Privacy Policy

This policy explains what personal data we process, why, on what legal basis, for how long, who we share it with and what rights you have. It covers:

• the sevenedge.pl website (Polish and English versions), including forms, calculators and tools, the SVEN chat, meeting bookings and demo pages (sevenedge.pl/pokaz/…),
• our internal panel panel.sevenedge.pl, where we run sales and customer service,
• contact with us by e-mail, phone and messaging apps,
• collecting information about businesses from publicly available sources and business contact with those businesses,
• cooperation with customers and business partners, including customers of the CRMPMS service — to the extent we act as a controller (section 3.12).

This English text is a convenience translation. In case of any discrepancy, the Polish version is legally binding.

1. Data controller

The controller of personal data is Adrian Hunia, a sole trader doing business under the registered business name “SEVENEDGE ADRIAN HUNIA”, entered in the Polish Central Register and Information on Business Activity (CEIDG), NIP (tax ID) 6842688170, REGON 544617676, address: ul. Spacerowa 31, 38-420 Kombornia (“SEVENEDGE”, “we”, “us”).

Contact in personal data matters:

• e-mail: contact@sevenedge.pl (please use the subject line “Personal data”),
• phone: +48 691 957 922,
• by post: ul. Spacerowa 31, 38-420 Kombornia.

We have not appointed a data protection officer (Art. 37 GDPR). Please contact us directly in personal data matters.

2. Key points

• We collect data you give us yourself (forms, e-mail, phone, chat) and publicly available data about businesses and their representatives (registers, company websites, listings).
• We use analytics and advertising cookies and our own visit analytics only after you consent in the cookie banner (details: Cookie policy).
• We do not send marketing messages by e-mail or text message and we do not make marketing phone calls without your prior consent (Art. 398 of the Polish Electronic Communications Law).
• We use artificial intelligence tools (e.g. the SVEN chat on this website, scoring how well a business matches our offer). The SVEN chat is an automated AI assistant, not a human.
• Some of our providers are based outside the European Economic Area (e.g. in the USA); we transfer data to them on the basis of the mechanisms provided in the GDPR (section 5).
• You can object to the use of your data for marketing at any time — just send us a message (e-mail contact@sevenedge.pl) or click the unsubscribe link in a message from us.

3. Purposes, legal bases, data and retention

3.1. Contact form and project brief (the “Contact” page and forms on other pages)

• Data: name, e-mail address, phone number, message, answers in the brief (e.g. industry, current situation, problems, approximate budget and timeline, who decides, preferred contact channel), the result of the tool or configurator the enquiry came from; if you consented to cookies — also the landing page, campaign parameters (UTM), referring domain, Google Ads click identifier (gclid) and visitor identifier together with the history of your visits to our website linked to it (pages visited, tools used and the events described in the Cookie policy, section 4.2).
• Purpose: replying to your enquiry, preparing a call and an estimate, sending an automatic confirmation of receipt.
• Legal basis: Art. 6(1)(b) GDPR (steps taken at your request before entering into a contract); where you write on behalf of a business — Art. 6(1)(f) GDPR (our legitimate interest: replying to the enquiry and contacting a representative of a potential customer). Data about the traffic source and visit history — Art. 6(1)(a) GDPR (cookie consent); without that consent we do not link the enquiry to your visit history.
• Retention: until the discussions end and, if no cooperation follows, 12 months from the last contact; if we start working together — as in section 3.11.

3.2. Forms next to calculators, audits and tools (e.g. loss calculator, estimate, process and automation audit, KSeF readiness check, gender pay gap calculator, PDF report download, referral programme, forms on offer pages)

• Data: e-mail address and, depending on the form, name, company, phone, description of the problem, answers given in the tool and its result, information about your consent.
• Purpose: sending the result or material and contacting you about the matter the result concerns.
• Legal basis: Art. 6(1)(a) GDPR — your consent to e-mail contact about this matter (given by ticking the box next to the form), which is also consent to receive commercial information from us electronically within that scope (Art. 398 of the Electronic Communications Law); for sending the requested result — Art. 6(1)(b) GDPR.
• Retention: until you withdraw consent, no longer than 12 months from the last contact. We keep information on giving and withdrawing consent for the limitation period for claims, so we can demonstrate compliance (Art. 6(1)(f) GDPR).

3.3. Meeting bookings and demo requests (calendar on the website, SVEN chat, “demo” form)

• Data: name, e-mail address, phone (required when booking a time slot, otherwise optional), meeting topic, chosen time slot, information provided in the request.
• Purpose: booking and holding the meeting (including as a Google Meet video call), sending the confirmation and the invitation with the meeting link.
• Calendar and video call: we save the booked slot in our Google Calendar. Google receives the time, the name and the e-mail address of the person booking and sends an invitation with the Google Meet link to that address (section 4). We do not pass the phone number or the content of the request to the invitation.
• Legal basis: Art. 6(1)(b) GDPR; where you act on behalf of a business — Art. 6(1)(f) GDPR.
• Retention: as in section 3.1; the Google Calendar event is deleted together with the booking data.

