Privacy Policy

Version 2026-10.4 · Effective from 13 October 2026

This policy explains how EMBIQ processes personal data when you visit embiq.com, write to us, use our contact form, book a meeting with us or apply for a job. It replaces and extends our earlier "Information notice for e-mail correspondence". We have tried to write it in plain language; if anything is unclear, write to us at info@embiq.com.

Who we are (the controller)

The controller of your personal data is:

EMBIQ spółka z ograniczoną odpowiedzialnością
al. Kraśnicka 27, 20-718 Lublin, Poland
KRS 0000338852 · NIP 9462590420 · REGON 060536403

In this policy we refer to the company as "EMBIQ", "we" or "us".

How to contact us about your data

For any question or request concerning your personal data, write to info@embiq.com or send a letter to the address above. We reply as quickly as we can and no later than within one month; if a request is complex we may extend this by a further two months and will tell you why.

What data we process, why, and on what legal basis

We only collect the data we need for the purposes described below. The abbreviation "GDPR" means Regulation (EU) 2016/679 (the General Data Protection Regulation).

1. E-mail correspondence

When you write to us (for example to info@embiq.com, rekrutacja@embiq.com or a personal address of one of our team members) we process the contact details of senders and recipients and the content of the messages in order to:

• communicate with you and reply to your message (Art. 6(1)(f) GDPR – our legitimate interest in responding to enquiries and maintaining business contacts, or Art. 6(1)(b) GDPR where the correspondence concerns a contract with you or steps you have asked us to take before entering into one);
• document arrangements made with clients, contractors and other persons (Art. 6(1)(b) GDPR);
• receive letters, notices and requests sent electronically, such as complaints, claims and other submissions, and establish, exercise or defend legal claims (Art. 6(1)(f) GDPR; where a message contains special categories of data, Art. 9(2)(f) GDPR).

If you ask us about our brand, products or services, we will send you the requested information to the e-mail address you wrote from. Your request is what allows us to reply; we will not add you to any mailing list without your separate consent.

2. Contact form on the website

Our contact form asks for your name, e-mail address and message, and optionally the name of your company and, when you request a quote, your indicative budget. We use this data to:

• reply to your enquiry and, if you ask for a quote or an offer, take the steps needed before a contract is concluded (Art. 6(1)(b) GDPR), or – for other enquiries – pursue our legitimate interest in answering messages sent to us (Art. 6(1)(f) GDPR);
• contact you in relation to your enquiry where you have agreed to this in the form (Art. 6(1)(a) GDPR – consent, which you can withdraw at any time without affecting the lawfulness of earlier processing);
• demonstrate that the form was submitted and which version of this policy was in force at the time (Art. 6(1)(f) GDPR – our legitimate interest in accountability). For this purpose we store the date of submission and the version of the policy you accepted.

To protect the form from spam and automated abuse, we use Cloudflare Turnstile (Cloudflare, Inc., United States). When you start filling in our contact form, Turnstile runs a short check in your browser. In most cases this happens without any action on your part; occasionally you may be asked to tick a box. For this check Cloudflare processes technical signals such as your IP address, TLS fingerprint, browser type (User-Agent) and the address of the page you are on. When you send the form, your data goes to a small service we run on Cloudflare's network (Cloudflare Workers, at form.embiq.com). It confirms the result of the check with Cloudflare and passes your data on to our content management system, and a notification is sent to our mailbox (info@embiq.com). Together with your data we record which of our websites the form was sent from.

We use Turnstile and this Cloudflare service on the basis of our legitimate interest in protecting the form and our systems from spam and abuse (Art. 6(1)(f) GDPR). For this purpose Cloudflare acts on our behalf, under a data processing agreement. Cloudflare also uses the Turnstile signals to improve its bot detection; for that purpose it acts as a separate controller, as described in the Turnstile Privacy Addendum. For transfers to the United States, see "Transfers outside the European Economic Area". If Turnstile cannot load, for example because it is blocked in your browser, the form cannot be sent; you can still write to us at info@embiq.com.

We do not store your IP address together with the form data. Providing your data is voluntary, but without your name, e-mail address and message we cannot answer you.

