1. Controller
The controller is Levan Ostrovski CODEVENOM, Polish tax ID (NIP) 5242971508. Correspondence address: ul. Czerniakowska 145/1, 00-453 Warsaw, Poland. For privacy matters, email office@codevenom.co.
Version 1.2
Privacy Policy
Last updated: 25 September 2026
This policy explains personal data processing connected with the CODEVENOM website, its forms, direct contact and recruitment. Separate notices may apply to contracted client services and people identified through prospecting.
2. Data we process
Depending on how you contact us, we process your name, company, email address, telephone number, enquiry or application, CV and attachments. The newsletter form collects an email address, and the resource form also collects a name. A resource request may also record an IP address, User-Agent and a domain derived from the email address. Use of the site may generate technical data, including an IP address and browser information. Please do not include special categories of data in a general enquiry unless needed for it.
3. Where the data come from
We receive data from you through the contact, newsletter, resource and recruitment forms or direct correspondence. Technical data arise when you use the site. We may also receive a contact person's details from a company, client or partner; where applicable, we provide that person with separate information under Article 14 GDPR.
4. Purposes
We use data to answer enquiries and assess cooperation, deliver requested resources, manage the newsletter and marketing covered by valid consent, conduct recruitment, operate and secure the site, meet legal duties, and establish or defend claims to a justified extent. Getting a resource does not require consent to later marketing. Sending an enquiry or reading this policy is not such consent. Analytics that depend on consent, if activated, have a separate purpose and cookie choice.
5. Legal bases and required data
Where an individual may contract with us directly, we handle their enquiry to take steps at their request before a contract (Article 6(1)(b) GDPR). We rely on legitimate interests (Article 6(1)(f)) for business correspondence with a company representative, delivery of a resource at a user's request, site security and justified claim defence. Accounting and tax duties rely on Article 6(1)(c). The newsletter, later marketing and optional analytics require appropriate separate consent (Article 6(1)(a)) and, for electronic commercial messages or access to a device, applicable electronic communications rules. Contact details needed to respond or send a link must be supplied for us to handle that request. Other fields marked optional may be omitted; providing data is generally not a statutory duty.
6. Recipients
People authorised to handle enquiries and recruitment and providers needed for the site and correspondence may access data. OVHcloud provides hosting, and Google Workspace provides company email. An enquiry notification may go to Slack, and a reply or resource link may be sent by email. Each provider's access depends on the service used; recipients do not all have the same legal role.
7. Access from outside the EEA
Use of providers such as Google and Slack may allow access to data from outside the European Economic Area, even if the main storage location is in the EEA. The rules and safeguards for a transfer depend on the service and the terms governing the specific account. To ask about the mechanism for a particular transfer and how to obtain a copy of safeguards, contact office@codevenom.co.
8. Retention
Retention depends on the purpose and data category. We keep enquiries and correspondence while handling the matter and afterwards only to the extent needed for a legal duty or justified claim defence. Newsletter and marketing data are used until consent is withdrawn or an objection is effective; a minimal record of the choice and opt-out may remain where needed to demonstrate compliance. We delete a material-delivery request record without marketing consent after 90 days. We assess technical logs and candidate data separately according to security and recruitment purposes. We respond to erasure requests under Article 17 GDPR; the mere possibility of a claim does not justify retaining all data indefinitely.
9. Your rights
Where the GDPR provides, you may request access, rectification, erasure, restriction and portability, and object to processing based on legitimate interests. An objection to direct marketing ends that use. You may withdraw consent at any time without affecting earlier lawful processing. Email office@codevenom.co. You may complain to the President of the Polish Personal Data Protection Office or the competent authority where you habitually live or work.
10. Recruitment
The controller is identified in section 1. For recruitment, email recruitment@codevenom.co. We use CVs, attachments and contact details to assess applications and conduct the current process. Data required in employment recruitment rely on applicable labour law and Article 6(1)(c) GDPR; steps requested by a candidate before a contract rely on Article 6(1)(b). Other data require a separate assessment, especially for B2B roles and special categories of data. Submitting a CV does not itself opt a candidate into future recruitment or the newsletter. Data are used during the current process and afterwards only to the extent justified for claims or by separate valid consent for future recruitment. If consent is withdrawn, we also assess any remaining retention basis.
11. Cookies and analytics
The site may use technologies necessary for its operation and optional technologies, including analytics. Consent for optional storage or access on a device must come first; a lack of choice is not consent. The site may load Google Tag Manager to manage tags; optional Google Analytics measurement requires separate consent. If the cookie settings control is unavailable, email office@codevenom.co; browser settings can also remove and block cookies. Withdrawal does not erase data sent earlier.
12. Security
We select technical and organisational measures according to the risk and type of data, including limiting access to people performing the relevant tasks. This information does not limit data subjects' rights or liability under the GDPR.
13. Changes
A new policy version takes effect when published on the site. A material change in the purpose or scope of processing requires a fresh legal-basis assessment and, where new consent is needed, obtaining it before the new processing starts.
14. Contact
Send questions about data, copies of transfer safeguards or your rights to office@codevenom.co or the correspondence address in section 1.