3.4. SVEN chat (AI assistant on the website)

• What it is: SVEN is an automated assistant based on artificial intelligence, not a human. Replies are generated by a language model of an external provider (Cerebras Systems Inc. (USA)). SVEN answers questions about SEVENEDGE and can book a meeting in our calendar.
• Data: the content of your messages and the replies, and — if you book a meeting — the data listed in section 3.3; your IP address (temporarily, in server memory, to limit the number of requests).
• Purpose: answering questions, booking meetings, protection against abuse.
• Legal basis: Art. 6(1)(f) GDPR (handling visitors' questions, service security) and, when booking a meeting, Art. 6(1)(b) GDPR.
• Retention: we keep a log of conversations on our server solely to improve the replies and to protect against abuse, for no longer than 4 months (older logs are deleted automatically); booking data — as in section 3.3. Please do not share sensitive data in the chat.

3.5. E-mail, phone and messaging correspondence

• Data: identification and contact details, the content of correspondence, information about calls (date, topic, arrangements).
• Purpose: handling correspondence and arrangements.
• Legal basis: Art. 6(1)(f) GDPR (legitimate interest: communicating with people who contact us and with business representatives); Art. 6(1)(b) GDPR where the correspondence concerns entering into or performing a contract with you.
• Retention: until the matter is closed and then until the limitation period for possible claims expires, unless the correspondence concerns a contract (section 3.11).
• AI assistant for correspondence: when one of our employees uses the AI assistant in our panel (section 3.10) to review e-mail or prepare a reply, the following data from the messages is sent to the AI model provider the assistant uses (section 4: OpenAI): sender and recipients, subject, date, the content of the message and of earlier messages in the same thread, and attachment names (not their content). We pass it only so that the assistant can answer and draft a reply. The assistant does not send anything itself: a human reviews, edits and sends the draft. Legal basis: as above (Art. 6(1)(f) GDPR, handling correspondence efficiently).

3.6. Collecting information about businesses from public sources and business contact (B2B marketing)

We look for businesses that our software and services can genuinely help, and we contact them. For this purpose we process data about businesses, including data of sole traders and of representatives and employees of businesses.

• Sources of data (Art. 14(2)(f) GDPR):
  • public registers: the Central Register and Information on Business Activity (CEIDG), the National Court Register (KRS), the REGON register (Statistics Poland), the VAT taxpayer list (the so-called white list),
  • company websites (including contact details and information about the offer),
  • public databases and directories: OpenStreetMap, Google (search results and place information), business directories (e.g. Panorama Firm, PKT.pl, aleo.com, rejestr.io),
  • public procurement and funding notices: the Public Procurement Bulletin and the e-Zamówienia platform, TED, Baza Konkurencyjności, public information bulletins and procurement platforms, public lists of grant beneficiaries,
  • public listings and requests for contractors: Useme, Oferia, OLX, public Facebook groups, job advertisements,
  • referrals: people and businesses who recommend a business to us in our partner programme (the referred business's contact details and a description of its need).
• Data: business name, legal form, NIP, REGON, KRS, business address, name of the business owner or representatives, business contact details (e-mail address, phone, website), industry and business description, the content of a public listing or request, information about the company website (including an automated assessment of its features and appearance based on a screenshot), business signals (e.g. participation in public procurement, a grant received, ongoing recruitment), notes from contact, our score of how well the business matches our offer.
• Purpose: choosing businesses worth contacting, preparing a personalised proposal, establishing and maintaining business contact, assessing (profiling) how well a business matches our offer.
• Legal basis: Art. 6(1)(f) GDPR — our legitimate interest, namely direct marketing of our own services to businesses (recital 47 GDPR). Before starting such activities we carry out and document a legitimate interest assessment.
• How we make contact: we send commercial information electronically (e-mail, text messages, messaging apps) and make marketing calls only after obtaining the recipient's prior consent — this also applies to businesses and legal persons (Art. 398 of the Electronic Communications Law). Without such consent we may: reply to a request for a contractor published by the business — through the channel indicated in the listing, submit a bid in a procurement procedure, or send a traditional letter.
• Information at first contact: at the latest at the first contact we provide information about the processing of data and its source (Art. 14(3)(b) GDPR). If we do not make contact, we provide this information within one month of obtaining the data or — where we have no contact details and it would involve a disproportionate effort — we publish it in this policy (Art. 14(5)(b) GDPR).
• Retention: 12 months from obtaining the data if no contact takes place, or 12 months from the last contact; if we start working together — section 3.11. After you object, we delete the data, keeping only minimal information (e-mail address or domain, date of objection) on a suppression list so that we do not contact you again — for as long as the objection remains relevant (Art. 6(1)(f) GDPR).
• Your right to object: you may object at any time to the processing of your data for direct marketing, including profiling — we will then stop processing it for that purpose (Art. 21(2) and (3) GDPR).

