Privacy Policy

This policy explains how CXLABS processes the personal data of people who visit our website, buy our services, write to us, or work with us on behalf of their organization. It supplements the CXLABS General Terms of Service, which refer to it in clause 10.1.

In short

• The controller of your data is CXLABS Sp. z o.o., based in Torun, Poland. For anything concerning your personal data, write to hello@cxlabs.digital.
• The data in your organization's monday.com account, the personal data in project documentation, and the personal data of third parties in support tickets belong to your organization. We process them as a processor under a data processing agreement, not under this policy (section 2).
• We activate analytics and advertising cookies only after you consent. You can change your choice at any time under "Cookie settings" in the website footer (section 7).
• You have the right to access your data, to have it rectified or erased, to restrict its processing, to data portability, to object, and to lodge a complaint with a supervisory authority (section 8).

1. Controller

The controller is CXLABS Sp. z o.o., ul. Polna 66, 87-100 Torun, Poland, registered with the District Court in Torun, 7th Commercial Division of the National Court Register, KRS 0000891126, REGON 388564992, VAT ID PL9562367495 ("CXLABS", "we").

Contact for personal data matters: hello@cxlabs.digital, or by post to our registered office marked "Personal data".

We have not appointed a data protection officer because we are not required to under Article 37 GDPR. Data protection matters are handled by the CXLABS management board.

"GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016.

2. When we decide about your data, and when we act on behalf of a client

This policy covers data whose purposes and means of processing we determine ourselves: traffic on www.cxlabs.digital, correspondence, forms, meeting bookings, invoicing, and work with the contact persons of our clients and business partners. Our support portal pomoc.cxlabs.digital and online purchases on the Polish website serve clients in Poland and are described in the Polish version of this policy.

Different rules apply to the data your organization processes in its own monday.com account (the Client Environment), to the personal data in project documentation and registers under Service Line B of the General Terms of Service, and to the data of your organization's employees, clients and business partners that you send us in support tickets and attachments. Your organization is the controller of that data, and we process it as a processor, only on its instructions. That processing is governed by clause 10 of the General Terms of Service and by the CXLABS Standard Data Processing Agreement published as their Annex at https://www.cxlabs.digital/terms-of-service, or by a separate data processing agreement where we have concluded one. If you want to exercise your rights in respect of that data, contact the organization that gave it to us. We will help it respond to your request.

Services of other providers that our links lead to (for example monday.com or LinkedIn) follow their own privacy policies.

3. Purposes, data, legal bases and retention periods

3.1. Contacting us

When you write to our email addresses, fill in the contact form (a monday.com form linked from the website), call us, or message us on LinkedIn.

Data: name, email address, phone number, company, job title, the content of your message, and anything else you choose to include.

Legal basis: Article 6(1)(f) GDPR, our legitimate interest in replying to your message and conducting correspondence. Where you ask about an offer for yourself as a sole trader, also Article 6(1)(b) GDPR (steps taken before entering into a contract).

Retention: up to 12 months after the last message, unless the conversation turns into a business relationship (then section 3.3 applies).

3.2. Booking and holding a meeting

You book a meeting in the Calendly calendar embedded on the contact page. Meetings take place online, in the tool named in the invitation.

Data: name, email address, and, if you provide them, phone number and company; the date and subject of the meeting; and, during a video call, your image and voice if you turn on your camera and microphone. If a meeting is to be recorded or transcribed, we tell you before recording starts and you may decline.

Legal basis: Article 6(1)(f) GDPR (organizing and holding the meeting) and, where we discuss an offer for you as a sole trader, Article 6(1)(b) GDPR.

Retention: as in section 3.1. Recordings and transcripts are deleted no later than 12 months after the meeting.

3.3. Offers, orders and performance of services

This covers representatives of clients and business partners, Coordinators, and people who take part in the work on the client's side.

Data: name, job title, company, business email address and phone number, the content of arrangements made in working channels (email, monday.com boards, Slack), and the time record with descriptions of activities.

Legal basis: Article 6(1)(f) GDPR, our legitimate interest in concluding and performing a contract with the organization you represent. Under clause 10.1 of the General Terms of Service, each party processes the data of contact persons as an independent controller. Where you conclude the contract as a sole trader, the legal basis is Article 6(1)(b) GDPR.

Retention: for the duration of the relationship and, after it ends, until the limitation period for claims expires. For claims related to business activity, this period is generally 3 years and ends on the last day of the calendar year (Article 118 of the Polish Civil Code).

3.4. Support tickets

Under the care service, we accept tickets through the channels set out in clause 18.4 of the General Terms of Service and store them, with their attachments, in our monday.com instance.

Data: the content of the ticket and replies, attachments, people copied on the ticket, and ticket status and history.

Where the problem lies with the platform, we pass the necessary information to monday.com support on your organization's behalf (clause 18.2 of the General Terms of Service).

Legal basis: Article 6(1)(b) GDPR where you order the service as a sole trader, and otherwise Article 6(1)(f) GDPR (handling the tickets of the organization you represent). We process third-party data contained in tickets and attachments as a processor (section 2).

Retention: while your organization uses our care service. When the care service ends, we hand over the ticket history within 14 days (clause 18.8 of the General Terms of Service). We delete ticket content and attachments within 30 days after the care service ends (clause 8.2 of the Data Processing Agreement). We keep data longer only where it is needed to demonstrate proper performance of the services and to defend against claims, until the limitation period expires.

3.5. Information about our services

We send clients, and people who have asked for it, information about our services, changes in monday.com and CXLABS events. Where we obtained your business contact details from publicly available sources to propose working together, we tell you where we got them at our first contact (Article 14 GDPR).

Data: name, job title, company, business email address and phone number, and contact history.

Legal basis: Article 6(1)(f) GDPR, our legitimate interest in marketing our own services. We send commercial information by electronic communication, including email and phone, only with your prior consent (Article 398 of the Polish Electronic Communications Law of 12 July 2024, Prawo komunikacji elektronicznej).

Retention: until you object or withdraw consent and, for contacts who did not reply, up to 12 months after the last attempt to contact them. An objection to marketing is always effective (Article 21(2) and (3) GDPR).

3.6. Invoices, accounting and tax

Data: data on invoices and accounting documents, and payment data.

Legal basis: Article 6(1)(c) GDPR in conjunction with the Polish Accounting Act, the Polish VAT Act and the Polish Tax Ordinance.

Retention: 5 years from the end of the calendar year in which the tax payment deadline expired (Article 86 § 1 in conjunction with Article 70 § 1 of the Polish Tax Ordinance), and for the period required by Article 74 of the Polish Accounting Act.

3.7. Establishing, pursuing and defending claims

Data: the data needed to demonstrate the course of the relationship, including correspondence, arrangements, time records, tickets and invoicing.

Legal basis: Article 6(1)(f) GDPR, our legitimate interest in establishing, pursuing and defending claims.

Retention: until the limitation period for claims expires and, in the event of a dispute, until it is finally resolved.

3.8. Website analytics and advertising

With your consent, we collect information about how you use the website, measure the effectiveness of CXLABS advertising, and identify the organizations from whose networks you visit the website. The tools are described in section 7.

Data: cookie and device identifiers, IP address, browser and device information, pages visited, time of visit, clicks and scrolling, and the source of the visit.

Legal basis: consent to storing information on, and accessing information from, your device (Article 399 of the Polish Electronic Communications Law) and Article 6(1)(a) GDPR for further processing. Withdrawing consent does not affect the lawfulness of processing before withdrawal.

Retention: until you withdraw consent. In Google Analytics, data is retained for no longer than 14 months.

4. Where we get your data if not from you

Some data comes from other people or from public sources:

• from the organization you represent, when it names you as Coordinator or contact person,
• from a member of your team who copied you on a ticket,
• from publicly available professional sources, to the extent described in section 3.5,
• from Leadinfo, which, with your consent, identifies the organization from whose network you visit the website.

