Privacy Policy

This Privacy Policy explains how DYVENIA sp. z o.o. (“Dyvenia”, “we”, “us”) processes personal data in connection with the website dyvenia.com, contact and meeting-booking forms, newsletters, Meta Lead Ads, Google Ads, Microsoft Clarity, and related marketing activities.

Who is the controller?

The controller of the data is DYVENIA SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, ul. Józefa Sarego 26/14, 31-047 Kraków, Poland.

KRS 0000914084 | NIP/VAT PL6762600902 | REGON 389555481

In case of any doubts related to the privacy policy, you can contact us at any time by sending a message to hello@dyvenia.com.

Short version – the most important information

Forms and inquiries. When you contact us, book a meeting, or request materials, we use the information you provide to handle your request and communicate with you.
Marketing. We send direct marketing by email or telephone only where we have the consent required for the relevant channel. Marketing consent is optional and can be withdrawn at any time.
Meta Lead Ads. If you submit a lead form on Facebook or Instagram, Meta sends the form data to Dyvenia. The same lead may be imported independently into our HubSpot CRM and into a separate lead-management panel operated for us by our marketing service provider.
Website analytics. We use Plausible Analytics for aggregate website statistics without cookies or persistent identifiers, as well as Microsoft Clarity to understand user interactions through aggregated behavior metrics and session replays.
Meta Pixel & Google Ads. Meta Pixel and Google Ads remarketing/conversion tags are used for advertising measurement, optimization, and remarketing only after you accept the marketing category in our consent banner.
HubSpot. We use HubSpot for CRM, newsletter, and meeting-related functions. Depending on the function and configuration, HubSpot may use cookies or similar technologies and may process data outside the EEA.
Your rights. You may have rights to access, rectify, erase, or restrict your data, to data portability, to object to certain processing, and to withdraw consent. You may also complain to a competent data protection authority.

1. How and why we process your data

1.1 Website visitors

Website operation and security. When you visit our websites, technical information may be processed by our hosting and security infrastructure, such as your IP address, request time, requested page, browser and device information, and server logs. We process this information where necessary to operate, secure, and troubleshoot the websites. The legal basis is our legitimate interest under Article 6(1)(f) GDPR.

Aggregate analytics – Plausible. We use Plausible Analytics to understand aggregate website usage. Plausible does not set cookies or create persistent visitor identifiers. It processes limited technical data to generate aggregate statistics and does not store raw IP addresses. We use these statistics based on our legitimate interest in understanding and improving our websites (Article 6(1)(f) GDPR).

Session analytics and user interaction – Microsoft Clarity. We use Microsoft Clarity to analyze how users interact with our website through behavioral metrics, heatmaps, and session replay to improve and optimize our website design and user experience. Microsoft Clarity processes behavioral metrics, session details, and technical usage data using cookies and other tracking technologies. Data captured by Microsoft Clarity may be processed in accordance with Microsoft’s privacy statement. The legal basis for using Microsoft Clarity is your consent under Article 6(1)(a) GDPR, obtained via our consent banner.

Optional technologies. Technologies used for advertising measurement, remarketing, or optional embedded functionality are activated only where the required consent has been obtained. The legal basis for processing based on such consent is Article 6(1)(a) GDPR. You can change your cookie/technology preferences at any time using the cookie preferences control available on our websites.

1.2 Contact, inquiries, and meeting bookings

If you contact us by email, through a website form, through social media, or book a meeting, we process the information you provide (for example, your name, business contact details, company, the content of your message, and meeting information) to respond, organize the meeting, and discuss potential cooperation. Depending on the context, the legal basis is Article 6(1)(b) GDPR (steps taken at your request before entering into a contract) or Article 6(1)(f) GDPR (our legitimate interest in handling business inquiries and correspondence).

1.3 Meta Lead Ads

We may use native lead forms provided by Meta on Facebook and Instagram. A form may ask for your name, surname, company, work email address, telephone number, and answers to business-related questions. Meta may verify a telephone number through its own SMS verification process. Dyvenia does not need the verification code itself.

If you submit a form to receive material such as an e-book or slide deck, we use the data to provide the requested material and handle the related inquiry. The legal basis is our legitimate interest in responding to a request you initiated (Article 6(1)(f) GDPR). Where your request directly concerns potential services, Article 6(1)(b) GDPR may also apply.

If you separately agree to direct marketing, we may also use your contact details to send marketing communications through the channel(s) covered by your consent. The legal basis for this processing is Article 6(1)(a) GDPR. Where Polish law applies, use of electronic communications or terminal equipment for direct marketing is also subject to Article 398 of the Polish Electronic Communications Law (Prawo komunikacji elektronicznej).

