Privacy Policy of B2B4U Sp. z o.o.

Courtesy translation. This English version is provided for information only. In case of any discrepancy, the Polish version (Polityka prywatności) prevails.

Date of last update: 19 October 2026

Table of contents

1. Definitions
2. Personal Data Controller
3. Data Protection Officer
4. Purposes and legal bases of personal data processing
5. Categories of data processed
6. Recipients of personal data
7. Transfer of data outside the European Economic Area
8. Data retention period
9. Rights of the data subject
10. Automated decision-making and profiling
11. Cookies
12. Changes to the Policy

I. DEFINITIONS

The terms used in this Privacy Policy have the following meanings:

1. Controller or B2B4U Sp. z o.o. — the personal data controller: B2B4U Spółka z ograniczoną odpowiedzialnością with its registered office in Gdańsk, ul. Wały Piastowskie 1/1102, 80-854 Gdańsk, entered in the Register of Entrepreneurs of the National Court Register kept by the District Court Gdańsk-Północ in Gdańsk, VII Commercial Division of the National Court Register, under KRS number: 0001088971, NIP: 5833501680, REGON: 527830133;
2. GDPR — Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (OJ L 119, 04.05.2016, p. 1);
3. Policy — this Privacy Policy of B2B4U Sp. z o.o.;
4. Website — the website operated by the Controller at https://b2b4u.pl and all related subpages and subdomains;
5. User — any natural person visiting the Website or using any service or functionality described in the Policy;
6. Partner — a natural or legal person who has entered into a Cooperation Agreement with the Company within the business incubator operated by the Company;
7. Project — a business project carried out by the Partner within the Company’s enterprise, on the terms set out in the Cooperation Agreement;
8. Bot — the Telegram bot used by the Controller for communication, registration of Partners and handling of the incubator’s processes, available at https://t.me/B2B4U_PL;
9. Personal data — any information relating to an identified or identifiable natural person, within the meaning of Article 4(1) GDPR;
10. Processing — any operation or set of operations performed on personal data, whether by automated or non-automated means, including collection, recording, organisation, structuring, storage, alteration, consultation, use, disclosure, combination, restriction, erasure or destruction.

II. PERSONAL DATA CONTROLLER

The controller of the personal data of Users and Partners is:

B2B4U Sp. z o.o. ul. Wały Piastowskie 1/1102 80-854 Gdańsk KRS: 0001088971 NIP: 5833501680 REGON: 527830133

Contacting the Controller:

• E-mail: info@b2b4u.pl
• Telephone: +48 571 660 286 (RU, BY) / +48 735 448 381 (PL, ENG)
• Telegram: @B2B4U_PL
• Correspondence address: as above

III. DATA PROTECTION OFFICER

The Controller has appointed a person responsible for the protection of personal data — the Data Protection Officer — who may be contacted in all matters concerning the processing of personal data:

• E-mail: info@b2b4u.pl (marked “for the attention of the Data Protection Officer”)
• Correspondence address: the same as the Controller’s address

IV. PURPOSES AND LEGAL BASES OF PERSONAL DATA PROCESSING

4.1. Use of the Website

The personal data of Users visiting the Website (including the IP address, device identifiers and data collected by cookies) are processed:

a) for the purpose of providing services by electronic means as regards making the content of the Website available — legal basis: Article 6(1)(f) GDPR (the Controller’s legitimate interest consisting in making the content of the Website available to Users);

b) for the purpose of ensuring the security of the Website, detecting abuse and maintaining the User’s session — legal basis: Article 6(1)(f) GDPR;

c) for the purpose of the possible establishment, exercise or defence of legal claims — legal basis: Article 6(1)(f) GDPR.

4.2. Contact form

Where the contact forms available on the Website are used, the Controller processes data (first name, surname, e-mail address, telephone number, content of the enquiry):

a) for the purpose of identifying the sender and handling their enquiry — legal basis: Article 6(1)(a) GDPR (the data subject’s consent);

b) for the purpose of direct marketing of the Controller’s services — legal basis: Article 6(1)(f) GDPR (legitimate interest);

c) for the purpose of the possible establishment, exercise or defence of legal claims — legal basis: Article 6(1)(f) GDPR.

4.3. Registration with the business incubator (Telegram bot, e-mail, form)

Where a person registers with the incubator, in particular by contacting the Telegram Bot, by e-mail or via the form on the Website, the Controller processes data (first name, surname, telephone number, e-mail address, Telegram identifier, data concerning the planned business activity):

a) for the purpose of establishing contact with a person interested in cooperation and presenting the Company’s offer — legal basis: Article 6(1)(b) GDPR (steps taken at the request of the data subject prior to entering into a contract);

b) for the purpose of answering questions, holding consultations and preparing a draft Cooperation Agreement — legal basis: Article 6(1)(b) GDPR;

c) for the purpose of keeping statistics on the effectiveness of recruitment processes — legal basis: Article 6(1)(f) GDPR (legitimate interest).