3. Booking a meeting

You can book a call with us through scheduling pages we operate with Pipedrive (embiq.pipedrive.com and meet.embiq.com). When you book, we process your name, e-mail address, the time slot you chose and any notes you add. We use this data to hold the meeting and prepare for it (Art. 6(1)(b) or Art. 6(1)(f) GDPR, as described in section 2).

We use Pipedrive as our CRM system to manage business contacts. If you are, or represent, a current or potential client or partner, we may keep your business contact details and a record of our communication there for the duration of our relationship and afterwards for as long as claims could be raised (Art. 6(1)(b) and (f) GDPR – our legitimate interest in managing client relationships).

4. Recruitment

If you apply for a job by e-mail to rekrutacja@embiq.com, we process the data in your application (CV, cover letter, contact details) in order to run the recruitment process for the position you applied for. The legal basis is employment law for the data it requires us to collect (the Polish Labour Code for roles in Poland, Austrian law for roles in Graz), steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR), and your consent (Art. 6(1)(a) GDPR) for any additional data you choose to include. If you agree, we will also keep your application for future recruitment; you can withdraw this consent at any time by writing to rekrutacja@embiq.com.

5. Website visits and server logs

embiq.com is a static website hosted on Amazon Web Services, with content served from our own content management system. When you open a page, the hosting infrastructure processes technical data such as your IP address, browser type, requested page, referring page and time of access. This data is used to deliver the website and keep it secure and stable (Art. 6(1)(f) GDPR – our legitimate interest in running a secure website). We do not combine server logs with data from the contact form.

6. Analytics tools and external content

With your consent given in the cookie banner (Art. 6(1)(a) GDPR, and the consent requirement for storing information on your device under electronic communications law), we use the following tools on the live website:

• Google Analytics 4 (Google Ireland Limited) – aggregated statistics about how visitors use the site. We run it with Consent Mode v2, with Google Signals and ad personalisation switched off.
• Hotjar (Hotjar Ltd, Malta) – heat maps and recordings of how visitors move through pages, which help us improve the site. Text you type into form fields is masked and is not recorded.

The same consent covers external content embedded in our pages:

• Clutch review widget (Clutch.co, United States) – a frame that shows our Clutch rating and client reviews. It is delivered through Cloudflare's network, which may set security cookies and measures the widget's performance. When the widget loads, Clutch and Cloudflare receive technical data such as your IP address and browser type; as Clutch is based in the United States, this data is transferred there. Without your consent we show a plain link to our Clutch profile instead; Clutch then receives data only if you click the link.
• YouTube videos (Google) – videos on some pages play in YouTube's privacy-enhanced mode (youtube-nocookie.com). With your consent, a video loads as soon as you open the page. Without it, we show a preview image from our own server, and the player loads from YouTube only when you click play. Once loaded, YouTube may store information on your device and set cookies according to Google's privacy policy; Google may process this data in the United States.

Clutch and Google process the data they receive as separate controllers, under their own privacy policies.

Our LinkedIn profile is linked as an ordinary link. Nothing from LinkedIn is loaded on our pages; LinkedIn receives data only if you click the link and visit it.

Fonts are served from our own server; we do not load fonts from third-party networks.

If you choose "Only necessary" in the banner, none of these tools or external content is loaded and no analytics cookies are set; you can still play a video by clicking it. We remember your choice – consent or refusal – for 6 months; after that, or when we change the tools we use, the banner asks you again. You can change your choice at any time via the "Cookie settings" link in the website footer.

Where your data comes from

In most cases we receive your data directly from you. If you represent an organisation, we may also receive your business contact details from your colleagues or from publicly available sources such as your organisation's website, in which case we process them to communicate with that organisation (Art. 6(1)(f) GDPR).

How long we keep your data

Where data is processed on the basis of consent, we stop as soon as you withdraw it. Where it is processed on the basis of our legitimate interest, we stop when you raise a justified objection.

Who receives your data

Your data is processed by our employees and contractors authorised to do so, and by service providers acting on our behalf under data processing agreements:

• hosting providers – Amazon Web Services and the provider hosting our content management system;
• Cloudflare, Inc. (protection of the contact form with Turnstile and delivery of form submissions to us – see section 2);
• Google (Google Workspace, our e-mail and collaboration platform; Google Analytics);
• Pipedrive (CRM and meeting scheduling);
• Hotjar Ltd (analytics tool, only after your consent);
• providers of IT, accounting, banking and legal services, and parties involved in delivering an order you place with us.