3.7. Demos for potential customers (sevenedge.pl/pokaz/…)

• Description: for a business we are talking to, we prepare a demo of our request monitor — the result of searching public groups and listings for that business's offer. The demo is available at an unguessable address given to that business.
• Data: the content of public posts and listings (as published), group name, publication date, a link to the original post, category, match score and a short AI-prepared explanation of that score. By default we hide the author's name and any contact details extracted from the post; the link, however, leads to the post, where Facebook shows the author.
• Purpose and legal basis: presenting our service to a potential customer — Art. 6(1)(f) GDPR.
• Retention: for as long as needed to present the demo and hold talks with the business it was prepared for; at the request of the person concerned we remove the entry from the demo.

3.8. Website analytics and cookies

• Data: cookie identifiers, IP address, information about the device and browser, pages visited, traffic source, on-page events (e.g. scrolling, button clicks, starting to fill in a form, engagement time).
• Purpose: visit statistics, improving the website, measuring the effectiveness of advertising campaigns and, if you send us a form, linking your visit history to your enquiry so we can prepare a better reply.
• Legal basis: Art. 6(1)(a) GDPR — consent given in the cookie banner (in connection with Art. 399 of the Electronic Communications Law). Without consent we do not store analytics or advertising cookies on your device and we do not run our own analytics. The Google Analytics script is only loaded after you consent.
• Retention: as set out in the Cookie policy; data in Google Analytics — for the retention period set in Google Analytics, no longer than 14 months; data of our own analytics — for as long as needed for visit statistics and assessing the website's effectiveness.
• Details, the list of cookies and how to change your decision: Cookie policy.

3.9. Server logs and security

• Data: IP address, date and time, requested address, response code, browser type (web server logs); in the panel — login and security event data.
• Purpose and legal basis: ensuring the security and continuity of our services, detecting abuse — Art. 6(1)(f) GDPR.
• Retention: server logs — according to their rotation cycle on the server; incident data — until the incident has been clarified and any proceedings have ended.

3.10. Internal panel panel.sevenedge.pl

The panel is SEVENEDGE's working tool and is not publicly available. In it we process the data described in sections 3.1–3.7 and 3.11, and the data of our panel users (login, password hash, permissions, activity log) — on the basis of Art. 6(1)(f) GDPR (organisation of work, security). The panel includes an AI assistant which, at an employee's request, analyses panel data (e.g. leads, calendar, tasks) using an external provider's model (section 4). At an employee's request the assistant also reads messages from the mailbox that employee has connected and drafts a reply (section 3.5). The model the assistant uses is chosen in the settings by the employee or an administrator (section 4). Employees can dictate a question or talk to the assistant by voice. In the “Premium” voice conversation the employee's voice is processed live by OpenAI. Recordings are sent to the provider only to turn them into text and answer; we do not store them, only the text of the conversation stays in the panel.

3.11. Customers and business partners

• Data: data of the customer or business partner (including a sole trader), of representatives and contact persons (name, position, business e-mail and phone), billing data, the content of the contract and correspondence.
• Purposes and legal bases: entering into and performing a contract — Art. 6(1)(b) GDPR (where the contract is with you) or Art. 6(1)(f) GDPR (contact with the business partner's representatives and employees); issuing invoices (including in the National e-Invoicing System, KSeF), keeping tax and accounting records — Art. 6(1)(c) GDPR; establishing, pursuing and defending claims — Art. 6(1)(f) GDPR.
• Retention: for the duration of the contract and then until the limitation period for contractual claims expires (as a rule 3 years for claims related to business activity, counted to the end of the calendar year — Art. 118 of the Polish Civil Code); accounting and tax documents — 5 years from the end of the calendar year in which the tax payment deadline passed (Art. 86 of the Polish Tax Ordinance).

3.12. Customers of the CRMPMS service

• For data that a CRMPMS customer enters into the service or obtains through it (e.g. leads, contacts, Facebook content, business profile data), the customer is the controller, and SEVENEDGE processes that data on the customer's behalf under a data processing agreement (in Polish). Please address requests concerning such data to that customer; if they reach us, we will forward them without delay.
• SEVENEDGE is the controller of the data of CRMPMS customers' representatives and contact persons (section 3.11) and of service security data (e.g. login attempts, event log) — Art. 6(1)(f) GDPR; retention: for the duration of the contract with the customer and as long as needed to investigate possible security incidents.