4.4. Conclusion and performance of the Cooperation Agreement

After the Cooperation Agreement has been concluded, the Controller processes the Partner’s data (first name, surname, PESEL, number and series of the identity document or passport, residential address, telephone number, e-mail address, bank details, data concerning the Project, documents concerning residence status and access to the labour market in the case of foreign nationals):

a) for the purpose of concluding and performing the Cooperation Agreement — legal basis: Article 6(1)(b) GDPR;

b) for the purpose of maintaining the Sub-account and conducting financial settlements relating to the Project — legal basis: Article 6(1)(b) GDPR;

c) for the purpose of fulfilling obligations arising from legal provisions, in particular tax law, insurance law and provisions on the legalisation of the stay and work of foreign nationals — legal basis: Article 6(1)(c) GDPR.

4.5. Issuing invoices and handling settlements

In the course of conducting settlements with the Partner and counterparties, the Controller processes the data necessary to issue VAT invoices, keep books of account and perform public-law obligations:

a) for the purpose of issuing invoices, keeping accounts and archiving accounting documentation — legal basis: Article 6(1)(c) GDPR in conjunction with the Accounting Act, the Act on Tax on Goods and Services and the Tax Ordinance Act;

b) for the purpose of paying remuneration, settling accounts with the Social Insurance Institution (ZUS) and the tax office, and performing other public-law obligations — legal basis: Article 6(1)(c) GDPR.

4.6. Communication with the Partner via the chosen channel

Communication with the Partner during the term of the Cooperation Agreement takes place through the channels chosen by the Partner, in particular:

• e-mail (the primary channel for formal messages, invoices and service of documents);
• Telegram (the Bot or direct communication with a consultant) — an optional channel for quick day-to-day communication;
• telephone — for urgent matters.

Legal basis: Article 6(1)(b) GDPR (performance of the Agreement) and Article 6(1)(f) GDPR (the Controller’s legitimate interest in the efficient servicing of the Partner).

Where the Telegram messaging app is used, section VII of the Policy, concerning the transfer of data outside the EEA, applies. The Partner has the right to choose an alternative communication channel at any time.

4.7. Marketing activities — B2B4U Newsletter and information about events

Where the relevant consent has been given, the Controller processes data (first name, e-mail address, telephone number):

a) for the purpose of sending the newsletter and marketing information about the Company’s services, events and offers — legal basis: Article 6(1)(a) GDPR (the data subject’s consent);

b) for analytical and statistical purposes — legal basis: Article 6(1)(f) GDPR.

Consent may be withdrawn at any time by sending a message to info@b2b4u.pl. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal.

4.8. Social media

The Controller maintains profiles on social media:

• Facebook: https://www.facebook.com/b2b4upl
• Instagram: https://www.instagram.com/b2b4u.pl
• LinkedIn: https://www.linkedin.com/company/b2b4upl
• Telegram: https://t.me/B2B4U_PL

Where there is an interaction with a profile (like, comment, message), the Controller processes data (account name, content of the interaction) — legal basis: Article 6(1)(f) GDPR (legitimate interest consisting in promoting services and communicating with the audience).

The rules on the processing of data by social media operators are set out in the terms of use and privacy policies of those operators.

V. CATEGORIES OF DATA PROCESSED

The Controller processes the following categories of personal data:

1. Identification data: first name, surname, date of birth, citizenship, PESEL, number and series of the identity document or passport;
2. Contact data: residential address, correspondence address, e-mail address, telephone number, Telegram identifier, identifiers in other messaging apps;
3. Data concerning legal status (in the case of foreign nationals): documents concerning the legalisation of the stay, data concerning access to the labour market, visa data;
4. Financial data: bank account number, settlement history, data for issuing invoices, data concerning the Sub-account;
5. Data concerning business activity: data concerning the Project, commercial arrangements, data of the Partner’s counterparties, accounting documents;
6. Technical data: IP address, device identifiers, data collected by cookies, logs of communication with the Bot.

VI. RECIPIENTS OF PERSONAL DATA

The Controller may disclose personal data to the following categories of recipients:

6.1. Employees and authorised persons

The data are processed exclusively by employees and persons authorised by the Controller on the basis of a written authorisation, who are bound to maintain confidentiality.

6.2. Processors (processing entities) under data processing agreements

6.3. Public administration authorities

Data may be disclosed to authorities entitled to receive them under applicable law, in particular: the Tax Office, the Social Insurance Institution (ZUS), the Office for Foreigners, the National Labour Inspectorate, law enforcement authorities, courts.

6.4. Other controllers

In some cases, your personal data may be disclosed to entities acting as independent controllers, in particular payment service providers, banks and entities providing postal services.

