Privacy Policy

1. Definitions

Data Controller or Controller or CodiLime or the Company – CodiLime Sp. z o. o. with its registered office in Warsaw, address: ul. Grzybowska 5a, 00-132 Warsaw, entered into the Register of Entrepreneurs of the National Court Register, maintained by the District Court for the Capital City of Warsaw in Warsaw, XII Commercial Division of the National Court Register, under KRS number 0001012032, tax identification number (NIP) 5273036643, share capital: PLN 50 000,00. Contact e-mail: gdpr@codilime.com

Personal Data or Data – all information about a natural person identified or identifiable by one or more specific factors determining their physical, physiological, genetic, mental, economic, cultural, or social identity, including device IP, location data, online identifier, and information collected via cookies and other similar technologies.

Policy – this Privacy Policy.

GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.

Site – the website located at https://codilime.com and any other CodiLime websites that post this Policy or refer to this Policy. This Policy does not apply to websites that post different statements in particular our careers page on the Site lists current openings; applications are made on jobs.codilime.com, operated with Teamtailor under its own privacy policy: https://jobs.codilime.com/privacy-policy.

User - any natural person visiting the Site or using one or more services or functionalities described in the Policy.

2. Data processing in connection with the use of the Site

2.1. In connection with the User's use of the Site, CodiLime collects Personal Data to the extent necessary to provide the individual services offered, carry out marketing activities, as well as information about the User's activity on the Site.

2.2. Purposes and legal basis of processing of Personal Data

Personal Data of all Users using the Site are processed by the Controller:

2.2.1. For the purpose of providing electronic services by making content collected on the Site available to Users and handling Users’ requests – legal basis; Taking steps at the User’s request prior to entering into a contract (Article 6(1)(b) GDPR) and the Controller’s Legitimate Interest (Article 6(1)(f) GDPR) in responding to requests;

2.2.2. For security, technical administration, and statistics based on server-side logs and similar strictly necessary information (i.e., not relying on Optional Cookies) – legal basis: the Controller’s Legitimate Interest (Article 6(1)(f) GDPR) consisting in ensuring the security and proper functioning of the Site and improving its functionalities; this includes cookieless, aggregate measurement of Site usage and page performance (Vercel Web Analytics and Speed Insights), which stores nothing on your device and uses no identifier that follows you between visits, and protection of our forms against automated abuse (Vercel BotID); Analytics conducted with the use of Optional Cookies or similar technologies is based on your Consent and is described in Section 5.

2.2.3. For the purpose of establishing, pursuing, or defending against legal claims – legal basis: Controller's Legitimate Interest (Article 6(1)(f) GDPR);

2.2.4 For marketing communication (sending email notifications about interesting offers or content, which in some cases contain commercial information - newsletter) and optional cookies –legal basis: User’s Consent (Article 6(1)(a) GDPR).

2.2.5. For completing the record of a contact request with business information about the User and their company from our CRM provider’s own data – legal basis: Controller’s Legitimate Interest (Article 6(1)(f) GDPR) in assessing and answering requests without asking you for more in the form (see Section 3.3);

2.2.6. For telling LinkedIn that a contact request came from someone who clicked one of our LinkedIn ads, and later whether it became a qualified lead, so that we know which campaigns bring conversations – legal basis: Controller’s Legitimate Interest (Article 6(1)(f) GDPR) in measuring its advertising (see Section 6.2).

2.3. System Logs: User activity, including Personal Data (IP address, events), is recorded in system logs of each Site. This information is processed primarily for technical and administrative purposes (security, system management) based on the Controller's Legitimate Interest (Article 6(1)(f) GDPR).

2.4. Social Media The Controller processes the Personal Data of Users visiting our social media profiles (LinkedIn, Facebook, YouTube, Instagram, X). This Data is processed solely to maintain the profiles and to promote our activities, events and services. The legal basis is Controller's Legitimate Interest (Article 6(1)(f) GDPR) in promoting its own brand.

Please note that social media platform providers process your data as independent controllers under their own terms and privacy policies. In certain cases (e.g., aggregated statistics/insights provided by the platform), we and the platform provider may be jointly responsible for the processing. Where applicable, the essence of any joint controllership arrangement is made available by the platform provider.

