Legal

Privacy and Cookie Policy

How we process personal data on the CTRL+CHAOS website and which cookies we use.

Version effective from 5 August 2026

1. Definitions 2. General Information 3. Data Controller 4. Scope of Personal Data Processed 5. CTRL+CHAOS Newsletter ("Chaos Log") 6. Analytical Tools (Google Analytics) 7. Google Ads and the Remarketing Tag ("Google Pixel") 8. Other Marketing and Analytical Tools 9. Ensuring Continuity of Communication and Enabling Contact with the 10. Compliance with Legal Obligations 11. Possible Establishment, Pursuit and Enforcement of Claims Arising from 12. Processing of Personal Data by Other Entities 13. Transfer of Personal Data to Third Countries or International Organisations 14. Information on Automated Decision-Making, Including Profiling 15. Rights of the User in Connection with the Processing of Their Personal Data 16. Cookies – General Information 17. Cookies and the Processing of Personal Data 18. Cookies Used on the Website 19. Final Provisions

1Definitions

For the purposes of this document, the following definitions apply: Data Controller/Controller – ITM Sp. z o.o. (a Polish limited liability company), with its registered office in Olsztyn, ul. Wawrzyczka 13, 10-762 Olsztyn, Poland, entered into the register of entrepreneurs of the National Court Register (KRS) under number: 0000053744, Tax Identification Number (NIP): 7392854679, Statistical Number (REGON): 510663071, with a share capital of PLN 50,000; CTRL+CHAOS – the "Control Your Chaos" AI services brand operated by the Controller; CTRL+CHAOS is not a separate legal entity; Personal Data – any information relating to an identified or identifiable natural person, i.e. information which, directly or indirectly, allows the identity of a natural person to be established; Processing – any operation or set of operations performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, retrieval, consultation or erasure; Privacy and Cookie Policy/Privacy Policy – this document, setting out the rules for the processing of Personal Data via the Website, based on and in accordance with the GDPR; GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation); Website – the website operated by the Controller under the CTRL+CHAOS brand, available at www.ctrlchaos.pl; User – a User within the meaning of the Terms of Service, whose Personal Data is Processed within the Website.

2General Information

1.This Privacy Policy has been prepared on the basis of, and in accordance with, all requirements of the GDPR, and in particular contains all the information the Controller is required to provide, under Article 13 GDPR, to the person whose Personal Data it Processes and from whom it has collected such Data.

2.Capitalised terms used but not defined in this Privacy Policy shall have the meaning given to them in the Website's Terms of Service.

3.This Privacy Policy describes matters relating to the Processing of Personal Data only via the Website.

4.The Website uses encrypted data transmission, i.e. it has an SSL (Secure Sockets Layer) certificate, a network protocol used for secure network connections.

5.This version of the Privacy Policy applies from 5 August 2026.

3Data Controller

1.The Controller of the User's Personal Data is ITM Sp. z o.o., with its registered office in Olsztyn, ul. Wawrzyczka 13, 10-762 Olsztyn, Poland, entered into the register of entrepreneurs of the National Court Register (KRS) under number: 0000053744, NIP: 7392854679, REGON: 510663071, with a share capital of PLN 50,000.

2.CTRL+CHAOS is an AI services brand of the Controller – ITM Sp. z o.o. remains identifiable as the entity responsible for the Website and for the Processing of Personal Data.

3.The User may contact the Controller regarding their Personal Data through the following means:

a.by post, at: ul. Wawrzyczka 13, 10-762 Olsztyn, Poland;

b.by e-mail, at: itm@itm.com.pl;

c.by telephone: +48 668 194 990;

d.via the newsletter sign-up form available on the Website.

4.The Controller has not appointed a Data Protection Officer, as, given the limited scope and scale of the Personal Data Processed, this is not, in the Controller's assessment, necessary or legally required.

4Scope of Personal Data Processed

1.Via the Website, the Controller may Process Personal Data through:

a.the newsletter sign-up form for CTRL+CHAOS ("Chaos Log");

b.the use of the Google Analytics analytical tool;

c.the use of the Google Ads tool (remarketing/conversion tag, commonly referred to as the "Google Pixel") and other similar marketing tools that may be implemented on the Website;

d.ensuring continuity of communication and enabling contact with the Controller regarding matters related to its business activity;

e.fulfilling legal obligations arising from applicable law, in particular accounting and tax regulations.

