Privacy Notice
Who we are
OBSTRUO prosta spółka akcyjna, ul. Święty Marcin 29 lok. 8, 61-806 Poznań, Poland, entered in the Register of Entrepreneurs of the National Court Register kept by the District Court Poznań - Nowe Miasto i Wilda in Poznań, 8th Commercial Division, under KRS 0001254019, NIP 7831958330, REGON 545245656.
We are the controller of the personal data described in this notice. For any privacy question or request, write to office@obstruo.ai.
What this notice covers
This notice covers personal data where we decide the purposes and the means: the data of people who create an account, who represent a customer, who write to us, and who visit our website.
It does not cover personal data contained in the requests, responses and tool calls that a customer routes through the Obstruo gateway. For that data the customer is the controller and we act only on its instructions, under our Data Processing Agreement. If your personal data may have passed through an organisation's use of Obstruo, that organisation is responsible for informing you and for answering your requests, and you should contact it directly. If you write to us about such data, we will refer the request to the customer concerned.
Account and service administration
What we hold. Name, business email address, role, organisation, authentication data including multi-factor enrolment, and records of actions taken in the Panel.
Why. To create and administer accounts, authenticate users, provide support, and operate the Service for the customer organisation.
Legal basis. Performance of a contract, Article 6(1)(b) GDPR, where you contract with us directly. Our legitimate interest in administering the contract with your employer, Article 6(1)(f), where you use the Service on behalf of a customer organisation.
How long. For the term of the agreement, then for the period in which claims may still be brought, which for business claims under Polish law is three years calculated to the end of the relevant calendar year.
Billing and accounting
What we hold. Billing contact details, company details, VAT identification, invoices, payment records and payment status. Card details are entered directly with our payment provider and are never stored by us.
Why. To take payment, issue invoices, and meet our accounting and tax obligations.
Legal basis. Performance of a contract, Article 6(1)(b), and compliance with a legal obligation, Article 6(1)(c), under Polish accounting and tax law.
How long. Five years from the end of the calendar year in which the tax became payable, as Polish tax law requires.
Support and correspondence
What we hold. Your name and email address, the content of your message and our reply, and anything else you choose to include.
Why. To answer questions, handle incidents, and keep a record of what was agreed.
Legal basis. Performance of a contract, Article 6(1)(b), where your message concerns a service we provide to you. Otherwise our legitimate interest in responding to enquiries, Article 6(1)(f).
How long. For as long as needed to deal with the matter and any follow-up, after which the correspondence is deleted. Where a message relates to a contract, an invoice or a possible claim, we keep it for as long as that record is needed for those purposes.
Please avoid sending us sensitive information by email where it is not necessary. Email reaches us outside the gateway and outside the redaction path.
Sales enquiries
What we hold. Your name, business email address, organisation, and whatever you tell us when you request a demo or make an enquiry, together with a record of our contact with you.
Why. To respond to your enquiry and to discuss whether our services suit your organisation.
Legal basis. Steps taken at your request before entering a contract, Article 6(1)(b), and our legitimate interest in responding to business enquiries and following them up, Article 6(1)(f).
How long. Until the enquiry is closed and any follow-up is complete, or until you ask us to delete it.
We keep this information in a customer relationship management system that we host on our own infrastructure in the European Union. It is not shared with a third-party CRM provider.
Website statistics and cookies
We use Umami for website statistics. It is cookieless and does not follow you across sites. It records the page requested, the referring site, and general technical information such as browser, device type and approximate country, derived from what your browser sends with the request. From that the service derives a short-lived pseudonymous identifier so repeat page views within one visit count as one visit. It is not linked to a name or an account, and we do not use it to identify you, profile you or build audiences.
We treat this as personal data even though it does not identify you directly, and we rely on our legitimate interest in understanding how our website is used, Article 6(1)(f) GDPR. You may object at any time by writing to office@obstruo.ai.
Because nothing is stored on or read from your device, the consent requirement in Article 5(3) of the ePrivacy Directive does not apply and we show no consent banner. We use no advertising, remarketing or session-recording tools of any kind.
The AI governance assessment runs entirely in your browser. Your answers are not sent to us, not stored, and not seen by us.
The Panel is an authenticated application and uses cookies strictly necessary to operate it, such as keeping you signed in and protecting the session. These are exempt from the consent requirement. The Panel runs no analytics or advertising cookies.
Server and security logs
Our servers record technical data such as IP address, timestamp, requested URL and user agent. We use this to operate the site and the Service, to detect and investigate abuse, and to keep our systems secure, relying on our legitimate interest in the security and integrity of our systems, Article 6(1)(f).
Who we share data with
We do not sell personal data and we do not share it for anyone else's marketing. We use the following providers, each processing on our instructions under a written contract:
- OVH SAS, hosting infrastructure, France.
- Scaleway SAS, delivery of transactional email, France.
- Microsoft (Ireland), business email, tenant located in the European Union.
- Stripe Payments Europe, Ltd., payment processing and billing, Ireland.
- Umami Cloud (EU region), website statistics, European Union.
We may also disclose personal data to advisers such as accountants and lawyers, and to public authorities where the law requires it.
International transfers
Each of the providers above contracts with us through an entity established in the European Economic Area, and the processing they carry out for us takes place in the EEA. Our website statistics are collected in the provider's EU region.
Where our payment provider transfers data within its own group outside the EEA for fraud prevention or card-scheme processing, it does so under the safeguards set out in its own data processing terms.
Automated decision-making
We do not make decisions about you producing legal or similarly significant effects by automated means.
Your rights
You may ask us for access to your personal data, for it to be corrected or erased, to restrict or object to processing, and to receive it in a portable form. Where we rely on legitimate interests you may object at any time on grounds relating to your situation. Where we rely on consent you may withdraw it at any time, which does not affect processing carried out beforehand.
Write to office@obstruo.ai. We respond within one month, and will tell you if we need longer because a request is complex.
You may also complain to the Polish supervisory authority, Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa. If you live or work in another EU country, you may complain to your local supervisory authority instead.
Providing your data
Where we need personal data to enter into or perform a contract with you, or because the law requires it, not providing it means we cannot supply the Service or issue a valid invoice. Everything else is optional.
Changes to this notice
We update this notice when our processing changes and post the new version here with its date. Where a change materially affects you, we will tell you directly.