Privacy Policy

1. Data controller

The controller of personal data processed in connection with the use of the advisio.pro website is:

The Controller has not appointed a data protection officer, unless information regarding such appointment is published on the Website in the future.

2. Scope of this Policy

This Privacy Policy describes how personal data is processed in connection with the use of the public Advisio Poland website, in particular in relation to:

• using the contact form,
• enquiries regarding Advisio tools, certification and the partner programme,
• using the directory of Certified Partners,
• using embedded video materials,
• maintaining Website analytics and ensuring its security,
• access to the administrative panel by authorized individuals.

This Policy does not govern data processing rules on separate systems and platforms, such as Insightful Profiler™ iP121 or Advisio World, which may have their own privacy notices.

3. Contact form and correspondence

If you contact Advisio Poland via the contact form, we may process in particular: full name, email address, telephone number (if provided), selected area of interest, message content, source page URL, form language, and technical information necessary for the secure handling of the enquiry.

Data is processed for the purpose of:

1. responding to the enquiry and conducting correspondence — based on the Controller’s legitimate interest consisting of handling business correspondence and enquiries addressed to Advisio Poland (Article 6(1)(f) GDPR);
2. taking steps at your request prior to entering into a contract, if the enquiry concerns purchasing a service, tool, certification or other partnership (Article 6(1)(b) GDPR);
3. establishing, exercising or defending legal claims — based on the Controller’s legitimate interest (Article 6(1)(f) GDPR).

Providing data in the form is voluntary, but data marked as required is necessary to send the enquiry and receive a response.

Checking the box next to the form constitutes an acknowledgement of having read the Privacy Policy and information regarding data processing. It is not the legal basis for processing data to respond to your enquiry.

4. Certifications and partner programme

If you contact us regarding certification, participation in the partner programme or other collaboration, data may be processed for the purpose of:

• providing information about the programme and available dates,
• taking steps prior to entering into an agreement,
• organizing the certification or partnership process,
• conducting necessary communication related to the collaboration,
• establishing, exercising or defending legal claims.

The legal basis for processing is in particular Article 6(1)(b) GDPR, and in terms of organizational communication, security and claim protection, also Article 6(1)(f) GDPR.

If registration for a specific date takes place on a third-party platform, the privacy policy of that service operator may also apply prior to transmitting data.

5. Certified Partners directory

The Website may publicly present data of Advisio Certified Partners, in particular: full name, organization name, city or operating region, contact details, website address or professional profile, professional profile description, and information on held certifications.

This data is published to enable users to find individuals and organizations authorized to work with Advisio methodologies and to carry out the partner programme.

The legal basis for processing may be the performance of a partner agreement or actions related to that agreement (Article 6(1)(b) GDPR), and where applicable, the consent of the data subject (Article 6(1)(a) GDPR).

The scope and duration of publication result from the partner relationship, granted authorizations and arrangements with the Partner.

6. Proprietary website analytics

Advisio Poland uses its own first-party analytics system to measure traffic, website performance, content effectiveness and detect automated traffic.

Public Advisio analytics:

• does not use tracking cookies,
• does not store raw IP addresses in the analytics database,
• does not use third-party advertising trackers,
• is not used to create advertising user profiles.

To distinguish traffic, the system may generate a technical, pseudonymous identifier based on connection and browser information. The identifier is generated using an HMAC function and rotates on a daily cycle, which limits the ability to link the activity of the same user across different days.

The legal basis for processing is the Controller’s legitimate interest in measuring Website performance, improving its quality, analyzing content effectiveness and protecting against abuse and automated traffic (Article 6(1)(f) GDPR).

7. Technical logs and security

Independently of the analytics database, the server infrastructure may record standard technical logs, including: IP address, date and time of the request, requested URL, HTTP method, response code, User-Agent, referer, and error/security event information.

This data is processed to ensure Website security, diagnose errors, and protect against attacks, abuse and unauthorized access.

The legal basis for processing is Article 6(1)(f) GDPR — the Controller’s legitimate interest in ensuring system security and Website operational continuity.

8. Cookies and device storage

Public Advisio analytics does not use cookies or identifiers stored on the user’s device to track user activity.

The Website administrative panel uses a strictly necessary technical session cookie, advisio_admin_session, intended exclusively for authorized administrative users. It is required for authentication and securing administrator sessions.

The Website does not use its own advertising cookies or cookies for profiling visitors of the public section of the Website.

