Privacy Policy

Last updated: 2026.09.10· Version 1.0

1. Who we are

codefit sp. z o.o., ul. Porcelanowa 19, 40-246 Katowice, Poland, entered in the Register of Entrepreneurs of the National Court Register kept by the District Court in Katowice-East, 8th Commercial NCR Division, under KRS number 0000564162, NIP 9542756325, REGON 361860622, is the controller of your personal data (“we”, “us”, “Codefit”).

Contact:

• e-mail: dpo@codefit.dev
• postal address: ul. Porcelanowa 19, 40-246 Katowice, Poland
• phone: +48 32 705 68 90

We have appointed a Data Protection Officer. You can contact the DPO in any matter concerning your personal data or the exercise of your rights:

• e-mail: dpo@codefit.dev
• post: ul. Porcelanowa 19, 40-246 Katowice, Poland, marked “DPO”

2. What this policy covers

This policy explains how we handle personal data when you:

• visit codefit.dev;
• send us an inquiry through the contact form;
• apply for a role through the job application form;
• subscribe to our newsletter;
• write to us by e-mail or call us;
• interact with our profiles on LinkedIn, Instagram and YouTube.

It also explains what cookies we use and what rights you have.

3. Legal framework

We process personal data in line with:

• Regulation (EU) 2016/679 (GDPR);
• the Polish Act of 10 May 2018 on the Protection of Personal Data;
• the Polish Act of 18 July 2002 on the Provision of Services by Electronic Means;
• the Polish Act of 12 July 2024 – Electronic Communications Law, which governs cookies and unsolicited commercial communication;
• the Polish Labour Code, in particular Art. 22¹, in relation to recruitment for employment.

4. How we use your data

4.1 Visiting the website (server logs)

Our hosting provider’s server automatically records your IP address, the date and time of the request, the requested URL, the HTTP status, the referrer, and browser and operating system data.

• Purpose: delivering the site, keeping it secure, detecting abuse and errors, producing aggregate traffic statistics.
• Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in operating and securing our website.
• Retention: 12 months, then deletion or anonymisation.

4.2 Cookies and similar technologies

Cookies are small text files stored on your device. We also use similar technologies such as local storage and tracking tags.

When you first visit codefit.dev, our consent banner lets you accept or reject each category of non-essential cookies. Strictly necessary cookies are set without consent, because the site cannot work without them.

You can change or withdraw your consent at any time in your browser settings. Withdrawal does not affect the lawfulness of processing carried out before it. Blocking strictly necessary cookies may stop parts of the site from working.

Retention: for the lifetime of each cookie listed above, or until you withdraw consent.

4.3 Contact form — inquiries

The inquiry form asks for your first name and e-mail address. Anything else you write in the message field is up to you.

• Purposes: answering your inquiry and, where it concerns our services, taking steps before entering into a contract; keeping a record of the correspondence.
• Legal bases: Art. 6(1)(b) GDPR — steps taken at your request before entering into a contract, if your inquiry relates to our services; Art. 6(1)(f) GDPR — our legitimate interest in replying to messages, maintaining business relationships and defending against claims.
• Providing the data: voluntary, but without a first name and e-mail address we cannot reply.
• Where it goes: the message reaches our Microsoft 365 mailbox, and business inquiries are recorded in our CRM (Pipedrive) so we can follow up.
• Retention: for the time needed to handle the inquiry, and afterwards up to 3 years for the purpose of establishing or defending claims. If the inquiry leads to a contract, section 4.6 applies.

Please do not send special categories of data, for example health data, through this form.

4.4 Job application form — recruitment

The application form asks for your first name, surname, e-mail address and a CV file. Your CV may contain further information you choose to include.

