Privacy Policy

1. Data controller

The controller of personal data is RedHex.AI, Polish tax identification number (NIP): 7262221071, with a correspondence address at ul. Narutowicza 40/1, 90-135 Łódź, Poland, operating redhex.ai.

For privacy matters and requests concerning personal data, contact us at team@redhex.ai.

2. Data we process

Through the contact form, we may process:

• your name, business email address and, optionally, company name;
• the selected topic, message content and information you voluntarily include in your enquiry;
• basic technical data related to form submission, such as an IP address, request time and HTTP metadata, to the extent necessary to protect the website against abuse.
• after you consent to analytics: a client identifier stored in Google Analytics cookies, visited pages, session and basic interaction data, browser and device information, and approximate location. We do not send contact-form field contents to Google Analytics.

Please do not include special-category data or personal data of third parties unless it is necessary for handling your enquiry.

3. Purposes and legal bases

• responding to your enquiry and taking steps at your request before entering into a contract — Article 6(1)(b) GDPR, where the enquiry concerns potential cooperation or a contract;
• handling other correspondence and maintaining communication — Article 6(1)(f) GDPR; our legitimate interest is the ability to respond to messages addressed to RedHex.AI;
• establishing, exercising or defending legal claims and documenting correspondence — Article 6(1)(f) GDPR;
• protecting the form and website, preventing abuse and diagnosing errors — Article 6(1)(f) GDPR;
• measuring visits and website usage to improve the service — Article 6(1)(a) GDPR, only after consent, which may be withdrawn at any time;
• complying with legal obligations — Article 6(1)(c) GDPR, where such an obligation applies.

The form is not used to subscribe users to marketing, and a marketing consent is not required for us to respond.

4. Whether data is required

Providing data is voluntary and is not a statutory requirement. Your name, email address, selected topic and message are necessary to receive and answer the enquiry. Without these data, we cannot handle the form. Providing a company name is optional.

5. Recipients

Data may be disclosed only where necessary to:

• persons authorised by RedHex.AI to handle correspondence;
• hosting, email, website maintenance and IT security providers acting under contracts and appropriate data-protection obligations;
• Google Ireland Limited — if you consent to the use of Google Analytics 4;
• public authorities or other entities where disclosure is required by law.

We do not sell data submitted through the form.

6. Transfers outside the EEA

We select providers with a view to limiting transfers outside the European Economic Area. If the use of a provider involves such a transfer, it will take place only under a mechanism permitted by the GDPR, in particular an adequacy decision or standard contractual clauses together with the required safeguards.

For Google Analytics, data may be processed by Google group entities outside the EEA. Google describes the applicable transfer mechanisms and safeguards in its privacy policy linked below.

7. Retention

• we retain correspondence for the time required to handle the enquiry and conclude the conversation;
• if the conversation leads to cooperation, data may continue to be processed in contract-related records and for periods required by law;
• after correspondence ends, data may be retained for the time necessary to establish, exercise or defend legal claims, no longer than the applicable limitation periods;
• technical security data are generally retained for no longer than 30 days, unless needed for longer to investigate an incident or pursue claims.
• user- and event-level data in Google Analytics are retained for no longer than 14 months; aggregate reports may remain available for longer.

8. Your rights

Subject to the conditions in the GDPR, you have the right to:

• access your data and receive a copy;
• rectify your data;
• erase your data or restrict its processing;
• data portability where processing is automated and based on Article 6(1)(b) GDPR;
• object, on grounds relating to your particular situation, to processing based on Article 6(1)(f) GDPR;
• withdraw analytics consent at any time through “Privacy settings”, without affecting the lawfulness of processing carried out before withdrawal;
• lodge a complaint with the President of the Polish Personal Data Protection Office.

To exercise your rights, email team@redhex.ai. Before handling a request, we may ask for information needed to confirm the requester’s identity.

9. Automated decision-making

Data from the form are not used for decisions based solely on automated processing or for profiling that produces legal effects or similarly significantly affects a user.

10. Cookies, local storage and Google Analytics

The website uses cookies and browser local storage only as described below:

• redhex_locale — a functional cookie stored after you select a language version; it remembers your preferred language for up to 12 months;
• redhex_analytics_consent_v1 — a local-storage entry that remembers your analytics-cookie choice for up to 180 days; it does not itself measure your activity;
• _ga and _ga_<identifier> — optional Google Analytics 4 cookies enabled only after you click “Accept”; they help distinguish users and sessions and are generally retained for no longer than 2 years.

Before consent, the Google tag is not downloaded and no analytics data are sent. We do not use advertising cookies, ads personalisation or Google Signals. You can reject or later withdraw consent using “Cookie settings”; after withdrawal, we block further measurement and remove analytics cookies available to the website. The server may independently create technical logs necessary to maintain website security, availability and diagnostics.

11. Security and changes

We apply technical and organisational measures appropriate to the nature of the data and relevant risks, including encrypted transmission in production, access restrictions and safeguards against automated form abuse.

We may update this Policy if the website, our providers or legal requirements change. The current version is always published at this address.