Privacy Policy

The administrator of personal data is NETSENDO PSA (simple joint-stock company), entered into the Register of Entrepreneurs of the National Court Register kept by the District Court Katowice-Wschód in Katowice, 8th Commercial Division of the National Court Register.

The Administrator has not appointed a Data Protection Officer (DPO). In matters regarding the protection of personal data, please contact us at the e-mail address: office@netsendo.com.

"Personal Data"

any information relating to an identified or identifiable natural person (Art. 4 point 1 GDPR).

"Processing"

any operation or set of operations which is performed on personal data, such as collection, recording, storage, modification, retrieval, consultation, use, disclosure, erasure or destruction (Art. 4 point 2 GDPR).

"Controller"

NETSENDO PSA — the entity that independently or jointly with others determines the purposes and means of the processing of personal data (Art. 4 point 7 GDPR).

"Service"

the website available at netsendo.com and all related subpages.

"Application" or "Software"

NetSendo software — a self-hosted email and SMS marketing automation platform, made available under a separate EULA license.

"User"

any natural person using the Service or Application.

"Cookies"

small text files saved on the User's end device by the web browser when using the Service.

"GDPR"

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 — General Data Protection Regulation.

"ECL"

Act of July 12, 2024 — Electronic Communications Law, regulating, among others, the rules for the use of cookies.

Users' personal data is processed based on the following purposes and legal bases:

In the case where the basis for processing is the legitimate interest of the Administrator (Art. 6 sec. 1 lit. f GDPR), this interest is in particular: conducting ongoing correspondence, ensuring the security of IT systems, conducting statistical analyses and marketing own products and services.

Users' personal data may be transferred to the following categories of recipients, solely to the extent necessary to achieve the indicated processing purposes:

• Hosting and IT infrastructure providers — entities providing Service hosting, databases, CDN services and e-mail;
• Payment service providers — payment operators handling subscription transactions (e.g., Stripe, Polar);
• Analytics tool providers — entities providing tools for analyzing website traffic (if used);
• Accounting office and legal advisors — entities providing accounting, tax and legal services to the Administrator;
• Public authorities — in cases provided for by applicable law (e.g., tax offices, courts, law enforcement agencies).

Each entity processing data on behalf of the Administrator operates on the basis of a data processing agreement (Art. 28 GDPR) and is obliged to apply appropriate data protection measures.

In connection with the use of third-party services (e.g., infrastructure providers, payment processors), personal data may be transferred outside the European Economic Area (EEA).

In such a case, the transfer of data takes place on the basis of:

• a decision of the European Commission finding an adequate level of data protection in a third country (Art. 45 GDPR);
• standard contractual clauses (SCC) adopted by the European Commission (Art. 46 sec. 2 lit. c GDPR);
• binding corporate rules (BCR) approved by the competent supervisory authority (Art. 47 GDPR);
• other mechanisms provided for in Chapter V of the GDPR.

In particular, data transfer to the USA may take place on the basis of the EU-US Data Privacy Framework (European Commission decision of July 10, 2023) or standard contractual clauses.

The User has the right to obtain a copy of the security measures used by contacting the Administrator at: office@netsendo.com.

Personal data is stored for the period necessary to achieve the purposes for which it was collected, taking into account applicable laws:

After the indicated periods expire, personal data is deleted or effectively anonymized.

In accordance with the GDPR, every User whose personal data is processed by the Administrator has the following rights:

• Right of access to data (Art. 15 GDPR) — the right to obtain confirmation as to whether personal data is being processed, and to obtain a copy of the data.
• Right to rectification of data (Art. 16 GDPR) — the right to request correction of incorrect or completion of incomplete data.
• Right to erasure of data (Art. 17 GDPR) — "right to be forgotten" — the right to request deletion of personal data when there is no legal basis for its further processing.
• Right to restriction of processing (Art. 18 GDPR) — the right to request restriction of data processing in specific cases.
• Right to data portability (Art. 20 GDPR) — the right to receive data in a structured, commonly used machine-readable format and to transmit it to another controller.
• Right to object (Art. 21 GDPR) — the right to object to the processing of data based on the legitimate interest of the Administrator, including profiling. In the case of objection to data processing for direct marketing purposes — data will no longer be processed for this purpose.
• Right to withdraw consent (Art. 7 sec. 3 GDPR) — in cases where processing takes place on the basis of consent, the User has the right to withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.
• Right to lodge a complaint with a supervisory authority(Art. 77 GDPR) — the User has the right to lodge a complaint with the President of the Personal Data Protection Office (PUODO):
  Personal Data Protection Office
  ul. Stawki 2, 00-193 Warsaw
  Website: https://uodo.gov.pl

To exercise the above rights, please contact us at the e-mail address: office@netsendo.com. A response to the request will be given without undue delay, no later than within one month of receiving the request. In the case of complex requests, this period may be extended by another two months, of which the User will be informed.

The Administrator does not make decisions towards Users based solely on automated data processing, including profiling, which would produce legal effects towards them or similarly significantly affect their situation (Art. 22 GDPR).

Basic analytical mechanisms may be used within the Service to optimize content and match communication to User preferences. Such activities do not constitute profiling within the meaning of Art. 22 GDPR, as they do not lead to automated decisions having a significant impact on the User.

In the event of implementing profiling mechanisms or automated decision-making in the future, the Administrator will update this Privacy Policy and inform Users in an appropriate manner.

The Administrator applies appropriate technical and organizational measures ensuring protection of processed personal data, in particular securing data against unauthorized access, change, loss, damage or destruction (Art. 32 GDPR).

The security measures used include in particular:

• Data transmission encryption — communication between the User's browser and the Service server takes place using the SSL/TLS protocol (HTTPS certificate);
• Access control — access to personal data is granted only to authorized persons, based on individual permissions;
• Regular backups — implemented backup procedures ensuring continuity of operation and data recovery;
• Software updates — regular updating of systems and software to eliminate known vulnerabilities;
• Personnel training — persons having access to personal data are trained in personal data protection and obliged to maintain confidentiality.

The NetSendo application offers features based on artificial intelligence, including generating email content, suggesting message topics and planning campaigns using the Campaign Architect module.

In this context, we inform that:

• AI models are provided by third parties — The User independently configures integration with a selected AI provider (e.g., OpenAI, Anthropic, Google) and provides their own API key. NETSENDO PSA does not process User AI queries nor has access to them;
• Data processed locally — in the case of using the Application in the self-hosted version, all AI data is processed on infrastructure controlled by the User and is not transferred to NETSENDO PSA;
• No automated decision making — AI functions are solely supportive and suggestive. The final decision on the content and sending of the message always belongs to the User;
• Compliance with AI Act — The Administrator monitors the development of regulations regarding artificial intelligence, including the Regulation of the European Parliament and of the Council (EU) on artificial intelligence (AI Act), and undertakes to adapt its services in accordance with applicable regulations.

The Administrator reserves the right to introduce changes to this Privacy Policy in order to adapt it to the current legal state, technological changes or modifications to the scope of services provided.

Users will be informed about any significant changes by:

• publishing the updated version of the Privacy Policy on the Service website;
• updating the "Last updated" date visible at the beginning of the document;
• in the case of significant changes — notifying by e-mail (if the Administrator has the User's e-mail address).

Continued use of the Service after the publication of the updated Privacy Policy means becoming acquainted with its content. However, this does not mean consent to data processing for new purposes — in such cases, the Administrator will ask for appropriate consent from the User.

Providing personal data by the User is voluntary, however:

• In the case of concluding a contract — providing data such as e-mail address, identification data and invoice data is a contractual requirement, necessary to provide services. Refusal to provide this data will prevent the conclusion and performance of the contract.
• In the case of a legal obligation — providing data for tax and accounting purposes (e.g., on an invoice) results from applicable laws and cannot be omitted.
• In other cases — providing data is fully voluntary and does not give rise to any negative consequences other than the inability to use specific functions of the Service (e.g., contact form, newsletter).