Privacy policy
Version dated
1. Controller and contact
The controller is INNOVATION BRIDGE FOUNDATION, a foundation based in Warsaw, Poland, KRS 0001265691, NIP 9512655996. Contact kontakt@innovationbridge.pl about personal data and your rights.
2. Contact requests
We process your sender address and the information you include in your message to handle your enquiry. The basis is our legitimate interest in correspondence (GDPR Article 6(1)(f)), or steps before a contract when you enquire on your own behalf (Article 6(1)(b)). The contact button opens a draft in your email application; you send it yourself. Clicking does not store a request in the website database. An enquiry is not marketing consent.
3. Newsletter
Request signup by sending an email containing your consent. We process the sender address, consent wording and message date. Newsletter processing relies on voluntary consent under GDPR Article 6(1)(a), including consent to electronic commercial information under Article 398 of the Polish Electronic Communications Law. Downloads do not require consent. We handle subscriptions manually and request email ownership confirmation before activating a subscription. Clicking the button does not subscribe you. You may withdraw consent at any time at kontakt@innovationbridge.pl without affecting earlier lawful processing.
4. Security and technical data
Hosting providers may keep technical logs including IP addresses and browser and connection information. The basis is the legitimate interest in service security under GDPR Article 6(1)(f). The site now uses email contact and does not load Turnstile. Previous form submissions retain cryptographically transformed daily network identifiers used for rate limiting, not raw IP addresses.
5. Providers and international transfers
The site uses Sites hosting and Cloudflare infrastructure. Email correspondence uses Zenbox. Earlier form submissions remain in D1 until deletion under our retention rules. They are not public; database access requires site administration permissions. We do not sell contact details. Global infrastructure may involve processing outside the EEA. Ask us for information about the provider, processing location and safeguards applicable to a service. Transfers requiring safeguards must use a Chapter V GDPR mechanism, such as an adequacy decision or standard contractual clauses. Cloudflare privacy information: https://www.cloudflare.com/privacypolicy/ .
6. Retention
Unconfirmed newsletter requests become eligible for deletion after 30 days. For earlier contact submissions in the form database, this period is 180 days. Deletion occurs during manual review rather than precisely when the period expires. Correspondence is kept while handling the matter and, where necessary, for related legal obligations or claims. Active newsletter data is kept until consent withdrawal or closure of the newsletter. Evidence of consent may be retained only as necessary to demonstrate lawful processing.
7. Your rights
Subject to GDPR conditions, you may request access, correction, erasure, restriction and portability, object to legitimate-interest processing and withdraw consent. You may complain to the Polish data protection authority: https://uodo.gov.pl/ . Providing data is voluntary but an email is needed to reply or handle signup. We do not use correspondence for marketing profiling or automated decisions with legal effects.
8. Optional Google Analytics
With your consent, we measure page visits, clicks to download our two resources, and email link clicks to assess content usefulness. A click does not mean an email was sent or a newsletter subscription activated. Processing relies on consent (GDPR Article 6(1)(a)). Google Analytics 4 loads only after you select “Allow analytics”. Declining does not limit site access. Our events do not include names, emails, organizations or messages. Page URLs exclude queries and fragments; referrers also exclude paths. Google receives visit data, cookie identifiers and browser and connection information. Advertising features, Google Signals and User-ID are not enabled.
9. Analytics retention
GA4 user and event data retention is set to two months without resetting the period on new activity. Google setting changes may take 24 hours to apply. This period does not cover most standard reports based on aggregated data. Details: https://support.google.com/analytics/answer/7667196 .
10. Google as a provider
Google Analytics is provided by Google Ireland Limited; Google LLC may also process data in the USA. Google processing terms include international transfer mechanisms, including standard contractual clauses: https://business.safety.google/adsprocessorterms/ . Information about data from partner sites: https://policies.google.com/technologies/partner-sites . We do not send correspondence to Google Search Console, which is used to verify the site and review search visibility.
11. Cookies, browser storage and withdrawal
Your choice is stored in local browser storage under ibf.analytics-consent.v1 for 180 days, after which we ask again. After consent, GA uses _ga and _ga_* cookies configured to expire after 180 days without extending expiry on subsequent page views. Change your choice using “Privacy settings” in the footer. Selecting “Decline analytics” stops measurement, clears accessible GA cookies and reloads the page. Withdrawal does not affect earlier lawful processing. Choices apply to this browser; clearing browser storage may remove them. External source materials are opened through links.