Privacy Policy

The controller of your personal data is Krzysztof Boguszewski IT Service, NIP: 7981474817, Regon: 383204480, address: Bialobrzegi, ul. Jana Kochanowskiego 35, 26-800 (owner of www.cvszablony.pl). Contact for all personal data matters: kontakt@cvszablony.pl.

We obtain your personal data primarily from you during registration in our service (www.cvszablony.pl). If you choose to sign in with an external account (Facebook, Google or LinkedIn), we receive limited data from that provider – see the section “Facebook Login and data received from Meta”. We also receive your data when you submit complaints or contact us via Customer Service. Details of the processed scope are in the section “To what extent we process your personal data”.

We process personal data only for specific, clearly defined purposes. For each purpose we list what data we use and on what legal basis:

1. Providing the Service and the CV generator – we store the data you enter (personal details, education, experience, skills, photo) so you can create, edit, save and download your CV and cover letters. Data: identification, contact, professional and educational data. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
2. Generating documents with AI tools – when you use an AI feature, the relevant fragment of your data is sent to the AI provider only to generate the requested text (e.g. a profile summary or job description) and the result is returned to your account. Data: the content you choose to include. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
3. Creating and managing your account, including sign-in with Facebook, Google or LinkedIn – to authenticate you, keep you logged in and let you manage your documents. Data: email, name, login provider ID, profile picture. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
4. Handling payments and settlements – to process purchases of paid features and issue invoices. Data: name, email, billing data, NIP (for companies), transaction history. Legal basis: performance of the contract and legal obligations under tax and accounting law (Art. 6(1)(b) and (c) GDPR).
5. Handling inquiries, complaints and support – to answer your messages and resolve problems. Data: contact data and the content of your message. Legal basis: legitimate interest in communicating with users (Art. 6(1)(f) GDPR).
6. Ensuring security of the Service – to prevent abuse, fraud and unauthorized access and to investigate incidents. Data: IP address, system logs, device information. Legal basis: legitimate interest (Art. 6(1)(f) GDPR).
7. Statistics and analysis of the Service – to understand how the Service is used and improve it (Google Analytics, Hotjar). Data: technical and usage data collected via cookies. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
8. Marketing communication – to send you news and offers, only if you agreed. Data: email address, phone number. Legal basis: your consent (Art. 6(1)(a) GDPR).
9. Fulfilling legal obligations and defending claims – e.g. keeping accounting records and handling data subject requests. Legal basis: legal obligation (Art. 6(1)(c) GDPR) and legitimate interest (Art. 6(1)(f) GDPR).

We do not use your data for purposes other than those listed above. We do not sell your data, do not use it to train AI models and do not make decisions about you based solely on automated processing that produce legal effects.

When using the Service, the Controller may process the following categories of personal data:

1. Identification data (e.g., first and last name, date and place of birth, nationality, gender, driving license, profile photo).
2. Contact data (e.g., email address, phone number, LinkedIn profile URL, any website URL you add).
3. Professional and educational data (e.g., completed schools, courses, trainings, certificates, professional experience with employment periods and employer names, skills and proficiency such as languages or software use/creation).
4. Content entered by the User in forms (e.g., account/profile/CV information, additional information in email correspondence, communication history with us, complaints, consents provided).
5. Content generated by the AI system based on the User's data.
6. User account data (where applicable, including Facebook user ID, Google ID, LinkedIn ID, NIP number).
7. Billing and payment data (where applicable).
8. Technical data (e.g., information on use of the service subject to your cookies* consent, IP number, device information such as browser and screen resolution, system logs).
9. Statistical and analytical data (including data from publicly available sources and information about the sources of data acquisition).

The Controller does not encourage Users to provide special categories of data (e.g., data regarding health, political opinions, trade union membership). Providing such data is solely the User's responsibility.

On the Website, we use session files (deleted simultaneously with closing the web browser) and persistent files (deleted after a set period of time, not simultaneously with closing the web browser).

1. For what purposes do we use cookies?

We use cookies for the following purposes:

1. Ensuring the proper functioning of the Website.
2. Ensuring the ability to log in and use the Account (if you are a User).
3. Ensuring safe use of the Website.

