PRIVACY POLICY

Last update: June 22, 2026

1. Who is the Data Controller?

The controller of your personal data is Agnieszka Bauer, conducting business activity under the name: Agnieszka Bauer, with its registered office at: Warszawa, ul. K. Jędrusik 6/6, Poland, NIP: 1181676290, REGON: 545099835 (hereinafter referred to as: the "Controller" or the "Seller"). In all matters related to the processing of personal data, you can contact the Controller directly via email: wglad@agabauer.com.

2. What Data Do We Process and How Do We Collect It?

The Controller collects and processes personal data using a minimized approach, strictly for the purposes necessary to execute the "Your Insight" Personal Development Program. Data is collected via the Destination Form in the Tally system and during the checkout process of the Shopify store. We process the following categories of data:

Identification and contact data: name, email address, phone number (if provided), invoice details (including NIP/Tax ID and company registered address for B2B Clients).
Report input data (Substantive data): exact date of birth.
Special categories of data (Sensitive data): information provided voluntarily by you in the open field of the Form labeled "Context", which may include details regarding your emotional state, well-being, personal relationships, or family situation.
Technical data: IP address, location data (used by the payment gateway to determine the country of tax residence), system logs.

3. Purposes and Legal Bases for Data Processing

Your personal data is processed on the basis of the GDPR provisions for the following purposes:

Purpose of processing	Legal basis	Retention period
Performance of the contract for the delivery of the Program (preparation of the PDF Report, conducting the 90-minute online session).	Art. 6(1)(b) GDPR (necessity for the performance of a contract).	For the duration of the contract and the execution of the session (maximum 60 days from the dispatch of the report).
Processing personal/emotional data entered in the "Context of the situation" field.	Art. 9(2)(a) GDPR (explicit, voluntary consent of the user prior to payment).	Until the customized PDF Report is delivered or until the Client withdraws their consent.
Compliance with legal and tax obligations (issuing VAT-exempt invoices, maintaining accounting records).	Art. 6(1)(c) GDPR in conjunction with Art. 74 of the Accounting Act and Art. 113 of the VAT Act.	For a period of 5 years, counting from the end of the calendar year in which the tax payment deadline expired.
Establishment, exercise, or defense of legal claims (including defense against allegations of consumer rights violations).	Art. 6(1)(f) GDPR (legitimate interest of the Controller).	Until the expiry of the limitation periods for claims resulting from the Civil Code.
GDPR compliance in the case of Abandoned Carts (deletion of data of individuals who did not complete the payment).	Art. 6(1)(f) GDPR (implementation of the principles of accountability and data minimization).	Data is deleted without undue delay, no later than within 48 hours from the moment the Form was filled out.
Managing sign-ups for the waitlist for the official edition of the "Your Insight" Personal Development Program and sending information about its launch.	Art. 6(1)(a) GDPR (explicit and voluntary consent of the data subject, expressed by ticking a dedicated checkbox).	Until the notification regarding the opening of the official edition of the Program is sent or until the user withdraws consent earlier.

4. Data Recipients (To whom do we transfer your data?)

Your personal data may be transferred exclusively to trusted third-party entities with whom the Controller has entered into Data Processing Agreements (DPA), in order to properly perform the service:

Shopify International Limited (Ireland) – operator of the e-commerce platform and the Shopify Payments system, for the purpose of handling the checkout and payment authorization.
Tally BV (Belgium) – provider of the electronic form system, for the purpose of collecting substantive data for the report.
Calendly LLC (USA) – online booking system, to enable self-selection of the 90-minute session slot.
Providers of marketing systems and automated email distribution (e.g., Shopify Email / Mailerlite) – for the purpose of handling notification dispatches to individuals signed up on the waitlist.
Entities providing accounting, hosting, and IT support services to the Controller.

5. Data Transfer Outside the European Economic Area (EEA)

Due to the utilization of global tool providers (Shopify, Calendly), your data may be transferred to third countries, in particular to the United States (USA). These entities guarantee the highest level of data protection by applying Standard Contractual Clauses (SCC) approved by the European Commission and (in the case of certified entities) through participation in the EU-US Data Privacy Framework (the European Commission's adequacy decision of July 10, 2023, establishing an adequate level of data protection in the USA).

