Privacy policy

This policy explains what data we collect on the Conetso websites, why we collect it, how long we keep it, who we entrust it to and what rights you have. It applies to conetso.com, healthcare.conetso.com and software.conetso.com.

1. Data controller

The controller of your data is CONETSO GROUP Sp. z o.o., ul. Bohdana Dobrzańskiego 1, 20-262 Lublin, Poland, entered in the Register of Entrepreneurs of the National Court Register (KRS) under number 0000939638, tax identification number (NIP) 9462712691, statistical number (REGON) 520708989. In this policy we refer to it as “we”.

We have appointed a data protection officer. You can contact the data protection officer about any matter concerning personal data protection at iod@conetso.com or by post at our registered office address.

2. Where we get your data from

• From the forms you fill in: the contact form and the newsletter sign-up form.
• Automatically when you visit the websites: from server logs and, if you consent, from Google Analytics.

The websites have no user accounts, chat, embedded maps, videos or social media plugins. We load fonts from our own server. Before you give consent, the websites do not connect to the servers of Google or any other analytics provider.

3. Purposes, legal bases and retention periods

3.1. Contact form

What data: your full name, email address and message, and, if you provide them, your company name and phone number. We also record which page and which button the form was sent from.

Why: to reply to your message, prepare an offer and hold business discussions with you.

Legal basis:

• steps taken at your request before entering into a contract (Art. 6(1)(b) GDPR), when you ask about our service for yourself;
• our legitimate interest, namely replying to your message and business contact with the company you represent (Art. 6(1)(f) GDPR).

How sending works: the form goes to our server-side function in Amazon Web Services, which forwards it and does not store anything. We receive your message:

• by email in the sales team’s mailbox (sent via Twilio SendGrid);
• as an enquiry in the HubSpot CRM system (contact, company, deal and a note with the content of your message);
• as a notification in the sales team’s channel in Microsoft Teams.

How long: for the duration of our discussions. If we enter into a contract, we keep the data for the term of the contract and for as long as required by law, for example tax law. If we do not enter into a contract, we delete the data 3 years after our last contact. This is the limitation period for claims related to business activity.

Sending the form does not mean consenting to marketing. Without your consent, we do not send you commercial communications by email or call you with offers (Art. 398 of the Polish Electronic Communications Law, Prawo komunikacji elektronicznej).

3.2. Protecting forms against bots (Cloudflare Turnstile)

What data: your IP address and information about your browser, your device and how you use the form, which are processed by Cloudflare.

Why: to tell a person from an automated program and to protect the forms against spam and abuse.

Legal basis: our legitimate interest, namely protecting the forms (Art. 6(1)(f) GDPR).

How it works: Turnstile loads only when you start filling in a form. It usually requires no action from you; sometimes it asks you to tick a box. It is not used for advertising or for tracking you on other websites. Your browser connects to Cloudflare directly, but our server does not additionally pass your IP address to Cloudflare. Cloudflare processes the data in accordance with its own rules for Turnstile. Turnstile may store information in your browser that is needed for verification. This is strictly necessary to provide the service you request, namely sending the form, so it does not require consent (Art. 399 of the Polish Electronic Communications Law).

3.3. Newsletter

What data: your email address and information about which brand’s newsletter the address was signed up to, when the subscription was confirmed and when you unsubscribed.

Why: to send you the newsletter of the brand you chose (Conetso Group, Conetso Healthcare or Conetso Software) with information about new blog articles, services and events, including commercial communications. We send it no more than twice a month. Each brand has a separate list.

Legal basis: your consent (Art. 6(1)(a) GDPR) and your consent to receive commercial communications by electronic means (Art. 398 of the Polish Electronic Communications Law).

How signing up works: after you fill in the form, we send you a message with a link. We send the newsletter and sign-up messages via Twilio SendGrid or Amazon SES. Your subscription takes effect only after you click the link. Without confirmation, we do not send the newsletter. No more than one sign-up request per day can be sent for a single email address. This protects other people’s inboxes from being flooded with messages.

How to unsubscribe: at any time, by clicking “Wypisz się” (Unsubscribe; the newsletter is sent in Polish) in the footer of any newsletter or by writing to iod@conetso.com. Withdrawing your consent does not affect the lawfulness of processing carried out before its withdrawal.

How long:

• we delete an unconfirmed address after 60 days;
• we keep a confirmed address until you withdraw your consent, and after withdrawal we remove it from the list after 30 days;
• we keep backups of the newsletter database for about 36 days, so a deleted address disappears from them after that period at the latest;
• for 3 years from the withdrawal of consent (or, for an unconfirmed subscription, from the date of sign-up) we keep only information about the granting, confirmation and withdrawal of consent (dates and brand), linked to a one-way hash of the email address and not to the address itself. We do this on the basis of our legitimate interest (Art. 6(1)(f) GDPR), so that we can demonstrate that the mailing was lawful;
• we keep the newsletter server logs, including the logs of the mailing system, for 90 days. They contain a truncated IP address (without its last part), which does not identify a specific device. The mailing system logs may contain an email address if delivery of a message fails;
• we keep access logs for the newsletter server (newsletter.conetso.com, including the subscription confirmation and unsubscribe pages) for 30 days. They contain the full IP address, information about the browser, the full request address, the time and the response code. The addresses of the confirmation and unsubscribe pages contain a random subscriber identifier. The logs are encrypted and stored in Amazon Web Services in the EU (Frankfurt), and only administrators have access to them. They are used for security and error diagnosis, on the basis of our legitimate interest (Art. 6(1)(f) GDPR);
• we keep addresses to which delivery has permanently failed, whose owner has complained about a message or has asked to be blocked, on a suppression list for 3 years. The list contains the email address, the blocking status and the date, with no other data and no newsletter subscription. It prevents us from sending messages again to addresses that do not exist or do not want our emails. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR);
• Twilio SendGrid keeps a message delivery history for up to 30 days. SendGrid and Amazon SES also maintain their own lists of addresses to which delivery has failed or which have complained, so as not to send to them again.

No tracking: we do not track whether individual people open messages or click links.

3.4. Server logs

What data: IP address, information about the browser and operating system (user agent), the address of the page visited, the address of the previous page (referrer), the time of the visit and the server response code.

Why: to protect the websites against attacks and abuse, diagnose errors and analyse search engine robot traffic.

Legal basis: our legitimate interest, namely the security and operation of the websites (Art. 6(1)(f) GDPR).

How long: 30 days. We store the logs in Amazon Web Services in the European Union (Frankfurt). The web application firewall (AWS WAF), which limits the number of requests from a single IP address, keeps samples of requests with the IP address for about 3 hours.

3.5. Cookie that remembers your choice

When you choose an option in the cookie banner, we save the conetso_consent cookie with your choice (“essential only” or “analytics”). It applies to all three websites (the conetso.com domain) for 180 days. This cookie is strictly necessary for the website to remember your decision, so it does not require consent (Art. 399 of the Polish Electronic Communications Law). The legal basis for processing is our legitimate interest, namely respecting and demonstrating your choice (Art. 6(1)(f) GDPR).

3.6. Visitor statistics (Google Analytics)

When: only if you click “Accept analytics cookies” in the cookie banner. Without this consent, Google Analytics does not load. We use statistics on conetso.com and healthcare.conetso.com. The software.conetso.com website does not use them.

What data: a random browser identifier stored in cookies, the pages visited, the time of the visit, approximate location (country, region), the type of device and browser, the address of the previous page and events on the page: clicking a phone number or email address, going to another Conetso website, opening the contact form with a button (the name of the button and of the page section), sending the form and signing up for the newsletter. Google Analytics 4 does not store the full IP address.

Why: to know which content is useful and to improve the websites. We view the results only as aggregate statistics.

Legal basis: your consent (Art. 6(1)(a) GDPR and Art. 399 of the Polish Electronic Communications Law).

No advertising: we do not use the data for advertising or remarketing. Google’s advertising features are disabled.

Cookies and retention period:

Cookie	Purpose	Retention
_ga	distinguishes browsers in the statistics	2 years
_ga_<identifier>	stores the session state in the statistics	2 years

We keep data in Google Analytics for 14 months.

How to withdraw consent: click “Cookie settings” at the bottom of any page and select “Essential only”. You can also delete cookies in your browser settings.

4. Who we entrust your data to

Your data is processed on our behalf by service providers with whom we have data processing agreements:

Provider	What it does	Where the data is stored
Amazon Web Services EMEA SARL	servers for the websites, forms and newsletter, newsletter sending (Amazon SES), logs, backups	EU (Frankfurt); the websites are delivered by the CloudFront network from nodes in Europe and North America
Twilio Inc. (SendGrid)	sending emails from the form and the newsletter	USA
HubSpot Ireland Ltd.	CRM system for handling enquiries	EU (Germany)
Microsoft Ireland Operations Ltd.	email and Microsoft Teams	EU
Cloudflare, Inc.	protecting forms against bots (Turnstile)	USA and the global Cloudflare network
Google Ireland Ltd.	visitor statistics, only with your consent	EU and USA

Public authorities may also receive data where required by law.

5. Transfers of data outside the European Economic Area

Some providers are based in the USA or use entities in the USA: Twilio (SendGrid), Cloudflare, Google and, in some cases, also Amazon, HubSpot and Microsoft. Transfers of data to the USA are based on the European Commission’s adequacy decision under the EU-US Data Privacy Framework. Where a provider is not certified under it, we use standard contractual clauses approved by the European Commission. You can obtain information about the safeguards by writing to iod@conetso.com.

6. Your rights

You have the right to:

• access your data and obtain a copy of it;
• rectify data that is inaccurate;
• request erasure of your data;
• request restriction of processing;
• data portability for data that we process on the basis of consent or a contract;
• object to processing based on our legitimate interest, on grounds relating to your particular situation, and object to direct marketing at any time;
• withdraw your consent at any time, without affecting the lawfulness of processing before its withdrawal.

To exercise your rights, write to iod@conetso.com. We will reply within one month.

You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stanisława Moniuszki 1A, 00-014 Warszawa, Poland.

7. Do you have to provide your data

Providing your data is voluntary. In the contact form, we cannot reply without your full name, email address and message. The company name and phone number are optional. To sign up for the newsletter, you need to provide an email address and your consent.

8. Automated decision-making and profiling

We do not make decisions about you by automated means and we do not profile you within the meaning of Art. 22 GDPR.

9. Security

The connection to the websites is encrypted (HTTPS). Our servers and backups are in the European Union (Frankfurt), and the data on them is encrypted. Only authorised persons have access. In the logs we record only what is needed for security and error diagnosis, without the content of messages sent through the forms.

10. Links to other services

The websites contain links to services for which other controllers are responsible, for example LinkedIn, WhatsApp (Meta), the Microsoft Bookings meeting booking system, the service request portal and the TeamViewer remote support tool. Once you go to them, their privacy policies apply.

11. Changes to this policy

When we change the way we process data, we will update this policy and the date below.

Last updated: 8 November 2026.

This is a translation of the Polish version. In case of any discrepancy, the Polish version prevails.