If you have given your consent, your data will be used for the following purposes:

1. Analyzing traffic on the Website.
2. Checking how you use the Website (e.g. which functionalities are interesting to you).

Remember that you can withdraw your consent at any time.

2. What data do we collect?

We may collect the following information using cookies:

1. Data about your device (including browser type, IP address, operating system, device settings, IP country).
2. Information about your activity on the Website (e.g. date, length of visit).
3. Location data (after your consent).

3. Tracking tools

In order to maintain and develop the Website, we use the tool Google Analytics provided by Google LLC, which performs similar functions to cookies. From Google Analytics we may have information, among others: about the duration of the session, your location, subpages you visited on the Website, the source from which you access the Website, etc.

In order to analyze traffic on the Service, we use the HotJar tool provided by Hotjar Ltd, which allows us to track traffic on our Service, and thus see what functionalities you use. From HotJar, we may have information about, among others, about the operating system you are using, the web browser, the time of browsing individual subpages, etc.

Personal data are processed on the basis of:

1. Article 6(1)(b) GDPR – performance of a contract.
2. Article 6(1)(c) GDPR – legal obligation.
3. Article 6(1)(f) GDPR – the Controller's legitimate interest (security, analysis, service improvement).
4. Article 6(1)(a) GDPR – User consent (where required).

Accordingly:

1. Your personal data provided for registration on our website are processed to perform the electronic services agreement.
2. If you have given separate consent, your personal data will be processed to deliver marketing communication electronically or by phone.
3. Your personal data provided in connection with creating and managing your profile, and creating or editing CVs in our service, are processed to fulfil the electronic services agreement and to enable you to exercise rights granted by the service terms.
4. Data about your use of the service that we obtain via cookies are processed based on your consent, given under Article 173 of the Telecommunications Law.
5. When we ask for your opinion about a product or service, your data are processed under our legitimate interest in continuously improving our services and product offer.
6. If you contact us with questions about how the service operates or how to perform certain actions, we collect your questions and related data and respond based on our legitimate interest in providing full information and ensuring a positive experience.
7. All personal data we hold are also processed for marketing under our legitimate interest in presenting you with offers and promotions to the email address or phone number you provided, as well as other information promoting our products and service offer.
8. The Service uses AI-based tools to automatically generate document content from data provided by the User. Generation is automated. The AI does not make decisions that produce legal effects for the User. The content is auxiliary and requires User verification. Users' data are not used to train or improve AI models.

The period for which we process your personal data depends on the purpose of processing. Specifically:

1. Registration in our service – for as long as you are registered, until you unsubscribe from the service. After this period, your data will be processed for accountability purposes required by data protection laws and for the limitation period of your claims, but no longer than 6 years.
2. Consent to receive marketing communications electronically or by phone – until you withdraw this consent. After this period, your data will be processed for accountability purposes required by data protection laws and for the limitation period of your claims, but no longer than 6 years.
3. Creating an account, managing the account, creating CVs – for the duration of the agreement. After this period, your data will be processed for accountability purposes required by data protection laws and for the limitation period of your claims, but no longer than 6 years.
4. Data obtained about how you use our services (via cookies) and data processed in our marketing database – for the entire period you are our customer and then for 5 years counting from when you stopped being our customer (stopped using our services and stopped making purchases in our stores).

We share your data only when necessary to deliver ordered services.

We do not sell or commercially share your data with third parties.

1. Hosting and infrastructure providers (OVHcloud).
2. AI tool providers acting as processors.
3. For payment transactions (including via payment operators such as Przelewy24), we share necessary data with the payment gateway (third party).
4. Accounting and analytics service providers.
5. Login providers you choose to use (Meta Platforms Ireland Ltd. for Facebook Login, Google, LinkedIn) – only to the extent needed to authenticate you.
6. Competent public authorities when required by law.

Some providers (e.g. Google, Meta) may process data outside the European Economic Area. In such cases transfers are based on the European Commission's adequacy decisions (EU-US Data Privacy Framework) or Standard Contractual Clauses.

