Personal data, handled with care.

1. Data controller and contact

The controller is Łukasz Chmielewski — automaciki.pl, ul. Lubomierska 22 lok. 4, 54-062 Wrocław, Poland; NIP 9591474176, REGON 525804261.

For privacy requests, contact info@automaciki.pl. No Data Protection Officer has been appointed at this time.

2. What we process and why

• Account and access data: name, work email, role, login time and security information, to provide secure access and administer the service.
• Quality-operation data: accountable people, supplier contacts, documents and audit records, to operate and evidence quality workflows.
• Integration data: Google Drive connection metadata and protected OAuth tokens, only when a user connects Drive.
• AI-assisted work: prompts and material deliberately submitted for drafting, extraction or gap analysis. AI output remains subject to authorised human review.

The legal basis depends on the context: performance of a contract, compliance with a legal obligation, legitimate interests in secure operations, or consent where consent is requested.

3. Recipients, transfers and retention

Data is shared only with processors needed to operate the service, such as hosting and security providers, the application database, Google Drive where connected, and an AI provider where an authorised user invokes an AI feature. Processor agreements and transfer safeguards are reviewed before production use.

We retain data only for the service relationship, approved quality-record retention requirements, legal obligations, dispute handling and security needs. Detailed retention periods are governed by the customer agreement and the approved retention schedule for the relevant quality system.

4. Your rights

Depending on the applicable law, you may request access, correction, deletion, restriction, portability or object to processing. You may also lodge a complaint with the President of the Personal Data Protection Office (UODO). Contact us at info@automaciki.pl.

5. Security and changes

ComplyPharm applies access controls, audit logging, encrypted OAuth-token storage and transport security. We may update this notice as the service or applicable requirements change; the current version will always be published at this address.