1.Who the data controller is
The controller of your personal data is AB Invest Sp. z o.o., NIP 5130261948, REGON 384121068, KRS 0000799318, ul. Żbicka 10A, 32-065 Krzeszowice. The site is run by Ilya Fridman, who also answers all messages (“I” below).
For anything related to your personal data, write to ilya@fridman.pl. You can also call: +48 737 576 876.
I have not appointed a data protection officer, as one is not required at this scale. Please contact me directly about anything.
2.What data I collect and where it comes from
I only collect the data you enter yourself, plus the technical data your browser sends with every request to the site.
Contact form
Required: your name, email address and message. Optional: phone number, company name, company size, job title and the service you’re interested in.
Call booking
Required: the time of the call, your name and email address. Optional: phone number, company name, company size, the topic of the call and the service you’re interested in. After booking I send a confirmation email with a calendar file.
AI assessment
You answer questions about the processes, data, tools and team in your company. The answers themselves contain no personal data. You give your email address, and optionally your company size, only if you want the result by email.
Savings calculator
You enter figures about work in your company, such as hours and rates. You give your email address only if you want the result by email. In that case I store it together with the values you entered and the result.
Email, phone and WhatsApp
If you write or call me directly, I process the data from that correspondence: your contact details and what the message says. WhatsApp also processes data under its own terms, as a separate controller.
Technical data
With every request your browser sends, among other things, your IP address, the date and time, the page address and the browser type. This data ends up in server logs and is used to protect the forms against spam, for example by limiting how many submissions come from one address. With each form message I also store when it was sent, the page it was sent from and any campaign (UTM) parameters in the link.
Visit statistics
I use Vercel Web Analytics. It counts page views in aggregate (page, referrer, country, device and browser type), uses no cookies and does not recognise you across visits on different days.
3.Why I process data and on what legal basis
| Purpose | Legal basis |
|---|---|
| Replying to an enquiry, the call and preparing an offer when you ask on your own behalf, e.g. as a sole trader | Art. 6(1)(b) GDPR: steps taken at your request before entering into a contract |
| Contacting you as a representative or employee of a company that asks about working together | Art. 6(1)(f) GDPR: my legitimate interest in replying to enquiries and discussing a possible contract |
| Booking the call and sending a confirmation with a calendar file | Art. 6(1)(b) GDPR, or Art. 6(1)(f) GDPR when you act on behalf of a company |
| Sending the AI assessment or calculator result to your email | Art. 6(1)(b) GDPR: providing the service you ask for |
| Protecting the site and forms against spam and abuse, data security | Art. 6(1)(f) GDPR: my legitimate interest in running the site securely |
| Aggregate visit statistics | Art. 6(1)(f) GDPR: my legitimate interest in improving the site |
| Performing the contract, if we start working together | Art. 6(1)(b) GDPR |
| Issuing invoices and keeping accounts | Art. 6(1)(c) GDPR: obligations under tax and accounting law |
| Establishing, pursuing or defending legal claims | Art. 6(1)(f) GDPR: my legitimate interest in protecting my rights |
GDPR means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data.
I don’t send newsletters or sales emails to the address you give in a form. You only get messages about the matter you asked about. I don’t sell data or pass it on to anyone for marketing.
4.Who I share data with
I only entrust data to providers the site can’t run without. They process it on my behalf, under data processing agreements (Art. 28 GDPR), and only as far as their service requires.
| Provider | What for | Where |
|---|---|---|
| Vercel Inc. | Hosting the site, server logs, cookieless visit statistics | USA, servers in many countries |
| Supabase Inc. | Database of enquiries, bookings and assessment results | Servers in the European Union, US company |
| Resend | Sending emails: booking confirmations and results | USA |
| Anthropic PBC | Writing the AI assessment summary. It receives only anonymous answers, never your name, email address or company name | USA |
| Telegram | A notification to me that a new submission has arrived. The message contains none of your personal data | Outside the EEA |
Data may also be accessed by my email and calendar provider (correspondence and video calls), my accounting office if we sign a contract and I issue invoices, and public authorities where the law requires it.
5.Transfers outside the European Economic Area
Some providers are based in the USA or may process data outside the EEA. In that case the transfer relies on the European Commission’s adequacy decision (EU-US Data Privacy Framework) where the provider takes part in it, or on the standard contractual clauses adopted by the European Commission (Art. 46(2)(c) GDPR).
You can get a copy of these safeguards by writing to ilya@fridman.pl.
6.How long I keep data
| Data | How long |
|---|---|
| A form enquiry, if we don’t start working together | 12 months from the last contact about it |
| A call booking | 12 months from the date of the call |
| An email address given in the AI assessment or the calculator | 12 months from sending the result. After that the answers remain only in anonymous form |
| Data related to a contract and invoices | For the duration of the contract, then as long as tax and accounting law requires (usually 5 years from the end of the year in which the tax payment was due), and until legal claims become time-barred |
| Technical data in logs and for spam protection | Only as long as security requires, no longer than 30 days |
If you ask me to delete your data earlier or successfully object to the processing, I will delete it sooner, unless the law requires me to keep it.
7.Your rights
In connection with the processing of your data you have the right to:
- access your data and get a copy of it (Art. 15 GDPR),
- have inaccurate data corrected (Art. 16 GDPR),
- have your data erased (Art. 17 GDPR),
- restrict processing (Art. 18 GDPR),
- have the data you gave me transferred to another controller (Art. 20 GDPR),
- object at any time to processing based on my legitimate interest (Art. 21 GDPR),
- lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl, or with the authority in the EU country where you live or work.
To use any of these rights, write to ilya@fridman.pl. I will reply without undue delay and within one month at the latest. In particularly complex cases this can be extended by two further months, in which case I’ll tell you why.
8.Do you have to give your data
Giving your data is voluntary. Without your name and email address, though, I can’t reply to an enquiry or book a call. You can skip any field marked as optional, and you can use the AI assessment and the calculator without giving any personal data at all.
9.Automated decisions and profiling
I don’t make decisions about you based solely on automated processing that have legal effects or similarly significantly affect you (Art. 22 GDPR).
The AI assessment result is an automatic summary of your answers: information for you, not a decision. I may sort enquiries automatically, for example by topic and company size, to reply faster, but I always decide on the reply myself.
11.How I protect data
The connection to the site is encrypted (HTTPS). Only I have access to stored submissions. The database uses row-level access control, and its access keys never reach the browser. Providers receive only the data they need for their service.
12.Changes to this policy
When I change how data is processed, I will update this page and the date at the top.