Book a demo
EN

Mindgram Privacy Policy

This Privacy Policy sets out the rules governing the processing of personal data of persons using Mindgram's Services and other users of the Website.

§1 DEFINITIONS

  • AI – artificial intelligence, i.e. an application and software exhibiting human-like abilities such as reasoning, learning, planning and creativity, enabling technical systems to perceive their surroundings, cope with the environment, perceive and solve problems, and act towards achieving a defined goal.
  • Controller or Mindgram – Mindgram sp. z o. o. with its registered office in Warsaw, KRS: 0000881002.
  • Cookies – text data collected in the form of files placed on the User's Device.
  • Personal data – means information relating to an identified or identifiable natural person ("data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, country of residence, employer data, branch or organizational unit, an online identifier or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
  • Mindgram Platform – the Mindgram platform through which Mindgram provides the Services.
  • GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
  • Website – the website "mindgram.com" available at https://mindgram.com.
  • External website – websites of partners, service providers or service recipients cooperating with the Controller.
  • Device – an electronic device together with software, through which the User accesses the Website or Application.
  • Services – services provided by Mindgram consisting of providing access to the Mindgram platform via the Website or Application.
  • User – a Platform User or a Website User.
  • Platform User – a natural person to whom the Controller provides services via the Website or Application.
  • Website User – a natural person using the Website.

§2 DATA PROTECTION OFFICER AND CONTACT WITH THE CONTROLLER

The Controller has appointed a Data Protection Officer, who can be contacted by e-mail at: gdpr@mindgram.com. The Data Protection Officer: Oskar Kopiński - ul. Stanisława Noakowskiego 12/36, 00-666 Warszawa.

Regardless of the above, the Controller may also be contacted directly at the following addresses:

  • postal address – Mindgram Sp. z o. o., ul. Wiktorska 17/2, 02-587 Warsaw, Poland,
  • e-mail address – kontakt@mindgram.com.

§3 TYPE, PURPOSE AND PERIOD OF PROCESSING OF PERSONAL DATA

PROCESSING OF PLATFORM USERS' DATA

Personal data of Platform Users is processed for one of the following purposes:

  • Performance of the agreement concluded with the Platform User, being the basis for the Platform User's use of the Mindgram Platform or participation in a webinar:
    • Legal basis: Article 6(1)(b) GDPR (conclusion, performance and termination of the concluded agreement),
    • Processing period: the term of the agreement,
    • Scope of data processed: e-mail address, first name, surname, company name (including branch or organizational unit data), location data (including country of residence), year of birth, gender, age, other data voluntarily provided by the Platform User in connection with registering an account on the Mindgram Platform, such as gender, telephone number, the provision of which is voluntary.
    • Legal basis: Article 6(1)(a) GDPR (consent to the processing of personal data to the extent it is not necessary for the performance of the concluded agreement),
    • Processing period: until the data is deleted or consent is withdrawn, but no longer than until the end of the term of the agreement,
    • Scope of data processed: any data voluntarily provided by the User in connection with the use of Mindgram's services, such as image (likeness) and other data provided at the Platform User's discretion in connection with the use of the Services, whereby the provision of data is voluntary and consent to the processing of data may be withdrawn by the User at any time.
    • Automated processing of personal data: within the scope of the Services provided on the Platform, automated processing of personal data (profiling) using AI may occur.
  • Pursuit of the Controller's legitimate interests:
  • consisting in establishing, pursuing or defending claims that the Controller may raise or that may be raised against the Controller in connection with the concluded agreement:
    • Legal basis: Article 6(1)(f) GDPR (pursuit of the Controller's legitimate interests),
    • Processing period: the data is stored until the limitation period for claims arising from the agreement concluded with the Controller has expired, which period is 3 years from the end of the agreement, but not earlier than the end of the last calendar day on which the 3-year limitation period expires,
    • Scope of data: e-mail address, first name, surname, company name (including branch or organizational unit data), year of birth, location data (including country of residence).
  • consisting in conducting marketing and sales activities towards persons with whom the Controller has concluded an agreement:
    • Legal basis: Article 6(1)(f) GDPR (pursuit of the Controller's legitimate interests),
    • Processing period: the term of the agreement concluded with the Controller,
    • Scope of data: e-mail address, first name, surname, company name, year of birth.
  • consisting in surveying the opinions of Platform Users and communicating with Platform Users for the purpose of developing Mindgram's products and services:
    • Legal basis: Article 6(1)(f) GDPR (pursuit of the Controller's legitimate interests),
    • Processing period: the term of the agreement concluded with the Controller,
    • Scope of data: e-mail address, first name, surname, company name (including branch or organizational unit data), location data (including country of residence), gender, age, other data voluntarily provided by the User in connection with the use of Mindgram's services.

PROCESSING OF WEBSITE USERS' DATA

Personal data of Website Users is processed for one of the following purposes:

  • Establishing contact via the contact form and e-mail messages for the purpose of using the demo version of the Platform:
    • Legal basis: Article 6(1)(a) GDPR (consent to the processing of personal data),
    • Processing period: until consent is withdrawn, but no longer than 3 years from the last correspondence between the Controller and the person concerned,
    • Scope of data processed: first and last name, e-mail address, telephone number, city, company name, role in the company, number of company employees, other data voluntarily provided in the content of the message, whereby the provision of personal data is voluntary but necessary to submit an inquiry and receive a response from Mindgram, and consent to the processing of personal data may be withdrawn at any time.
  • Establishing contact via the contact form and e-mail messages in order to respond to inquiries, send e-books, guides, newsletters, and provide access to video recordings in connection with a request submitted via the contact form:
    • Legal basis: Article 6(1)(a) GDPR (consent to the processing of personal data),
    • Processing period: until consent is withdrawn, but no longer than 3 years from the last correspondence between the Controller and the person concerned,
    • Scope of data processed: first and last name, e-mail address, telephone number, city, position, company, other data voluntarily provided in the content of the message, whereby the provision of personal data is voluntary but necessary to submit an inquiry and receive a response from Mindgram, and consent to the processing of personal data may be withdrawn at any time.
  • Conducting marketing and sales activities:
    • Legal basis: Article 6(1)(a) GDPR (consent to the processing of personal data),
    • Processing period: until consent is withdrawn, but no longer than 3 years from the last correspondence between the Controller and the person concerned,
    • Scope of data: first and last name, e-mail address, telephone number, company name (including branch or organizational unit data), location data (including country of residence), role in the company, number of company employees.
  • Establishing contact, including responding to inquiries addressed to the Controller via the contact form and e-mail messages:
    • Legal basis: Article 6(1)(a) GDPR (consent to the processing of personal data),
    • Processing period: until consent is withdrawn, but no longer than 3 years from the last correspondence between the Controller and the person concerned.
    • Scope of data processed: first and last name, e-mail address, telephone number, company name, role in the company (including branch or organizational unit data), location data (including country of residence), number of company employees, other data voluntarily provided in the content of the message, whereby the provision of personal data is voluntary but necessary to submit an inquiry and receive a response from Mindgram, and consent to the processing of personal data may be withdrawn at any time.

PROCESSING OF OTHER PERSONS' DATA

  • Conducting marketing and sales activities towards persons who are not Mindgram customers:
    • Legal basis: Article 6(1)(a) GDPR (consent to the processing of personal data),
    • Processing period: until consent is withdrawn,
    • Scope of data: e-mail address, first name, surname, company name, other voluntarily provided data, whereby the provision of personal data and consent to its processing is voluntary but necessary to receive marketing and sales content from Mindgram, and consent to the processing of personal data may be withdrawn at any time.
  • Pursuit of the Controller's legitimate interests consisting in maintaining profiles on social media (including Facebook, Instagram, LinkedIn), including communicating with social media users:
    • Legal basis: Article 6(1)(f) GDPR (pursuit of the Controller's legitimate interests),
    • Processing period: until the given social media user's activity on the Controller's social media ends, or until an objection to the processing of data is raised,
    • Scope of data: e-mail address, first name, surname, username/handle, image (likeness), company name, other voluntarily provided data.

§4 RIGHTS OF DATA SUBJECTS

Persons whose personal data is processed have the following rights:

  • The right to access personal data, i.e. the right to obtain access to one's own personal data, exercised upon request submitted to the Controller.
  • The right to rectification of personal data, i.e. the right to request that the Controller promptly rectify personal data that is inaccurate and/or complete incomplete personal data, exercised upon request submitted to the Controller.
  • The right to erasure of personal data, i.e. the right to request that the Controller promptly erase personal data, exercised upon request submitted to the Controller. In the case of data collected in user accounts, erasure of data consists in its anonymization. Upon receiving a request for erasure of personal data, the Controller each time verifies the legitimacy of the request, taking into account all legal bases for the processing of personal data. The Controller always informs the person whose data it processes of how the request has been handled. In the case of the Newsletter service, the User may independently delete their personal data by using the link included in each e-mail message sent.
  • The right to restriction of processing of personal data, i.e. the right to restrict the processing of personal data in the cases indicated in Article 18 GDPR, including where the accuracy of the personal data is contested, exercised upon request submitted to the Controller.
  • The right to data portability, i.e. the right to obtain from the Controller personal data in a structured, commonly used, machine-readable format, exercised upon request submitted to the Controller.
  • The right to object to the processing of personal data, i.e. the right to object to the processing of one's personal data in the cases specified in Article 21 GDPR, exercised upon request submitted to the Controller.
  • The right to lodge a complaint with the supervisory authority responsible for the protection of personal data (the President of the Personal Data Protection Office, Poland).

§5 COOKIE POLICY

COOKIES USED ON THE WEBSITE AND PLATFORM AND THE PURPOSES FOR WHICH THEY ARE USED

Mindgram uses the following types of cookies on the Website and Platform:

  • External cookies – files placed on and read from the User's Device by the IT systems of External websites. Scripts of External websites which may place Cookie files on Users' Devices have been knowingly incorporated into the Website and Platform through scripts and services made available and installed on the Website or Platform.
  • Session cookies – files placed on and read from the User's Device by the Website or Platform during a single session of a given Device. Once the session ends, the files are deleted from the User's Device.
  • Persistent cookies – files placed on and read from the User's Device by the Website or Platform until manually deleted. The files are not automatically deleted at the end of the Device's session, unless the User's Device is configured to delete Cookie files upon the end of the Device's session.

Cookies used on the Website and Platform can also be divided into:

  • Necessary cookies – files that contribute to the usability of the Website or Platform by enabling basic functions such as navigating the Website and accessing secure areas of the Website or Platform. The Website or Platform cannot function properly without these cookies.
  • Preference cookies – files relating to preferences. They enable the Website or Platform to remember information that changes the appearance or functioning of the Website or Platform, e.g. preferred language or the region in which the User is located.
  • Statistical cookies – cookies that help the owner of the Website and Platform understand how various Users behave on the site, by collecting and reporting anonymous information.
  • Marketing cookies – files used to track Users on the Website or Platform. Their purpose is to display advertisements that are relevant and interesting to individual Users and thus more valuable to third-party publishers and advertisers.
  • Unclassified cookies – files that are in the process of being classified, together with the providers of the individual cookie files.

SECURITY OF DATA STORAGE

  • Mechanisms for storing and reading Cookie files – the mechanisms for storing, reading and exchanging data between Cookie files saved on the User's Device and the Website or Platform are carried out through built-in web browser mechanisms and do not allow other data to be retrieved from the User's Device or data on other websites visited by the User, including personal data or confidential information. Transferring viruses, Trojan horses or other worms onto the User's Device is also practically impossible.
  • External cookies – the Controller takes all possible steps to verify and select website partners in the context of User security. The Controller selects well-known, large partners enjoying global public trust for cooperation. However, it does not have full control over the content of Cookie files originating from external partners. The Controller does not bear liability, to the extent permitted by law, for the security of Cookie files, their content, or their use in accordance with the license by Scripts installed on the website that originate from External websites.
  • Control of Cookie files – the User may, at any time, independently change the settings regarding the saving, deletion and access to data stored in Cookie files by each website, using the form available on the Website and Platform.
  • Risks on the User's side – the Controller applies all possible technical measures to ensure the security of data placed in Cookie files. However, it should be noted that ensuring the security of this data depends on both parties, including the User's own activities. The Controller bears no liability for the interception of this data, impersonation of the User's session, or its deletion, resulting from conscious or unconscious actions of the User, viruses, Trojan horses and other spyware with which the User's Device may be, is, or has been infected. In order to protect themselves against these risks, Users should follow the recommendations for safe use of the internet.
  • Storage of personal data – the Controller ensures that it makes every effort to keep the personal data voluntarily entered by Users secure, with access to it limited and carried out in accordance with its intended purposes and purposes of processing. The Controller also ensures that it makes every effort to protect the data it holds against loss, by applying appropriate physical and organizational safeguards.

Restricting the saving of and access to Cookie files on the User's Device may cause certain functions of the Website or Platform to malfunction.

The Controller bears no liability whatsoever for malfunctioning features of the Website or Platform where the User restricts, in any way, the ability to save and read Cookie files, or does not consent to their processing.

