Privacy Policy

Version 2026-09 · Effective from 25 September 2026

This policy explains how EMBIQ processes personal data when you visit embiq.com, write to us, use our contact form, book a meeting with us or apply for a job. It replaces and extends our earlier "Information notice for e-mail correspondence". We have tried to write it in plain language; if anything is unclear, write to us at info@embiq.com.

Who we are (the controller)

The controller of your personal data is:

EMBIQ spółka z ograniczoną odpowiedzialnością
al. Kraśnicka 27, 20-718 Lublin, Poland
KRS 0000338852 · NIP 9462590420 · REGON 060536403

In this policy we refer to the company as "EMBIQ", "we" or "us".

How to contact us about your data

For any question or request concerning your personal data, write to info@embiq.com or send a letter to the address above. We reply as quickly as we can and no later than within one month; if a request is complex we may extend this by a further two months and will tell you why.

What data we process, why, and on what legal basis

We only collect the data we need for the purposes described below. The abbreviation "GDPR" means Regulation (EU) 2016/679 (the General Data Protection Regulation).

1. E-mail correspondence

When you write to us (for example to info@embiq.com, rekrutacja@embiq.com or a personal address of one of our team members) we process the contact details of senders and recipients and the content of the messages in order to:

• communicate with you and reply to your message (Art. 6(1)(f) GDPR – our legitimate interest in responding to enquiries and maintaining business contacts, or Art. 6(1)(b) GDPR where the correspondence concerns a contract with you or steps you have asked us to take before entering into one);
• document arrangements made with clients, contractors and other persons (Art. 6(1)(b) GDPR);
• receive letters, notices and requests sent electronically, such as complaints, claims and other submissions, and establish, exercise or defend legal claims (Art. 6(1)(f) GDPR; where a message contains special categories of data, Art. 9(2)(f) GDPR).

If you ask us about our brand, products or services, we will send you the requested information to the e-mail address you wrote from. Your request is what allows us to reply; we will not add you to any mailing list without your separate consent.

2. Contact form on the website

Our contact form asks for your name, e-mail address and message, and optionally the name of your company and, when you request a quote, your indicative budget. We use this data to:

• reply to your enquiry and, if you ask for a quote or an offer, take the steps needed before a contract is concluded (Art. 6(1)(b) GDPR), or – for other enquiries – pursue our legitimate interest in answering messages sent to us (Art. 6(1)(f) GDPR);
• contact you in relation to your enquiry where you have agreed to this in the form (Art. 6(1)(a) GDPR – consent, which you can withdraw at any time without affecting the lawfulness of earlier processing);
• demonstrate that the form was submitted and which version of this policy was in force at the time (Art. 6(1)(f) GDPR – our legitimate interest in accountability). For this purpose we store the date of submission and the version of the policy you accepted.

Form submissions are stored in our content management system and a notification is sent to our mailbox (info@embiq.com). We do not store your IP address together with the form data. Providing your data is voluntary, but without your name, e-mail address and message we cannot answer you.

3. Booking a meeting

You can book a call with us through scheduling pages we operate with Pipedrive (embiq.pipedrive.com and meet.embiq.com). When you book, we process your name, e-mail address, the time slot you chose and any notes you add. We use this data to hold the meeting and prepare for it (Art. 6(1)(b) or Art. 6(1)(f) GDPR, as described in section 2).

We use Pipedrive as our CRM system to manage business contacts. If you are, or represent, a current or potential client or partner, we may keep your business contact details and a record of our communication there for the duration of our relationship and afterwards for as long as claims could be raised (Art. 6(1)(b) and (f) GDPR – our legitimate interest in managing client relationships).

4. Recruitment

If you apply for a job by e-mail to rekrutacja@embiq.com, we process the data in your application (CV, cover letter, contact details) in order to run the recruitment process for the position you applied for. The legal basis is the Polish Labour Code for the data it requires us to collect, steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR), and your consent (Art. 6(1)(a) GDPR) for any additional data you choose to include. If you agree, we will also keep your application for future recruitment; you can withdraw this consent at any time by writing to rekrutacja@embiq.com.

5. Website visits and server logs

embiq.com is a static website hosted on Amazon Web Services, with content served from our own content management system. When you open a page, the hosting infrastructure processes technical data such as your IP address, browser type, requested page, referring page and time of access. This data is used to deliver the website and keep it secure and stable (Art. 6(1)(f) GDPR – our legitimate interest in running a secure website). We do not combine server logs with data from the contact form.

