Privacy Policy

1. Who We Are

The controller of your personal data is Siarhei Hryshchanka, trading as Exply Labs, a sole trader (jednoosobowa działalność gospodarcza) registered in Poland.

• NIP: 1182256704
• Registered address: Sokratesa 13C, 01-909 Warsaw, Poland
• Email: support@explylabs.com

2. Scope of This Policy

This policy covers this website only. Concernity is not yet available; when it launches it will have its own privacy policy describing the data it processes, published before the first release. We have not appointed a Data Protection Officer, as we are not required to — privacy enquiries go to the address above and are handled by the controller personally.

3. What We Collect, Why, and On What Legal Basis

We collect only what we need, and each purpose has its own legal basis under Regulation (EU) 2016/679 (GDPR):

• Project enquiry form — your name, email address, organisation, message, and the budget and timeline you select. Used to respond to your enquiry and, where relevant, prepare a proposal. Legal basis: Art. 6(1)(b), steps taken at your request before entering into a contract. Kept for 12 months from our last correspondence, unless a contract follows.
• Waitlist — your email address. Used to email you once, when the product is available to try. Legal basis: Art. 6(1)(a), your consent. Kept until the product launches, until you withdraw consent, or until you ask us to delete it — whichever comes first.
• Technical connection data recorded automatically by our hosting provider — IP address, browser and device type, referring page, date and time, and pages requested. Used to keep the website available and secure and to diagnose faults and abuse. Legal basis: Art. 6(1)(f), our legitimate interest in operating a secure, functioning website. Kept for 90 days.
• Billing and accounting records, where a contract is concluded. Used to meet statutory bookkeeping and tax obligations. Legal basis: Art. 6(1)(c), compliance with a legal obligation under Polish accounting and tax law. Kept as that law requires — generally 5 years from the end of the relevant tax year.

4. What We Do Not Do

Providing your data is voluntary. If you do not provide the data marked as required on a form, we cannot respond to you or add you to a waitlist. We do not sell, rent or trade your personal data, and we do not share it with third parties for their own marketing. We do not use it for advertising or profiling, and we carry out no automated decision-making producing legal or similarly significant effects within the meaning of Art. 22 GDPR.

5. Who Receives Your Data

Your data is processed on our behalf by the following service providers:

• Website hosting — Render Services, Inc. (United States).
• Content delivery and protection — Cloudflare, Inc. (United States). Every request to this site passes through Cloudflare, which therefore sees your IP address.
• Email delivery — Google (Gmail API, United States), used to deliver the messages you send us through our forms.
• We use no analytics service and embed no third-party widgets.

6. Transfers Outside the European Economic Area

The providers named above are established in the United States, so your personal data is transferred outside the European Economic Area. Those transfers are made on the basis of the European Commission's Standard Contractual Clauses, or under an adequacy decision where one applies to the provider. You may request details of the safeguards in place by writing to us.

7. Security

We take reasonable technical and organisational measures to protect your personal data against unauthorised access, loss, alteration and disclosure. The website is served over HTTPS; our own accounts with the providers named above — hosting, content delivery and email — are protected by two-factor authentication; and we keep the data we hold to the minimum described above. No transmission over the internet is entirely secure, and we cannot guarantee absolute security.

8. Your Rights

Under the GDPR you have the right to:

• Access — obtain confirmation of whether we process your data, and a copy of it.
• Rectification — have inaccurate data corrected and incomplete data completed.
• Erasure — have your data deleted, where one of the grounds in Art. 17 applies.
• Restriction — have our processing limited, where one of the grounds in Art. 18 applies.
• Data portability — receive the data you gave us in a structured, commonly used, machine-readable format, and have it sent to another controller where technically feasible.
• Object — object at any time to processing based on our legitimate interests, on grounds relating to your particular situation.

9. Withdrawing Consent

Where we rely on your consent — currently only waitlist emails — you may withdraw it at any time, with no explanation and at no cost, by emailing support@explylabs.com or using the unsubscribe link in any message we send you. Withdrawal does not affect the lawfulness of processing carried out before it.

10. Exercising Your Rights, and Complaints

Write to support@explylabs.com. We will respond within one month; for complex requests that period may be extended by a further two months, and we will tell you within the first month if that happens. If you believe we have handled your personal data unlawfully, you may lodge a complaint with the Polish supervisory authority — Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl — or with the supervisory authority in the EU country where you live or work.

11. Cookies

This website sets no cookies and stores nothing in your browser. There is therefore no cookie banner and nothing for you to accept or decline. For full details, please see our Cookie Policy.

Cookie Policy

12. Children

This website is not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

13. Changes to This Policy

We may update this policy. Any new version is published on this page with a revised date. Where a change materially affects how we process data you have already given us, we will tell you by email before it takes effect.

14. Contact Us

If you have any questions about this Privacy Policy or wish to exercise your rights, please contact us at: