Privacy policy

Applies from 26 October 2026

This policy explains which personal data we process when you use coretheus.com (also at coretheus.pl), in particular when you ask us to call you back: why, on what legal basis, for how long, and what your rights are. We apply Regulation (EU) 2016/679 (GDPR) and Polish law.

1. Controller

The controller of your data is Coretheus spółka z ograniczoną odpowiedzialnością (a Polish limited liability company), al. Marszałka Piłsudskiego 12, 43-⁠100 Tychy, Poland, entered in the register of entrepreneurs of the National Court Register (KRS) under number 0001185695, tax identification number (NIP) 6463022515 (“Coretheus”, “we”).

For anything concerning your data, email contact@coretheus.com or write to our registered address. We have not appointed a data protection officer.

2. What data we process

Call-back request: your name, your phone number with its country, and your consent to be called. We add the page language, the date and time of sending, the date of the consent wording and a request number.
The call and further contact: whatever you tell us, for example what you need or your email address.
Technical data on every visit: IP address, date and time, the address of the page opened, and the information about your browser and device that the browser sends with every request. Our hosting provider (Vercel) sees it in its server and firewall logs.
Form protection: the result of the browser check (section 8) and pseudonymous counters of requests from one network, which do not store the IP address.

The data comes from you or from a person who sent the request on your behalf. In business matters we may supplement it with information from public registers (for example KRS or CEIDG). We use no analytics or tracking tools. The site is not aimed at children.

3. Purposes, legal bases and retention

Calling you back about your request

Data: the call-back request: name, number, page language, time of sending, request number
Legal basis: Art. 6(1)(b) GDPR – steps taken at your request before entering into a contract, where you ask about working with us for yourself; otherwise, for example where you act for a company, Art. 6(1)(f) GDPR – our legitimate interest in answering a request to be contacted. We call on the basis of your consent, as required by Art. 398 of the Polish Electronic Communications Law (Prawo komunikacji elektronicznej, read with its Art. 400).
Retention: until the call; afterwards we keep the request as proof (below)

Presenting our offer during the call (direct marketing)

Data: name, phone number, page language
Legal basis: Art. 6(1)(f) GDPR – our legitimate interest in direct marketing of our own services; the call itself on the basis of your consent (Art. 398 of the Electronic Communications Law)
Retention: until you object or withdraw your consent, at most 3 years from the request; we keep the fact that you objected for as long as needed to respect it

Proof of the request and of the consent

Data: the request e-mail, including the date of the consent wording
Legal basis: Art. 6(1)(f) read with Art. 7(1) GDPR – our legitimate interest in being able to show that we called at your request and with your consent
Retention: 3 years from the request; if we conclude a contract, as long as that contract’s records. If the number was given by someone not entitled to do so, we do not call it again and keep the request only as evidence in case of a complaint or claims, for the same period.

Further correspondence, offer and contract

Data: whatever you tell us in the call or in messages
Legal basis: Art. 6(1)(b) GDPR where it concerns a contract with you; Art. 6(1)(f) GDPR where you represent a company – our legitimate interest in conducting business talks; Art. 6(1)(c) GDPR where the law, for example tax law, requires us to keep contract records
Retention: until the matter is closed and then up to 3 years; contract records for as long as the law requires

Alerts about undelivered requests

Data: if the request e-mail does not reach our inbox, your name and phone number go in an alert to our fallback mailbox so that we can still call you back
Legal basis: Art. 6(1)(f) GDPR – our legitimate interest in calling back despite a failure
Retention: as for the request: 3 years

Security of the site and the form

Data: technical request data, the result of the browser check, pseudonymous network keys
Legal basis: Art. 6(1)(f) GDPR – our legitimate interest in protection against spam, automated programs and abuse and in keeping the form available. This includes, among other things, the browser check, a hidden field that only programs fill in, and limits on requests.
Retention: counters at most 25 hours; we do not store the result of the browser check

Running the site and server logs

Data: IP address, time, page address, browser information
Legal basis: Art. 6(1)(f) GDPR – our legitimate interest in delivering the site and detecting failures and attacks
Retention: as long as Vercel keeps logs under our plan; extracts needed to investigate an incident or to defend against claims – until the matter is closed

Legal claims

Data: the data needed in the matter
Legal basis: Art. 6(1)(f) GDPR – our legitimate interest in establishing, exercising or defending legal claims
Retention: until the limitation periods expire

4. Do you have to give us your data?

No, it is voluntary. Without your name, phone number and consent we cannot call you back. You can email us at contact@coretheus.com instead; we will use the data in your message to answer it (on the bases given above for calling back, proof and further correspondence).

5. Your rights

You have the right to:

access your data and receive a copy (Art. 15 GDPR),
have your data corrected (Art. 16),
have your data erased (Art. 17),
restrict processing (Art. 18),
data portability for data we process by automated means on the basis of a contract or consent (Art. 20),
object to processing based on our legitimate interest, on grounds relating to your particular situation (Art. 21(1)),
withdraw your consent to be called at any time, without affecting the lawfulness of what we did before (Art. 7(3)),
lodge a complaint with the President of the Polish Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stanisława Moniuszki 1A, 00-⁠014 Warszawa, uodo.gov.pl) or with the supervisory authority of the country where you live or work.