We recruit for employment contracts, contracts of mandate (umowa zlecenia) and B2B cooperation. The legal basis depends on the form of engagement:

• Employment contract: we may require the data listed in Art. 22¹ § 1 of the Polish Labour Code — first name and surname, date of birth, contact details, education, professional qualifications and employment history, where these are necessary for the role. Legal basis: Art. 6(1)(c) GDPR in connection with Art. 22¹ of the Labour Code.
• Contract of mandate or B2B cooperation: we process your data to take steps at your request before entering into a contract. Legal basis: Art. 6(1)(b) GDPR.
• Any further data you include voluntarily — for example a photograph, interests, links to a portfolio or GitHub profile: Art. 6(1)(a) GDPR, your consent, given by sending us a CV containing that data. You can withdraw this consent at any time; we will then assess your application on the remaining data.
• Special categories of data (for example health data or trade union membership): only if you include them yourself, on the basis of Art. 9(2)(a) GDPR, your explicit consent. We ask you not to include such data unless the role specifically requires it.
• Assessing your suitability and defending against claims, including claims of unequal treatment in recruitment: Art. 6(1)(f) GDPR — our legitimate interest.
• Future recruitment: Art. 6(1)(a) GDPR — your separate, voluntary consent. If you give it, we keep your application for 12 months and contact you when a matching role opens. You can withdraw this consent at any time and we will delete the application.

• Providing the data: voluntary, but without the data listed above we cannot consider your application.
• Where it goes: applications are recorded in Atlassian Jira, which we use as our recruitment system, and are accessible only to the people involved in the given recruitment process. Correspondence with candidates goes through our Microsoft 365 mailbox.
• Retention for the specific recruitment process: until the process closes, plus 6 months for the purpose of defending against claims.
• Retention for future recruitment, if you consented: 12 months from submission, or until you withdraw consent.

After these periods we delete the application, including the CV file and any attachments.

4.5 Newsletter

If you subscribe to our newsletter, we process your e-mail address and first name, if the form asks for it.

• Purposes: sending you our newsletter and marketing content about our own services by electronic means, and measuring how the newsletter performs — delivery, opens, clicks.
• Legal bases: Art. 6(1)(a) GDPR — your consent, which is also required for commercial communication under the Act on the Provision of Services by Electronic Means and the Electronic Communications Law; Art. 6(1)(f) GDPR — our legitimate interest in direct marketing of our own services and in measuring the effectiveness of our mailings.
• Providing the data: voluntary; without an e-mail address we cannot send the newsletter.
• Confirmation: we use double opt-in — after signing up you receive a message asking you to confirm the subscription.
• Retention: until you unsubscribe or withdraw consent, and afterwards up to 3 years as evidence that consent was given.

Every message contains an unsubscribe link. Withdrawing consent does not affect the lawfulness of processing carried out before it.

4.6 Clients, contractors and business contacts

If we work together, we process contact details, correspondence, contract, billing and identification data, including data of your employees and representatives given to us as contact persons.

• Legal bases: Art. 6(1)(b) GDPR — performance of a contract; Art. 6(1)(c) GDPR — accounting and tax obligations under Polish law; Art. 6(1)(f) GDPR — business communication, contact with representatives of our counterparties, and establishing or defending claims.
• Retention: for the duration of the contract, then for the statutory limitation period for claims, and 5 years from the end of the tax year in which the tax obligation arose for accounting records.

4.7 Our social media profiles: LinkedIn, Instagram, YouTube

We run profiles on LinkedIn, Instagram and YouTube. If you visit them, follow us, comment, react, share our content or send us a message, we process the data visible on your public profile together with the content of your interactions, and we receive aggregated statistics about our audience from the platform.

• Purposes: presenting Codefit and our work, publishing content, answering questions, building our employer brand, and analysing the reach and performance of our posts.
• Legal basis: Art. 6(1)(f) GDPR — our legitimate interest in promoting our activity and communicating with our audience.
• Retention: until you withdraw your interaction (unfollow, delete a comment) or successfully object; direct messages for 12 months from the end of the conversation.

Joint controllership for page statistics. For the audience statistics these platforms generate about our profiles, we are a joint controller with the platform operator under Art. 26 GDPR. The platform decides how the underlying data is collected and processed and bears the primary responsibility for informing you about it; we only select which statistics to view.