3.13. Handling your rights and our legal obligations

• Purpose and legal basis: handling the requests described in section 6 and demonstrating accountability — Art. 6(1)(c) GDPR in connection with Articles 12–22 GDPR.
• Retention: until the limitation period for claims related to the request expires.

4. Recipients of data

We share data only to the extent necessary with the following categories of recipients:

Processors acting on our behalf (service providers):

Other recipients:

• Telegram (Telegram Messenger Inc. / Telegram FZ-LLC) and WhatsApp (WhatsApp Ireland Limited) — messaging apps we use to send our team work notifications. The notification about a new enquiry from a form on the website does not contain your personal data: only the name of the form, technical information (e.g. whether it is a repeat enquiry, the number of events in the visit history) and a link to the panel; the team reads the enquiry itself in the panel, after logging in. Personal data may, however, be included in: a message left by phone with our AI assistant (name, call-back number and the matter — via Telegram), our team's morning work summary (e.g. names of businesses that asked for a demo — via Telegram) and alerts about notices, tenders and funding calls from public sources (section 3.6 — via Telegram or WhatsApp). The messaging providers process data on their own terms, and Telegram is based outside the EEA.
• Meta Platforms Ireland Limited — if we enable the Meta pixel in the future, only with your consent; the Meta pixel is currently not used.
• providers of our accounting and legal services, postal and courier operators, our bank, payment service providers and public authorities (e.g. tax authorities, the National e-Invoicing System run by the Minister of Finance, courts, the President of the Personal Data Protection Office) — where required by law or necessary to pursue claims.

We do not sell personal data and we do not share it with other businesses for their own marketing.

5. Transfers outside the European Economic Area

Some providers listed in section 4 process data in third countries, in particular in the USA. Transfers are based on:

• the European Commission's adequacy decision under the EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795) — for recipients certified under that framework; the validity of the decision was confirmed by the General Court of the EU in its judgment of 3 September 2025 (T-553/23), which has been appealed to the Court of Justice, or
• standard contractual clauses adopted by the European Commission (Implementing Decision (EU) 2021/914), concluded with the recipient.

Notifications about new enquiries from forms (section 4) do not contain your personal data. Other work notifications sent via the Telegram messaging app (section 4) are not covered by any of these mechanisms. You can obtain a copy of the safeguards used for the other recipients by contacting us: e-mail contact@sevenedge.pl.

6. Your rights

You have the right to:

1. access your data and obtain a copy of it (Art. 15 GDPR),
2. rectification of your data (Art. 16 GDPR),
3. erasure of your data (Art. 17 GDPR),
4. restriction of processing (Art. 18 GDPR),
5. data portability for data we process by automated means on the basis of consent or a contract (Art. 20 GDPR),
6. object to processing based on our legitimate interest (Art. 21(1) GDPR) and, in the case of direct marketing including profiling, to object unconditionally (Art. 21(2) GDPR),
7. withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal (Art. 7(3) GDPR) — you can change your cookie consent using the “Cookie settings” link in the website footer,
8. lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland (uodo.gov.pl).

To exercise your rights, contact us: e-mail contact@sevenedge.pl. We will reply without undue delay and no later than within one month (in special cases this may be extended by a further two months, in which case we will let you know). We may ask for information needed to confirm your identity.

7. Profiling and automated decisions

For B2B marketing we assess — also using AI models — how well a business or a request it has published matches our offer (e.g. industry, region, signals such as public procurement, a grant, the state of its website). The assessment only helps us decide whom to contact; we do not make decisions based on it that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). You can object to this profiling (section 6).

8. Whether providing data is required

Providing data is voluntary. Without an e-mail address or phone number we cannot reply to your enquiry or book a meeting; without the data required by tax law we cannot enter into a contract or issue an invoice.

9. Artificial intelligence

We use artificial intelligence systems within the meaning of Regulation (EU) 2024/1689 (the AI Act). When you talk to the SVEN chat, you are talking to an AI system — we tell you so in the chat window. Content prepared with the help of AI and addressed to you on our behalf is reviewed by a human, including replies to your e-mails: a human sends them, not the assistant. We do not use high-risk AI systems.

10. Security

We apply technical and organisational measures appropriate to the risk, in particular: encrypted connections (HTTPS/TLS), access to the panel only for authorised persons with a strong password stored as a hash (bcrypt), protection against forged requests (CSRF), limiting login attempts, keeping secrets separate from code, data processing agreements with providers.

11. Changes to this policy

We update this policy when the law, our services or our providers change. The current version is always available at https://sevenedge.pl/polityka-prywatnosci (English: https://sevenedge.pl/en/privacy); we will announce significant changes on the website. Previous versions are available on request.