Privacy Statement

updated: 7 July 2026

This Privacy Statement (hereinafter, the Policy) governs the processing of personal data of users of the website with the domain name "wislacode.com" (hereinafter referred to as the Services).

We attach great importance to the protection of your personal data, so take a moment to find out more about our Privacy Statement and contact us if you have any questions.

1.1. For the purposes hereof, the following terms and definitions are used:

Web-site – web-sites with domain name "wislacode.com".

We (WislaCode) – WislaCode Solutions Prosta Spółka Akcyjna.

You (User) – any individual that is using functional features of the Services and has reached the age of full legal capacity in accordance with the legislation of the country of their citizenship.

2.1. This Policy shall govern any interaction between WislaCode and users related to personal data when using the Services.

2.2. This Policy neither governs nor determines the rights and obligations of third parties. It also does not apply to third-party applications or software available to users for integration with the Services. Thus, if you integrate any third-party applications with our Services, we will not be able to control how such applications process your personal data.

2.3. Please do not use the Services if you do not agree with the provisions and scope hereof.

3.1. The purposes and means of how your personal data is collected in these Services are determined by the following legal entity:

WislaCode Solutions Prosta Spółka Akcyjna

Warsaw, 02-591, ul. Stefana Batorego 18/108

email: info@wislacode.com

4.1. Personal data is any information that could enable direct or indirect identification of a person (e.g., their name, passport details, online identifier, etc.).

4.2. In accordance herewith, personal data may be collected both directly and indirectly.

(1) Personal data are collected directly when you provide them voluntarily (e.g. when registering in the Services).

(2) Indirect collection of personal data may occur automatically when accessing the Services. For example such a personal data collecting will occur when we receive your personal data from third parties (e.g. our analytics partners) or via cookies.

4.3. The personal information we collect varies based on your interactions with our website and other services. The categories of data we may gather include:

(1) Service Usage Data – your interactions with our website, including navigation patterns, feature usage, the words you type into our on-site search (with obvious personal data removed), server logs and session activity.

(2) Feedback Form Data – your contact information as well as details shared when you reach out with your enquiry, such as your messages and any relevant information needed to address your inquiries.

(3) Marketing Data – your contact details, your subscriptions if applicable as well as your other marketing preferences.

(4) AI Assistant Data – if you use our on-site AI assistant, the messages you send to it, the assistant's replies, the pages you viewed on this website during that visit, and any contact details you choose to share in the chat.

5.1. "Processing" is understood as at least one of the following: storage, modification, retrieval, disclosure, structuring, use, destruction as well as any other action with respect to your personal data.

5.2. We will process your personal data only for the following purposes and on the following legal grounds:

5.3. Subject to data anonymisation, your personal data may be used by WislaCode for any other purposes. This allows us to both strictly respect the data protection rights of our users, and not to lose the value of the user experience that they have shared within the Services.

5.4. We do not use automated decision making tools (including profiling) to process personal data. Automated decision-making tools primarily include those systems that, having processed your personal data, can make any decision with respect to you that has potential legal consequences, without human intervention.

5.5. Your personal data will be stored on the servers of our counterparties that we are using for operating our Services.

5.6. Employees of WislaCode shall also take all necessary organisational, legal and technical measures available to us for protection of your personal data. Users of the Services shall also be responsible to the maximum possible extent for the provision of accurate account details, keeping passwords and any other information required for authorisation confidential and its protection from unauthorised access by third parties.

5.7. Any personal data collected and processed hereunder shall be properly protected unless:

(1) you consent to their disclosure;

(2) such personal data are anonymised;

(3) such personal data are subject to disclosure under the applicable law.

5.8. We will do our best to keep your personal data protected. However, despite any possible measures taken on our part, we cannot guarantee full protection of the Services against information security risks.

6.1. A number of third parties may have access to your personal data – processors, services of which we use in order to constantly improve our Services, as well as provide you with the opportunity to use all its functionality.

Therefore, the following legal entities will be having the access to your personal data:

(1) Vercel Inc. – website hosting, content delivery and cookieless analytics;

(2) Neon – managed database (Postgres) storing form submissions, website content, and our own first-party, cookieless analytics (the pages you view, the site or search that referred you, any campaign parameters in the link you arrived from, your approximate country and device type, and a derived traffic-source channel), linked only by a one-way hashed session identifier and recorded only if you accept analytics cookies. The raw, event-level analytics records are kept for up to 180 days; after that we retain only aggregate daily statistics (date, page and counts, carrying no session identifier). We also keep an aggregate log of the words typed into our on-site search box, with obvious personal data (such as emails and phone numbers) removed, together with how many results each search returned; this search log carries no session identifier or any other identifier, so it cannot be linked to you or to your visit, is recorded only if you accept analytics cookies, and is used only in aggregate to learn what visitors look for and where content is missing. Search logs older than 180 days are deleted;

(3) Cloudflare, Inc. – media storage (R2) and bot protection (Turnstile);

(4) Plus Five Five, Inc. (Resend) – sending our enquiry notification emails;

(5) Google LLC – map embeds on the contact page, optional Google sign-in (for visitors on our forms, and for our own staff signing in to the site's admin), and website analytics (Google Analytics 4) with advertising measurement and remarketing (Google Ads), loaded via Google Tag Manager. Google Tag Manager and these Google tags load on each page view; until you consent they run in a cookieless mode (Google Consent Mode) that sets no cookies and no cross-site identifiers and sends Google only aggregate signals used to measure traffic and model conversions. Cookies and full measurement start only if you accept the matching category in our cookie banner;

(6) LinkedIn Corporation – optional LinkedIn sign-in, and (only with your consent) advertising conversion tracking and retargeting (the LinkedIn Insight Tag), loaded via Google Tag Manager;

(7) YouTube (Google, no-cookie mode) – company video on the about page, loaded only when you click play;

(8) Anthropic, PBC (USA) – powers our on-site AI assistant. The assistant is part of this website, not a third-party embed. When you send it a message, that message, together with relevant pages from this website, is sent to Anthropic's Claude model to generate a reply. We store the conversation, the pages you viewed and any contact details you choose to share, so that our team can follow up and so we can improve the assistant. Nothing is sent to Anthropic unless you write to the assistant.

(9) Telegram Messenger Inc. – when you send us an enquiry through a form on this website (the contact form or a resource or webinar form), or when you talk to our on-site AI assistant, we forward a notification to our team's private Telegram workspace so we can respond quickly. The notification contains the details you submitted (such as your name, email, phone and message) or, for the AI assistant, the conversation, and, where available, the pages you viewed on this website during that visit. This is used only internally, to handle your enquiry. This transfer to Telegram is not covered by an adequacy decision or by Standard Contractual Clauses. We therefore make it only with your explicit consent: before we forward anything you tick a required box, agreeing to the transfer, having been informed that Telegram may process your details outside the European Economic Area, where the usual EU safeguards may not apply and there may be additional risk. This is the basis set out in Article 49(1)(a) of the GDPR. If you would prefer that we did not use Telegram, do not tick the box - you can contact us by email at info@wislacode.com instead.

Some of these providers process personal data outside the European Economic Area (for example in the USA). Except for the transfer to Telegram described in (9) above, which we make only on the basis of your explicit consent (Article 49(1)(a) of the GDPR), these transfers are protected by an appropriate safeguard, such as the EU-US Data Privacy Framework, the European Commission's Standard Contractual Clauses, or equivalent measures. The LinkedIn Insight Tag is loaded only after you give the matching consent in our cookie banner, and never before. Google Tag Manager and Google's own measurement tags (Google Analytics and Google Ads) load on each page view, but until you consent they operate in cookieless Consent Mode - they set no cookies and no cross-site identifiers and send Google only aggregate signals. No cookies are set by any of these tools before you consent.

6.2. To ensure the provision of our services, your personal data may also be transferred to a legal entity created after reorganisation of WislaCode should it be necessary.

6.3. Please note that disclosure of your personal data may be required in accordance with the law and judicial procedures or at the request of public bodies of the country of your stay or other countries. Your personal data will be disclosed if it is necessary for the purposes of national security, law enforcement, protection of the rights and legitimate interests of WislaCode and third parties or for other substantial public interest purposes.

6.4. Below, we describe the categories of personal information we have disclosed in the past 12 months and the categories of third parties with whom that information may be shared.

Categories of Personal Information Disclosed:

• Identifiers (e.g., name, email address, IP address)
• Commercial information (e.g., purchase history, interactions with our services)
• Internet or other electronic network activity (e.g., browsing behaviour, device information)
• Geolocation data (if collected)
• Inferences drawn from other personal data (e.g., preferences, interests)

Categories of Third Parties to Whom We Disclose Personal Information:

• Service providers (e.g., hosting providers)
• Marketing and advertising partners
• Analytics providers
• Affiliated companies and business partners
• Legal, regulatory, or law enforcement entities when required by law

We disclose personal information only for the purposes described in this Privacy Statement, such as to operate and improve our services, comply with legal obligations, protect against fraud and misuse, and as described above.

7.1. To the extent to which it is not prohibited by the applicable law, we do not authorise the use of our Services by individuals who have not reached the age of full legal capacity in accordance with the legislation of the country of their citizenship. We do not collect and process (at least knowingly) their personal data without the consent of their legal representatives.

8.1. The following provisions apply specifically to individuals residing in the United States, in accordance with applicable federal and state privacy laws. These provisions describe our practices related to the collection, use, disclosure, and potential sale of personal information, with a particular focus on the rights of California residents under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA).

8.2. Under the CCPA and CPRA, "sell" and "sale" refer to the transfer, disclosure, or making available of a consumer's personal information to a third party for valuable consideration. This does not necessarily involve a direct monetary exchange but may include other forms of benefit.

8.3. We do not sell personal information in the traditional sense. However, we may allow Service Providers to process personal information for business purposes such as advertising, marketing, and analytics, which may be considered a "sale" under CCPA/CPRA.

8.4. In the past twelve (12) months, we may have sold the following categories of personal information:

• Identifiers
• Personal information categories listed under the California Customer Records statute (Cal. Civ. Code § 1798.80(e))
• Commercial information
• Internet or other similar network activity

8.5. The categories listed above align with CCPA/CPRA definitions. This does not mean that all types of personal information within these categories were sold, but rather that some data within these categories may have been shared in exchange for value.

8.6. Your rights regarding the collection and use of your personal information are governed by the privacy laws applicable to your place of residence, including the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), and similar state laws such as those in Virginia, Colorado, Connecticut, and others.

8.7. Depending on your state of residence, you may have the following rights:

• Right to Know: You may request information about the categories and specific pieces of personal information we collect, use, disclose, and share.
• Right to Delete: You may request that we delete personal information we have collected from you, subject to certain exceptions.
• Right to Correct: You may request that we correct inaccuracies in your personal information.
• Right to Opt-Out of Sale or Sharing: You may opt out of the sale or sharing of your personal information, if applicable.
• Right to Limit Use of Sensitive Personal Information: In certain states, you may request to limit our use or disclosure of sensitive personal information.
• Right to Non-Discrimination: You have the right not to receive discriminatory treatment for exercising your privacy rights.

9.1. The following provisions apply specifically to individuals residing in the European Economic Area (EEA) and are intended to comply with the General Data Protection Regulation (GDPR) and other applicable data protection laws. These provisions describe your rights regarding the collection, processing, and use of your personal information, as well as the choices available to you for managing your privacy.

9.2. Depending on your place of residence, you may have the following rights:

• Right of Access: You may request confirmation as to whether we process your personal data and, if so, obtain a copy of that data along with information about how it is used.
• Right to Rectification: You may request that we correct inaccuracies or complete incomplete personal data concerning you.
• Right to Erasure ("Right to be Forgotten"): You may request that we delete your personal data, subject to certain legal exceptions.
• Right to Restrict Processing: You may request that we limit the processing of your personal data under certain circumstances.
• Right to Data Portability: You may request to receive your personal data in a structured, commonly used, and machine-readable format, and to have that data transmitted to another controller where technically feasible.
• Right to Object: You may object to the processing of your personal data on grounds relating to your particular situation, including the right to object to processing for direct marketing purposes.
• Right to Lodge a Complaint: You have the right to lodge a complaint with a supervisory authority if you believe our processing of your personal data violates applicable data protection laws.

10.1. To exercise any of your rights under applicable laws or if you have any questions related to your personal information, please contact us at dpo@wislacode.com.

10.2. Please note that WislaCode may need to verify your identity before fulfilling your request. If we are unable to fulfil your request, we will explain the reasons why. If we deny your request, you may appeal our decision by contacting us at the same email and stating "Privacy Request Appeal" in the subject line.

10.3. We will typically respond to your request within 30 calendar days from the date we receive it. If we need more time (up to an additional 60 days in the case of EEA residents and up to 45 days in the case of USA residents), we will inform you of the reason and extension period in writing.

11.1. This Policy may be amended and (or) modified at any time of the Services operation. In this case, a notice with information about the changes accompanied by the new version of the Policy and date of its adoption will be published in the Services. The User of the Services must read and acknowledge the new version hereof.

11.2. The Policy is an agreement between us and the User about the use of the Services. Any other pre-existing written or oral agreements or arrangements with respect to such use are hereby cancelled.

11.3. If any provision hereof is invalid or unenforceable, other provisions shall remain valid and enforceable to the fullest extent permitted by applicable law.

11.4. Failure to enforce your strict compliance herewith cannot be construed as our waiver of any provision hereof or any right hereunder.