Privacy Policy

The operator of Convomint and data controller is Abersite Artur Bereśniewicz, ul. Kobryńska 19, 15-722 Białystok, Poland, tax ID (NIP): 847 134 90 60. Data protection contact: [email protected].

We act in two roles. As a data controller — for data collected via the public website and in connection with serving Customers (accounts, billing, contact forms, demo, newsletter). As a data processor (art. 28 GDPR) — for data of our Customers' employees and associates processed inside the application (reviews, surveys, development plans); the controller of that data is the employer (our Customer).

We process: account data (first name, last name, e-mail address, organisational role), billing data (company details, tax ID, payment history — we do not store card numbers, they are handled by Stripe), data entered in the application by the Customer's organisation (team structures, reviews, survey responses, development plans, notes), technical data (IP address, logs, session identifiers), and data from marketing and demo-access forms (e-mail address, optionally company name, marketing consent, IP address).

We process data to: provide the service, manage accounts and support (art. 6(1)(b) GDPR — contract); handle billing, accounting and legal obligations (point (c) — legal obligation); ensure security, prevent abuse and run product analytics (point (f) — legitimate interest); provide the demo and contact you about the product (point (f)); and — only with your consent — send marketing information, including the newsletter (point (a) — consent). You can withdraw consent at any time (via the unsubscribe link or by writing to [email protected]), without affecting the lawfulness of earlier processing.

If your data ended up in Convomint because your employer uses our platform for reviews or surveys — your employer is the controller of your data. The employer decides on the purposes and scope of processing; we act on its documented instructions under a data processing agreement.

Please direct requests for access, rectification or erasure of data processed within an organisation to your employer first. We support our Customers in fulfilling those rights. For anonymous surveys, we do not show results for groups that are too small.

We entrust data to trusted subprocessors only to the extent necessary to run the service: hosting and infrastructure providers in the EU/EEA, the transactional e-mail provider Amazon Web Services (Amazon SES, EU region — Ireland; recipient e-mail addresses and notification content only), the payment operator Stripe (for billing), the analytics tool PostHog (EU cloud, eu.posthog.com — in the application: user identifier, role, company metadata and feature-usage events; on the public website: anonymous, cookieless visit statistics; no review or survey content), and the AI model providers described in section 6. Each subprocessor is bound by a data processing agreement or standard contractual clauses. We do not sell data or share it for advertising purposes.

AI features (template generation, report narratives, "HR Copilot", comment analysis) use external language-model providers — including OpenAI, Anthropic and Google — as subprocessors. We minimise data: first and last names are NOT sent to the models (they are automatically removed before sending), and analyses receive only anonymised metrics and content. The providers operate under data processing agreements and standard contractual clauses (SCC) and do not use the transferred data to train their models. AI features are supportive — we make no automated decisions producing legal effects (art. 22 GDPR). You may object to AI processing — contact your organisation's administrator or us.

We store data in the European Union. The exceptions are AI model calls (section 6) and payment processing, where data may reach third countries (e.g. the USA). Such transfers rely on standard contractual clauses approved by the European Commission or other mechanisms provided for in Chapter V GDPR (e.g. adequacy decisions for entities certified under the EU-U.S. Data Privacy Framework).

We process data for the duration of the agreement with the Customer. After it ends, data is deleted or anonymised after a 30-day export window, except for data whose longer retention is required by law (e.g. accounting records — 5 years from the end of the tax year) or which is necessary to establish and pursue claims. Demo and newsletter form data is kept until consent is withdrawn or an objection is raised. Backups rotate automatically and are deleted according to the retention schedule.

You have the right to: access your data, rectify it, erase it, restrict processing, data portability, object to processing based on legitimate interest, and withdraw consent. We handle requests without undue delay, at the latest within one month. You also have the right to lodge a complaint with the President of the Polish Personal Data Protection Office (uodo.gov.pl). If section 4 applies to you, contact your employer first as the data controller.

The public Convomint website operates without advertising or tracking cookies; public-page visit statistics are collected anonymously by PostHog and set no cookies. The application uses only essential cookies (session, security); product analytics runs without storing cookies or any other identifier on your device. Details, including the cookie table and management options, are in the Cookie Policy available in the Service footer.

We use transport encryption (TLS), role-based access control, monitoring and automated backups. In the event of a personal data breach likely to result in a risk to rights and freedoms, we will notify the President of the Personal Data Protection Office within 72 hours, and the affected individuals where the risk is high (art. 33–34 GDPR).

We will announce material changes to this policy in the Service or by e-mail. The date of the last update is always visible at the top of the document.