Last updated: 14 September 2026
This document sets out the rules for processing personal data collected in connection with the operation of the website www.evolpe.ai (the “Site”), operated by Evolpe Consulting Group Spółka z ograniczoną odpowiedzialnością spółka komandytowa, with its registered office at Aleje Solidarności 46, 61-696 Poznań, Poland, entered in the Register of Entrepreneurs kept by the District Court Poznań Nowe Miasto i Wilda in Poznań under KRS number 0000494749, NIP 7811892697 (the “Controller”, “we”, “us”).
All processing described here is carried out in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the “GDPR”).
I. Controller and contact details
- Controller: Evolpe Consulting Group Sp. z o.o. sp. k., Aleje Solidarności 46, 61-696 Poznań, Poland
- Email for data protection matters: contact@evolpe.ai
- Phone: +48 783 372 094
- We have not appointed a Data Protection Officer. Please direct all requests concerning your personal data to the email address above.
II. What we process, why, and on what legal basis
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Responding to enquiries submitted via forms on the Site | First name, last name, company, work email, phone number, message content | Art. 6(1)(b) GDPR (steps prior to entering into a contract) and Art. 6(1)(f) GDPR (our legitimate interest in handling correspondence) | For the duration of the enquiry, then up to 3 years from the last contact (limitation period for business claims) |
| Sending commercial and marketing information by electronic means | Email address, first name, last name, company | Art. 6(1)(a) GDPR (your consent), in conjunction with Art. 10 of the Polish Act on the Provision of Services by Electronic Means of 18 July 2002 and Art. 172 of the Polish Telecommunications Law | Until you withdraw consent or object |
| Ensuring the security and correct operation of the Site (including anti-spam protection of forms) | IP address, browser and device data, server logs | Art. 6(1)(f) GDPR (our legitimate interest in the security of the service) | Server logs: up to 12 months |
| Traffic statistics and measuring the effectiveness of the Site | Pseudonymous identifiers, pages viewed, referral source, approximate location (country/city level), device data | Art. 6(1)(a) GDPR (your consent, given via the cookie banner) — except for cookieless statistics, which rely on Art. 6(1)(f) GDPR | See the cookie table in Section VI |
| Marketing analytics, session recording, testing page variants and identifying business visitors | Pseudonymous identifiers, interactions with the page, company data inferred from the IP address | Art. 6(1)(a) GDPR (your consent, given via the cookie banner) | See the cookie table in Section VI |
| Establishing, exercising or defending legal claims | Data collected for the purposes above | Art. 6(1)(f) GDPR (our legitimate interest) | Until the applicable claims become time-barred |
Providing your data is voluntary. However, providing the data marked as required in a form is necessary for us to respond to your enquiry — without it we cannot contact you.
III. Your rights
Under the GDPR you have the following rights. To exercise any of them, write to contact@evolpe.ai. We will respond without undue delay and in any case within one month of receiving your request.
- Right of access (Art. 15 GDPR) — to obtain confirmation as to whether we process your personal data, to access that data, and to receive a copy of it.
- Right to rectification (Art. 16 GDPR) — to have inaccurate data corrected and incomplete data completed.
- Right to erasure, the “right to be forgotten” (Art. 17 GDPR) — to have your data deleted where, among others, it is no longer necessary for the purposes for which it was collected, you have withdrawn your consent, or you have objected to the processing.
- Right to restriction of processing (Art. 18 GDPR) — to require us to limit processing to storage only, for example while we verify the accuracy of your data.
- Right to data portability (Art. 20 GDPR) — to receive the data you provided to us in a structured, commonly used, machine-readable format, and to have it transmitted to another controller, where processing is based on consent or on a contract and is carried out by automated means.
- Right to object (Art. 21 GDPR) — to object at any time, on grounds relating to your particular situation, to processing based on our legitimate interest. Where data is processed for direct marketing purposes, you may object at any time and without giving reasons, and we will stop such processing.
- Right to withdraw consent (Art. 7(3) GDPR) — where processing is based on your consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal. Consent for cookies can be changed at any time using the Manage consent button available on every page of the Site.
- Right to lodge a complaint with a supervisory authority (Art. 77 GDPR) — if you believe that the processing of your personal data infringes the GDPR, you may lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland — uodo.gov.pl.
IV. Automated decision-making and profiling
We do not make decisions about you that are based solely on automated processing and produce legal effects concerning you or similarly significantly affect you, within the meaning of Art. 22 GDPR.
With your consent, we do use analytical tools that profile your activity on the Site in a limited way — for example by assigning you to a page-variant test group, recording an anonymised session, or matching your IP address to a company. This profiling serves only to improve the Site and to assess the effectiveness of our marketing. It does not produce legal effects for you and you can stop it at any time by withdrawing your consent.
V. Cookies and similar technologies
- The Site uses cookies — small text files stored on your device — as well as similar technologies such as local storage and session storage.
- Cookies that are strictly necessary for the Site to function, and cookies that record your own cookie choices, are used on the basis of Art. 173(3) of the Polish Telecommunications Law and Art. 6(1)(f) GDPR. They do not require your consent.
- All other cookies — statistical and marketing — are placed only after you have given consent in the banner displayed on your first visit.
- You can change or withdraw your consent at any time using the Manage consent button available on every page of the Site. You can also delete cookies at any time through your browser settings.
- We group cookies into four categories: Functional (necessary for the Site to work), Preferences, Statistics and Marketing. Section VI lists every service that is actually active on the Site.
