Privacy Policy.

1. Controller and Contact Details

The controller of your personal data is SustematiQ Sp. z o.o., with its registered office at ul. Św. Judy Tadeusza 8F, Unit 1, 55-095 Domaszczyn, Poland, entered in the National Court Register (KRS) under number 0001253359, NIP 8961670119, REGON 545235400. You can contact us at info@sustematiq.com.

We have not appointed a Data Protection Officer unless stated otherwise. Privacy-related questions can be sent to info@sustematiq.com.

2. Data We Process by Context

We collect and process personal data in the following contexts:

• Website Browsing: Standard internet logging including security logs, hashed IP addresses, hashed user-agent strings, and timestamps.
• Contact Form: Name, email address, organization name, type of inquiry, and message details.
• Guided Project-Intake (Project Signal Builder): Organizational domain, developmental stage, required deliverables, contact details (name, email, organization), and optional notes.
• FoQus Guest Mode: Ephemeral session state. No personal data is transmitted to SustematiQ server-side.
• FoQus Local Profile Mode: Progress, preferences, statistics, badges, and reflections stored locally on your device.
• FoQus Online Profile Mode: Submitted profile details (name, email address, optional profile note, source, consent choices, profile status, public ID, hashed IP address, hashed user agent, and timestamps).
• Optional Local-Only Reflections: Feedback or reflections written after sessions are stored in the browser only.
• Google Analytics: Consented analytical identifiers, device type, approximate location, and site interactions.
• Consent Logs: Cookie preferences, timestamp, consent ID, and Consent Mode parameters.

3. Lawful Bases of Processing

We process personal data based on the following legal grounds under Article 6(1) of the General Data Protection Regulation (GDPR):

• Contact and Guided Intake: Article 6(1)(b) GDPR (taking steps at the request of the data subject prior to entering into a contract) and Article 6(1)(f) GDPR (our legitimate interest in responding to business and project enquiries).
• FoQus Online Profile: Article 6(1)(b) GDPR (performance of a contract – providing the requested Online Profile service), Article 6(1)(f) GDPR (our legitimate interest in service security, abuse prevention, and rate limiting), and Article 6(1)(a) GDPR (consent, if you opt-in to optional updates).
• Google Analytics: Consent under Article 6(1)(a) GDPR (plus local storage access consent under ePrivacy rules).
• Consent Logs: Article 6(1)(c) GDPR (compliance with a legal obligation to demonstrate valid consent) and Article 6(1)(f) GDPR (legitimate interest in documentation).
• Security Logs (including hashed IP/User Agent): Article 6(1)(f) GDPR (our legitimate interest in securing our website and applications, preventing abuse, and troubleshooting).
• Local-Only FoQus Data: We do not receive or process this data server-side; local browser storage is utilized for requested application functions.

4. FoQus Data Modes

5. Analytics and Cookies

With consent, SustematiQ may use Google Analytics to understand website usage and improve performance. Google Analytics is managed through Google Consent Mode v2. Analytics storage is denied by default and is only activated after consent is given through the cookie banner or cookie settings. We do not use any tracking or profiling inside the FoQus application.

6. No AI/Model Training

FoQus is not trained on user data, and user data is not used to train AI models.

7. Hashed IP Addresses and User Agents

Hashed IP addresses and hashed user-agent strings are treated as pseudonymous personal data, not anonymous data. They are used for security, abuse prevention, rate limiting, and integrity of the profile service where applicable. They are not utilized to trace individuals outside necessary security contexts.

8. Recipients and Processors of Data

Your personal data may be shared with the following categories of processors acting on behalf of SustematiQ:

• Hosting and server infrastructure providers.
• Email delivery and SMTP service providers.
• Google Analytics (only if analytical cookies are consented to).
• Technical support and administration services.
• Internal SustematiQ project team members.

9. International Data Transfers

If Google Analytics is consented to, some analytical parameters may be transferred and processed on servers located outside the European Economic Area (EEA), including the United States. We rely on standard contractual clauses and provider compliance terms as safeguards where applicable.

10. Data Retention

We retain personal data only for as long as necessary to fulfill the respective purpose or as required by law:

11. Your Rights under GDPR/RODO

You possess the following rights regarding your personal data:

• Access: The right to obtain details on the processing of your data and a copy of the data.
• Rectification: The right to correct inaccurate or incomplete data.
• Erasure (Right to be Forgotten): The right to request data erasure under appropriate conditions.
• Restriction: The right to limit data processing.
• Portability: The right to receive your data in a structured, commonly used format.
• Objection: The right to object to processing based on legitimate interests.
• Withdrawal of Consent: The right to withdraw consent at any time without affecting prior processing legality.
• Complaint: The right to lodge a complaint with a supervisory authority.

We respond to valid data subject requests within one month. Requests can be submitted via email to info@sustematiq.com.

12. Right to Complain to UODO

You have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO) if you believe our data processing violates the GDPR/RODO. Address: ul. Stawki 2, 00-193 Warsaw, Poland.

13. Protection of Minors

FoQus is not directed to children under 16. Users under 16 should not create an Online FoQus Profile. If we learn that we have collected personal data from a child under 16 without appropriate parental consent, we will take steps to delete it.