2.5. Marketing Communications

Subscription

We send marketing communications (newsletters, offers) only if you actively subscribe and give your Consent (Art. 6(1)(a) GDPR). This is usually done by checking a box located under our contact forms or by entering your email in the newsletter sign-up field. The box is never pre-ticked, and subscribing is never a condition of anything else. We keep a record of the consent wording you saw and when you gave it, to be able to prove the consent (Art. 7(1) GDPR); after you unsubscribe we keep the fact of it, so that you are not added to the list again against your decision. The newsletter is sent through HubSpot. HubSpot records whether you open our emails and which links you click, so we can see which content interests our readers.

Double Opt-In Mechanism After signing up you receive an email with a confirmation link; your subscription starts once you click it. This helps us comply with the accountability principle.

Unsubscribing (Opt-Out) You have the right to withdraw your consent at any time by:

• Clicking the "Unsubscribe" link in our emails or
• Contacting us at gdpr@codilime.com [more details in Section 9 below].

2.6. Recruitment (CAREERS)

Job applications are submitted and processed on jobs.codilime.com, as described in its privacy policy: https://jobs.codilime.com/privacy-policy.

3. Personal Data we collect

3.1. When you contact us we collect Personal Data provided directly by you, such as your name, email address and your message, together with the context of the request – the page it was made from, the related material you asked about, and the campaign parameters your visit carried (UTM) – and any other information you provide. Providing personal data is voluntary; however, if you do not provide the data required in our forms (in particular your email address), we may not be able to respond to your request or provide the relevant service.

3.2. When you visit our Site, our hosting provider processes the technical request data needed to deliver the Site and keep it secure: IP address, browser type, requested URL and time of the request. Images and files on the Site are delivered by our storage provider (Supabase), which receives the same technical data. The cookie banner is delivered by HubSpot, which receives the address of the page and your approximate region in order to show the banner that applies to you; this records no visit. Information about the pages you view, how long you spend on them, the website that brought you and your actions on the Site is collected only by the optional tools described in Section 5, according to your cookie choices. For more information go to Section 5 [Cookies].

3.3. Information from other sources. When your contact request, download or newsletter signup reaches our CRM, HubSpot completes the record from its own business data, keyed on your email address and its domain: about your company – public business information such as its name, industry, size, revenue, location, website, social media pages and the technologies its website uses; about you, where it has them – your name, job title, role, seniority, city and country, public LinkedIn profile, and whether your email address is a business or a personal one. We use this to understand who is writing to us without asking you for more in the form. You can object to it at any time (see Section 9).

4. Data Recipients and sharing

4.1. Categories of Recipients

We engage third-party companies to support our operations. We share your Personal Data with them only when necessary to provide our services or comply with legal obligations. Depending on their role, these entities may act as Processors (processing Data strictly according to our instructions) or as Independent Controllers (defining their own purposes). These include:

• IT and hosting Service Providers: Entities providing cloud storage, server infrastructure, email delivery and technical maintenance required to keep our Site running.
• Marketing & Analytics Partners: Providers of tools used to manage contact requests and newsletters (CRM, e.g., HubSpot), analyze the use of the Site (e.g., Google Analytics, Microsoft Clarity) and measure our advertising (e.g., LinkedIn).
• Professional Advisors: Legal counsels, tax advisors, accountants, and auditors who are bound by professional secrecy or contractual confidentiality obligations.
• Related Companies: Affiliates within the CodiLime corporate group. We may share data for internal administrative purposes, reporting, and business management based on our legitimate interest (Recital 48 GDPR). Depending on the case, group entities may act as independent controllers or processors. You can request information on the relevant group recipients by contacting us at gdpr@codilime.com
• Public Authorities: Law enforcement agencies, courts, or government bodies. We disclose Data only when legally required to do so (e.g., to comply with a court order or tax laws) or to protect our rights and safety.
• Business Transfers: In the event of a merger, acquisition, reorganization, or sale of assets, your data may be transferred to the acquiring entity based on our legitimate interest in ensuring business continuity.

4.2. Data Transfer Outside the EEA

Some of our partners ( Vercel, Supabase, HubSpot, Google, Microsoft, LinkedIn) are headquartered in the USA. We transfer data outside the European Economic Area (EEA) only when necessary and secured by:

• The EU-US Data Privacy Framework (DPF): For entities certified under this program (recognized by the EC as providing adequate protection).
• Standard Contractual Clauses (SCCs): Issued by the European Commission, for other entities.

Our database and file storage (Supabase) and our hosting’s compute are located in the EU (Ireland).

You may request information on the applicable safeguards, including SCCs (or information on where they are available), by contacting us at gdpr@codilime.com.

5. Cookies and Similar Technologies

We use cookies and similar tracking technologies to track the activity on our Site and store certain information. A cookie is a small piece of data (text file) that a website – when visited by a user – asks your browser to store on your device in order to remember information about you, such as your language preference or login information. For a full list of cookies used on our Site, please refer to our Cookie Policy.

5.1. Categories of Cookies & Legal Basis We categorize cookies into the following groups. For each category, we rely on a specific legal basis under the GDPR:

A. Strictly Necessary Cookies (Essential)

Purpose: These cookies are necessary for the Site to function and cannot be switched off in our systems. They are usually only set in response to actions made by you which amount to a request for services, such as setting your privacy preferences, logging in, or filling in forms.

Cookies used for this purpose include:

• Consent cookies: remember which categories you accepted or declined in the cookie banner;
• Authentication cookies: used only by the editorial sign-in for our staff;
• Security cookies: protect our cookie banner provider’s servers against bots;

Legal Basis: Strictly Necessary Cookies are stored/accessed on your device because they are necessary for the operation of the Site and the provision of services you request, and therefore do not require your consent under the rules applicable to cookies and similar technologies. To the extent these cookies involve processing of Personal Data, the legal basis under the GDPR is our Legitimate Interest (Art. 6(1)(f) GDPR) and/or necessity for the performance of a contract/provision of a service (Art. 6(1)(b) GDPR), depending on the specific cookie and purpose.

Opt-out: You can set your browser to block or alert you about these cookies, but some parts of the site will not then work. These cookies do not store any personally identifiable information.

B. Optional Cookies (Analytics, Advertisement, Functionality) In the EU, the EEA, the United Kingdom and Switzerland we use these cookies only if you give us your Voluntary Consent (Art. 6(1)(a) GDPR) in our cookie banner, where each category is off until you turn it on and “Accept all” and “Decline all” are side by side; nothing in a category runs until you accept it. Elsewhere they run from your first visit, and the banner says so and lets you turn each category off. Your location is judged from your IP address. Your choice is kept for six months, after which the banner asks again; it also asks again when we add a tool to a category. A browser sending a Global Privacy Control signal is treated as having declined. To allow them, switch the signal off in your browser.

• Analytics Cookies
• • Purpose: These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. Some of them use a random identifier: if you later send us a contact request, download one of our materials with your email address or sign up for the newsletter, the visits recorded by HubSpot become part of your contact record (see Section 5.2).
  • Consequence of refusal: If you do not allow these cookies, we will not know when you have visited our site and will not be able to monitor its performance.
• Functionality Cookies
• • Purpose: These cookies enable the website to provide enhanced functionality and personalization. They may be set by us or by third-party providers whose services we have added to our pages. No tool on the Site uses this category at present.
  • Consequence of refusal: If you do not allow these cookies, then some or all of these services may not function properly.
• Advertisement Cookies
• • Purpose: These cookies may be set through our site by our advertising partners (e.g., LinkedIn). They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They are based on uniquely identifying your browser and internet device.
  • Consequence of refusal: If you do not allow these cookies, you will experience less targeted advertising.

5.2. Specific Cookies and Third Parties We use both first-party cookies (set by us) and third-party cookies (set by a domain different than the domain of the website you are visiting).

From time-to-time, we engage trusted third parties to track usage statistics and manage our advertising. These partners act as independent Controllers or our Processors. Below are the categories of tools we use:

A. Analytics & Heatmaps Tools that help us understand how you use the Site, which pages are popular, and troubleshoot user experience issues.

• Google Analytics: Provided by Google Ireland Ltd./Google LLC. Helps us analyze Site usage and create statistics. It counts visits under a random identifier kept in a cookie: the pages you see, what you search for on the Site, the link or campaign that brought you, your approximate location (down to the city, worked out from your IP address, which Google Analytics does not store), your device and browser, and what you do with our own elements (a material downloaded, a form opened or sent, a link clicked, a video started). It is not connected to our CRM, receives no form contents, and Google’s advertising features are switched off for it.
• Other Key Providers: HubSpot (records the pages you visit, when, the link or campaign that brought you and what you click on them, under a random identifier; if you send us a contact request, download one of our materials with your email address or sign up for the newsletter, these visits become part of your contact record in our CRM), Microsoft Clarity (anonymous session replays and heatmaps – scrolling, clicks, mouse movement; what you type into form fields is masked and never recorded; not connected to our CRM).

B. Advertising & Remarketing Tools that allow us to display personalized advertisements to you on other websites (e.g., social media) based on your visits to our Site.

• LinkedIn Marketing Solutions: Provided by LinkedIn. The Insight Tag tells LinkedIn that a visit came from one of our campaigns, so we can measure the campaigns and show them to people who have visited the Site. LinkedIn and we are joint controllers of what the tag collects, under LinkedIn’s terms for it.

C. Multimedia & Functional Services that allow us to embed content directly on our Site.

Key Providers: YouTube (Google Ireland Ltd.). Videos load only after you press play; until then the Site shows a static preview served from our own servers, and no request is sent to Google. Pressing play loads YouTube’s player from its privacy-enhanced domain (youtube-nocookie.com), and from that moment Google processes data as described in its own privacy policy.

5.3. Data transfers & Management

Important Note on International Transfers: Some of our partners (HubSpot, Google, Microsoft, LinkedIn) are headquartered in the United States. We ensure that any transfer of data to the USA is secured by the EU-US Data Privacy Framework (for certified entities) or Standard Contractual Clauses (SCCs), ensuring a level of protection comparable to GDPR (see Section 4.2: Data Transfer Outside the EEA).

Managing Your Choices: Instead of manually adjusting browser settings, you can easily manage your preferences or withdraw consent at any time by clicking the “Cookie settings” link at the foot of every page; withdrawing stops the tools from that moment.

6. Automated Decision-Making and Profiling

6.1. No Automated Legal Decisions We do not use automated decision-making that produces legal effects concerning you or similarly significantly affects you (as defined in Art. 22 GDPR). For example, we do not use algorithms to automatically filter job applications or determine prices based on your profile.

6.2. Profiling for Marketing Purposes If you consent to Optional Cookies (in particular Advertisement Cookies), we may use tools (e.g., analytics and advertising pixels) to automatically analyze your activity on our Site (e.g., pages visited, time spent, events) in order to create audience segments and display relevant advertisements to you on other websites (remarketing) and/or tailor marketing content. With your analytics consent, the pages you visited are kept with your contact record if you send us a request, download one of our materials with your email address or sign up for the newsletter; without it, nothing connects your visits to you.

Legal basis:

(a) where profiling relies on Optional Cookies or similar technologies – your Consent (Art. 6(1)(a) GDPR), which you can withdraw at any time via Cookie Settings, without affecting the lawfulness of processing before withdrawal;

(b) where we process your data for direct marketing without relying on Optional Cookies – telling LinkedIn that a contact request came from someone who clicked one of our LinkedIn ads, and later whether it became a qualified lead (only the click identifier or the identifier of a LinkedIn lead form, your email address, name and company, and only for people who interacted with our ads), and completing your contact record with business information from our CRM provider (Section 3.3) – our Legitimate Interest (Art. 6(1)(f) GDPR). In such cases you have the right to object at any time, and we will stop processing your data for direct marketing purposes (Art. 21(2) GDPR).

Our CRM gives each contact an engagement score, built from the pages they visited on the Site (only with analytics consent); when the score passes a threshold, we treat the contact as ready for us to get in touch. The score has no other effect. Legal basis: our Legitimate Interest (Art. 6(1)(f) GDPR) in choosing whom to contact and when; you can object at any time (Section 9).

7. The security of your Personal Data

We implement appropriate technical and organizational measures to protect your Personal Data against accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access. These measures include, but are not limited to:

• Storage of all information on secure servers and guard them by strict procedures and ensuring that all personnel are trained and bound by confidentiality obligations;
• Encryption of data in transit (SSL/TLS protocols);
• Access to the Site’s editorial system limited to individually granted accounts, signed in through company single sign-on, with changes to accounts logged; a single emergency account, held in the company password manager, is logged on every use;
• Regular security audits; CodiLime is ISO 27001 certified;
• Storage of the Site’s database, files and backups in the EU (Ireland), with backups encrypted at rest; our CRM provider, HubSpot, stores data in the United States (see Section 4.2).
• Selection of vendors who guarantee a high level of security.

Limitation: However, please note that no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your Personal Data, we cannot guarantee its absolute security.

8. Data retention period

We retain your Personal Data only for as long as necessary to fulfill the purposes for which it was collected, or to comply with applicable legal requirements. The specific retention periods are determined as follows:

• Contact Requests on the Site: spam – 1 month; rejected – 3 months; not yet assessed – 3 months from arrival; qualified – 12 months from the last change. A deleted record remains in encrypted backups for up to 60 further days. In our CRM, a contact created from a request marked as spam is deleted after 1 month, one marked as rejected after 3 months, and one never assessed 3 months after its last request unless it has subscribed to the newsletter; a qualified one becomes part of the business relationship below. A contact created when you download one of our materials is deleted from our CRM 12 months after your last download, unless you have since subscribed to the newsletter or sent us a request, which then follow their own rules. A contact deleted from our CRM can be restored for up to 90 further days.
• Contact & Business Relations: Processed for the duration of the relationship. After that, data is stored until the expiry of applicable limitation periods for claims(generally 3 or 6 years, depending on the type of claim), and longer if required to establish, pursue or defend legal claims.
• • 5 years (from the end of the tax year): to comply with tax and accounting regulations (legal obligation).
• Marketing & Newsletter: Processed until you withdraw your consent. Where we process data for direct marketing based on legitimate interest (if applicable), you may object at any time. A sign-up that was never confirmed receives no issue. After an unsubscribe we keep the fact of it, and the record of the consent is kept to prove that it existed.
• Analytics & Security Logs: Server logs are kept for 1 day. Visits recorded by HubSpot stay with a contact record for as long as that record is kept; Microsoft Clarity keeps session replays for 30 days, or up to 13 months for a replay we mark to keep for analysis; Google Analytics keeps the detail of visits for 14 months, after which only aggregated reports remain. Cookies are kept as listed in the Cookie Policy.
• Statistics: monthly counts of enquiries and of qualified enquiries are kept indefinitely; they contain nothing that identifies a person.

After the retention period expires, your Data is irreversibly deleted or anonymized.

9. Your rights relating to Data Processing

Under the GDPR, you have the following rights regarding your Personal Data:

Access: You can ask us to confirm whether we process your data and provide a copy of it.

Rectification: You can ask us to correct inaccurate or incomplete data.

Erasure ("Right to be forgotten"): You can ask us to delete your data in certain circumstances (e.g., when consent is withdrawn).

Restriction: You can ask us to suspend the processing of your data.

Portability: You can ask to receive your data in a structured, machine-readable format.

Objection: You can object to processing based on legitimate interest (including marketing) at any time.

Withdraw Consent: Where processing is based on consent (e.g., Newsletter, Cookies), you can withdraw it at any time without affecting the lawfulness of processing based on consent before its withdrawal.

How to contact us: To exercise these rights, contact us at: gdpr@codilime.com. We will respond within one month. This period may be extended by two further months in complex cases.

Unsubscribing & Technical Updates: Please allow up to 72 hours for our systems to fully update your preferences (e.g., after clicking unsubscribe), meaning you might still receive a scheduled email within this short window.

Complaint: You have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, place of work, or place of the alleged infringement. In Poland, the supervisory authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych).

10. Contact information

We welcome your comments or questions about this Privacy Policy. You may contact us at our address: gdpr@codilime.com.

11. Changes to this Privacy Policy

We reserve the right to change this Privacy Policy. If we make any changes, we will notify you by updating the “Last updated” date below or through a visible notice on our Site.

This Privacy Policy was last updated on 9 November 2026

Cookie Policy

Cookie List

A cookie is a small piece of data (text file) that a website – when visited by a user – asks your browser to store on your device in order to remember information about you, such as your language preference or login information. Those cookies are set by us and called first-party cookies. We also use third-party cookies – which are cookies from a domain different than the domain of the website you are visiting – for our advertising and marketing efforts. In the EU, the EEA, the United Kingdom and Switzerland the Site asks before it sets anything that is not needed to run it; elsewhere the analytics and advertisement tools run from the first visit, and the banner lets you turn each category off (see Section 5.1). You can change your choice at any time under “Cookie settings” at the foot of every page. We use the following cookies:

Strictly Necessary Cookies

Always on, because the banner cannot remember your choice without them. The editorial sign-in for our staff sets its own strictly technical cookies, which concern our staff only.

Analytics Cookies

These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our site. They help us to know which pages are the most and least popular and see how visitors move around the site. Only with your consent where consent is required. If you do not allow these cookies we will not know when you have visited our site, and will not be able to monitor its performance.

Functionality Cookies

These cookies enable the website to provide enhanced functionality and personalisation. They may be set by us or by third party providers whose services we have added to our pages. If you do not allow these cookies then some or all of these services may not function properly. Nothing on the Site uses this category today.

Advertisement Cookies

These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites. They hold an identifier unique to your browser and device, which is Personal Data, rather than your name or email address. If you do not allow these cookies, you will experience less targeted advertising. Only with your consent where consent is required: LinkedIn’s Insight Tag, which sets cookies on our domain and on LinkedIn’s, as LinkedIn lists them in its cookie table (linkedin.com/legal/l/cookie-table).