say.work Privacy Policy
1. Data controller
The controller of your personal data is „9 BITS” spółka z ograniczoną odpowiedzialnością (a limited liability company) with its registered office in Warsaw, ul. Solec 81 B, lok. A-51, 00-382 Warsaw, Poland, entered in the National Court Register (KRS) under number 0000323228, tax ID (NIP) 7010174828, REGON 141733294 (hereinafter: the “Controller”, “we”).
The Controller has appointed a data protection officer. In all matters concerning your personal data, you can write to iodo@9bits.pl or by post to the registered office address, marked “Data Protection Officer”.
This policy describes how we process personal data in connection with registering a company and using the say.work platform, in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR).
2. Who this policy applies to
This policy covers data for which we are the controller:
- people who register a company using the form on say.work, including sole traders;
- people who represent a customer and contact us about the contract, billing and support;
- platform users — with regard to their accounts, sign-in and the security of the service.
This policy does not cover data that a customer enters into its company on the platform, such as employee data, working time, absences or salaries. The customer is the controller of that data, and we process it only on the customer’s behalf, under the data processing agreement included in the Terms of Service (Article 28 GDPR). For questions about that data, contact your employer or the company you work for.
3. What data we process and where it comes from
| Data | Source |
|---|---|
| First name, last name, email and phone of the person registering the company | from you, via the registration form |
| Company name, Polish tax ID (NIP) or EU VAT number, address, country | from you; we suggest the name and address from public registers: the Polish REGON database run by Statistics Poland (GUS) for Polish companies and the EU VIES system for EU companies |
| Chosen modules, number of users, company address on the platform, demo data | from you, via the registration form |
| Account and sign-in data: email, password (stored only as a hash), one-time codes, IP address, browser, sign-in time | created during activation and use of the platform |
| Billing data: invoices, payment status | created during the contract |
| Content of your correspondence with us | from you |
A tax ID and a company address are personal data only when the company is run by a natural person, for example a sole trader.
4. Purposes and legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Reviewing the application, setting up the company on the platform and sending the link for setting a password | Art. 6(1)(b) — steps taken at your request before entering into a contract |
| Providing the service: accounts, sign-in, trial period, customer support | Art. 6(1)(b) — performance of a contract |
| Issuing invoices, accounting, keeping billing records | Art. 6(1)(c) — legal obligation (tax and accounting laws) |
| Platform security: preventing abuse, limiting the number of applications, security event log | Art. 6(1)(f) — our legitimate interest |
| Checking company data in GUS and VIES | Art. 6(1)(f) — legitimate interest (accurate data about business partners) |
| Contacting you about the contract, changes to the service and security | Art. 6(1)(b) and (f) |
| Establishing, pursuing and defending legal claims | Art. 6(1)(f) — legitimate interest |
We do not send marketing messages without your separate consent.
5. How long we keep data
| Situation | Period |
|---|---|
| Application rejected | 30 days from rejection, then permanently deleted |
| Company not activated (the password link expired after 3 days) | the company and the application are permanently deleted during the night after the link expires |
| 7-day trial ended without purchase | 7 days from the company being blocked, then permanently deleted |
| Company blocked for non-payment | 30 days from blocking, then permanently deleted |
| Cancellation of the platform | until the end of the paid month, then 30 days to download the data export, then permanently deleted |
| Invoices and billing records | 5 years from the end of the year in which the tax payment deadline passed (tax laws) |
| Data needed to defend legal claims | until the limitation period for claims expires |
Data in backups disappears with subsequent backup cycles. A company’s financial data is encrypted with its own key, and deleting the company destroys that key — its data then becomes unreadable in older backups too.
6. Who we share data with
We do not sell data. We keep access to it to the minimum necessary:
- the platform and our mail server run on our own servers, housed in a rented server room at Beyond.pl in Poznań (Poland); Beyond.pl provides the space, power and connectivity, but has no access to the data on the servers;
- the accounting firm that keeps our books receives only data from invoices and billing documents, under a data processing agreement and bound by confidentiality;
- within 9 BITS, only people who approve applications, support customers and handle billing have access to the data — bound by confidentiality.
When checking a company, we send only the Polish tax ID to Statistics Poland (GUS) or the EU VAT number to the European Commission’s VIES system. We may also disclose data to public authorities where the law requires it.
No transfers outside the European Economic Area. The platform, its data and its mail run on servers in Poland. We do not transfer your data outside the European Economic Area.
7. Your rights
You have the right to:
- access your data and receive a copy of it;
- rectify inaccurate or incomplete data;
- erasure of your data when there is no longer a basis for processing it;
- restriction of processing;
- portability of the data we received from you, in a machine-readable format;
- object to processing based on our legitimate interest;
- lodge a complaint with the President of the Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw, Poland) if you believe we process your data unlawfully.
To exercise these rights, write to iodo@9bits.pl. We reply without undue delay and in any case within one month.
8. Cookies and browser storage
The platform uses only cookies necessary for it to work:
| Cookie / data | Purpose | Duration |
|---|---|---|
| session cookie (access token) | keeping you signed in | until you sign out or the session expires |
| CSRF protection cookie | security of saving data | same as the session |
| browser storage: language and view settings | remembering your preferences | until you delete them in your browser |
We do not use analytics or advertising cookies on the platform. The www.say.work website additionally uses Google tools — see section 10.
9. Other information
Security. Each company’s data on the platform is kept separate from other companies’ data. Connections are encrypted (HTTPS), passwords are stored only as hashes, and financial data is stored encrypted with each company’s own key. Only authorised people have access to the data.
Voluntary provision. Providing data in the form is voluntary, but without it we cannot review the application or set up the company on the platform.
No profiling. We do not make decisions about you based solely on automated processing, including profiling. Every registration application is approved by a person.
Changes to this policy. We will inform platform users about material changes by email or by a notice in the application. The current version is always available at say.work/en/privacy-policy (Polish version: say.work/polityka-prywatnosci) and next to the registration form. In case of discrepancies, the Polish version prevails.
10. The www.say.work website
The www.say.work information website links to the registration form (start.say.work). The form is part of the platform, and we process the data from it as described in sections 3–5. On the information website itself, we use the following external services:
| Service | Purpose | Data |
|---|---|---|
| Google Tag Manager and Google analytics tools (Google Ireland Ltd.) | visit statistics, improving the website | IP address, cookie identifiers, information about the browser and pages visited |
| Google Fonts (Google Ireland Ltd.) | displaying fonts | IP address when a font is downloaded |
| Calendly (Calendly LLC, USA) | booking a presentation — after clicking the “Meeting” link | data you enter in the Calendly form, under Calendly’s privacy policy |
We set analytics cookies only with your consent (Art. 6(1)(a) GDPR and Article 399 of the Polish Electronic Communications Law). You can withdraw your consent at any time in the cookie settings on the website or in your browser.
Google and Calendly may process data in the USA. The basis for the transfer is the European Commission’s adequacy decision (EU-US Data Privacy Framework), in which both companies participate. On the say.work platform itself, we do not transfer data outside the European Economic Area.