COOKIES OF EXTERNAL SERVICES USED ON THE PLATFORM

On the Platform, the Controller uses JavaScript scripts and web components of partners, who may place their own cookie files on the User's Device. Below is a list of partners or their services implemented on the Platform, which may place cookie files:

  • Multimedia services: YouTube, Vimeo, Agora.io
  • Social media and advertising / combined services (registration, login, content sharing, communication, etc.): Facebook / Facebook Pixel, LinkedIn / LinkedIn Insight Tag, Google / Google Ads, User.com, SendGrid, Firebase
  • Analytics: Google Analytics, WordPress Stats (Automattic Inc.), Google Tag Manager, Hotjar
  • CRM: HubSpot
  • Other services supporting the operation of the Platform: Segment, Survicate

Services provided by third parties are beyond the Controller's control. These entities may at any time change their terms of service, privacy policies, purposes of data processing and the manner in which they use cookie files.

COOKIES OF EXTERNAL SERVICES USED ON THE WEBSITE

On the Website, the Controller uses JavaScript scripts and web components of partners, who may place their own cookie files on the User's Device. A list of partners or their services implemented on the Website, which may place cookie files, is available at: http://www.mindgram.com/pl/ciasteczka.

Services provided by third parties are beyond the Controller's control. These entities may at any time change their terms of service, privacy policies, purposes of data processing and the manner in which they use cookie files.

§6 TYPES OF NON-PERSONAL DATA COLLECTED ON THE WEBSITE

The Website collects data about its users. Some data is collected automatically and anonymously, while some data is personal data voluntarily provided by Users when signing up for individual services offered by the Website.

Anonymous data collected automatically:

  • IP address.
  • Browser and device type.
  • Screen resolution.
  • Approximate location.
  • Website subpages visited, data on activity on the Website and Platform.
  • Time spent on a given subpage.
  • Operating system type.
  • Address of the previous subpage.
  • Referring page address.
  • Browser language.
  • Internet connection speed.
  • Internet service provider, mobile network data.
  • Telephone number.

§7 ACCESS TO PERSONAL DATA BY THIRD PARTIES

As a rule, the Controller is the sole recipient of personal data provided by persons using Mindgram's Services and other users of the Website.

Where necessary for the proper provision of services, the Controller may use the services of external entities and AI solutions. The Controller uses only the services of such processors and such AI solutions that provide sufficient guarantees of implementing appropriate technical and organizational measures, so that the processing meets the requirements of the GDPR and protects the rights of data subjects.

Recipients of personal data, and entities to which we entrust personal data, may include entities supporting us in our ongoing operations, including entities participating in the provision of services, in particular providers of psychological services, providers of automated e-mail or SMS dispatch services, IT solution providers including software used in the provision of services, providers of technical and organizational solutions to the Controller, AI service providers, as well as other entities, where the use of their services is necessary for the proper provision of services by Mindgram. Personal data collected by Mindgram may also be disclosed to: relevant state authorities upon their request pursuant to applicable law, or other persons and entities – in cases provided for by law.

Mindgram may transfer personal data to third countries where any of the entities indicated above processes data in a third country, and only where the European Commission has issued an adequacy decision or where standard contractual clauses approved by the European Commission are used.

In justified cases, and only with the consent of the data subject, the Controller may transfer personal data to third parties who will also act as controllers of the personal data.

§8 EXTERNAL LINKS

The Website – including articles, posts, entries or User comments – may contain links to external websites with which the website Controller does not cooperate. The Controller bears no liability for content located outside the Website.

§9 PROFILING

The Controller may make automated decisions, including profiling of Website Users and Platform Users, to the extent it conducts marketing activities – with respect to Platform Users, on the basis of the Controller's legitimate interest, and with respect to Website Users, on the basis of consent given for such activity.

The Controller may make automated decisions, including profiling of Website Users and Platform Users, with respect to Services provided using AI, for both Platform Users and Website Users, on the basis of consent given for such activity.

§10 CHANGES TO THE PRIVACY POLICY

The Controller reserves the right to make any changes to this Privacy Policy, without the need to notify persons whose data it processes, with respect to the use and application of anonymous data or the use of Cookie files.

The Controller reserves the right to make any changes to this Privacy Policy with respect to the processing of Personal Data, of which it will notify persons whose data it processes within 14 days of the change. Continued use of the services means that the introduced changes to the Privacy Policy have been reviewed and accepted. If a User does not agree with the introduced changes, the User is obliged to delete their account from the Website or withdraw consent to the processing of their Personal Data.

Changes introduced to the Privacy Policy take effect upon their publication.