If you apply for a role in Graz, we share your application with EMBIQ GmbH, Brückenkopfgasse 1/6, 8020 Graz, Austria, the company that will sign your contract (see section 4).

When their content loads on our pages, Clutch (with its delivery network Cloudflare) and Google (YouTube) also receive technical data directly from your browser – see section 6.

We also disclose data to public authorities where the law requires us to do so. We do not sell personal data.

Transfers outside the European Economic Area

Some of our providers are established, or process data, in countries outside the EEA, in particular in the United States. In such cases we make sure that an appropriate safeguard is in place: the European Commission's adequacy decision for the EU-US Data Privacy Framework (for providers certified under it) or the Standard Contractual Clauses adopted by the European Commission, together with additional measures where necessary. Cloudflare, which protects our contact form and delivers its submissions, relies on its certification under the EU-US Data Privacy Framework and, should it lapse, on the Standard Contractual Clauses. You can ask us for details of the safeguard used for a given provider by writing to info@embiq.com.

Your rights

Under the GDPR you have the right to:

• access your data and obtain a copy of it (Art. 15 GDPR); the first copy is free of charge, and we may charge a reasonable fee based on administrative costs for further copies;
• rectification of inaccurate data and completion of incomplete data (Art. 16 GDPR);
• erasure of your data where we no longer have a legal basis to process it or it is no longer needed (Art. 17 GDPR);
• restriction of processing (Art. 18 GDPR) – for example while we verify the accuracy of data you contest, where the processing is unlawful but you prefer restriction to erasure, where we no longer need the data but you need it for legal claims, or while we assess your objection;
• data portability (Art. 20 GDPR) – to receive the data you provided to us on the basis of consent or a contract in a structured, commonly used, machine-readable format and to have it transmitted to another controller;
• object (Art. 21 GDPR) to processing based on our legitimate interest, on grounds relating to your particular situation, and at any time to processing for direct marketing purposes. Following an objection, we will stop unless we can demonstrate compelling legitimate grounds that override your interests, rights and freedoms, or grounds for establishing, exercising or defending legal claims;
• withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal. Consent for cookies can be withdrawn through the "Cookie settings" link in the footer; other consents by writing to info@embiq.com;
• lodge a complaint with the supervisory authority: the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland (uodo.gov.pl). You may also lodge a complaint with the supervisory authority of the Member State where you have your habitual residence or place of work, or where the alleged infringement took place – in Austria, the Datenschutzbehörde (DSB); in Germany, the competent data protection supervisory authority of your federal state (Land).

To exercise your rights, contact us at info@embiq.com and tell us which right you wish to exercise and to what extent. We may need to verify your identity before acting on a request.

We do not make decisions based solely on automated processing, including profiling, that would produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).

Cookies and similar technologies

Cookies are small text files stored on your device by your browser. Our website uses two strictly necessary cookies of its own, the strictly necessary browser storage of the Turnstile check on the contact form and, only with your consent, cookies from the analytics tools and external content listed in section 6. Lifetimes below are maximum values; the actual period may be shorter.

With your consent, the Clutch widget and YouTube videos load as soon as you open a page that contains them. Without it, a YouTube video loads only after you click play; YouTube (Google) may then store information on your device according to Google's privacy policy. Apart from a video you choose to play and the Cloudflare Turnstile check on pages with our contact form (section 2), we load no third-party scripts or content unless you click "Accept".

You can also delete or block cookies in your browser settings. Blocking the necessary cookie means the banner will be shown again on your next visit.

Data security

We protect personal data with technical and organisational measures appropriate to the risk, including encrypted connections (HTTPS), access controls and restriction of access to those who need it for their work. Our providers are bound by contract to apply equivalent measures.

Changes to this policy

We may update this policy when we change the tools we use, the way we process data or when the law changes. The current version is always available on this page, together with its version number and effective date. If a change materially affects you, we will inform you in an appropriate way, for example by a notice on the website. Previous versions are available on request.

Version 2026-10.4 · Effective from 13 October 2026