Privacy notice

PRIVACY NOTICE OF THE SMARTCVI EDUCATIONAL PLATFORM
(draft for review — version 2026-10-draft-1; the Polish version is binding)

1. Controller
The controller of the personal data of users of the SmartCVI educational platform (the "Platform") is [COMPANY NAME], registered office [REGISTERED ADDRESS], KRS [KRS NUMBER], NIP [NIP] (the "Controller"). Contact for data-protection matters: [E-MAIL ADDRESS]. [IF APPOINTED: details of the data protection officer.]

2. What data we process
a) account data: e-mail address, username, chosen language, account creation date, e-mail confirmation;
b) purchase data: the package and access period chosen, payment dates and amounts, subscription status, billing country and — for a business purchase — the name, address and tax id for the invoice; payment-card details are processed solely by the payment operator (Stripe) and never reach the Controller;
c) learning data: the teaching cases attempted, the reports and measurements entered, assessment results, chapter progress, ratings given to content;
d) technical data: IP address, session identifier, browser and device information (including the result of the image-viewer compatibility test), security event logs;
e) correspondence: messages sent through the contact form or by e-mail, including withdrawal statements and complaints.
Teaching cases on the Platform contain only anonymised or synthetic images; we do not process users' medical data.

3. Purposes and legal bases
a) keeping the account and providing the service (Article 6(1)(b) GDPR — performance of a contract);
b) processing payments, issuing and storing invoices, tax settlements (Article 6(1)(c) GDPR — legal obligation, and (b));
c) handling withdrawals, complaints and enquiries (Article 6(1)(b) and (c) GDPR);
d) Platform security, fraud prevention, event logging (Article 6(1)(f) GDPR — the Controller's legitimate interest);
e) pseudonymised usage statistics to improve the Platform (Article 6(1)(f) GDPR); a user may object to this processing in the account settings;
f) automatic assessment of reports by the "AI mentor" — a feature of the service chosen by the user (Article 6(1)(b) GDPR); the model provider receives the report content and its comparison with the reference report, without data identifying the user;
g) commercial communications — only with consent (Article 6(1)(a) GDPR), which may be withdrawn at any time.
We do not make decisions based solely on automated processing that would produce legal effects for the user.

4. Recipients
We entrust data to processors to the extent necessary: the payment operator Stripe Payments Europe, Ltd. (payments, card verification), the invoicing provider Fakturownia (invoices), the e-mail provider [E-MAIL PROVIDER] (transactional messages), the hosting provider [HOSTING PROVIDER], and the language-model provider [AI PROVIDER] (report content only, without identifying data). Data may be disclosed to public authorities on the basis of law.
Some providers may process data outside the European Economic Area; transfers then rely on standard contractual clauses approved by the European Commission or on an adequacy decision. [TO BE COMPLETED: providers outside the EEA and the transfer basis.]

5. Retention
a) account data — for the life of the account and up to 30 days after its deletion;
b) purchase data and invoices — 5 years from the end of the tax year of the transaction (tax law), and data needed to defend claims — until the limitation periods expire;
c) records of consents and statements (acceptance of the terms, withdrawals) — until the limitation periods for claims expire;
d) technical and security logs — up to [NUMBER] days;
e) pseudonymised statistics — up to [NUMBER] days, then aggregated.

6. Your rights
You have the right of access to your data, to rectification, erasure, restriction of processing, data portability, to object to processing based on legitimate interest, and to withdraw consent at any time (without affecting the lawfulness of processing before withdrawal). Requests may be sent to [E-MAIL ADDRESS]. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland) or your local supervisory authority.

7. Whether providing data is required
Providing account and purchase data is voluntary but necessary to create an account and conclude a contract. Invoice details are necessary for a business purchase.

8. Cookies and local storage
The Platform uses cookies and browser local storage only for purposes necessary to the service: keeping the session, securing forms (CSRF), remembering the chosen language and image-viewer settings. We do not use third-party advertising or tracking cookies. [TO BE COMPLETED if analytics tools are introduced.]

9. Changes to this notice
We announce changes to this notice on the Platform and, for material changes, also by e-mail. The current version is always available on the Platform.