Privacy Policy

1.Controller and contact

Controller: Grasperly Sp. z o.o., ul. Zachodnia 70/417, 90-403 Łódź, Poland. KRS 0001238012. NIP 7252366483.

Privacy contact: contact@kepta.legal. We have not appointed a Data Protection Officer (DPO), because we do not meet the mandatory thresholds in Article 37 of the GDPR, but the mailbox is monitored by the people at Kepta responsible for data protection. We aim to respond within five (5) business days and, in any event, within the one-month statutory deadline set by Article 12(3) of the GDPR (extendable by two further months for complex or numerous requests under the same provision).

Supervisory authority: the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, www.uodo.gov.pl. You have the right to lodge a complaint there at any time concerning the processing of your personal data, particularly if you believe the processing infringes the GDPR.

2.What personal data we collect

We collect only what we need for the purpose for which we are processing.

Website visitors (kepta.legal). Page-view counts, language preference, referrer URL, approximate location, browser and device type. With your consent in the cookie banner, collected through Google Analytics and PostHog using cookies; PostHog then also records clicks, browser errors and session recordings of how pages were used, with every form field masked. If you decline, Google Analytics does not run and PostHog only counts page views, clicks, form outcomes and errors anonymously, without cookies, recordings or profiles (see the Cookie Policy for how unique visits are counted with a daily-changing hash and how to object). What you type into a form never reaches either tool. See our Cookie Policy for the cookies involved and how to withdraw consent.

Contact form. When you use the contact form we receive your name, work email, company, and the message you write.

Request form. When you ask for a service (for example a contract review) we receive the service or plan you choose, your company, work email, the jurisdiction and requested deadline if you give them, and your description of what the matter needs to achieve. The form does not ask for documents; please do not include other people's sensitive data in the description.

Demo request form. When you book a demo we receive your first and last name, work email, company name, company location, company size, and anything you write about what you would like to explore.

Sign-up form. When you use the sign-up form we receive your work email, company, the plan you choose, and any note you add.

How you reached us (all forms). Every form submission also carries where your visit began: the referring website, the first page you landed on, and any campaign tags in the link you followed (UTM parameters). The site notes these in your browser's session storage for the current visit, without cookies and whether or not you accept Google Analytics, and sends them only if you submit a form. We use them to understand which channels bring enquiries.

Startup application form. The application is a questionnaire. We receive your name, work email, company, company website, how you heard about Kepta, your role, who the company sells to, whether its business is regulated, its legal form, team size, stage, the fund or accelerator that backs you and when you last raised, what it builds, and your answers about legal work: the documents ahead of you, a description of a recent contract or legal matter, who handles contracts and how many you sign, how pressing it is, what you pay today and whether the last invoice matched your expectations, what matters most, who decides, whether you have documents to go through with a lawyer now, which ones and by when, and whether the programme suits you. We save your answers as you complete each section and when you leave the page part-way, so we also receive a questionnaire you started but did not send. If you tick the separate marketing box, we also record your consent to receive offers and news about the programme by email.

Prospects and customer-contact persons generally. In addition to what you submit through a form, we keep the notes we make about a conversation with you. Source (Article 14(2)(f) GDPR): we collect this data directly from you when you submit a form, write to us, or speak with us at an event. We do not enrich prospect records from third-party data brokers or scrape public profiles to build them.

Candidates. What you submit in your application (CV, cover letter, work-history details, professional licences), our interview notes, references that you have authorised us to obtain, and the outcome of the recruitment process.

Event attendees. Name, work email, employer, and any dietary or accessibility information you provide for an event.

Server logs. Our web server keeps standard technical logs of requests, which include IP addresses, for the security and stability of the site. None of this is used for advertising or sold to anyone. Account-security telemetry, such as detecting attempted account takeover, will apply only once the Kepta platform and its user accounts are available.

3.Purposes and legal bases

We process personal data only where we have a lawful basis under Article 6 of the GDPR. The table below maps purposes to bases. Where we rely on legitimate interests under Article 6(1)(f) we state the specific interest pursued.

Operating kepta.legal and counting page views. Legitimate interest (Article 6(1)(f)), *specific interest: understanding how visitors use our website so that we can run, secure, and improve it.* This covers the anonymous, cookieless counting PostHog performs when you decline analytics cookies, and the anonymous lead and error counts sent from our server: no cookies, no IP storage, no profiles. You can object at any time (Article 21) by turning on Global Privacy Control or Do Not Track in your browser, or by writing to us. Analytics with cookies (Google Analytics, and PostHog with cookies and session recordings) runs only on your consent (Article 6(1)(a)), which you can withdraw at any time.

