Boldare Privacy Policy
Last updated: 21 October 2026 · Version 2.0
Data controller
The controller of your personal data is BOLDARE S.A., with its registered office at Zwycięstwa 52, 44-100 Gliwice, Poland, entered in the register of entrepreneurs of the National Court Register kept by the District Court in Gliwice, 10th Commercial Division of the National Court Register, under KRS number 0000914518, NIP (tax ID) 6312698829, REGON 389585559, with share capital of PLN 100,000.00 paid in full (“Boldare”, “we”, “us”).
For any matters relating to personal data protection, contact us:
- by email: ado@boldare.com,
- in writing: BOLDARE S.A., Zwycięstwa 52, 44-100 Gliwice, Poland, marked “Personal data protection”.
We have appointed a Data Protection Officer, whom you can contact on all matters relating to the processing of your personal data and the exercise of your rights: by email at ado@boldare.com or in writing at our registered office address, marked “Data Protection Officer”.
Scope of this policy and sources of data
This policy explains how we process personal data in connection with the boldare.com website, our business operations, and your communication with us. It applies to website visitors, people who contact us, representatives of clients and business partners, people who download our materials, subscribers, event and meeting participants, job candidates, and followers of our social media profiles.
We collect data primarily directly from you – when you fill in a form, write to us, download a resource, register for an event, take part in a meeting, or apply for a job. Some data is collected automatically when you use the website, as described in section 4 and in our Cookie Policy.
We may also obtain business contact details of people we would like to work with from publicly available sources (company websites, LinkedIn, public registers) and from commercial business contact databases. These include name, job title, company name, and business contact details. We may also receive the details of client representatives from their employer.
Purposes, legal bases, and retention periods
Each purpose of processing has an assigned legal basis and retention period. Where we rely on our legitimate interest (Article 6(1)(f) GDPR), we state what that interest is. When the stated periods expire, we delete or anonymise the data.
Purpose Data Legal basis Retention period Responding to an enquiry sent via a form or by email name, email, company, job title, phone number, message content Article 6(1)(f) GDPR – interest: responding to you and maintaining correspondence; Article 6(1)(b) where the enquiry concerns entering into a contract with you 3 years from the last contact Preparing offers and sales discussions as above, plus information about the planned project Article 6(1)(f) GDPR – interest: presenting an offer to the company you represent 3 years from the last contact Business outreach to people whose data we obtained from public sources or B2B databases name, job title, company, business contact details Article 6(1)(f) GDPR – interest: establishing business cooperation until you object, and no longer than 3 years from the last contact Providing downloadable materials (e-books, reports) first name, email, company, job title Article 6(1)(b) GDPR – delivering the material 3 years from download; further marketing contact only with consent Concluding and performing contracts with clients and business partners details of representatives and contact persons Article 6(1)(f) GDPR – interest: performing the contract with the entity you represent; Article 6(1)(b) where you are the contracting party for the term of the contract and then until the limitation period for claims expires, no longer than 6 years from the end of the calendar year in which the contract ended Online meetings with clients and candidates, including recordings and notes image, voice, name, meeting content Article 6(1)(f) GDPR – interest: accurately documenting arrangements; we inform you about recording before the meeting starts clients – for the duration of the cooperation and then until the limitation period for claims expires; others – 3 years from the meeting Accounting and tax obligations data contained in accounting documents Article 6(1)(c) GDPR in conjunction with the Polish Accounting Act and tax law 5 years from the end of the calendar year in which the tax payment deadline expired Newsletter and commercial information sent by email or phone email, first name, company, phone number Article 6(1)(a) GDPR and consent to receive commercial information (Article 398 of the Polish Electronic Communications Law) until consent is withdrawn; records of consent and withdrawal – 5 years from withdrawal Organising events and webinars name, email, company, job title Article 6(1)(b) GDPR – registration and participation; Article 6(1)(f) – follow-up contact after the event 3 years from the event Recruitment data from CVs and application documents Article 6(1)(c) GDPR in conjunction with Article 22¹ of the Polish Labour Code; Article 6(1)(b) for civil-law contracts; Article 6(1)(a) for data provided voluntarily beyond the required scope; after the process ends – Article 6(1)(f) GDPR, interest: defending against claims until the end of the recruitment process, then up to 3 years Future recruitment processes as above Article 6(1)(a) GDPR – separate consent until consent is withdrawn, no longer than 3 years Security of the website and IT systems IP address, server logs, device and browser information Article 6(1)(f) GDPR – interest: protecting the website against abuse and keeping it running 24 months Managing and documenting cookie consent consent ID, date, banner version, choice made Article 6(1)(c) GDPR in conjunction with Article 7(1) GDPR 5 years from giving or changing consent Additional website features: form bot protection, error reporting, fonts, and embedded content (“Functional” category) device and visit data, online identifiers Article 6(1)(a) GDPR until consent is withdrawn; provider periods in the technology declaration Analytics and session recordings (“Analytics” category) device, visit, and interaction data Article 6(1)(a) GDPR until consent is withdrawn; provider periods in the technology declaration Advertising and campaign measurement (“Marketing” category) online identifiers, visit and activity data Article 6(1)(a) GDPR until consent is withdrawn; provider periods in the technology declaration Running social media profiles profile name, reactions, comments, messages Article 6(1)(f) GDPR – interest: communicating with followers and promoting our services until you delete the content or we stop running the profile Establishing, pursuing, and defending legal claims data necessary in a given matter Article 6(1)(f) GDPR – interest: protecting Boldare’s rights until the limitation period for claims expires Cookies and similar technologies
Our website uses cookies and technologies that store or access information on your device (local storage, pixels, scripts). Essential technologies are always active. Other categories are activated only after you give consent.
Category Purpose Services Essential website operation, security, and remembering your privacy choices Usercentrics, Google Tag Manager, Cloudinary Functional additional services, including contact forms, error reporting, fonts, embedded presentations, and videos Pipedrive Web Forms, Sentry, Google Fonts, Google AJAX, gstatic.com, jQuery, cloudfront.net, Slideshare, YouTube Analytics website usage statistics, session recordings, and heatmaps Google Analytics, Hotjar, Microsoft Clarity, Boldare A/B tests Marketing advertising, remarketing, and campaign measurement Google Ads, Google AdServices, Google Syndication, DoubleClick, Facebook Pixel, LinkedIn Insight Tag Enabling optional services sends device and visit information to their providers and may involve cookies. Advertising services may link your activity across websites. Cookie names, lifetimes, and provider details are available in our Cookie Policy (https://www.boldare.com/cookies-policy/) and the technology declaration.
Storing information on, or accessing information from, your device is governed by Articles 399–400 of the Polish Electronic Communications Law. Where optional technologies process personal data on the basis of consent, Article 6(1)(a) GDPR applies. The legal bases for data processed through essential technologies are set out in section 3. Data you enter in forms is processed on the bases described in section 3, regardless of your cookie choices.
You can accept all technologies, reject optional ones, or choose your settings. Browsing, scrolling, or closing the banner does not constitute consent. You can change or withdraw consent at any time via the “Cookie Settings” link in the website footer. Once you withdraw consent, we stop processing based on it and erase the data we are responsible for without undue delay, unless another legal basis allows us to keep it. Withdrawal does not affect the lawfulness of processing carried out before it.
Recipients of data
We do not sell personal data. We share it only with recipients needed for the purposes in section 3 – processors acting on our behalf under data processing agreements, or independent controllers.
Category Providers Role Location / processing Consent management Usercentrics GmbH processor Germany (EEA) CRM, forms, and email communication Pipedrive OÜ processor Estonia (EEA) Forms and surveys Typeform S.L. processor Spain (EEA) Recruitment Breezy HR, Inc. processor USA Infrastructure, hosting, and content delivery Amazon Web Services, Cloudinary processors EEA and USA Email, documents, and internal communication Google (Google Workspace), Slack processors EEA and USA Online meetings and meeting notes providers of video conferencing and note-taking tools processors EEA and USA Error monitoring Functional Software, Inc. (Sentry) processor USA Analytics and session recordings Google (Google Analytics), Hotjar Ltd, Microsoft (Clarity) processors Malta (EEA) and USA Advertising and campaign measurement Google (Google Ads, DoubleClick), Meta Platforms Ireland Ltd, LinkedIn Ireland Unlimited Company independent controllers, or joint controllers for data collection via pixels Ireland (EEA) and USA Embedded content Google (YouTube), Scribd, Inc. (Slideshare) independent controllers USA Advisers and professional services law firms, accounting office, auditors independent controllers or processors Poland Public authorities courts, tax authorities, law enforcement independent controllers – only where required by law Poland The full list of technologies used on the website, including cookie names and lifetimes, is set out in the technology declaration in our Cookie Policy.