5. Who receives your data

We share data with providers that process it on our behalf under data processing agreements (Article 28 GDPR):

• monday.com Ltd.: the platform on which we run our CRM, tickets, time records, forms and documentation; our account is in the EU data region,
• Make (make.com): the integration platform that connects our systems with our monday.com instance; the scenarios run in the EU data zone,
• Webflow, Inc. (hosting of www.cxlabs.digital) and Cloudflare, Inc. (delivery of website content and protection against attacks),
• Google: email and documents (Google Workspace), Google Analytics, Google Tag Manager and Google Ads,
• Microsoft (Clarity), Ahrefs and Leadinfo: website analytics and identification of organizations visiting the website, with your consent (section 7),
• Calendly, LLC: meeting booking calendar,
• Slack: working channels, where we agree such a channel with your organization,
• our accounting service providers, legal advisers, bank and insurer, to the extent needed for their tasks.

The following act as separate controllers: monday.com, when we pass a matter to its support on your organization's behalf; LinkedIn; the bank, in respect of its own legal obligations; and public authorities where the law requires it, including tax authorities and the Polish National e-Invoicing System (KSeF).

6. Transfers outside the European Economic Area

Some providers are established or process data outside the EEA, in particular in the United States (Webflow, Cloudflare, Google, Microsoft, Calendly), Singapore (Ahrefs) and Israel (monday.com Ltd., whose subcontractors also operate in other countries). Transfers take place on the basis of a European Commission adequacy decision (Israel: Decision 2011/61/EU; United States: the decision of July 10, 2023 on the EU-US Data Privacy Framework, for organizations certified under it) or of the standard contractual clauses adopted by the European Commission (Article 46(2)(c) GDPR).

7. Cookies and similar technologies

Cookies and similar technologies (such as browser local storage) store information on your device or read it from your device. Without consent we use only those that are necessary for the website to work, or for a service you request. We activate the others only after you consent in the banner (Article 399 of the Polish Electronic Communications Law). You can change or withdraw your consent at any time under "Cookie settings" in the website footer. You can also delete cookies in your browser settings.

• necessary (no consent required): operation of the website on Webflow, Cloudflare protection against attacks, remembering your choice in the banner,
• functional (no consent required when you use the feature): the Calendly booking calendar on the contact page,
• analytics (with consent): Google Analytics (visit statistics), Microsoft Clarity (click maps and session recordings, meaning a record of cursor movements, clicks and scrolling), Ahrefs Web Analytics (traffic statistics),
• marketing (with consent): Google Ads (measuring conversions from CXLABS advertising), Leadinfo (identifying, from your IP address, the organization from whose network you visit the website).

8. Your rights

You have the right to:

• access your data and receive a copy of it (Article 15 GDPR),
• have your data rectified (Article 16 GDPR),
• have your data erased (Article 17 GDPR),
• restrict processing (Article 18 GDPR),
• data portability for data processed on the basis of a contract or consent (Article 20 GDPR),
• object to processing based on our legitimate interest and, in respect of marketing, object at any time without giving reasons (Article 21 GDPR),
• withdraw consent at any time, without affecting the lawfulness of processing before withdrawal (Article 7(3) GDPR),
• lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stanisława Moniuszki 1A, 00-014 Warsaw, Poland, https://uodo.gov.pl, or with the supervisory authority of the EU member state in which you live or work (Article 77 GDPR).

Send your request to hello@cxlabs.digital. We reply within one month and, in complex cases, may extend this period by two months, in which case we will let you know (Article 12(3) GDPR). We may ask for information confirming your identity if we have reasonable doubts about who is making the request.

9. Do you have to provide your data

Providing data is voluntary. Without contact details we cannot reply to your message, and without the details of the person placing an order and of the organization we cannot conclude or perform an order. Invoicing details are required by tax law.

10. Profiling

We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. With your consent, the tools described in section 7 analyze how the website is used, measure the effectiveness of advertising and identify organizations visiting the website. This serves to evaluate CXLABS content and advertising, not to take decisions about specific individuals.

11. Security

We apply measures appropriate to the risk (Article 32 GDPR), in particular: two-factor authentication on accounts with access to Client Environments, named team accounts or one dedicated service account without password sharing, encrypted connections, and access limited to the areas needed for the task.

12. Changes to this policy

We update this policy when our services, tools or the law change. Each version has a number and a date of update. We inform clients with an active care service or order of changes that affect them by email. Previous versions are available on request.

13. Contact

CXLABS Sp. z o.o., ul. Polna 66, 87-100 Torun, PolandEmail for personal data matters: hello@cxlabs.digital

‍