2.The Controller may also Process Personal Data where it becomes necessary to establish, pursue or defend claims, in the event of court or other proceedings.

3.All Personal Data that may be Processed by the Controller via the Website is provided by the User voluntarily.

4.The User is not required to provide the Controller with their Personal Data. However, failure to provide certain Personal Data may make it impossible to perform a given service or achieve a specific purpose (e.g. failure to provide an e-mail address will make it impossible to sign up for the CTRL+CHAOS newsletter).

5.Where the User does provide their Personal Data, the Controller will Process it on the basis of, and within the limits of, the law, in particular in a manner that is adequate within the meaning of the GDPR, i.e. relevant and limited to what is necessary for the purposes for which it is Processed, in accordance with the principle of data minimisation.

6.Detailed legal bases for the Processing of Personal Data are set out further in this Privacy Policy.

5CTRL+CHAOS Newsletter ("Chaos Log")

1.By signing up to the CTRL+CHAOS newsletter ("Chaos Log"), the Controller Processes the Personal Data the User provides by completing and submitting the newsletter sign-up form, i.e. the User's e-mail address.

2.The legal basis for Processing Personal Data is Article 6(1)(a) GDPR, i.e. Processing based on the consent of the data subject, for the purpose of sending the newsletter by the Controller.

3.Sign-up takes place through a form on the Website, and the Personal Data provided in it is transferred to a third-party newsletter delivery platform – MailerLite Limited, 88 Harcourt Street, Dublin 2, D02 DK18, Ireland – used by the Controller for the technical handling of the sign-up and of newsletter delivery.

4.The User's Personal Data Processed in connection with the newsletter is Processed until consent to Processing is withdrawn.

5.The User may withdraw their consent to the processing of their Personal Data at any time, in particular by using the unsubscribe link included in every newsletter message. Withdrawing consent does not affect the lawfulness of Processing carried out by the Controller on the basis of consent given by the User before its withdrawal.

6Analytical Tools (Google Analytics)

1.The Controller uses the Google Analytics analytical tool on the Website.

2.Within Google Analytics, the Controller may Process the following categories of the User's Personal Data: IP address, approximate location limited to town/city level, information about the device and browser used, and data on how the User uses the Website.

3.The purpose of Processing Personal Data through Google Analytics is statistical analysis of User traffic on the Website and User interaction with the Website, which the Controller uses to optimise the operation of the Website.

4.The legal basis for Processing Personal Data referred to in this section is Article 6(1)(a) GDPR, i.e. Processing based on consent given by the User via the cookie notice (the so-called "cookie banner"), which will be displayed on the Website on the User's first visit.

5.The User has the right to withdraw the consent given at any time, without affecting the lawfulness of Processing carried out before its withdrawal, by changing the cookie settings described in this section.

6.Personal Data Processed within Google Analytics is Processed for up to 2 years, i.e. until the cookie expires or until the User withdraws consent to the Processing of such Data.

7Google Ads and the Remarketing Tag ("Google Pixel")

1.The Controller uses, or plans to use, the Google Ads marketing tool on the Website, together with a remarketing/conversion tag, commonly referred to as the "Google Pixel".

2.Within this tool, the Controller may Process the following categories of the User's Personal Data: IP address, approximate location limited to town/city level, and information about the User's interaction with the Controller's advertisements and with the Website.

3.The purpose of Processing Personal Data through Google Ads is to enable the Controller to run advertising and remarketing campaigns to promote the AI services offered under the CTRL+CHAOS brand.

4.The legal basis for Processing Personal Data referred to in this section is Article 6(1)(a) GDPR, i.e. Processing based on consent given by the User via the cookie notice, which will be displayed on the Website on the User's first visit.

5.The User has the right to withdraw the consent given at any time, without affecting the lawfulness of Processing carried out before its withdrawal, by changing the cookie settings.

6.Personal Data Processed within this tool is Processed for the period indicated by the Controller in the settings of the relevant cookie, or until the User withdraws consent to its Processing.

8Other Marketing and Analytical Tools

1.The Controller reserves the right to implement additional analytical, marketing or remarketing tools on the Website, such as, for example, Meta Pixel, LinkedIn Insight Tag, or similar tools from other providers.