Responding to inquiries and demo requests. Steps prior to entering a contract at the request of the data subject (Article 6(1)(b)) and legitimate interest (Article 6(1)(f)), *specific interest: running a B2B sales pipeline and providing a professional response to commercial inquiries.*

Offers and programme news by email. Only if you tick the separate marketing box on the startup application form: your consent (Article 6(1)(a)), together with your consent to receive commercial information by electronic means under Article 398 of the Polish Electronic Communications Law. You can withdraw it at any time by writing to us or replying to any such email; withdrawal does not affect processing before it.

Account administration (once the platform is live). When the Kepta platform becomes available, we will process account-management data to perform our contract with the customer you belong to (Article 6(1)(b)) and to meet our legal record-keeping obligations (Article 6(1)(c)). This does not apply at the launch of this website.

Recruitment. Steps prior to entering an employment relationship at the request of the data subject (Article 6(1)(b)) and legitimate interest (Article 6(1)(f)), *specific interest: identifying suitable candidates for open roles.* Retention of candidate data beyond the current recruitment process for the purpose of considering future opportunities is based on the candidate's explicit consent (Article 6(1)(a)), consistent with Article 22¹ of the Polish Labour Code, which is requested separately and may be withdrawn at any time.

Event management. Performance of an event-attendance contract (Article 6(1)(b)) and legitimate interest (Article 6(1)(f)), *specific interest: ensuring event safety, accessibility, and quality.*

Security and fraud prevention. Legitimate interest (Article 6(1)(f)), *specific interest: protecting kepta.legal, the people who contact us, and Kepta from unauthorised access, abuse, and other security incidents. Platform and account-security processing applies once the Kepta platform is live.*

Compliance with law. Tax, accounting, anti-money-laundering, sanctions screening, and other obligations imposed on us by Polish, EU, or applicable foreign law (Article 6(1)(c)).

Defence of legal claims. Legitimate interest (Article 6(1)(f)), *specific interest: establishing, exercising, and defending legal claims by or against Kepta.*

4.Retention

We do not keep personal data longer than necessary. Specific retention periods are:

• Google Analytics: up to fourteen (14) months, Google's default event-data retention period; only collected at all if you accept it in the cookie banner.

• PostHog: events for the period fixed by our PostHog plan, currently twelve (12) months (we will update this policy before any change), and session recordings up to thirty (30) days; only collected at all if you accept analytics in the cookie banner.

• Inquiry and demo data: twenty-four (24) months from last meaningful contact, then deleted from active systems and retained only in audit logs for one further year.

• Customer-contact-person data (active customers): for the duration of the customer relationship, plus six (6) years for tax and statute-of-limitations purposes.

• Platform account data: not applicable at the launch of this website. Retention periods for account data will be set out here once the Kepta platform and its user accounts become available.

• Candidate data (unsuccessful applicants): twelve (12) months from the date of decision, unless you have consented to a longer period for future opportunities.

• Candidate data (successful applicants): transferred to employee records on hire; that processing is covered by our internal HR notice.

• Server logs: twelve (12) months, except for incidents under investigation, where logs are kept until investigation is closed plus three (3) years for evidentiary purposes.

• Records required by law: for the period mandated by the applicable law (e.g. five years for VAT documentation under Polish tax law).

5.Recipients and sub-processors

We share personal data only where necessary and only with recipients bound by appropriate confidentiality and data-protection terms.

Service providers (processors). At launch we use a small number of providers, each bound by a data-processing agreement meeting Article 28 of the GDPR: Google Workspace (the mailbox that sends and receives the emails generated by the forms on kepta.legal), Google Ireland Limited (Google Analytics, website analytics that runs only once you accept it in the cookie banner) and PostHog, Inc. (product analytics, session recordings and error tracking for kepta.legal, hosted in PostHog's EU cloud; with cookies and session recordings only once you accept analytics in the cookie banner, otherwise anonymous cookieless statistics only; from our server it also receives anonymous counts and delivery outcomes of form submissions, and server error reports, none of which contain the content of your submission or any identifier). The current list is published at kepta.legal/sub-processors. The website itself runs on Kepta's own server infrastructure, not on a third-party cloud. Additional providers, including AI model providers, will be engaged only once the Kepta platform is live, and will be listed on the sub-processor page before that happens.

Professional advisors. Our lawyers, auditors, tax advisors, and insurers, where they have a legitimate need to know in their professional capacity and are themselves bound by confidentiality.

Authorities. Public authorities to whom we are required to disclose information by law (e.g. tax authorities, the supervisory authority, courts, prosecutors). We disclose the minimum necessary and require a lawful basis from the authority.

Transactions. In a merger, acquisition, reorganisation, or sale of all or substantially all of our assets, personal data may be transferred subject to standard confidentiality protections in the transaction documents and continued application of this policy or one no less protective.

