Privacy Policy
Version 1.0 — effective from 1 July 2026
1. Data Controller
The controller of personal data is WRTX sp. z o.o. with its registered office in Warsaw, at ul. Żelazna 67/17, 00-871 Warszawa, entered in the register of entrepreneurs of the National Court Register maintained by the District Court for Kraków-Śródmieście in Kraków, 11th Commercial Division of the National Court Register, under KRS number 0001181535, NIP 6793335275, REGON 542128364, share capital PLN 5,000.00 (hereinafter: the Controller, we).
Contact regarding data protection matters: contact@hyllet.com or in writing to the registered office address.
The Controller has not appointed a Data Protection Officer. All matters relating to personal data are handled at the e-mail address above.
2. Scope of the policy
This policy describes the rules for processing the personal data of individuals using the website available at hyllet.com — including individuals who contact us, sign up for the waiting list and newsletter, and apply for positions at our company.
The Website presents information about the hyllet.cash service, provided by the Controller under a separate agreement. The rules for processing personal data in connection with the conclusion and performance of the agreement for the provision of the hyllet.cash service, including the scope and legal bases of processing, are set out in the hyllet.cash documentation provided prior to the conclusion of that agreement. Signing up for the waiting list on the Website does not constitute the conclusion of an agreement for the hyllet.cash service or the transfer of your data in connection with that service.
3. Purposes of processing, legal bases and retention periods
| Purpose | Scope of data | Legal basis | Retention period |
|---|---|---|---|
| Providing the Website, ensuring its security and stability, error diagnostics | IP address, date and time of the request, browser and operating system type, URL address (server logs) | Article 6(1)(f) GDPR — legitimate interest consisting in ensuring IT security and preventing abuse | up to 12 months |
| Handling inquiries submitted via the contact form or e-mail | first and last name, e-mail address, optionally company name, phone number, position, message content | Article 6(1)(b) GDPR — actions taken at the request of the data subject prior to entering into an agreement, where the inquiry concerns our services; Article 6(1)(f) GDPR — legitimate interest consisting in conducting correspondence in other cases | for the duration of the correspondence, and thereafter until the limitation period for any potential claims expires |
| Sign-up for the waiting list and sending the newsletter, including information on the launch and development of services | e-mail address, optionally first name and company name | Article 6(1)(a) GDPR — consent, in connection with Article 398 of the Polish Electronic Communications Law | until consent is withdrawn or an objection is raised |
| Demonstrating that marketing consent was given and withdrawn | e-mail address, content and date of consent, date of withdrawal | Article 6(1)(f) GDPR — legitimate interest consisting in demonstrating legal compliance | 3 years from withdrawal of consent |
| Conducting recruitment for positions at our company | data referred to in Article 22¹ of the Polish Labour Code and other data voluntarily provided in application documents | Article 6(1)(c) GDPR in connection with Article 22¹ of the Polish Labour Code; Article 6(1)(b) GDPR — actions taken prior to entering into an agreement; Article 6(1)(a) GDPR — consent for data provided beyond the required scope and for future recruitment processes | until the end of the recruitment process, and in the case of consent for future recruitment — 12 months from the date it was given |
| Product analytics — measuring how the Website is used and improving it, without identifying users | IP address, browser and device type, subpages visited, referral source, events within a visit | Article 6(1)(f) GDPR — legitimate interest consisting in measuring the effectiveness of, and developing, the Website | up to 12 months, in aggregated form — indefinitely |
| Protecting the Website against automated traffic, attacks and abuse | IP address, request characteristics | Article 6(1)(f) GDPR — legitimate interest consisting in ensuring the security and availability of the Website | up to 12 months |
| Support in preparing responses to inquiries using a language model | content of the inquiry and the data contained therein | Article 6(1)(b) or (f) GDPR — as applicable to the handling of the inquiry | in accordance with the rules for handling the inquiry; the provider does not retain the content for longer than is necessary to provide the response |
| Establishing, pursuing or defending claims | data collected in connection with the purposes above | Article 6(1)(f) GDPR — legitimate interest consisting in protecting the Controller's rights | until the limitation period for claims expires |
| Fulfilling tax and accounting obligations | data required by law | Article 6(1)(c) GDPR | 5 years counting from the end of the calendar year in which the obligation arose |
4. Social media profiles
We maintain company profiles on social media platforms, including LinkedIn. If you interact with us on such a profile (following, reactions, comments, messages), we process the data visible in your profile and the content of the interaction on the basis of Article 6(1)(f) GDPR — our legitimate interest consisting in conducting communication and building brand recognition. We retain the data until you delete the interaction or object to the processing.
With regard to profile statistics, we are a joint controller of data together with the operator of the relevant social media platform. The rules for processing data by the platform operator are set out in its own privacy policy, the content of which we have no influence over.
5. Recipients of data
We may transfer personal data only to entities that process it on our instructions and on the basis of a data processing agreement, or to entities authorized to receive it under applicable law. We use the following providers:
| Area | Provider | Role |
|---|---|---|
| Hosting and provision of the Website | Vercel Inc. (USA) | making the Website available, technical logs |
| Database | Redis Cloud Ltd (Israel) | storage of Website data |
| E-mail and office tools | Google Workspace — Google Ireland Limited (Ireland) | correspondence, documents |
| Newsletter and waiting list | MailerLite — UAB "MailerLite" (Lithuania) | sending messages |
| Handling of waiting list sign-ups | GetWaitlist, Inc. (USA) | receiving and queuing sign-ups |
| Customer support | Anthropic PBC (USA) | processing inquiry content by a language model in order to prepare responses |
| Protection against bots and abuse | Cloudflare, Inc. (USA) | filtering automated traffic, protection against attacks |
| Product analytics | PostHog, Inc. (USA) | measuring how the website is used |
In addition, data may be disclosed to:
- entities providing IT services in connection with the maintenance and development of the Website,
- law firms, tax advisors and accounting firms,
- operators of social media platforms — to the extent described in point 4,
- public authorities and courts — to the extent and in the cases provided for by law.
We do not sell personal data or disclose it to third parties for marketing purposes. The content of inquiries transferred to the customer support provider is not used to train artificial intelligence models.
6. Transfer of data outside the European Economic Area
Some of our providers are established outside the European Economic Area. This applies to Vercel Inc., GetWaitlist, Inc., Anthropic PBC, Cloudflare, Inc. and PostHog, Inc. — entities established in the United States — as well as Redis Cloud Ltd, established in Israel.
Data transfers take place on the following bases:
- Israel — a European Commission decision confirming an adequate level of protection of personal data; the transfer does not require additional safeguards.
- United States — the European Commission's implementing decision of 10 July 2023 on the EU–US Data Privacy Framework, with respect to providers participating in that framework, or standard contractual clauses adopted by the European Commission, supplemented with a transfer impact assessment and additional technical and organizational safeguards.
We will provide information on the basis applied to a specific provider, together with a copy of the safeguards, upon request sent to contact@hyllet.com.
7. Your rights
You have the right to:
- access your data and receive a copy of it,
- rectification of inaccurate data and completion of incomplete data,
- erasure of data ("the right to be forgotten"),
- restriction of processing,
- data portability — with respect to data processed on the basis of consent or a contract, in an automated manner,
- object to processing based on our legitimate interest, for reasons related to your particular situation; where processing is for the purposes of direct marketing, you may object at any time and without justification,
- withdraw consent at any time — withdrawal does not affect the lawfulness of processing carried out before its withdrawal.
You can withdraw your consent to the newsletter and waiting list by clicking the unsubscribe link in the footer of any message, or by writing to contact@hyllet.com.
We fulfil requests without undue delay, no later than within one month of receipt. In justified cases this period may be extended by a further two months — we will inform you of this, stating the reason.
8. Complaint to the supervisory authority
If you believe that we are processing your data unlawfully, you have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.
9. Voluntary provision of data
Provision of data is voluntary. However, providing an e-mail address is a condition for signing up for the waiting list and receiving the newsletter, and providing contact details is a condition for receiving a response to an inquiry. In the recruitment process, providing the data referred to in Article 22¹ of the Polish Labour Code is a statutory requirement; other data is provided voluntarily.
10. Automated decision-making
We do not make decisions concerning you based solely on automated processing, including profiling, which would produce legal effects concerning you or similarly significantly affect you.
When handling inquiries, we use the support of a language model, which helps prepare a response. The model does not make decisions concerning your rights or your access to services, and responses requiring substantive assessment are verified by a human. You may at any time request direct contact with one of our employees by writing to contact@hyllet.com.
11. Cookies and analytics without data storage
11.1. We do not use cookies
The hyllet.com Website does not save cookies on your device and does not use browser local storage (localStorage, sessionStorage) to identify you or track your activity. We do not embed advertising pixels or third-party tracking scripts for marketing purposes.
For this reason, we do not display a cookie consent banner — there is nothing to consent to. Under Article 399 of the Act of 12 July 2024 — the Polish Electronic Communications Law, the obligation to obtain consent applies to storing information on, and gaining access to information stored on, a terminal device. No such activities occur on our Website.
11.2. Analytics in storage-free mode
We use the PostHog analytics tool, configured in storage-free mode (without storing data on the device). This means the tool does not save any identifier on your device, does not recognize you on a subsequent visit, and does not combine your visits into a single profile.
For this purpose we process: IP address (truncated, or processed solely to determine an approximate location at country level), browser and device type, the address of the subpage visited, referral source, and events within a single visit.
The basis for processing is Article 6(1)(f) GDPR — our legitimate interest consisting in measuring the effectiveness of the Website and improving it. This data is aggregated in nature and is not used to make any decisions concerning individual persons.
You have the right to object to this processing for reasons related to your particular situation — simply send a message to contact@hyllet.com. You may also limit data collection by enabling the Global Privacy Control signal in your browser or by using extensions that block analytics scripts; the Website will function normally.
11.3. Protection against bots
To protect the Website and its forms against automated traffic, attacks and abuse, we use the services of Cloudflare, Inc. As part of this protection, the IP address and request characteristics are processed. The basis is Article 6(1)(f) GDPR — legitimate interest consisting in ensuring the security and availability of the Website.
11.4. Browser settings
Regardless of the above, you may at any time manage your privacy settings and block scripts in your web browser.
12. Data security
We apply technical and organizational measures appropriate to the risk of a violation of the rights and freedoms of data subjects, including encryption of transmissions using the TLS protocol, access control based on the principle of least privilege, multi-factor authentication for internal systems, and regular review of the safeguards applied.
13. Changes to the policy
We may update this policy — in particular in connection with changes in the law, the scope of services, or the tools used. The current version is always available at hyllet.com/polityka-prywatnosci. The date of the last update is indicated in the header of the document. We will inform individuals signed up to the waiting list of any material changes by e-mail.