VII. TRANSFER OF DATA OUTSIDE THE EUROPEAN ECONOMIC AREA

The Controller informs you that, in connection with the use of the services of certain providers, personal data may be transferred outside the European Economic Area (EEA):

7.1. Telegram (United Arab Emirates)

In connection with the use of the Telegram messaging app (operator: Telegram FZ-LLC with its registered office in Dubai, United Arab Emirates), data are transferred outside the EEA. With regard to the United Arab Emirates, the European Commission has not issued a decision on an adequate level of data protection within the meaning of Article 45 GDPR.

Legal basis for the transfer: Article 49(1)(a) GDPR — explicit consent of the data subject, given at the first contact with the Bot or the Controller’s consultant in the Telegram messaging app, after having been informed of the risks of such a transfer.

Alternative communication channel: The Partner may at any time choose an alternative channel (e-mail: info@b2b4u.pl, telephone: +48 571 660 286) and refuse to use Telegram.

7.2. Google LLC (United States)

In connection with the use of Google Workspace (Gmail, Google Drive, Google Docs, Google Sheets), data are transferred to the USA. The transfer takes place on the basis of:

• European Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 on the adequate level of protection of personal data under the EU-US Data Privacy Framework — Google LLC is a certified participant in the programme;
• standard contractual clauses (SCCs) approved by the European Commission, forming part of the data processing agreement (Google Workspace Data Processing Addendum).

7.3. PandaDoc Inc. (United States)

In connection with the use of the PandaDoc platform (operator: PandaDoc Inc., with its registered office in the USA), data are transferred to the USA. The transfer takes place on the basis of standard contractual clauses (SCCs) approved by the European Commission, forming part of the data processing agreement with PandaDoc Inc.

7.4. SendPulse Inc. (United States)

In connection with the use of the services of SendPulse Inc. (registered office: 220 E 23rd St #401, New York, NY 10010, USA), in particular as regards the handling of the Telegram Bot, communication automation and CRM, personal data are processed on servers located in the United States and Germany. With regard to the servers located in the USA, data are transferred outside the EEA. The transfer takes place on the basis of standard contractual clauses (SCCs) approved by the European Commission, forming part of the data processing agreement with SendPulse Inc., and — where applicable — on the basis of European Commission Implementing Decision (EU) 2023/1795 on the EU-US Data Privacy Framework.

7.5. Safeguards

Where data are transferred outside the EEA, the Controller applies appropriate safeguards in accordance with the GDPR. The data subject may obtain a copy of those safeguards by contacting the Controller at info@b2b4u.pl.

VIII. DATA RETENTION PERIOD

The period for which personal data are stored depends on the purpose and legal basis of the processing:

IX. RIGHTS OF THE DATA SUBJECT

In connection with the processing of personal data, you have the following rights:

1. Right of access (Article 15 GDPR) — the right to obtain information about the processing of data and to receive a copy of them;
2. Right to rectification (Article 16 GDPR) — the right to request the rectification of inaccurate data or the completion of incomplete data;
3. Right to erasure (Article 17 GDPR) — in the cases provided for by law;
4. Right to restriction of processing (Article 18 GDPR);
5. Right to data portability (Article 20 GDPR) — the right to receive data in a structured, commonly used and machine-readable format;
6. Right to object (Article 21 GDPR) — the right to object to the processing of data based on the Controller’s legitimate interest;
7. Right to withdraw consent (Article 7(3) GDPR) — where processing is based on consent, without affecting the lawfulness of processing carried out before its withdrawal;
8. Right to lodge a complaint with a supervisory authority — the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, https://uodo.gov.pl.

Exercise of rights: In order to exercise the above rights, you should contact the Controller at info@b2b4u.pl or at the Controller’s correspondence address. A reply is provided within 30 days of receipt of the request.

X. AUTOMATED DECISION-MAKING AND PROFILING

The Controller does not make decisions in a fully automated manner, including by means of profiling, that would produce legal effects concerning data subjects or similarly significantly affect them.

XI. COOKIES

The Website uses cookie files (cookies). Detailed information on the types of cookies used, their purpose, storage period and providers (including SendPulse, Google, Facebook) is available in the cookie banner displayed on the first visit to the Website and in the “Manage Consent” settings available at any time.

The User may manage cookies at any time using the settings of their web browser. Disabling the handling of cookies may affect the functionality of the Website.

XII. CHANGES TO THE POLICY

The Controller reserves the right to amend the Privacy Policy in order to adapt it to current legal provisions and to changes in the Controller’s activities. The Controller will give notice of any change to the Policy by posting the new version on the Website together with the date of the last update. In the case of Partners covered by the Cooperation Agreement, changes to the Policy, to the extent material to the performance of the Agreement, will additionally be communicated by electronic means.

B2B4U Sp. z o.o. Gdańsk, June 2026