You can sign in to our service using Facebook Login provided by Meta Platforms Ireland Ltd. Using Facebook Login is voluntary – you can always create an account with your email address instead.

1. What data do we receive from Facebook?

Only after you grant permission in the Facebook login window, we receive:

1. your Facebook user ID (app-scoped identifier),
2. your first and last name,
3. your email address,
4. your profile picture (if available).

We do not receive your Facebook password, friends list, posts, messages or any other data, and we never post anything on Facebook on your behalf.

2. How do we use this data?

1. to create your account and sign you in to the service,
2. to pre-fill your name and contact details in your profile and CV (you can edit or delete them at any time),
3. to communicate with you about your account and the service.

The legal basis is performance of the contract (Article 6(1)(b) GDPR). We do not use data received from Facebook for advertising, profiling or training AI models.

3. Do we share this data?

We do not sell, rent or transfer data received from Facebook to third parties. It is stored on our servers (OVHcloud) and accessed only by processors listed in the section “Who are the recipients of your personal data?”, solely to provide the service.

4. How long do we keep it?

As long as your account is active. When you delete your account or ask us to delete your data, data received from Facebook is deleted within 30 days.

5. How to disconnect Facebook?

You can remove our app at any time in your Facebook settings: Settings & privacy → Settings → Apps and websites, select CVSzablony and click “Remove”. To delete the data we already hold, follow the instructions in the section “How to delete your data?”.

We process personal data in accordance with applicable law, in particular the Data Protection Act and the General Data Protection Regulation (GDPR).

We follow these rules when processing your personal data:

1. Adequacy – we process only the data necessary to achieve the given processing purpose, and for each process we have analyzed compliance with this rule.
2. Transparency – you should fully know what happens to your data. This document, where we aim to give you complete information about how we process your personal data, is an expression of that rule.
3. Accuracy – we strive to keep your personal data in our systems current and truthful. If you find your data have not been updated or are incorrect, please contact us at kontakt@cvszablony.pl.
4. Integrity and confidentiality – we apply necessary safeguards to protect the confidentiality and integrity of your personal data. We continuously improve them as the environment and technology evolve. Safeguards include physical and technological measures limiting access to your data and measures preventing loss of your data.
5. Accountability – we want to account for every action on personal data so that, if you ask, we can provide complete and reliable information about what actions we performed on your data.
6. Minimization of scope – we have verified the scope of collected data, their processing, and volume for adequacy to processing purposes. We perform periodic reviews of the amount and scope of processed data, at least once per year.

How your data is processed in practice:

1. Collection – data is collected only when you enter it in forms, sign in with an external account, contact us, or (with your consent) through cookies.
2. Storage – data is stored in databases on servers of OVHcloud located in the European Union. Connections to the Service are encrypted (HTTPS/TLS) and passwords are stored only in hashed form.
3. Access – only authorized persons and processors who need the data to provide the Service have access to it, under confidentiality obligations and data processing agreements.
4. AI processing – data is sent to the AI provider only at the moment you use an AI feature and only to generate the requested content. Providers act as processors and are not allowed to use your data for their own purposes or to train models.
5. Automated decisions – we do not make decisions about you based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect you.
6. Deletion – when the purpose of processing ends or you request deletion, data is removed from active systems and then from backups within their rotation cycle, as described in the section “How to delete your data?”.

As part of our daily practice, we collect the following consent from users of our service and our customers:

1. Consent to communicate with you electronically or by phone for marketing purposes – this includes informing you about product news, our offers, discounts, and promotional campaigns.

   You can express this consent when creating an account in the service by completing the registration form available at www.cvszablony.pl.

   Providing consent is voluntary, and we do not condition the ability to use the service or purchase products or services on it.

   If you have given consent, you have the right to withdraw it at any time by sending an email to kontakt@cvszablony.pl. Note that some time may pass from the moment you withdraw consent until the request is processed in the system and all databases synchronize. We will make efforts to complete these actions without undue delay, but in any case no longer than one month. Withdrawal of consent does not affect the lawfulness of processing carried out based on the consent before its withdrawal.

