QENSA Privacy Policy

1. Data controller

1. The controller of personal data is Neurocore spółka z ograniczoną odpowiedzialnością (a limited liability company) with its registered office in Sośnica, ul. 3 Maja 25, 37-555 Sośnica, KRS 0001160402, NIP 7922326995, REGON 541129249 (the "Controller" or "we").
2. In matters concerning personal data, you may contact us at: mail@qensa.org.

2. Two roles and the scope of this Policy

1. This Policy describes how we process personal data as controller – with respect to visitors to the qensa.org website, persons creating and maintaining an Account, and persons using the contact forms.
2. A separate situation is the processing of personal data that may be contained in documents uploaded by Customers to the application (Customer Content). In that respect, we act as a processor on behalf of the Customer acting as controller, and the applicable rules are set out in § 12 of the Terms of Service (entrustment of data processing), not in this Policy.

3. Purposes, legal bases and retention periods

We process data for the following purposes:

1. Provision of the Service and maintenance of the Account – legal basis: necessity for the performance of a contract (Article 6(1)(b) GDPR). Retention period: the term of the contract, and thereafter until the expiry of the limitation period for any claims.
2. Account registration and newsletter – legal basis: consent (Article 6(1)(a) GDPR), performance of a contract, or our legitimate interest in contacting you regarding the service (Article 6(1)(b) and (f) GDPR). Retention period: until consent is withdrawn, an objection is raised, or Account servicing ends.
3. Handling enquiries from the contact form – legal basis: taking steps prior to entering into a contract and our legitimate interest in providing a response (Article 6(1)(b) and (f) GDPR). Retention period: the duration of handling the matter and until the expiry of the limitation period for claims.
4. Billing and tax obligations – legal basis: legal obligation (Article 6(1)(c) GDPR). Retention period: in accordance with tax and accounting regulations.
5. Payment processing (subscriptions) – legal basis: performance of a contract (Article 6(1)(b) GDPR). Payments are processed by an external payment services provider; we do not store full payment card details.
6. Marketing of our own services – legal basis: our legitimate interest (Article 6(1)(f) GDPR), and with respect to electronic communications – consent. Retention period: until an objection is raised or consent is withdrawn.
7. Security, statistics and analysis of the Service – legal basis: our legitimate interest (Article 6(1)(f) GDPR), and to the extent requiring cookie consent – consent (section 8). Retention period: in accordance with the configuration of the tools.
8. Establishment, pursuit or defence of claims – legal basis: our legitimate interest (Article 6(1)(f) GDPR).

4. Voluntary provision of data

Providing data is voluntary but necessary to use the relevant features (e.g. creating an Account, subscribing to the newsletter, making contact). Failure to provide data may prevent the relevant feature from being used.

5. Recipients of data

1. Data may be disclosed to entities processing it on our behalf, in particular the following categories of recipients:

• a cloud infrastructure provider (hosting, data storage) in the European Union;
• providers of artificial intelligence models made available via an API;
• an external payment services provider;
• providers of analytics and marketing tools;
• providers of communication, ticketing, and e-mail tools;
• entities providing accounting and legal services.

2. Data may be disclosed to public authorities where required by law.
3. A detailed, up-to-date list of the entities processing entrusted data (in the context of Customer Content) is made available upon request, in accordance with § 12 of the Terms of Service.

6. Transfers of data outside the EEA

1. As a rule, data is processed in the European Union region.
2. To the extent that cooperation with tool providers (e.g. AI models, analytics) involves the transfer of data outside the European Economic Area, this takes place on the basis of mechanisms compliant with the GDPR, in particular the standard contractual clauses approved by the European Commission, together with additional safeguards.

7. Data and AI model training

Content submitted to the Service is not used to train or fine-tune artificial intelligence models. This commitment arises from the terms of the agreements concluded with the infrastructure and AI model providers.

8. Cookies and similar technologies

1. The Service uses cookies and similar technologies to ensure proper operation, analyse traffic, and – with the User's consent – for marketing purposes.
2. We use the following categories of cookies:

3. Analytics and marketing cookies are activated after consent is given via the cookie banner. Consent may be withdrawn at any time by changing the settings in the Service or in the browser.
4. The use of Google Analytics 4 may involve the transfer of data to Google LLC; this takes place on the terms described in section 6.
5. The User may manage cookies in their browser settings, including blocking or deleting them. Restricting cookies may affect the operation of certain features of the Service.

9. Rights of data subjects

1. You have the right to:

• access your data and obtain a copy of it;
• rectify your data;
• erase your data;
• restrict processing;
• data portability;
• object to processing based on legitimate interest;
• withdraw consent at any time (without affecting the lawfulness of processing carried out before its withdrawal).

2. To exercise your rights, please contact us at: mail@qensa.org.
3. You have the right to lodge a complaint with the supervisory authority – the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych) (ul. Stawki 2, 00-193 Warszawa, Poland).

10. Automated decision-making and profiling

We do not make decisions concerning you based solely on automated processing, including profiling, that would produce legal effects or similarly significantly affect your situation.

11. Changes to the Privacy Policy

We may update this Policy in the event of changes in the law, technology, or the scope of our services. The current version is published in the Service together with the date of the last update.