.

Purposes of using Cookies

1. Necessary — to ensure the correct operation of the Website and of authorisation and login mechanisms. These files do not require consent.

2. Analytical and statistical — to collect information on how the Website is used for analysis and improvement purposes. These files require the User’s consent given via the cookie banner.

3. Marketing — if such cookies are implemented, they will only be activated with the User’s prior consent.

Cookie management

1. The User may change the settings regarding the storage, deletion and access to data stored in Cookies at any time, using the cookie banner on the Website or the browser settings.

2. All modern web browsers allow Cookies to be disabled in the privacy and security settings.

3. Restricting the storage of and access to Cookies may cause some Website functions to malfunction.

§ 10. Embedded content from other websites

Content on the Website may include embedded material from other websites (e.g. videos, images, articles). Embedded content behaves in the same way as a direct visit to the partner website. These websites may collect information about the User, use their own cookies and monitor interactions with the embedded material in accordance with their own privacy policies.

§ 11. Data security

1. The Controller applies technical and organisational measures appropriate to the risks associated with processing, including encryption of connections (SSL/TLS), access control and regular backups.

2. The mechanisms for storing and reading Cookies do not enable the collection of personal data or confidential information from the User’s Device.

3. The Controller is not responsible for the security of Cookies originating from the Website’s partners.

4. Data security also depends on the User’s actions and the security of the User’s Device.

§ 12. Exclusions and limitations of liability

1. The Controller is not liable for the interception of data, hijacking or deletion of the User’s session as a result of the User’s activity, or viruses, trojans and spyware installed on the User’s Device.

2. Services provided by third parties are outside the Controller’s control.

3. Liability for AI content: Content generated by AI Systems is of an informational, illustrative or auxiliary nature. Due to the specific characteristics of machine learning technology (AI hallucinations), the Controller does not guarantee 100% accuracy, reliability or timeliness of generated content. The generated information does not constitute professional legal, medical, financial, tax or engineering advice. The obligation to verify the generated content (including for potential infringements of third-party copyright) rests with the User. The full rules of liability for paid services are set out in the Terms & Conditions.

§ 13. Graphic materials and metadata

When uploading graphic materials to the Website, the User should avoid uploading images containing embedded location data (EXIF GPS tags), unless this is necessary. Content may be analysed by automated filters and cybersecurity tools.

§ 14. Amendments to the Privacy Policy

1. The Controller reserves the right to amend this Policy.

2. The Controller will inform Users of material changes to the Policy at least 14 days before they take effect, in a manner that enables them to familiarise themselves with the content of the changes (e.g. a notice on the Website, an e-mail to registered Users).

3. Technical and editorial changes that do not affect the scope of Users’ rights may be introduced without a notification period.

4. The current version of the Policy is always available at https://notberg.com.