In the case of third-party services, such as the YouTube player, the third-party provider's technologies may apply once the user actively initiates such content. Details are described below.

9. YouTube video materials

Selected Advisio product pages feature video materials hosted on YouTube.

The Website uses privacy-enhanced embedding from the youtube-nocookie.com domain. The external player is only loaded after the user deliberately plays the video (click-to-load).

Once the video is loaded, the browser establishes a connection with Google/YouTube infrastructure. As a result, technical information such as IP address, browser data, device data and playback information may be transmitted to Google.

The operator of YouTube in the European Economic Area is generally Google Ireland Limited, and data may also be processed by Google LLC and other entities within the Google group. If you do not wish to establish a connection with YouTube, do not play the embedded video.

10. Data recipients

Personal data may be transferred to entities supporting the Controller only to the extent necessary to fulfill a specific purpose.

Categories of recipients may include in particular:

• server infrastructure and hosting providers,
• IT services, system maintenance and security providers,
• Resend / Plus Five Five, Inc. — for technical handling of email delivery from forms,
• Google Ireland Limited / Google LLC — in the event of deliberate playback of embedded YouTube videos,
• electronic mail providers,
• legal, accounting or advisory service providers to the Controller, where access to data is necessary,
• public authorities — exclusively when the obligation to disclose data arises from legal provisions.

Processors acting on behalf of the Controller process data based on appropriate contracts and solely in accordance with documented instructions from the Controller.

11. Data transfers outside the EEA

Using certain technology providers may involve the transfer of or access to data from countries outside the European Economic Area, in particular the United States.

In such cases, the Controller relies on mechanisms provided for in Chapter V of the GDPR, appropriate to the given provider and specific transfer. These may include in particular:

• European Commission adequacy decisions, including the EU-U.S. Data Privacy Framework regarding certified entities in the USA,
• standard contractual clauses (SCC) approved by the European Commission,
• other legally permissible safeguards required by the GDPR.

Resend declares compliance with the EU-U.S. Data Privacy Framework and uses subprocessors described in its documentation. Google also declares certification of Google LLC under the EU-U.S. Data Privacy Framework.

12. Data retention periods

Data is stored no longer than necessary for the purpose for which it was collected, taking into account legal obligations and the need to establish, exercise or defend legal claims:

• Enquiries and correspondence: for the duration required to handle the enquiry and conduct correspondence, and subsequently for the period necessary to demonstrate communication history and until the expiry of limitation periods for potential claims.
• Certifications and cooperation: for the duration of the process or contractual relationship, and subsequently for the period required by law or necessary for claim protection.
• Certified Partners: for the duration of the publication authorization and partner relationship, and following its termination for the period necessary to comply with legal obligations and claim protection.
• Analytics data: for the period necessary to generate statistics and analyze Website performance; the pseudonymous visitor identifier rotates on a daily cycle.
• Technical logs: for a period resulting from current retention configuration and security requirements, and subsequently deleted or overwritten.
• Administrator accounts: for the duration of access authorization to the panel.

13. Rights of data subjects

Under the rules set out in the GDPR, you have the right to:

• access your data,
• rectify your data,
• erase your data,
• restrict data processing,
• object to processing based on Article 6(1)(f) GDPR for reasons related to your particular situation,
• data portability — where the conditions of Article 20 GDPR are met,
• withdraw consent at any time, where processing is based on consent (without affecting the lawfulness of processing carried out prior to its withdrawal).

To exercise your rights, you may contact the Controller at: office@advisio.pro.

You also have the right to lodge a complaint with the competent supervisory authority — in Poland, this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych — PUODO).

14. Automated decision-making

Within the public advisio.pro website, the Controller does not make decisions concerning users based solely on automated processing which produce legal effects concerning them or similarly significantly affect them.

15. Data security

The Controller applies technical and organizational measures aimed at protecting data appropriately according to the nature, scope and risks of processing, including encrypted HTTPS connections, server-side data validation, access control to the administrative panel and administrator session security.

16. Links and third-party websites

The Website may contain links to external platforms (e.g. ip121.ai, app.ip121.ai, advisio-world.net, YouTube, Partner websites). Upon navigating to a third-party website, data processing rules are determined by its operator.

17. Changes to the Privacy Policy

This Policy may be updated in the event of changes in legal regulations, Website operation, deployment of new functionalities or changes in technology providers. The current version is always published on the advisio.pro website.