Privacy Policy
Version: 2026-10-12-clc.1
Last updated: 2026-10-15
1. Data controller
The controller of personal data is:
Brillnet Piotr Adamski
ul. Sienkiewicza 73/6
90-057 Lodz, Poland
Tax ID (NIP): PL7321779060
Privacy contact: kontakt@brillnet-app.com
2. Scope
This policy describes data processing on brillnet-app.com, including contact forms, newsletter or product-update subscriptions, information about Brillnet products, and cookie or similar-technology preferences. It also covers limited, individual business outreach about Brillnet products using professional contact details published by the business or in another public business source.
The website presents Brillnet's current and planned offer. Detailed rules for individual applications, if made available, may be described in separate terms or contracts.
3. Data we may process
Depending on how the website is used, we may process:
- contact data submitted in a form, such as first name, last name, company name, e-mail address, phone number and message content,
- newsletter and marketing-subscription data, such as e-mail address, first name, last name, company name, source of subscription, subscription date, consent status and unsubscribe history,
- for individual business outreach: a published professional e-mail address, business name, location, and a person's name or role only if the source explicitly publishes it; limited public facts about the business's services or booking process, the source URL, date checked, correspondence and objection history,
- technical data, such as IP address, request identifiers, browser and device information, and basic security logs,
- cookie and similar-technology preferences stored in the user's browser,
- aggregated statistics about website operation and popularity,
- aggregated telemetry events containing the day, a controlled source group, a controlled landing-page group and an event name; this register does not store full URLs, query strings, referrers, user identifiers or browser identifiers,
- billing and contractual data if a contact leads to an agreement with Brillnet.
We do not ask users to provide special-category data, such as health data, political opinions, religion or sexual orientation.
4. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Handling contact forms, responding to inquiries and preparing offers | Art. 6(1)(b) GDPR where the inquiry concerns pre-contractual steps, or Art. 6(1)(f) GDPR where we respond to ordinary correspondence |
| Sending newsletters, product updates and marketing communication to people who subscribed through our forms or are in a business relationship with Brillnet | Art. 6(1)(a) GDPR where consent is used, or Art. 6(1)(f) GDPR for business contacts in an existing relationship; electronic marketing is sent only where we have the required consent or another permitted basis |
| Sending one individually relevant first business message to a published professional address, where the country and contact rules permit it | Art. 6(1)(f) GDPR - legitimate interest in presenting a product relevant to the recipient's published professional activity; the separate rules for electronic marketing are checked before contact. We do not send after an objection |
| Maintaining correspondence and documenting arrangements | Art. 6(1)(f) GDPR - legitimate interest in handling inquiries and protecting the controller's interests |
| Website security, form abuse prevention and error diagnostics | Art. 6(1)(f) GDPR - legitimate interest in maintaining a secure website |
| Aggregated website performance measurement through Cloudflare Web Analytics | legitimate interest in maintaining website performance; according to Cloudflare documentation, this tool does not use cookies or localStorage and does not collect visitors' personal data |
| Aggregated measurement of entry sources and product transitions on the Brillnet website | Art. 6(1)(f) GDPR - legitimate interest in assessing which public content and product transitions are useful; the measurement is first-party, cookie-free and identifier-free |
| Contract performance, billing and tax obligations | Art. 6(1)(b) and 6(1)(c) GDPR |
| Establishing, pursuing or defending claims | Art. 6(1)(f) GDPR |
4a. Public sources and first business contact
For this limited outreach, we obtain business contact details and the facts used to make a message relevant from the business's own website, an official business profile or another publicly accessible business source. We record the source and the date checked. We do not infer a private e-mail address from a naming pattern or collect private-profile or sensitive information for outreach.
The first message states why we contacted that business, identifies the source or source category of the address, links to this policy and offers a simple way to object by replying. An expression of interest in a product demonstration does not sign the recipient up to a subscription, trial or unrelated marketing. We stop outreach when an objection arrives and keep only the minimum details needed to respect it.
5. Cookies and similar technologies
The website uses cookies, browser local storage and similar technologies where needed to operate the website and remember user preferences.
Details are available in the Cookie Policy. Preferences can be changed through the Cookie settings button in the website footer.
6. Recipients and processors
Data may be shared with providers that help us operate the website, handle inquiries and send e-mail messages. We use only providers needed for website operation, security, correspondence, newsletter delivery and the limited individual business outreach described above.
| Provider | Role | Data scope |
|---|---|---|
| TuruMail (turumail.com) | delivery of individually relevant business outreach | published professional e-mail address, business name where included, subject, message content, delivery metadata and suppression status |
| Resend / Plus Five Five, Inc. | delivery of form messages, newsletters, product updates and individual business outreach | for outreach: the published professional e-mail address, business name, message content and technical delivery metadata; for forms and subscriptions: the data listed above as applicable |
| Proton Mail | individual business correspondence, including first-contact messages and replies | recipient and sender addresses, subject, message content and delivery metadata |
| Google Workspace | historic individual business correspondence and any correspondence still routed through that service | recipient and sender addresses, subject, message content and delivery metadata |
| Cloudflare | CDN, website security and abuse prevention | technical request data, IP address, security signals |
| Accounting, legal or administrative providers | contracts, billing and legal obligations | contact, contractual and billing data where needed |
| Public authorities | legal obligations | data required by applicable law |
Processors acting on our behalf process data under appropriate agreements or other mechanisms required by GDPR.
The current processor list for the Brillnet landing page is available in the Processor List.
7. Transfers outside the EEA
Technical and email providers may process specified data outside the EEA, including TuruMail and Resend / Plus Five Five, Inc. Transfers are qualified by recipient, data and purpose under GDPR Chapter V. We use the applicable adequacy decision, including DPF only for a covered recipient and scope, or Standard Contractual Clauses with the required assessment and supplementary measures. A DPA governs Article 28 duties; the transfer also requires an applicable Chapter V basis. Details of the basis and safeguards are available through this Policy’s contact.
8. Retention periods
| Data type | Retention period |
|---|---|
| Contact-form correspondence | for the time needed to handle the matter, then generally up to 3 years from the end of the year of the last contact, unless a longer period is needed to establish or defend claims |
| Newsletter and product-update data | until consent is withdrawn, the user unsubscribes or an objection is effective; proof of consent, subscription source and unsubscribe history may be retained longer to demonstrate compliance |
| Unanswered individual business outreach | until the documented campaign closes, then reviewed for deletion; no longer than 12 months after the last message unless correspondence or a legal claim requires a longer period |
| Business outreach objections | the minimum address, domain or business identifier and objection details needed to prevent further contact for as long as that restriction remains relevant |
| Contractual and billing data | for the contract term and the period required by tax and accounting rules |
| Technical and security logs | for the period needed for diagnostics and security, generally up to 90 days unless the logs concern an incident |
| Cookie and similar-technology preferences | until settings are changed, consent is withdrawn, browser data is deleted or the consent mechanism version changes |
9. Data subject rights
You have the right to:
- access your data,
- rectify inaccurate data,
- erase data,
- restrict processing,
- data portability where applicable,
- object to processing based on legitimate interest,
- withdraw consent at any time without affecting the lawfulness of earlier processing,
- lodge a complaint with the President of the Polish Data Protection Office.
Requests can be sent to: kontakt@brillnet-app.com.
Each newsletter or marketing e-mail should include a simple unsubscribe option. Recipients of individual business outreach can object by replying to the first message; no account or form is required. We do not use newsletter open tracking or link-click tracking unless that feature is separately disclosed and has an appropriate legal basis.
10. Data security
We apply technical and organisational measures appropriate to the risk, including TLS encryption, access restrictions, form protections and monitoring of errors and abuse.
11. Automated decisions
We do not make decisions about website users based solely on automated processing that would produce legal effects or similarly significantly affect them. We do not conduct advertising profiling.
12. Policy changes
This policy may be updated when the website, Brillnet's offer, the tools we use or the law changes. The current version is published on this page.
13. Contact
For privacy questions, contact us:
- Email: kontakt@brillnet-app.com
- Website: brillnet-app.com
Public sources and individual business correspondence
Before sending, we separately check the applicable country rules, required channel consent and the provider’s terms. A public professional address or a GDPR processing basis does not replace these conditions. The scope, sources, data, retention and objection provisions for individual business correspondence above remain applicable.