Data protection law grants you a set of rights you can use at any time. Unless you abuse these rights (e.g., unjustified daily requests for information), exercising them is free and should be straightforward.

Your rights include:

1. Right of access to your personal data – you can ask us to export the information we hold about you and send it in a commonly used format (e.g., CSV, JSON).

2. Right to rectification – if you learn that the data we process are incorrect, you may request correction and we are obliged to do so. In some cases, we may ask you to provide a document or other proof supporting the change.

3. Right to restriction of processing – if despite our adherence to data adequacy you believe we process too broad a scope of your data for a given purpose, you may request we narrow that processing. We will comply unless doing so would conflict with legal requirements or be necessary to perform the contract.

4. Right to erasure (“right to be forgotten”) – you may request that we delete from our databases and documentation all information containing your personal data. We cannot delete data we are legally obliged to keep (e.g., transaction documents for tax purposes, warranty obligations, accountability requirements). In all cases, we will remove your data to the fullest extent possible, and where deletion is not possible we will pseudonymize it so it is accessible only to a very limited group within our organization.

5. Right to data portability – you may ask us to export the data you have provided during all our interactions and cooperation to a separate file so you can transfer it to another controller.

You can exercise the above rights by contacting us at kontakt@cvszablony.pl. Use the same address if you encounter any situation that raises concerns about compliance or potential infringement of your rights. We will answer your questions and address the matter promptly.

When you exercise your rights, we fulfill or refuse the request without undue delay and no later than within one month of receipt. If the request is complex or there are numerous requests, we may extend this deadline by up to two additional months. We will inform you in advance about any extension.

If you believe we have breached data processing rules, you have the right to lodge a complaint directly with the supervisory authority (the President of the Personal Data Protection Office). Please provide a full description of the situation and indicate which action you consider to infringe your rights or freedoms. Submit the complaint directly to the authority.

Separately, you also have the right to object to the processing of your personal data.

You exercise this right when you do not want us to process your personal data for a specific purpose (e.g., marketing). In such a case, we will continue processing your data for other purposes, but not for the purpose you objected to.

You can submit your objection by emailing kontakt@cvszablony.pl.

You can request deletion of your account and all your personal data at any time, free of charge, including data received via Facebook Login, Google or LinkedIn. You do not need to give a reason.

1. How to submit a deletion request

Choose any of the following methods:

1. By email – send a message to kontakt@cvszablony.pl with the subject “Data deletion request”.
2. By post – send a letter to: Krzysztof Boguszewski IT Service, ul. Jana Kochanowskiego 35, 26-800 Białobrzegi, Poland.

In your request, please include:

1. the email address linked to your account,
2. if you signed in with Facebook – your name as shown on Facebook (we can then locate your account by your app-scoped Facebook ID),
3. whether you want to delete all data or only selected data (e.g. a single CV or your marketing consent).

2. Verification

To protect you from someone else deleting your account, we may ask you to confirm the request from the email address linked to your account. We will not ask for any additional documents unless we have reasonable doubts about your identity.

3. What we delete and when

1. We confirm receipt of your request within 3 business days.
2. Within 30 days we delete your account, profile, CVs, cover letters, AI-generated content, uploaded photos and data received from Facebook, Google or LinkedIn from our active systems.
3. Copies in backups are overwritten in the normal backup rotation cycle, no later than 90 days after deletion. Until then they are not used for any purpose.
4. We inform our processors (e.g. hosting and AI providers) about the deletion where they hold your data.
5. After completion, you receive an email confirming that your data has been deleted.

4. Data we must keep

We retain only data we are legally required to keep, e.g. invoices and payment records for tax and accounting purposes (5 years from the end of the tax year), or data needed to establish or defend legal claims. Such data is restricted and not used for any other purpose.

5. Removing the Facebook connection

You can also remove our app from your Facebook account: Settings & privacy → Settings → Apps and websites → CVSzablony → Remove. This stops Facebook from sharing new data with us; to delete the data we already hold, submit a request as described above.

If you are not satisfied with how we handled your request, you can lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland.