Privacy Policy

Information on what personal data the truebalance.pl website collects, for what purpose and on what basis, who receives it, and what rights data subjects have.

[OWNER CONTENT: full text of the privacy policy, in impersonal form, based on the inventory from sections 2 to 13]

Data controller

The controller of the personal data collected by the truebalance.pl website is True Balance Accounting Sp. z o.o.

  • Controller details: [OWNER CONTENT: registered office address, KRS, NIP, e-mail address for personal data matters; information on whether a data protection officer has been appointed]
  • What the policy states (T-91): the identity and contact details of the controller; the contact details of the data protection officer, where one has been appointed; the purposes and legal basis of processing; the legitimate interests where Article 6(1)(f) is the basis; the recipients or their categories; the intention to transfer data outside the European Economic Area; the retention period; the rights of the individual; the right to withdraw consent; the right to lodge a complaint with a supervisory authority; whether providing data is a requirement and what the consequences of not providing it are; automated decision-making (the website does not use it).

Contact form

  • Where: the Contact page, form F3.
  • Fields: name, e-mail, phone (optional), company name (optional), subject (optional), preferred time for a call (optional), message (optional), marketing consent (optional).
  • Purpose: replying to the message and arranging a call about our services.
  • Basis (proposal to be verified, T-92): GDPR Article 6(1)(f) (replying to the enquiry and contact about cooperation with the company represented); point (b) only where the sender is to become a party to the contract. The parenthesis at point (f) describes the controller's legitimate interest (an element from section 2).
  • Storage: the enquiry is saved in the website's content management system together with the website language; the IP address is not saved with the enquiry.
  • Submission limit: the IP address is held in server memory for a short time; purpose: protecting the form against abuse (limiting the number of submissions); basis (proposal to be verified, T-92): GDPR Article 6(1)(f).
  • E-mails: a confirmation to the sender and a notification to the office with all fields (a reply to the notification goes to the sender); the confirmation contains a separate paragraph on the right to object (section 11).
  • Providing data: voluntary; without the required fields (name, e-mail) we cannot reply.

Demo or module implementation form

  • Where: the Platform page (form F1, module selection) and the module pages (form F2, the page's module in a hidden field or preselected).
  • Fields: name, business e-mail, company, module, type of enquiry (demo or implementation), answer to the question “Do we already handle your accounting?” (yes, no, considering changing accounting office), message (optional), marketing consent (optional).
  • Purpose: contact about a demo or implementation of the selected module; a summary of the number of enquiries by module, without evaluating individuals.
  • Basis (proposal to be verified, T-92): contact (as in section 3): GDPR Article 6(1)(f) (replying to the enquiry and contact about cooperation with the company represented); point (b) only where the sender is to become a party to the contract; measuring demand (summary of the number of enquiries): point (f).
  • Storage and e-mails: as in section 3, including the submission limit and the paragraph on the right to object in the confirmation; the confirmation to the sender contains the module name and the type of enquiry, with no promise of a deadline.
  • Providing data: voluntary; without the required fields (name, e-mail, company, module, type, answer to the question about accounting services) we cannot handle the enquiry.

We implement the platform for a limited number of our accounting clients. [OWNER CONTENT: where we describe data processing in the platform itself, including by the AI model provider (e.g. separate information provided during implementation)]; this policy concerns the website.

  • Form: a separate checkbox in forms F1, F2 and F3, unticked by default and not required; submitting the form does not depend on consent.
  • Wording: “I want to receive True Balance marketing information by e-mail about the office's services and the platform modules. I can withdraw my consent at any time.”
  • Basis (T-92, T-93): the individual's consent (GDPR Article 6(1)(a)); sending marketing information, including direct marketing, by means of telecommunications terminal equipment requires the recipient's prior consent (Electronic Communications Law, Article 398(1)).
  • Withdrawal (T-97): consent can be withdrawn at any time, without affecting earlier processing; withdrawal must be as easy as giving consent; method: the unsubscribe link in every marketing message or a message to the address from section 2.
  • Message form (T-90): every marketing message is clearly marked as marketing information, with the sender's identification (True Balance Accounting Sp. z o.o.) and its electronic address.
  • Proof (T-98): the controller keeps a record of the consent given (the form record with the date).

Visit analytics

  • How it works: the analytics script (Umami) loads only after consent to the “analytics” category in the consent banner; without consent the website sends no data to analytics; analytics counts page views.
  • Basis (T-92, T-94): consent (GDPR Article 6(1)(a); Electronic Communications Law, Article 399).
  • Scope and period: [OWNER CONTENT: who maintains the analytics instance, the scope of data collected and the period for which it is kept]
  • Changing your choice: the “Consent settings” button in the footer; details in the cookie policy.
  • Data: a random browser identifier, the decision (acceptance, rejection, change), consent categories, policy version, website address, a hash of the IP address (an HMAC code, not the address itself), date.
  • Recording consent (T-98): purpose: demonstrating that the person gave consent; basis (proposal to be verified, T-92): GDPR Article 6(1)(c) or (f).
  • Recording refusal and change of choice: purpose: respecting the choice (the website does not ask again before the policy version changes) and demonstrating it; basis (proposal to be verified, T-92): GDPR Article 6(1)(f), with the legitimate interest described in section 12.

Servers and backups

  • Website system: the website runs on a content management system instance in which form enquiries and the consent decision log are saved.
  • Backups: the database and website files are backed up.
  • Entities: [OWNER CONTENT: the entity maintaining the website system instance, the hosting provider and place of processing, server logs (whether they record the IP address, who stores them and for how long), data processing agreements]

Data recipients

  • Categories: the entity maintaining the website system and servers; the hosting provider; the analytics provider, if True Balance does not maintain the instance (section 6); the office's e-mail provider, which sends confirmations and notifications: [OWNER CONTENT: name of the office's e-mail provider and the data processing agreement]; authorised persons at True Balance.
  • Outside the European Economic Area: [OWNER CONTENT: whether data is transferred outside the European Economic Area (e-mail, hosting) and on what basis]

Data retention periods

  • Periods: [OWNER CONTENT: retention periods for enquiries from forms F1, F2, F3, copies of confirmation and notification e-mails in the office's inbox, marketing consents, the consent decision log, analytics data, server logs and backups, or the criteria for determining them; the time the IP address is kept in the submission limit]

Rights of data subjects

  • Rights (T-91): access to data, rectification, erasure, restriction of processing, objection, data portability, withdrawal of consent at any time, a complaint to a supervisory authority.
  • Objection (T-99): objection to processing based on a legitimate interest (on grounds relating to the person's particular situation) and to direct marketing; information about this right at the latest at the first communication, clearly and separately from other information: a separate paragraph in the enquiry confirmation e-mail (S00); method: a reply to that e-mail or a message to the address from section 2.
  • How to submit a request: a message to the address from section 2.

Bases for processing

  • Principle (T-92): processing is lawful only if at least one condition from GDPR Article 6(1) is met, including consent (point a), necessity for the performance of a contract to which the data subject is a party or for taking steps at their request before entering into a contract (point b), a legal obligation (point c) or the controller's legitimate interest (point f).
  • Choice: [OWNER CONTENT: choice of basis for forms F1, F2, F3 and the consent log, and a description of the legitimate interest]

Policy version and changes

  • Version: each version of the policy has a number; after a version change the consent banner asks for consent again.
  • Date: [OWNER CONTENT: version number and the date the policy takes effect]

Files stored in the browser are described in the cookie policy; to contact the office: Contact.