Objection to marketing. You can object at any time, without giving reasons, to the processing of your data for direct marketing (Art. 21(2) GDPR): email contact@coretheus.com or say so during the call. From then on we will not present our offer to you.

To exercise your rights, email contact@coretheus.com or write to our registered address. We will answer without undue delay and within one month of receiving the request. Where necessary, taking into account the complexity and number of requests, we may extend this period by two further months; we will tell you so within one month, with the reasons (Art. 12(3) GDPR). Where requests are manifestly unfounded or excessive, in particular because of their repetitive character, we may charge a reasonable fee or refuse to act (Art. 12(5) GDPR). We may ask for information needed to make sure that the request comes from the person the data is about.

6. Who receives your data

Service providers process data on our behalf under data processing agreements:

Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA

Task: hosting the site, server functions, the application’s records (counters), firewall, browser check (BotID), server logs
Where the data is: functions and the application’s records in Frankfurt am Main (Germany); Vercel’s primary processing facilities and logs in the United States; Vercel’s backups are replicated globally
Transfer safeguard: Vercel’s certification under the EU-U.S. Data Privacy Framework (an adequacy decision of the European Commission) and the Commission’s standard contractual clauses (decision 2021/914) in its data processing agreement

Plus Five Five, Inc. (Resend), 2261 Market Street #5039, San Francisco, CA 94114, USA

Task: sending the call-back e-mails, alerts and monthly reminders
Where the data is: sent from the eu-west-1 region (Ireland); Resend stores account data, message metadata and logs, including message content, in the United States – for 30 days on the plan we use
Transfer safeguard: Resend’s certification under the EU-U.S. Data Privacy Framework and standard contractual clauses (decision 2021/914) in its data processing agreement

Google (Google Workspace)

Task: our mailboxes, which receive requests, alerts and reminders
Where the data is: Google data centres in various countries, including the United States (Google LLC)
Transfer safeguard: Google LLC’s certification under the EU-U.S. Data Privacy Framework and standard contractual clauses in Google’s data processing terms

Vercel and Resend also process, as separate controllers, data about the use of their services (for example technical data and metadata) under their own privacy policies. When we call you back, our telephone operator handles the call as a separate controller. We may also disclose data to our advisers (for example legal or accounting advisers) and to public authorities where the law requires or permits it, for example in connection with abuse or legal claims. The text of the standard contractual clauses is published in Commission Implementing Decision (EU) 2021/914 (eur-lex.europa.eu); you can obtain a copy of the safeguards, without confidential commercial information, on request to contact@coretheus.com.

7. Automatic refusal of requests

The spam protection automatically refuses some requests, for example when a request appears to have been sent by an automated program or when request limits are exceeded. This is not a decision that produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR): you can always email us at contact@coretheus.com.

8. Cookies and browser storage

The site itself sets no cookies and stores nothing in your browser (such as localStorage, sessionStorage or IndexedDB). It uses no analytics, advertising or tracking tools and loads nothing from other companies’ servers – fonts and images come from our own site. What you type in the form stays only in the memory of the open tab and disappears when the request is sent or the page is reloaded.

There are two exceptions. Both protect the service you ask for:

Browser check (Vercel BotID, basic level)

When: only after you open the “Request a call” window
What it reads: a script served from our site reads technical characteristics of the browser and device (among them the browser identifier, screen and graphics parameters, and signs of control by a program). It attaches the encrypted result to the request, and our server passes it, together with the technical request data (including the IP address), to Vercel, which judges whether a person sent the request.
What it stores: nothing: no cookie and no data in browser storage
Purpose: protecting the form against automated programs. We do not switch on the advanced analysis (Deep Analysis) or its cookies.

Vercel firewall check

When: only if the firewall considers the traffic suspicious, for example during an attack on the site; it then shows a short check page (Vercel Security Checkpoint)
What it stores: after a successful check, a cookie holding the check session, valid for up to 1 hour; Vercel names it and does not publish the name
Purpose: protecting the site against attacks without checking the browser again at every step

These exceptions need no consent, which is why the site shows no cookie banner: storing or accessing information that is necessary to provide the service you ask for does not require consent (Art. 399(3)(2) of the Polish Electronic Communications Law). We process the resulting data for security (section 3). You can block cookies in your browser settings; the firewall check may then repeat.

9. Security

We apply technical and organisational measures appropriate to the risk (Art. 32 GDPR), including encrypted connections (HTTPS), limiting data to what is necessary and access only for authorised people.

10. Changes to this policy

We change this policy when the way we process data or the law changes. Each version shows the date from which it applies (at the top of the page). The consent wording in the form carries the same date as the version of this policy it belongs to. The Polish version is binding; the English and German versions are translations.

Back to the site