You can exercise your rights against both us and the platform. For data held inside the platform — your account, the platform’s own cookies and profiling — the platform is in the best position to respond, and our access to it is limited or none. We do not control how these platforms process data when you are logged into them. Please review their privacy settings and policies.

4.8 Embedded YouTube videos

Some of our pages embed videos hosted on YouTube. A video loads only after you accept the relevant cookie category; until then you see a placeholder. When the video loads, your IP address and browser data are sent to Google Ireland Limited, which may set its own cookies.

• Legal basis: Art. 6(1)(a) GDPR — your consent, given through the cookie banner.
• We use YouTube’s privacy-enhanced mode (youtube-nocookie.com), which limits the cookies set before you start playback.
• More information: Google privacy policy.

5. Who we share data with

We do not sell your personal data. We disclose it to processors acting on our instructions under data processing agreements concluded pursuant to Art. 28 GDPR:

Other recipients:

• LinkedIn Ireland Unlimited Company, in connection with the LinkedIn Insight Tag and our company page, as a separate or joint controller;
• Meta Platforms Ireland Limited and Google Ireland Limited, in connection with our profiles and embedded video, as described in sections 4.7 and 4.8;
• professional advisers — accountants, legal counsel, auditors — bound by confidentiality;
• public authorities, where we are legally required to disclose data.

6. Transfers outside the EEA

Our hosting is located in Poland and our mailboxes are hosted in the European Union. Some of our other providers belong to groups established in the United States and may process data outside the European Economic Area.

Where this happens, we rely on:

• the European Commission’s adequacy decision for the EU-U.S. Data Privacy Framework, where the recipient is certified under it — this applies, among others, to Google, LinkedIn, Microsoft, Atlassian and Pipedrive entities in the United States;
• Standard Contractual Clauses approved by the European Commission, together with additional technical and organisational safeguards, where the Framework does not apply.

You can request a copy of the safeguards in place by writing to dpo@codefit.dev.

7. Your rights

Under the GDPR you have the right to:

• access your data and obtain a copy of it (Art. 15);
• rectify inaccurate or incomplete data (Art. 16);
• erase your data — the right to be forgotten (Art. 17);
• restrict processing (Art. 18);
• data portability — receive your data in a structured, commonly used, machine-readable format, or have it transmitted to another controller, where processing is based on consent or a contract and carried out by automated means (Art. 20);
• object to processing based on our legitimate interest, on grounds relating to your particular situation; where we process data for direct marketing, you can object at any time and we will stop (Art. 21);
• withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal (Art. 7(3));
• lodge a complaint with a supervisory authority.

To exercise any of these rights, write to dpo@codefit.dev or to our postal address. We respond within one month of receiving the request; for complex requests we may extend this by up to two further months and will tell you why.

Supervisory authority in Poland:

President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych)
ul. Stawki 2, 00-193 Warsaw, Poland
uodo.gov.pl

You may also lodge a complaint with the supervisory authority in your EU country of residence or place of work.

8. Automated decision-making and profiling

We do not make decisions about you based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR). In particular, job applications are reviewed and assessed by people.

Google Analytics and LinkedIn may profile users for statistical and advertising purposes on the basis of the cookie consent you give; you can withdraw that consent at any time.

9. Security

We apply technical and organisational measures appropriate to the risk, as required by Art. 32 GDPR. These include encryption in transit (TLS), access control on a need-to-know basis, multi-factor authentication for our business systems, data processing agreements with all our providers, backups, and confidentiality obligations and training for our team.

10. Children

Our website and services are addressed to businesses and professionals. We do not knowingly collect data from children under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

11. Changes to this policy

We may update this policy, for example when the law changes or when we start using new tools. The current version is always published at codefit.dev/privacy-policy with the date of the last update. If a change materially affects you, we will inform you by e-mail or through a notice on the site.

12. Contact

Questions about this policy or about your data:
dpo@codefit.dev
codefit sp. z o.o., ul. Porcelanowa 19, 40-246 Katowice, Poland