In this document
1. Who is responsible for your data
The controller of your personal data is EMPATYZER sp. z o.o., with its registered office in Bialystok, ul. Warszawska 6/32, 15-063 Bialystok, Poland, KRS 0001048777, NIP 9662180081, hereinafter referred to as “Empatyzer”.
If you have any questions concerning personal data, you can contact us at: [email protected].
This Policy applies to personal data processed when you use the Empatyzer website and the Empatyzer System.
2. What data we process and why
Account and use of Empatyzer
We process the data required to create and maintain your Account, in particular your first and last name, email address and login-related data. We do so in order to provide access to Empatyzer and perform our agreement with you. The legal basis is Article 6(1)(b) GDPR.
Profile and assessment
We process your questionnaire responses as well as information such as age, gender, length of service, professional experience, department and information about organisational relationships, including your manager. Based on this information, we calculate results and create a profile used to personalise recommendations and other Empatyzer features. The legal basis is performance of the service under Article 6(1)(b) GDPR.
Conversations with Em and other AI features
We process the content of your conversations and those elements of your profile that are necessary to generate an answer or recommendation. We do so in order to provide the feature you choose to use, on the basis of Article 6(1)(b) GDPR.
Organisations
We process information about your membership and role in an Organisation and the data required to operate it, including your first and last name, email address and information on whether you have completed a particular questionnaire or task. The legal basis is Article 6(1)(b) GDPR.
If an Organisation Administrator invites you to Empatyzer, we receive your email address from that person and use it to send and manage the invitation. The legal basis is our legitimate interest in enabling Organisations to invite Users, under Article 6(1)(f) GDPR.
Payments
We process information concerning the purchased plan, payments and billing data required to perform the agreement and comply with accounting and tax obligations. The legal basis is Article 6(1)(b) and (c) GDPR. Payment card details are handled by Stripe and are not stored by Empatyzer.
Security and operation of the System
We process basic technical data and information concerning your use of Empatyzer, in particular login information, device and browser information, IP address and events required for diagnostics and security. The legal basis is our legitimate interest in ensuring the proper and secure operation of the System and preventing abuse, under Article 6(1)(f) GDPR.
Contact
If you contact us, we process the data you provide and the content of your message in order to respond, handle your request or prepare an offer. The legal basis is Article 6(1)(b) GDPR where the contact concerns entering into or performing an agreement, and Article 6(1)(f) GDPR in other cases.
System emails
We send information required to use Empatyzer to the email address assigned to your Account, including information about your Account, security, Organisation and operation of the service. Such messages form part of the service and are not marketing communications. The legal basis is Article 6(1)(b) GDPR.
Providing the data required to create an Account is necessary to use Empatyzer. Providing questionnaire responses is necessary only to use features based on your profile. Billing data is required when purchasing a Paid Plan. Any other data is provided voluntarily.
3. Profiling, privacy within an Organisation and AI
Empatyzer creates a User profile based on information and responses provided in the System and uses it to personalise recommendations, content and other features.
We do not use this profile to make automated decisions that produce legal effects concerning a User or similarly significantly affect the User. Empatyzer is not intended for recruitment, employee performance assessment or decisions concerning employment, promotion, remuneration, dismissal or allocation of duties.
An Organisation Administrator may view data required to manage the Organisation, in particular a User’s first and last name, email address and information on whether the User has completed a particular questionnaire or task. The Administrator does not have access to the User’s questionnaire responses or private conversations with Em.
Team or Organisation analyses are presented in aggregated form for groups of at least 5 people.
We use OpenAI and Anthropic services to provide some AI features. We disclose only the information necessary to generate the requested response and limit data that could directly identify the User. These providers do not use data submitted by Empatyzer to train their models.
4. Where we obtain data and who receives it
We obtain most personal data directly from you. We may also receive your email address from an Organisation Administrator who invites you to Empatyzer, basic Account information from Google or Microsoft if you choose to sign in through those services, and payment-related information from Stripe.
We use service providers required to operate Empatyzer. Personal data may in particular be entrusted to providers of hosting and IT infrastructure, AI models, email and communications, authentication, payment, accounting, legal and technical services.
In particular, we use OpenAI and Anthropic for AI features, Google and Microsoft for authentication where you choose those services, and Stripe for payment processing.
Some of these providers may process personal data outside the European Economic Area. Where this occurs, we rely on safeguards permitted under the GDPR, in particular European Commission adequacy decisions or Standard Contractual Clauses.
We do not sell personal data.
5. How long we retain data
We retain Account data, questionnaire responses, your profile and conversation history for as long as you maintain an Account.
Once an Account is deleted, the User’s data is no longer available in the active System or in Organisations to which the User belonged. Data may be retained for longer only where required by law, for settlements, security purposes, or to establish, exercise or defend legal claims.
Billing and accounting data is retained for the period required by applicable law.
The email address of a person invited to an Organisation who does not create an Account is retained only for the period required to manage the invitation.
Data contained in technical backups is deleted in accordance with the standard backup rotation cycle and is not used for the ongoing provision of services.
Technical and security data is retained for as long as necessary for those purposes and is then deleted or anonymised.
Data disclosed to AI providers is retained by them for the period resulting from the configuration of the services used by Empatyzer and the agreements concluded with those providers.
6. Your rights
Depending on the legal basis and manner of processing, you have the right to request access to your personal data, rectification, erasure or restriction of processing and, where applicable, data portability or to object to processing. Where processing is based on consent, you may withdraw that consent at any time.
To exercise your rights, contact us at [email protected].
You also have the right to lodge a complaint with the President of the Personal Data Protection Office in Poland (Prezes Urzedu Ochrony Danych Osobowych).
7. Cookies and similar technologies
The website and the System use cookies and similar mechanisms necessary for login, session management, security, remembering settings and proper operation of the service.
We may also use cookies or similar technologies for statistics and analysis of how the website is used. Where they are not necessary for providing the service, we activate them only after obtaining your consent.
You can change or withdraw your consent at any time in the cookie settings.
Regardless of consent, we may process technical data that is necessary to ensure the security and proper operation of the System.
8. Changes to this Policy
We may update this Policy where the manner in which personal data is processed changes or where required by applicable law. The current version is always available on the Empatyzer website.