Privacy policy

The controller of personal data processed in connection with the Rebrandy website is Rebrandy, ul. Jesionowa 28, 71-016 Szczecin, Poland, Polish tax identification number 8522727828.

For matters concerning personal data, email biuro@rebrandy.pl or send correspondence to the address above.

This policy applies to the website available at rebrandy.pl.

The scope depends on how you use the website:

• contact form: starting point, objectives, situation description, budget, timing, full name, email address, optional phone number and company name, and the page from which the enquiry was sent;
• email or telephone contact: data you provide in correspondence or during the call;
• automated diagnostic tools: the public website URL, the required work email submitted as workEmail, the required work phone number submitted as phoneE164, the selected tool or diagnostic type, and data needed to start the test; workEmail and the phone number identify the submission and remain linked to its run and report;
• diagnostic run and result: submission date and time, run identifier and status, technical test data, responses, error messages, and the generated result;
• immutable choice evidence: the exact wording and version of the scope confirmation, privacy notice or voluntary marketing consent, their hashes, the date, source and scope of the choice, and target and source digests; later withdrawal or objection is recorded as a separate event rather than a change to the original evidence;
• technical data: IP address, request date and time, visited page, browser and device information, and server logs where needed to maintain and secure the website;
• website protection and rate limiting: information needed to detect automated, excessive or repeated submissions and attempted abuse.

We do not ask for special-category data such as health information, beliefs or origin. Do not include it in a form or at the address submitted for diagnosis. Submit only a public URL you are authorised to test; do not provide passwords or URLs for private resources.

• starting the selected free diagnostic, running the automated test, making the result available and sending necessary operational messages — performance of the service requested by the user under Article 6(1)(b) GDPR;
• handling an enquiry and taking steps before entering into an agreement — Article 6(1)(b) GDPR; where a contact person acts for an organisation and that basis does not apply to their data, our legitimate interest in handling requested business correspondence under Article 6(1)(f) GDPR;
• sending commercial and marketing information about Rebrandy services to the submitted email address — only after the user makes a voluntary choice, under Article 6(1)(a) GDPR and the prior consent required by Article 398 of the Polish Electronic Communications Law;
• maintaining immutable evidence of scope confirmation, presentation of privacy information, marketing consent, its scope and withdrawal — to demonstrate compliance with our obligations and defend claims, as applicable under Article 6(1)(c) and (f) GDPR;
• securing forms, tools and the website, diagnosing errors, applying limits and preventing abuse — our legitimate interest under Article 6(1)(f) GDPR;
• establishing, pursuing or defending claims — our legitimate interest under Article 6(1)(f) GDPR;
• meeting legal obligations connected with a later engagement, if one begins — Article 6(1)(c) GDPR.

Email marketing consent is separate and voluntary. Refusing or later withdrawing it does not affect whether a tool runs, the scope of the diagnostic or access to the result. Messages necessary to perform or make the requested diagnostic available are operational, not marketing messages.

Confirming that you have read the privacy information records that it was presented. It is not consent to the Privacy policy or to marketing.

Data may be accessed only by authorised Rebrandy personnel and the categories of suppliers needed for the purposes described above: hosting, email and application-infrastructure providers; a provider running automated performance tests or other parts of a diagnostic; a CRM provider; an email-marketing provider where the user has selected that channel; and IT maintenance and security providers.

Data may also be disclosed to legal advisers, accountants, auditors or competent authorities, but only where a particular matter or legal obligation requires it. Providers receive only the data needed for their task and act under appropriate agreements or their own legal basis.

If a selected provider processes data outside the European Economic Area, the transfer uses a mechanism permitted by the GDPR, such as an adequacy decision or standard contractual clauses, with supplementary measures where needed. Contact us for information about the mechanism applicable to a particular provider.

• tool input, run information and result — for the time needed to perform and make the diagnostic available and then, to the extent necessary, to handle complaints, demonstrate how the service ran and protect against claims;
• enquiry data and later correspondence — until the matter ends or, if an engagement begins, for the time needed to prepare and perform it; afterwards, to the extent necessary to demonstrate the contact and until the relevant limitation period for claims expires;
• an email address used for marketing — until consent is withdrawn, an objection is made or the marketing purpose ends, subject to periodic reviews of whether the data remains current;
• records of consent and withdrawal — for the time needed to demonstrate that consent was valid, handle an objection and defend claims; after withdrawal we may retain a minimal suppression record to prevent further messages;
• logs, security data and rate-limit information — for the time needed to protect the website, detect abuse, diagnose errors and investigate incidents;
• data required by law, such as accounting records — for the period set by the applicable rules;

To determine the specific period, we consider the type of tool and data, the time needed to make the result available, the risk of abuse or complaint, applicable claim periods and legal obligations. We delete or anonymise data earlier when it is no longer needed and no basis requires further processing.

Exact retention periods for workEmail, the phone number, submissions and reports, logs and immutable consent evidence must match the real configuration and receive legal approval before the public tools are enabled.

Depending on the basis and circumstances of processing, you may have the right to:

• access your data and receive a copy;
• rectify or erase data, or restrict processing;
• data portability where applicable;
• object to processing based on legitimate interests;
• withdraw consent at any time where processing is based on consent, without affecting the lawfulness of earlier processing;
• lodge a complaint with the President of the Polish Personal Data Protection Office.

Send a request to biuro@rebrandy.pl. Before acting, we may ask for information needed to confirm the identity of the requester.

You can withdraw email-marketing consent through the unsubscribe link in a message or by contacting us. You may also object to direct marketing at any time. Withdrawal or objection does not limit access to a diagnostic or a result you have received.

Providing a public URL, work email address and work phone number in a tool form is voluntary but required to use the service: the URL defines the diagnostic target, while workEmail and phoneE164 identify the request and link it to the generated report. In the contact form, fields marked as required are needed to submit and handle the enquiry; the remaining fields are optional.

Email-marketing consent is not a condition of receiving a diagnostic. Confirming that you have read the privacy information records its receipt; it is not agreement to the Privacy policy or consent to marketing.

The tools automatically analyse the submitted public URL and generate a preliminary diagnostic result. We do not use this data to make decisions about the user based solely on automated processing that produce legal or similarly significant effects. We do not profile visitors for advertising.

We use technical and organisational measures appropriate to the website, including HTTPS encryption, limited access methods for forms and tools, request-size controls, data validation and submission rate limits. No method of sending data over the Internet removes all risk.

Information about cookies, browser storage and external resources is in the Cookie policy.

Report access uses a time-limited result token held only in browser memory while the interface polls for and retrieves the report. The token is not persisted in browser storage or placed in the URL, and it expires after a limited period.

We update this policy when website features, suppliers or processing methods change. Material changes will update the document date and version.