We do not sell personal data. We do not share personal data with advertising networks, data brokers, or any party for the purpose of independent marketing to you.

6.International transfers

Most of our processing happens in the European Union. The website runs on Kepta's own server infrastructure in the EU, our analytics provider Google Ireland Limited (Google Analytics) is established in Ireland, and our PostHog project is hosted in PostHog's EU cloud (Frankfurt, Germany).

Google Analytics and Google Workspace, though each contracted through an EU entity, can involve data flows to Google's infrastructure outside the EEA. PostHog, Inc. is a US company: our data is stored in its EU cloud, but its staff may access it from outside the EEA for support and operations. Any such transfer is made under an appropriate safeguard listed in Articles 45 to 49 of the GDPR, in the ordinary case the European Commission's Standard Contractual Clauses with supplementary measures where needed, or the EU-US Data Privacy Framework where the recipient is certified under it.

Where any other transfer outside the EEA occurs, for example when a non-EEA professional advisor reviews a matter, it is made only under one of those safeguards: an adequacy decision, the Standard Contractual Clauses with appropriate supplementary measures, or, where strictly necessary, one of the derogations in Article 49.

On request to contact@kepta.legal we will provide a copy of the safeguard in place for any specific transfer.

7.Your rights

You have the rights set out in Articles 15 to 22 of the GDPR. Specifically:

• Access (Article 15), obtain confirmation whether we process your personal data and, if so, a copy of that data and the information set out in Article 15(1)–(2).

• Rectification (Article 16), correct inaccurate or incomplete data.

• Erasure (Article 17), request deletion in the circumstances listed in Article 17(1), subject to the exceptions in Article 17(3).

• Restriction of processing (Article 18), restrict processing in the circumstances listed in Article 18(1).

• Data portability (Article 20), receive your personal data in a structured, commonly used, machine-readable format, where the processing is based on consent or on a contract and is carried out by automated means.

• Objection (Article 21), object at any time, on grounds relating to your particular situation, to processing based on legitimate interest. We will then stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or for the establishment, exercise, or defence of legal claims. You also have an absolute right to object to direct marketing.

• Automated decisions (Article 22), not to be subject to a decision based solely on automated processing that produces legal effects on you or similarly significantly affects you, subject to the exceptions in Article 22(2). We do not currently take such decisions about website visitors, prospects, or candidates.

• Withdraw consent (Article 7(3)), where processing is based on consent, withdraw it at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

To exercise any of these rights, email contact@kepta.legal. We will respond without undue delay and in any event within one (1) month of receipt of the request, in line with Article 12(3). Where the request is complex or numerous we may extend that period by a further two months and we will notify you of the extension within the first month.

We do not charge a fee for handling requests unless they are manifestly unfounded or excessive, in particular because of their repetitive character, in which case we may charge a reasonable fee or refuse to act, in line with Article 12(5).

8.Cookies

kepta.legal sets one strictly necessary cookie: `NEXT_LOCALE` remembers the site (country and language) you chose. Google Analytics and PostHog set analytics cookies only if you accept them in the cookie banner. If you decline, Google Analytics does not run and PostHog only counts visits anonymously, without cookies. The Kepta platform, once live, will use only strictly necessary cookies. Full details are in our Cookie Policy.

9.Children

Kepta serves businesses. kepta.legal is not directed to children. We do not knowingly collect personal data from children under sixteen (16). If you believe we have done so, please contact contact@kepta.legal and we will delete the data without undue delay.

10.Security

We apply technical and organisational measures appropriate to the risk in line with Article 32 of the GDPR. For this website that includes serving the site over HTTPS, keeping form-handling secrets out of the codebase and off the browser, and limiting who can access the server that runs the site and receives form submissions.

The fuller set of controls that will govern the Kepta platform and the lawyer-delivered services will be committed to in Schedule 3 of the DPA before those services process customer data. Current security information is published on our Security & data page.

If we become aware of a personal-data breach we will notify the Polish supervisory authority and affected data subjects in line with Articles 33 and 34 of the GDPR, and our customers in line with the DPA.

11.Changes to this policy

We may update this policy from time to time to reflect changes in our practices, our service, or the law. Material changes will be summarised at the top of this page for at least thirty (30) days, and we will email affected data subjects where they have a reasonable expectation of notice. Continued use of kepta.legal or the Platform after the effective date of an update constitutes acknowledgement of the updated policy.

12.Language

This policy is published in English and in Polish. The English-language version is the binding text; the Polish-language version is a translation provided for convenience. Where mandatory law applicable to a data subject requires another language to govern, the mandatory provisions of that law prevail.