Social media profiles. We run company profiles on LinkedIn, Facebook, Instagram, X, Threads, YouTube, Behance, Dribbble, GitHub, Medium, Clutch, and GoodFirms. For profile statistics on Facebook, Instagram, and LinkedIn, we are joint controllers with the platform operator (Meta Platforms Ireland Ltd, LinkedIn Ireland Unlimited Company). The operators of all platforms also process data for their own purposes, in line with their own privacy policies.
Transfers outside the European Economic Area
Some of the providers listed in section 5 process data in the United States. We transfer data there only using the mechanisms set out in Chapter V GDPR:
- a European Commission adequacy decision (Article 45 GDPR) – under the EU–US Data Privacy Framework, for recipients with a current certification,
- standard contractual clauses adopted by the European Commission (Article 46(2)(c) GDPR) – for other recipients.
The mechanism applied to each provider is stated in the technology declaration. You can obtain a copy of the safeguards by writing to ado@boldare.com.
Profiling and automated decision-making
If you consent to marketing technologies, our advertising partners may create profiles based on your activity to tailor the ads you see and measure their effectiveness. This does not produce legal effects concerning you or similarly significantly affect you.
We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR). This also applies to recruitment – candidates are selected by our people.
Your rights
Depending on the legal basis for processing, you have the following rights:
Right When it applies Access to your data and a copy of it (Article 15 GDPR) always Rectification (Article 16 GDPR) always Erasure (Article 17 GDPR) where the data is no longer needed, consent has been withdrawn, a valid objection has been made, or processing is unlawful Restriction of processing (Article 18 GDPR) for example, while the accuracy of the data or an objection is being verified Data portability (Article 20 GDPR) where processing is based on consent or a contract and carried out by automated means Objection (Article 21 GDPR) where processing is based on legitimate interest; for direct marketing – always and without giving reasons Withdrawal of consent (Article 7(3) GDPR) where processing is based on consent – at any time, without affecting earlier processing To exercise your rights, write to ado@boldare.com. You can also unsubscribe from the newsletter using the link in every message. We will respond without undue delay and within one month at the latest. In justified cases, this period may be extended by a further two months – we will let you know. We may ask for information to confirm your identity.
You have the right to lodge a complaint with the President of the Personal Data Protection Office in Poland (Stawki 2, 00-193 Warsaw, uodo.gov.pl) or with the supervisory authority in the country of your habitual residence, place of work, or place of the alleged infringement.
Voluntary provision of data, security, and changes to this policy
Providing data. Providing your data is voluntary but necessary to respond to an enquiry, conclude a contract, or sign up for a newsletter or event. Mandatory fields are marked in our forms. In recruitment, the data listed in Article 22¹ of the Polish Labour Code is required to take part in the process; any other data is voluntary. Declining optional technologies does not limit access to website content, although some additional features may be unavailable.
Security. We apply technical and organisational measures appropriate to the risk, including access control and logging, encryption of data in transit, backups, regular reviews of access rights, and data processing agreements with our providers. Only authorised persons bound by confidentiality have access to the data.
Changes to this policy. We update this policy when our processes, providers, or applicable laws change. The current version is always available on this page with the date of the last update. We will give advance notice of material changes concerning processing based on consent.
Other websites. Our website contains links to third-party websites. This policy does not cover them – please read their own privacy policies.
Version history
Version Date Changes 2.0 21 October 2026 New policy: purposes and legal bases for each process, retention periods, list of providers, transfers outside the EEA, separate Cookie Policy 1.0 21 May 2018 First version of the policy
