Privacy Policy

1. Introduction

This Privacy Policy explains how Aleksandra Kubicka, conducting business under the trade name Clean Culture Aleksandra Kubicka, operating as Taanto, a sole proprietorship registered in Poland ("Controller", "we", "our", "us"), processes personal data in connection with:

our website located at taanto.ai
consulting and advisory services provided by the Controller
communication with users, customers, and prospective customers
free materials and marketing communication
bookings and consultation requests

We process personal data in accordance with Regulation (EU) 2016/679 (GDPR) and the Polish Personal Data Protection Act of 10 May 2018.

2. Data Controller

The controller of personal data described in this Privacy Policy is:

Aleksandra Kubicka, conducting business under the trade name Clean Culture Aleksandra Kubicka, operating as Taanto

NIP: 5842677326

ul. Góralska 67/2

80-292 Gdańsk, Poland

Contact email: [email protected]

3. Roles in Data Processing

When individuals interact with our website, download free materials, contact us, submit inquiries, or book consultations, the Controller acts as the data controller.

In the course of providing consulting and advisory services, the Controller may gain access to personal data held by the client organization. In such cases, the Controller acts as a data processor on behalf of the client. The scope and terms of such processing are governed by a separate data processing agreement.

4. Categories of Personal Data

Depending on how you interact with us, we may process the following categories of personal data:

name, email address, phone number, company name, job title, message content
booking details and service-related communication
social media username, publicly available profile information, messages and interactions
technical data: IP address, browser type, device information, operating system, language settings, approximate location, pages viewed, clicks, session data, cookie identifiers, timestamps

5. Purposes of Data Processing

We may process personal data for the following purposes:

providing and operating our website
responding to inquiries and maintaining correspondence
providing consulting and advisory services
providing free materials and downloadable resources
sending marketing communication
managing bookings, meetings, and consultations
providing customer support
sending service-related communication to users
maintaining and operating our social media presence
analyzing website traffic and user behavior
improving our website, services, and communication
ensuring security, reliability, and integrity of the website and related services
complying with legal obligations

6. Legal Basis for Processing

We process personal data based on the following legal grounds under Article 6 GDPR.

6.1 Performance of a Contract - Art. 6(1)(b) GDPR

We process personal data where necessary to:

provide our consulting and advisory services
manage bookings and consultations
fulfill service agreements

6.2 Legitimate Interests - Art. 6(1)(f) GDPR

We may process personal data based on our legitimate interests, including:

responding to inquiries and maintaining communication
operating and improving our website and services
providing customer support
maintaining our social media presence
ensuring service security
preventing abuse, misuse, or unauthorized access
maintaining technical logs necessary for reliability and security

6.3 Legal Obligations - Art. 6(1)(c) GDPR

We process personal data where necessary to comply with legal obligations, including accounting, tax, and regulatory requirements.

6.4 Consent - Art. 6(1)(a) GDPR

Where required, we rely on consent, including for:

certain cookies and marketing technologies
specific forms of marketing communication

Consent may be withdrawn at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

7. Whether Providing Data Is Mandatory

Providing personal data is generally voluntary. However, it may be necessary in order to receive a response to an inquiry, obtain free materials, book a consultation, or receive our services. If required data is not provided, we may be unable to complete the requested action.

8. Data Retention

We retain personal data only for as long as necessary for the purposes for which it was collected, unless a longer retention period is required by law. In particular:

inquiry and contact form data: up to 2 years from last contact
cookie data: in accordance with consent preferences and browser settings
statistical and analytical data: up to 2 years
booking and consultation data: for the duration of the relationship and any follow-up period
accounting and tax-related data: up to 6 years, or longer if required by law

9. Data Recipients

Personal data may be shared with the following categories of recipients:

public authorities and institutions, to the extent required by applicable law in connection with the Controller's legal obligations, such as pursuing legal claims, fulfilling tax obligations, and other proceedings regulated by law
website infrastructure provider (hosting, server, domain)
website development and technical support provider
cloud storage provider for data and documents
cookie consent management provider
accounting and bookkeeping service provider
invoicing software provider
where you have consented to marketing cookies, your data stored in cookies may be shared with our advertising partners (e.g. Meta, Google)
where you have consented to analytics cookies, your data stored in cookies may be processed by the provider of our website analytics software (e.g. Google Analytics)
other subcontractors who may gain access to personal data where the scope of their services requires such access

These providers process personal data only to the extent necessary to provide their services to the Controller.

10. International Data Transfers

Some service providers may process personal data outside the European Economic Area (EEA), including in the United States. The following providers are involved in such transfers:

Google LLC (USA) - website analytics (Google Analytics), cloud tools (Google Workspace). Transfer safeguard: EU-US Data Privacy Framework (DPF) certification.
Meta Platforms, Inc. (USA) - marketing and advertising tools (Meta Pixel). Transfer safeguard: EU-US Data Privacy Framework (DPF) certification.

Where the EU-US Data Privacy Framework does not apply, transfers are carried out on the basis of Standard Contractual Clauses (SCCs) approved by the European Commission, or other appropriate safeguards under Chapter V of GDPR.

11. Cookies

Our website uses cookies and similar technologies. We may use strictly necessary cookies (required for the website to function), analytics cookies, marketing cookies, and functional cookies. Third-party cookies may be provided by Google, Meta, and Cookiebot.

You can manage your cookie preferences through our cookie banner or browser settings. Analytics and marketing cookies are used only where consent has been obtained.

12. Data Subject Rights

Under GDPR, you have the right to: access your personal data, rectification, erasure, restriction of processing, data portability, withdrawal of consent at any time, and lodging a complaint with a supervisory authority.

Right to object (Art. 21 GDPR)

You have the right to object, on grounds relating to your particular situation, at any time to processing of your personal data based on our legitimate interests (Art. 6(1)(f) GDPR). If you object, we will no longer process your data for the relevant purpose unless we demonstrate compelling legitimate grounds which override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims.

Where personal data is processed for direct marketing purposes, you have the right to object at any time. If you object, your data will no longer be processed for such purposes.

Requests regarding personal data may be sent to: [email protected]

In Poland, the competent supervisory authority is the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland (www.uodo.gov.pl).

13. Automated Decision-Making

We do not perform automated decision-making or profiling that produces legal or similarly significant effects.

14. Contact

If you have any questions regarding this Privacy Policy or the processing of personal data, please contact:

Aleksandra Kubicka, Clean Culture Aleksandra Kubicka (operating as Taanto)

Email: [email protected]