VI. Services active on the Site
The table below lists all third-party and self-hosted services that are actually running on the Site, together with the cookies they set. We do not list services we do not use.
| Service | Provider | Purpose | Category | Cookies / storage | Retention |
|---|---|---|---|---|---|
| Complianz | Complianz B.V., Netherlands (self-hosted on our server) | Recording and storing your cookie consent | Functional — no consent required | cmplz_policy_id, cmplz_banner-status, cmplz_functional, cmplz_preferences, cmplz_statistics, cmplz_marketing, cmplz_consented_services | 365 days |
| Cap | Self-hosted by us at cap.evolpe.cloud; widget code delivered via the jsDelivr CDN | Proof-of-work challenge protecting forms against automated abuse | Functional — no consent required | No cookies | Not applicable |
| Mautic | Self-hosted by us at mautic.evolpe.it | Receiving and handling submissions from forms on the Site | Functional — data is sent only when you submit a form | No cookies set on the Site | See Section II |
| Plausible Analytics | Self-hosted by us at plausible.evolpe.it | Aggregated, cookieless traffic statistics | Statistics — no consent required (no cookies, no cross-site identifiers) | No cookies | Aggregated data only |
| Google Tag Manager | Google Ireland Ltd, Ireland | Managing the tags listed below and enforcing your consent choices (Google Consent Mode v2) | Functional | No cookies | Not applicable |
| Google Analytics 4 | Google Ireland Ltd, Ireland | Traffic statistics and analysis of how the Site is used | Statistics — requires consent | _ga, _ga_LHRK37B00J | Up to 2 years |
| Hotjar | Hotjar Ltd, Malta (EU) | Heatmaps and anonymised session recordings used to improve usability | Marketing — requires consent | _hjSessionUser_3777682 (12 months), _hjSession_3777682 (30 minutes), hjActiveViewportIds, hjViewportId (local/session storage) | Up to 12 months |
| Albacross | Albacross Nordic AB, Sweden (EU) | Identifying the company a business visitor belongs to, based on IP address | Marketing — requires consent | nQ_cookieId, nQ_userVisitId | Up to 12 months |
| Visual Website Optimizer (VWO) | Wingify Software Pvt. Ltd., India | A/B testing of page variants and analysis of their effectiveness | Marketing — requires consent | _vwo_uuid, _vwo_uuid_v2, _vwo_sn, _vwo_ds, _vis_opt_s, _vis_opt_test_cookie, _vwo_822664_config (local storage) | Up to 12 months |
| Google Maps | Google Ireland Ltd, Ireland | Displaying a map on the contact page | Marketing — requires consent; the map is blocked until you accept | Google cookies, set only after you load the map | Per Google’s policy |
Before you make a choice in the cookie banner, Google Tag Manager and Google Analytics operate in Google Consent Mode v2 with all consent signals set to “denied”. In this state they do not write cookies and do not create a persistent identifier for you; they only transmit an anonymised, cookieless signal. Full measurement starts only after you give consent.
VII. Recipients of your data
- Providers of the services listed in Section VI, acting as our processors or, where indicated by the provider, as independent controllers.
- Our hosting provider and providers of IT and telecommunications maintenance services.
- Providers of accounting, legal and advisory services, where this is necessary for the performance of a contract or the defence of claims.
- Public authorities, where we are required to disclose data by law.
We do not sell your personal data and we do not share it with third parties for their own marketing purposes.
VIII. Transfers outside the European Economic Area
- Google Ireland Ltd (Google Tag Manager, Google Analytics, Google Maps) is established in the EU. Google may, however, transfer data to Google LLC in the United States. Such transfers take place under the EU–U.S. Data Privacy Framework, to which Google LLC is certified, and additionally under the European Commission’s Standard Contractual Clauses.
- Hotjar Ltd (Malta) and Albacross Nordic AB (Sweden) process data within the EEA.
- Wingify Software Pvt. Ltd. (VWO) is established in India, a country for which the European Commission has not issued an adequacy decision. This transfer takes place on the basis of the European Commission’s Standard Contractual Clauses, supplemented by additional safeguards applied by the provider.
- Services we host ourselves — Plausible, Mautic and Cap — process data on infrastructure located within the EEA.
You may request a copy of the safeguards applied to these transfers by writing to contact@evolpe.ai.
IX. Information provided in forms
- We collect the information you provide voluntarily in the forms on the Site.
- We may also record technical connection data, such as your IP address and the time of submission, for security purposes and to demonstrate that consent was given.
- Data from forms is processed for the purpose arising from the function of the particular form, as described in Section II.
- Data from forms may be entrusted to entities that provide technical services to us — in particular hosting and IT maintenance providers — solely for the purpose of carrying out the task you requested, and on the basis of a data processing agreement.
- Consent to marketing communications given in a form is separate from, and independent of, the consent required to have your enquiry answered. Refusing marketing consent does not prevent us from responding to you.
X. Data security
We collect personal data with due diligence and protect it against access by unauthorised persons using technical and organisational measures appropriate to the risk, in accordance with Art. 32 GDPR. These include encrypted transmission (TLS), access control, and data processing agreements concluded with our processors.
XI. Changes to this Privacy Policy
We may update this Privacy Policy to reflect changes in the services we use or in applicable law. The date of the most recent update is shown at the top of this page. Where a change materially affects how we process your data, we will inform you by a notice on the Site.