Data flow. Meta transfers submitted lead data to Dyvenia. Our HubSpot CRM and the separate lead-management panel at dyvenia.nexizen.pl import leads independently from Meta. These systems are not linked and do not exchange lead data.

If you opt in, we may send you information about Dyvenia’s services, offers, events, webinars, publications, and other marketing content by the channel(s) you selected. You can withdraw your consent at any time, without affecting the lawfulness of processing carried out before withdrawal. Consent is not a condition for receiving material that was offered without a marketing-consent requirement.

1.5 Business relationships and correspondence

If you are our client, supplier, contractor, or a representative or contact person of such an organization, we may process your business contact details and correspondence to manage the relationship, perform contracts, keep appropriate business records, comply with legal obligations, and establish, exercise, or defend legal claims. Depending on the context, the legal bases are Article 6(1)(b), ©, and/or (f) GDPR.

2. What personal data do we process

Identification data, such as name and surname.
Business and contact data, such as company, job-related information, work email address, and telephone number.
Information you submit in forms or correspondence, including answers to business-related questions and the content of inquiries.
Meeting and communication data, such as booking details and correspondence history.
Marketing-consent data, such as the selected channel, date/time, source, and evidence of consent or withdrawal.
Website and device data, such as page URL, referrer, event time, IP address, browser, and device information where processed by the relevant technology.
Advertising identifiers generated or read by Meta technologies (including the _fbp and _fbc identifiers) and Google Ads technologies (including gclid or other Google advertising cookies).
User behavior metrics, heatmaps, and session interaction data collected through Microsoft Clarity.

3. Website technologies, cookies, and similar technologies

3.1 Necessary technologies

We may use technologies necessary to provide the websites, protect them against misuse, remember your privacy choices, and provide functionality you explicitly request. Where storage of or access to information on your device is strictly necessary to provide the service you requested, no optional-consent mechanism is required for that specific technology.

3.2 Plausible Analytics

Plausible is used for aggregate website statistics without cookies, local storage, or persistent visitor identifiers. Raw IP addresses are not stored by Plausible. Plausible visitor data is processed and stored in the European Union.

3.3 Microsoft Clarity

Microsoft Clarity provides behavioral analytics, session replays, and heatmaps to help us understand how users interact with our website. Microsoft Clarity uses cookies and tracking technologies to capture interaction data. Processing is conducted only after you consent via our banner (Article 6(1)(a) GDPR).

3.4 HubSpot

We use HubSpot for CRM, newsletters, and, on certain pages, meeting booking and related functions. If an embedded HubSpot function uses optional cookies or similar tracking technologies, it is loaded only after the relevant consent is given. Depending on the particular HubSpot feature and configuration, HubSpot may process technical information such as IP address, browser information, page interactions, and unique identifiers.

3.5 Google Tag Manager, Google Ads, and Meta Pixel

We use Google Tag Manager as a technical tag-management tool to organize and deploy various scripts and tags on our website (including Google Ads tags, Microsoft Clarity, and Meta Pixel).

Google Ads. We use Google Ads for conversion tracking, advertising measurement, and remarketing. Google Ads tags set cookies or read parameter identifiers (such as gclid) to track whether visits to our website lead to conversions (e.g., booked meetings or form submissions) and to display targeted advertising to users on Google Search and partner networks. Google Ads tags fire only after you provide marketing consent via our consent banner.

Meta Pixel. The Meta Pixel is configured as a marketing technology and is not allowed to fire before you consent to the marketing category. If you consent, the Meta Pixel may record: PageView (opening a page), Lead (the fact that a form was submitted), and Schedule (the fact that a call was booked). The form contents and the date, time, and details of the booked meeting are not sent to Meta through these events. Advanced Matching is disabled, so Dyvenia does not send your name, email address, or telephone number to Meta through the Pixel.

For these events, Meta and Google may receive the page URL and referrer, event time, IP address, browser and device information, and online identifiers. If you are logged in to Facebook, Instagram, or Google accounts in the same browser, the respective platform may be able to associate the event with your account through their own technologies.