2.Where a new tool referred to in the preceding paragraph is implemented, the Controller will update this Privacy Policy and the cookie notice, indicating the purpose of Processing, the scope of Personal Data, the legal basis, the tool provider and the data retention period, before the tool begins to actually Process the User's Personal Data.

3.Until such an update is made, the rules described in this document regarding analytical and marketing tools, including the requirement to obtain the User's consent via the cookie notice, apply accordingly to any new tools of this kind.

9Ensuring Continuity of Communication and Enabling Contact with the

Controller

1.By enabling contact with the Controller regarding matters related to its business activity (e.g. via e- mail or telephone), the Controller Processes Personal Data provided by the User, i.e.: first and last name, company name, e-mail address, telephone number, as well as other Data voluntarily provided by the User in the content of a message or telephone call.

2.The legal basis for Processing Personal Data in this respect is Article 6(1)(f) GDPR, i.e. Processing for the purposes of the Controller's legitimate interest, which in this case means ensuring continuity of communication and enabling contact with the Controller in matters relating to its business activity.

3.Personal Data Processed to ensure contact with the Controller will be stored for the period necessary to conduct correspondence and achieve the purpose for which it was provided, and thereafter may be Processed for a period arising from the Controller's legitimate interests.

4.The User has the right, at any time, to object to the Processing of their Personal Data for this purpose.

10Compliance with Legal Obligations

1.The Controller may Process Personal Data to the extent necessary to fulfil legal obligations incumbent upon it under generally applicable law, in particular obligations of an administrative, archival or reporting nature.

2.Personal Data Processed for this purpose may include, in particular: first and last name, e-mail address and other data provided to the Controller in connection with the fulfilment of the obligations referred to in this section.

3.The legal basis for Processing Personal Data in connection with the Controller's compliance with legal obligations referred to in this section is Article 6(1)(c) GDPR.

4.The User's Personal Data Processed for the purpose of complying with legal obligations is Processed until the legal obligations incumbent on the Controller, which required the Processing of such Data, expire.

11Possible Establishment, Pursuit and Enforcement of Claims Arising from

the Agreement for the Provision of Electronic Services

1.Where it becomes necessary to establish, pursue or enforce claims arising from the Agreement for the Provision of Electronic Services, or to defend against such claims, in court or other proceedings, the Controller will Process the Personal Data necessary for this purpose, in accordance with the law.

2.The Personal Data referred to in paragraph 1 above may include: first name, last name, postal address, e-mail address, telephone number, company name and Tax Identification Number (NIP).

3.The legal basis for Processing Personal Data in the situation referred to in this section is Article 6(1) (f) GDPR.

4.The User's Personal Data that may be Processed for the purposes of potential claims or disputes is Processed until the limitation period for claims relating to the agreement concluded has expired.

12Processing of Personal Data by Other Entities

1.In order to use tools that enable the Controller to operate the Website and that support its business activity, as well as to provide Electronic Services, the User's Personal Data may also be Processed by the following entities:

a.the Website's hosting provider, which stores Personal Data on its server, as a data processor;

b.entities providing IT and software development services related to the Website, as data processors;

c.entities handling marketing campaigns and providing analytical services, as data processors;

d.MailerLite Limited, 88 Harcourt Street, Dublin 2, D02 DK18, Ireland – for the technical handling of the CTRL+CHAOS ("Chaos Log") newsletter sign-up and delivery, as a processor of the Data;

e.Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA – in connection with the Controller's use of the Google Analytics and Google Ads tools, which is an independent controller of such Personal Data.

13Transfer of Personal Data to Third Countries or International Organisations

1.The Controller does not directly transfer the User's Personal Data to third countries or international organisations.

2.The User's Personal Data may, however, be transferred to third countries by Google LLC (Google Analytics, Google Ads), whose tools the Controller uses, and which may, in connection with such activities, become independent controllers or processors of the User's Personal Data. Personal Data Processed in connection with the CTRL+CHAOS ("Chaos Log") newsletter is stored by MailerLite Limited on servers located within the European Economic Area. The data processing agreement concluded with MailerLite Limited provides for the possibility of transferring such Data to the United States on the basis of the standard contractual clauses referred to in Article 46(2)(c) GDPR.

3.Google LLC is listed among the entities participating in the Data Privacy Framework, and, pursuant to Commission Implementing Decision (EU) C(2023) 4745 of 10 July 2023 on the adequate level of protection of personal data under the EU-US Data Privacy Framework, the protection of Personal Data corresponds to the standards of the regulations applicable in the European Union.

4.In the case of providers of marketing tools located outside the European Economic Area that are not listed under the Data Privacy Framework, the transfer of Personal Data takes place with the application of appropriate safeguards provided for by the GDPR, including standard contractual clauses. More information on this subject can be found in the privacy policy of the relevant provider.

14Information on Automated Decision-Making, Including Profiling

The User's Personal Data is not used by the Controller for the purpose of making decisions about the User based on the automated Processing of Personal Data, including profiling, which produce legal effects concerning the User.

15Rights of the User in Connection with the Processing of Their Personal Data

1.Pursuant to Articles 16–21 GDPR, the User is granted the following rights in relation to the Personal Data Processed by the Controller.

2.Under the legal bases referred to above, the User has the right to exercise the following rights with respect to their Personal Data Processed by the Controller, i.e. the right to:

a.access their Personal Data, pursuant to Article 15 GDPR;

b.rectify their Personal Data, pursuant to Article 16 GDPR;

c.erase their Personal Data, pursuant to Article 17 GDPR;

d.restrict the Processing of their Personal Data, pursuant to Article 18 GDPR;

e.data portability, pursuant to Article 20 GDPR;

f.object to the Processing of their Data, pursuant to Article 21 GDPR.

3.Further detailed information on the User's rights can be found in Articles 16–21 GDPR, respectively.

4.The User also has the right to lodge a complaint with the competent supervisory authority if they believe that their Personal Data is not being Processed properly and in accordance with the law.

5.The competent supervisory authority may be the authority competent for the User's habitual residence in a Member State, the User's place of work, or the place of the alleged infringement relating to Personal Data.

6.In Poland, the supervisory authority for Personal Data is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych).

7.Before lodging any complaint, the Controller nevertheless encourages the User to first contact it at the e-mail address indicated in this document, in order to clarify the matter or any doubts the User may have regarding the Processing of Personal Data via the Website.

16Cookies – General Information

1.The Website uses cookies.

2.Cookies are small pieces of text information stored on the User's end device used to access the Website, e.g. a computer or mobile phone.

3.Cookies may be read by the Controller's IT system (so-called "first-party" cookies) or by the IT systems of third parties (so-called "third-party" cookies).

17Cookies and the Processing of Personal Data

1.By reading the User's cookies through the Controller's IT system, the Controller may gain access to information that constitutes Personal Data, and therefore, on the basis of such activities, the Controller Processes such Personal Data.

2.Some information, including Personal Data contained in cookies, may also be read by the IT systems of third parties.

3.Some of the cookies used by the Controller are necessary for the proper provision of electronic services to the User within the meaning of the Polish Act of 18 July 2002 on the Provision of Electronic Services, while the Controller's use of other cookies (statistical and marketing) is not necessary for the proper use of the Website.

4.Cookies that are not necessary for the proper provision of electronic services to the User are blocked until the User consents to their use, and thereby to the Processing of Personal Data.

5.The consent referred to above may be given by the User via the cookie banner, which will be displayed on the Website during the User's first visit.

6.The legal basis for the Processing of Personal Data via cookies, referred to in the paragraphs above, is Article 6(1)(a) GDPR, i.e. the User's consent, as described in more detail in the sections above concerning the rules for Processing Data within the tools used on the Website.

7.Additionally, within their web browser, the User may at any time manage their cookie settings, including by blocking or re-enabling their use.

18Cookies Used on the Website

1.The Controller uses both its own cookies and third-party cookies on the Website.

2.Its own (technical) cookies are used to ensure the correct operation of the various mechanisms present on the Website and do not require the User's consent.

3.Third-party cookies are used for the purposes described in the sections above, and are, in particular, Google Analytics and Google Ads cookies, provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA, as well as any cookies of other marketing tools that may be implemented on the Website pursuant to Section 8 of this Privacy Policy.

19Final Provisions

1.In matters not regulated in this Privacy Policy, the relevant provisions of Polish law and the GDPR shall apply.

2.The Controller has the right to amend the content of this Privacy Policy, in particular where required by changes relating to the Processing of Personal Data on the Website, technological changes, or changes to the applicable law relating to the matters described in this document.

3.This Privacy Policy is drawn up in both Polish and English language versions. In the event of any discrepancy or inconsistency between the two versions, the Polish-language version shall prevail.

← home Terms of Service →