Website privacy notice

The controller for the processing described in this notice is ASAI LABS POLAND SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ ("ASAI Labs", "we", "us", or "our") (Article 4(7) GDPR).

This notice covers the public ASAI Labs website and the contact, scheduling, careers, and investor journeys linked from it. It does not replace an Organization-specific notice for personal data processed through Exponata. For customer-directed Exponata workflows, the customer normally determines the purpose and is the controller, while ASAI Labs acts as processor under Article 28 GDPR.

ASAI Labs is established in Poland and therefore has not appointed an EEA representative. A Data Protection Officer has not currently been appointed; privacy enquiries go to the contact above.

Depending on how you use the website, we may process the following personal data within the meaning of Article 4(1) GDPR:

• Technical and usage data: IP address, request time, requested page, referrer, browser, operating system, device category, approximate location, language, and security or delivery logs.
• Analytics data: page views and aggregated traffic information. Vercel Web Analytics uses a daily request-derived hash rather than a persistent cookie.
• Visitor intelligence: if you consent to Apollo tracking, cookie and device identifiers, pages viewed, visit frequency, and company, industry, location, or professional attributes inferred or matched by Apollo.
• Demo and meeting data: name, business email, phone number, company, role, time zone, availability, meeting selections, and details you include in a booking.
• Candidate data: name, email, phone number, company, LinkedIn profile URL, and the information you provide about your interest in working with ASAI Labs.
• Investor interest data: name, firm, work email, role, typical ticket size, preferred investment stages, and the reasons for your interest.
• Correspondence data: your contact details and the content and metadata of messages you send to us.
• Consent and rights records: your cookie choice, its timestamp and version, and the minimum information needed to handle a privacy request or complaint.

We do not intentionally collect special-category data through this public website (Article 9(1) GDPR). Please do not include sensitive information in free-text fields unless it is necessary and you have a lawful reason to provide it.

We process personal data only for specified purposes and on an applicable legal basis (Articles 5(1)(b) and 6 GDPR).

Where we rely on legitimate interests, we consider the purpose, necessity, and impact on your rights. We do not rely on that basis where your interests or fundamental rights override ours (Article 6(1)(f)). You may object as described in section 9.

We obtain personal data:

• directly from you when you email us, book a meeting, or submit a candidate or investor form;
• automatically from your browser, device, and network when you request a page or make a cookie choice;
• from Cloudflare, Vercel, Calendly, and Typeform when they provide hosting, analytics, scheduling, or form services on our behalf; and
• from Apollo and public or professional sources where Apollo supplies company-level or business-contact information. This is indirect collection for Article 14 GDPR purposes.

Browsing the website and accepting Apollo tracking are optional. The details marked as required by Calendly or Typeform are needed to schedule the requested meeting or evaluate the submitted interest; without them, we may be unable to complete that request. Free-text answers and optional fields are voluntary.

We disclose personal data only where needed to authorized ASAI Labs personnel and contractors, the providers below, professional advisers and auditors, public authorities when legally required, or a recipient involved in a corporate transaction subject to appropriate safeguards (Articles 5(1)(c) and 28 GDPR).

Some providers and their support teams process data in the United States or other countries outside the EEA. Depending on the recipient, transfers rely on an adequacy decision under Article 45 GDPR, including the EU-US Data Privacy Framework for participating recipients, or the European Commission's 2021 Standard Contractual Clauses under Article 46(2)(c), together with supplementary measures where required. You may request information about the applicable safeguard from [email protected].

External websites reached through ordinary links may act as independent controllers and publish their own notices. Typeform and Calendly also process limited service and device data for their own security and platform purposes under their notices.

Cookie and similar-technology choices must be specific, informed, and withdrawable (Articles 4(11) and 7 GDPR). This website uses the following technologies:

You can withdraw Apollo consent or change your choice at any time. Withdrawal does not affect processing already carried out lawfully before withdrawal (Article 7(3) GDPR).

We keep personal data no longer than necessary for the stated purpose (Article 5(1)(e) GDPR). The following periods or criteria apply:

• security and website request logs are normally retained for up to 90 days, unless a specific incident or legal obligation requires longer;
• Vercel's daily visitor hash expires after 24 hours; aggregated reporting data follows the configured account reporting window;
• Apollo visitor intelligence is kept while needed to evaluate relevant business interest and is reviewed periodically, subject to withdrawal, objection, deletion requests, and the provider contract;
• demo, enquiry, investor, and correspondence data is kept while the request or relationship is active and afterwards only for applicable legal obligations and claim periods;
• candidate data is kept for the recruitment process and any applicable employment-law or claim period; retention for future opportunities requires a separate lawful basis where required;
• consent records remain until your choice changes or local browser storage is cleared; and
• privacy-request and complaint records are retained only for the applicable legal obligation or limitation period.

Restricted backups may retain deleted data until the relevant recovery cycle expires. They are not returned to ordinary use, and approved deletion instructions are reapplied after a restore.

Apollo may infer a visiting company, industry, location, or level of business interest from technical and page-view data. ASAI Labs may use those signals to prioritize proportionate B2B outreach. You may withdraw consent to tracking and object to processing based on legitimate interests (Articles 7(3) and 21 GDPR).

We do not use this website data to make decisions based solely on automated processing that produce legal or similarly significant effects about you (Article 22 GDPR).

Subject to the conditions and exceptions in the GDPR, you may have the right to:

• access your personal data and receive a copy (Article 15);
• correct inaccurate or incomplete data (Article 16);
• request erasure (Article 17);
• restrict processing (Article 18);
• receive eligible data in a portable format (Article 20);
• object to processing based on legitimate interests, including direct marketing (Article 21);
• withdraw consent at any time without affecting earlier lawful processing (Article 7(3)); and
• not be subject to a qualifying solely automated decision (Article 22).

Email [email protected] to exercise a right. We may request proportionate information to verify identity where there are reasonable doubts (Article 12(6)); an identity-document copy is not required by default. We normally respond within one month, subject to the extension permitted for complex or numerous requests (Article 12(3)).

Apollo also operates a separate business-contact database. A request about Apollo's independent copy can be submitted through its Privacy Center.

We use technical and organizational measures appropriate to the risk, including encrypted transport, access controls, provider due diligence, data minimization, consent gating for optional tracking, payload-limited telemetry, and incident response procedures (Articles 25 and 32 GDPR). No security measure can eliminate every risk, and safeguards are reviewed as the site, providers, and risks change.

Questions about this notice or ASAI Labs' processing can be sent to:

You may lodge a complaint with the supervisory authority where you live or work, or where an alleged infringement occurred (Article 77 GDPR). ASAI Labs' lead supervisory authority is the President of the Personal Data Protection Office (Prezes UODO), Urząd Ochrony Danych Osobowych, ul. Stanisława Moniuszki 1A, 00-014 Warszawa, Poland. UODO provides information for individuals.

We may update this notice when our processing, providers, or legal obligations change. The effective version and date will remain shown at the top, and material changes will be communicated where required by Articles 12-14 GDPR.