6. Your Rights Under the GDPR

In connection with the processing of your personal data, you are entitled to the following rights:

The right to access your data and receive a copy thereof.
The right to rectify (correct) your data.
The right to erase data ("the right to be forgotten") – in situations specified in Art. 17 GDPR.
The right to restrict the processing of data.
The right to data portability.
The right to withdraw consent at any time – in relation to special categories of data (Art. 9 GDPR) processed on the basis of consent. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. However, withdrawing consent prior to the dispatch of the report prevents the execution of the service due to the lack of input data.
The right to lodge a complaint with a supervisory authority: The President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, if you consider that the processing of your data violates the law.

To exercise your rights, please send an appropriate request directly to the email address: wglad@agabauer.com.

7. Cookie Files (Cookie Policy)

The agabauer.com website utilizes cookies (small text files saved on your terminal device).

We deploy Essential cookies (ensuring the proper functioning of the Shopify store and integration with the shopping cart). This processing is mandatory on the basis of Art. 6(1)(f) GDPR.
Subject to your explicit, voluntary consent expressed on the cookie banner (Art. 6(1)(a) GDPR), the website may utilize Analytical and Marketing cookies to optimize and analyze traffic on the site. The cookie banner allows you to freely manage, accept, or reject these files at any time.

8. Complaint to the Supervisory Authority

If you believe that your data is being processed unlawfully, you have the right to lodge a complaint with a supervisory authority. In Poland, the supervisory authority is: The President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, www.uodo.gov.pl.

9. Voluntariness of Providing Data

Providing data is voluntary but, in certain cases, necessary:

the lack of an email address will prevent contact, sign-up for the waitlist, or delivery of the Report;
the lack of a date of birth will prevent the preparation of the "Your Insight" Report;
the lack of invoicing details may prevent the issuance of an invoice;
the lack of data required for the execution of the Service may prevent the conclusion or performance of the contract.

10. Profiling and Automated Decision-Making

Your data will not be used to make decisions based solely on automated processing that would produce legal effects concerning you or similarly significantly affect you.

If analytical or advertising tools are utilized on the Website, they may involve basic marketing profiling, e.g., analyzing activity on the Website or tailoring advertisements. Such activities take place exclusively in accordance with applicable regulations and, where required, on the basis of your consent.

11. Use of AI Tools

The "Your Insight" Report is not generated automatically and is not the result of solely automated decision-making. During editorial work, proofreading, organizing text structure, or developing auxiliary materials, I may use tools based on artificial intelligence, such as large language models.

Prior to entering any content into external AI tools, I apply anonymization or far-reaching data minimization. I do not transfer data that identifies the Client, such as first and last name, email address, phone number, invoicing details, or exact date of birth, to such tools.

If the method of using AI changes significantly in the future, the Privacy Policy will be updated, and where required, I will request the appropriate consent.

The Controller declares that no data from the "Context" text field is transferred to external artificial intelligence models.

12. Data Security

I apply appropriate organizational and technical measures to protect personal data against unauthorized access, accidental loss, alteration, destruction, or unauthorized disclosure.

Access to data is restricted exclusively to individuals or entities that require it to achieve specific purposes, e.g., handling a submission, executing the Service, payments, accounting, technical tools, communication, or the protection of claims.

13. Links to Other Websites

The Website may contain links to external services, e.g., payment operators, appointment scheduling tools, social media, external platforms, or embedded materials.

I am not responsible for the privacy practices applied by these entities. Before using their services, it is highly recommended to review their terms and conditions and privacy policies.

14. Changes to the Privacy Policy

The privacy policy may be updated, in particular in the event of changes to legal regulations, tools used on the Website, the manner in which the Website operates, the scope of services, or the scope of processed data.

The current version of the Privacy Policy is always available on the Website at: agabauer.com/pages/privacy-policy.