4. Who receives your data

Depending on the relevant activity, personal data may be disclosed or made available to:

Google LLC / Google Ireland Limited. For Google Ads conversion tracking, advertising measurement, and tag management.
Microsoft Corporation. For Microsoft Clarity session analytics and behavioral measurement.
Meta Platforms Ireland Limited. For Meta Lead Ads, Facebook/Instagram services, and, after marketing consent, Meta Pixel event data.
HubSpot. For CRM, newsletter, form, and meeting-related functions. HubSpot acts as our processor for customer personal data, as specified in its Data Processing Agreement, although certain HubSpot features may involve separate controller processing.
DAMIAN.NK. Our external marketing service provider, which configures marketing tags on our behalf and operates the dyvenia.nexizen.pl lead-management panel as a processor.
Hosting and infrastructure providers. Including infrastructure used to host the lead-management panel and the websites, and other IT/security providers necessary to operate our systems.
Plausible. For aggregate website analytics.
Professional advisers and public authorities. Where necessary for legal, accounting, compliance, or claims purposes, or where disclosure is required by law.

5. Transfers outside the European Economic Area

Some service providers, in particular Google, Microsoft, Meta, and HubSpot, may process personal data outside the European Economic Area, including in the United States. Where such transfers take place, we rely on an applicable transfer mechanism, such as an adequacy decision (including the EU-U.S. Data Privacy Framework for certified recipients) and/or the European Commission’s Standard Contractual Clauses, as appropriate. You may contact us if you would like more information about the safeguards used for a particular transfer.

6. How long do we keep your data

Data / context	Retention rule
Meta Lead Ads / sales lead – no substantive follow-up	Up to 12 months from collection, unless a shorter period follows from a withdrawal, objection, or other legal requirement.
Active sales lead	Up to 24 months from the last substantive interaction, unless the person becomes a client or an earlier deletion/withdrawal rule applies.
Marketing contact data	Until consent is withdrawn or the applicable lead-retention period expires, whichever occurs first.
Evidence of consent / opt-out or suppression record	For as long as reasonably necessary to demonstrate compliance and to ensure that a person who opted out is not contacted again, subject to applicable limitation periods.
Client / supplier / business correspondence	For the duration of the relationship and afterward for the period required by applicable law or reasonably necessary to establish, exercise, or defend claims.
Meta _fbp / _fbc & Google Ads identifiers	Planned lifetime: up to 90 days (or as configured by Google/Meta cookies). Meta and Google determine retention for data they subsequently process as independent controllers.
Security and server logs	For a limited period determined by the relevant security and hosting settings, and only for as long as necessary for the relevant security or troubleshooting purpose.

7. Your rights

We strive to make you happy by working with us. Remember, however, that you have (also if you come from the United Kingdom of Great Britain and Northern Ireland) many privileges that will allow you to influence the way we process your personal information and, in some cases, cause you to stop such processing. These rights are:

The right of access by the data subject (Article 15 GDPR): You have the right to obtain confirmation as to whether personal data concerning you is being processed and obtain access to that data.
Right to rectification (Article 16 GDPR): You have the right to obtain the rectification of inaccurate personal data concerning you without undue delay.
Right to erasure / ‘right to be forgotten’ (Article 17 GDPR): You have the right to obtain the erasure of personal data concerning you under certain circumstances.
Right to restriction of processing (Article 18 GDPR): You have the right to obtain restriction of processing where specific conditions apply.
Right to object to processing (Article 21 GDPR): You have the right to object at any time to processing based on legitimate interests or for direct marketing purposes.
Right to data portability (Article 20 GDPR): You have the right to receive your personal data in a structured, commonly used, and machine-readable format.

To use any of the rights described, please contact us by email at hello@dyvenia.com.

8. Is providing data mandatory?

Providing personal data is generally voluntary. However, certain information may be necessary to respond to an inquiry, book a meeting, deliver requested material, or enter into a business relationship. Marketing consent is always optional. Refusing or withdrawing marketing consent does not prevent you from receiving material or a service that is offered independently of that consent.

9. Where we obtain data

directly from you, for example, when you use our websites, contact us, book a meeting or submit a form;
from Meta Platforms when you submit a Meta Lead Ad form;
from an organization you represent or work with, where your business contact details are provided to us for legitimate business correspondence.

10. Automated decision-making and profiling

Dyvenia does not make decisions about you based solely on automated processing that produces legal effects or similarly significant effects. If you consent to Meta or Google marketing technologies, Meta and Google may use event data and other information available to them for advertising measurement, optimization, audience selection, and personalization. Their respective processing is governed by their applicable privacy policies.

11. Security

We apply organizational and technical measures appropriate to the nature of the processing and the risks involved. We limit access to personal data to persons and service providers who need it for their role and use contractual safeguards with processors where required by the GDPR.

12. Changes to this Privacy Policy

We may update this Privacy Policy when our processing activities, technologies or legal requirements change. The current version will be published on our websites with the date of the latest update.