6. Analytics and marketing tools

With your consent given in the cookie banner (Art. 6(1)(a) GDPR, and the consent requirement for storing information on your device under electronic communications law), we use the following tools on the live website:

• Google Analytics 4 (Google Ireland Limited) – aggregated statistics about how visitors use the site. We run it with Consent Mode v2, with Google Signals and ad personalisation switched off.
• Hotjar (Hotjar Ltd, Malta) – heat maps and recordings of how visitors move through pages, which help us improve the site. Text you type into form fields is masked and is not recorded.
• LinkedIn Insight Tag (LinkedIn Ireland Unlimited Company) – measuring the effectiveness of our LinkedIn campaigns and showing relevant content to visitors of our site on LinkedIn. For the collection of data by the tag and its transmission to LinkedIn, we and LinkedIn act as joint controllers under LinkedIn's joint controller terms; LinkedIn is then solely responsible for further processing, as described in the LinkedIn Privacy Policy.
• Clutch review widget (Clutch.co) – an embedded frame that displays client reviews of EMBIQ. The frame is served through a content delivery network that may set security cookies.

Videos on our site are embedded in YouTube's privacy-enhanced mode (youtube-nocookie.com): YouTube does not set cookies until you play a video. Fonts are served from our own server; we do not load fonts from third-party networks.

If you choose "Only necessary" in the banner, none of these tools is loaded and no analytics or marketing cookies are set. You can change your choice at any time via the "Cookie settings" link in the website footer.

Where your data comes from

In most cases we receive your data directly from you. If you represent an organisation, we may also receive your business contact details from your colleagues or from publicly available sources such as your organisation's website, in which case we process them to communicate with that organisation (Art. 6(1)(f) GDPR).

How long we keep your data

Where data is processed on the basis of consent, we stop as soon as you withdraw it. Where it is processed on the basis of our legitimate interest, we stop when you raise a justified objection.

Who receives your data

Your data is processed by our employees and contractors authorised to do so, and by service providers acting on our behalf under data processing agreements:

• hosting providers – Amazon Web Services and the provider hosting our content management system;
• Google (Google Workspace, our e-mail and collaboration platform; Google Analytics);
• Pipedrive (CRM and meeting scheduling);
• Hotjar Ltd, LinkedIn Ireland Unlimited Company and Clutch (analytics and marketing tools, only after your consent);
• providers of IT, accounting, banking and legal services, and parties involved in delivering an order you place with us.

We also disclose data to public authorities where the law requires us to do so. We do not sell personal data.

Transfers outside the European Economic Area

Some of our providers are established, or process data, in countries outside the EEA, in particular in the United States. In such cases we make sure that an appropriate safeguard is in place: the European Commission's adequacy decision for the EU-US Data Privacy Framework (for providers certified under it) or the Standard Contractual Clauses adopted by the European Commission, together with additional measures where necessary. You can ask us for details of the safeguard used for a given provider by writing to info@embiq.com.

Your rights

Under the GDPR you have the right to:

• access your data and obtain a copy of it (Art. 15 GDPR); the first copy is free of charge, and we may charge a reasonable fee based on administrative costs for further copies;
• rectification of inaccurate data and completion of incomplete data (Art. 16 GDPR);
• erasure of your data where we no longer have a legal basis to process it or it is no longer needed (Art. 17 GDPR);
• restriction of processing (Art. 18 GDPR) – for example while we verify the accuracy of data you contest, where the processing is unlawful but you prefer restriction to erasure, where we no longer need the data but you need it for legal claims, or while we assess your objection;
• data portability (Art. 20 GDPR) – to receive the data you provided to us on the basis of consent or a contract in a structured, commonly used, machine-readable format and to have it transmitted to another controller;
• object (Art. 21 GDPR) to processing based on our legitimate interest, on grounds relating to your particular situation, and at any time to processing for direct marketing purposes. Following an objection, we will stop unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or grounds for establishing, exercising or defending legal claims;
• withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal. Consent for cookies can be withdrawn through the "Cookie settings" link in the footer; other consents by writing to info@embiq.com;
• lodge a complaint with the supervisory authority: the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland (uodo.gov.pl).

To exercise your rights, contact us at info@embiq.com and tell us which right you wish to exercise and to what extent. We may need to verify your identity before acting on a request.

We do not make decisions based solely on automated processing, including profiling, that would produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).

Cookies and similar technologies

Cookies are small text files stored on your device by your browser. Our website uses one strictly necessary cookie and, only with your consent, cookies from the analytics and marketing tools listed in section 6. Lifetimes below are maximum values; the actual period may be shorter.

Playing an embedded YouTube video may cause YouTube (Google) to store information on your device according to Google's privacy policy. We do not load any other third-party scripts before you have made your choice in the banner.

You can also delete or block cookies in your browser settings. Blocking the necessary cookie means the banner will be shown again on your next visit.

Data security

We protect personal data with technical and organisational measures appropriate to the risk, including encrypted connections (HTTPS), access controls and restriction of access to those who need it for their work. Our providers are bound by contract to apply equivalent measures.

Changes to this policy

We may update this policy when we change the tools we use, the way we process data or when the law changes. The current version is always available on this page, together with its version number and effective date. If a change materially affects you, we will inform you in an appropriate way, for example by a notice on the website. Previous versions are available on request.

Version 2026-09 · Effective from 25 September 2026