Last updated: 10 October 2026. This policy explains what personal data we collect on breinz.ai, why, for how long, and what rights you have. It applies to the website only — services we deliver to clients are governed by the relevant contract.
1. Who is the controller
The controller of your personal data is Digital We, ul. Wierzynka 3/28, 01-172 Warsaw, Poland, (tax ID) 5211476251, REGON 013089777, operating the breinz brand and the website breinz.ai.
For anything related to your data, write to admin@breinz.ai. We have not appointed a data protection officer, as we are not required to.
2. What data we process and why
Contact form
When you send us a message we process your name, email address, company name (if given) and the content of your message. We use it to answer you and, if it comes to that, to prepare an offer. Legal basis: taking steps at your request before entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in handling enquiries (Art. 6(1)(f) GDPR). We keep this data for as long as the conversation is live and then up to 3 years, in case a claim arises from it.
Marketing emails
If you tick the consent box in one of our forms, we process your email address to send you news and marketing from breinz.ai by email, sparingly. If you tick it in the contact form, we also keep the name and company you gave there. Legal basis: your consent (Art. 6(1)(a) GDPR). Together with your address we store the date, the IP address, the page and form you used and the wording of the consent you agreed to, so that we can prove it was given (Art. 7(1) GDPR). We also note when an email to your address fails, so we can stop sending to addresses that no longer work.
Our emails come in separate kinds, such as notifications of new posts or the newsletter; every email has a link to stop that kind or all of them. Stopping all of them, or writing to admin@breinz.ai, withdraws your consent. Withdrawal does not affect the lawfulness of emails sent before it. After withdrawal we keep only the proof of your consent and its withdrawal for 3 years, in case a claim arises, and then delete it.
Server logs and website security
Like every website, our hosting records technical data about each visit: IP address, date and time, requested URL, browser and operating system. We use it to keep the site running, detect abuse and diagnose errors. Legal basis: our legitimate interest in the security and stability of the site (Art. 6(1)(f) GDPR). Logs are kept for up to 90 days.
Analytics
We use Google Analytics to understand how the site is used — which pages are visited, from where and on what devices. Legal basis: your consent (Art. 6(1)(a) GDPR, Art. 173 of the Polish Telecommunications Law), which you can withdraw at any time by blocking analytics cookies. Details, including how to opt out, are in our Cookies page.
3. Who we share data with
We do not sell personal data and we do not share it with anyone for their own marketing. Your data is handled by providers who process it on our behalf and under our instructions: the hosting provider of breinz.ai, the email delivery service we use to send form notifications and marketing emails, and Google (Google Ireland Ltd.) for analytics. Where a provider is based outside the European Economic Area — as Google may be — the transfer relies on the European Commission’s adequacy decision for the EU–US Data Privacy Framework or on Standard Contractual Clauses.
We may also disclose data where the law requires it, for example to a public authority acting within its powers.
4. Your rights
Under the GDPR you have the right to:
- access your data and get a copy of it,
- have it corrected or deleted,
- restrict how we process it,
- receive it in a portable format where processing is based on consent or a contract,
- object to processing based on our legitimate interest,
- withdraw consent at any time, without affecting what was done before.
To exercise any of these, email admin@breinz.ai. We answer within one month. If you think we are handling your data unlawfully, you can lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl) or with the supervisory authority in the EU country where you live.
5. Is providing data mandatory?
No. It is voluntary — but without a name, an email address and a message we cannot answer your enquiry, and without an email address we cannot send you marketing emails.
6. Automated decisions
We do not make automated decisions about you and we do not profile you. Every message sent through the form is read by a person.
7. Changes to this policy
We update this policy when the way we process data changes. The current version is always the one published here, with the date at the top.