Skip to content

/privacy-policy // GDPR compliance

Privacy Policy

Effective: 2026-11-09. Data controller: QA10 sp. z o.o., ul. Mariacka 37, 40-014 Katowice, Poland (KRS 0001232199).

This Privacy Policy sets out the rules for processing personal data of users of the qa10.io website by QA10 sp. z o.o. It describes data you give us on the website, by email and in the form in QA10 ads on TikTok, and provides the information required by Article 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the "GDPR").

1. Data Controller

The controller of your personal data is:

QA10 sp. z o.o. — registered office and address: ul. Mariacka 37, 40-014 Katowice, Poland.

Registry court (official Polish name): Sąd Rejonowy Katowice-Wschód w Katowicach, VIII Wydział Gospodarczy Krajowego Rejestru Sądowego.

KRS 0001232199 · Tax ID (NIP) 9542906279 · REGON 544435060.

Share capital: 5,000.00 PLN.

Contact: hello@qa10.io, phone +48 880 839 850.

2. Data Protection Officer

The Controller has not appointed a Data Protection Officer — the processing does not meet the criteria of Article 37(1) GDPR (no large-scale processing of special categories of data, no regular and systematic monitoring of data subjects on a large scale). For all matters concerning personal data processing, please contact the Controller directly at hello@qa10.io.

3. Scope and sources of data

We receive data directly from you when you submit the contact form, a Q-Dev brief, a Q-Journey enquiry or an email.

The form includes:

  • your name, company name, email address and description of your enquiry;
  • the selected enquiry type and form language, and optionally your country;
  • for a Q-Dev brief: the selected line and option, whether you have an existing website and data resources, your preferred quote currency and optionally the hours spent on the process;
  • any other information you voluntarily include in your correspondence.

Handling web requests also involves technical data, including your IP address. The address is used to limit repeated form submissions. The website does not require an account.

Cloudflare Turnstile processes technical signals such as your IP address, TLS fingerprint, User-Agent header, sitekey and associated origin. The form sends its verification token to our server; before handling the enquiry, the server sends this token and your IP address (remoteip) to Cloudflare Siteverify.

If you consent to visit statistics, Vercel Web Analytics collects on each page view the event time, the page address without query parameters, the address of the page you came from, your device type, operating system and browser, and the country, region and city determined from the request. It recognises a visitor for 24 hours by a hash calculated from request data. Details are in the Cookie Policy.

Form in a QA10 ad on TikTok

We also receive data when you submit the form in a QA10 ad in the TikTok app (TikTok Lead Generation instant form). We receive the data you enter in the fields of that form, such as your name, email address, phone number and company name, and your answers to the questions in the form. You can see which fields the form contains before you submit it. If you allow it, TikTok may prefill some fields with information from your TikTok account.

In this form we do not ask for special categories of data (such as health data), financial data (such as income or account numbers), ID document numbers or your date of birth.

We receive the enquiry in the TikTok ads panel, where it is available to us for 90 days after submission. We contact you about the enquiry by email or phone, and further correspondence is handled in the same way as for an enquiry sent through the website. Submitting the form does not subscribe you to a marketing list.

4. Purposes and legal bases of processing

Every processing operation has a defined legal basis under Article 6(1) GDPR. The mapping of purposes, legal bases and retention periods is presented in the table below.

Scroll horizontally to read the table.

Processing purpose Legal basis Retention period
Handling inquiries submitted via the contact form, the form in a QA10 ad on TikTok or email. Art. 6(1)(f) GDPR — legitimate interest of the Controller in conducting business correspondence. Up to 3 years from the last contact or until an effective objection is raised.
Steps at your request before entering into a Q-Dev or Q-Journey contract and its performance, where you yourself are a party to the contract. Art. 6(1)(b) GDPR — steps at the data subject's request before entering into a contract, or performance of a contract with that person. For as long as necessary for those steps and contract performance; afterwards only as necessary for the separate purposes below, where they actually arise.
Contact and cooperation with a representative of a company or other organisation that is or will be a party to the contract. Art. 6(1)(f) GDPR — the legitimate interest of the Controller and the represented organisation in maintaining contact and carrying out the cooperation. For as long as necessary for contact and cooperation; for an ordinary enquiry the period in the first row applies, and for specific claims the criteria below apply.
Tax obligations concerning the relevant documents (such as invoices and records). Art. 6(1)(c) GDPR — legal obligation, in particular under Articles 70 and 86 of the Polish Tax Ordinance and the relevant tax provisions. Until the tax liability becomes time-barred: generally 5 years from the end of the calendar year in which the tax payment deadline expired. This takes account of suspension or interruption of the limitation period, and exceptions and periods under special provisions.
Accounting obligations concerning documentation covered by the Polish Accounting Act. Art. 6(1)(c) GDPR — legal obligation under the Polish Accounting Act. According to the documentation category and periods in Art. 74 of the Polish Accounting Act. Periods under paragraph 2 of that article run from the beginning of the year following the financial year to which the records relate, subject to the applicable special rules.
Establishing, pursuing or defending against claims. Art. 6(1)(f) GDPR — legitimate interest of the Controller. Only for the period and to the extent necessary to protect specific claims, according to the applicable limitation period. Accrual, the year-end rule, suspension and interruption are taken into account; this does not mean retaining all data automatically.
Technical copies on the sending mail server and its local backups. Art. 6(1)(f) GDPR — legitimate interest in reliable message sending and maintaining the availability and security of correspondence. Technical copies of messages on the Controller's sending server (Postal) in Warsaw, Poland are retained for up to 30 days. Encrypted local backups of that mail server rotate after 14 daily copies; a backup copy is retained for up to approximately 14 days after it is made.
Website security, limiting repeated form submissions and protecting the form from spam and automated abuse using Cloudflare Turnstile. Art. 6(1)(f) GDPR — legitimate interest in securing the website. The attempt counter uses a 10-minute window. Expired entries are removed on the next request or server restart.
Website visit statistics (Vercel Web Analytics): aggregated traffic data we use to improve the website. Art. 6(1)(a) GDPR — your consent given in the banner, in conjunction with Art. 399(1) of the Polish Electronic Communications Law. Statistical reports are available to us for 12 months. Vercel deletes the hash identifying a visitor after 24 hours. After the agreement ends, Vercel deletes the data within a reasonable time unless the law requires it to be kept. Data that Vercel processes as an independent controller is retained under the rules described in section 6.

The 10-minute period above concerns only QA10's attempt counter; Cloudflare's retention of Turnstile signals remains to be verified.

Tax and accounting document retention periods do not automatically apply to enquiry correspondence. An enquiry alone does not create an obligation to issue an invoice.

The periods for technical copies and mail-server backups do not change the retention periods for correspondence in the mailbox or the periods for the other purposes described in the table.

5. Voluntary nature of data provision

Providing data is voluntary. Fields marked as required are needed to handle an enquiry through the form. You can also contact us by email. Where data is required to enter into a contract, providing it is a condition of contract conclusion under Art. 13(2)(e) GDPR.

Submitting an enquiry does not subscribe you to a marketing list and does not place an order or make a payment.

We do not require consent to process data for an ordinary enquiry. The basis is the legitimate interest identified in the table; you have a right to object where the statutory conditions are met.

Consent to visit statistics is voluntary. Not giving it does not limit your use of the website.

6. Recipients and other entities to whom we disclose data

Processors. Where providers process data on behalf of the Controller, the processing requirements of Art. 28 GDPR apply. The technical providers' functions include:

  • Hosting, form processing and visit statistics: Vercel Inc. (USA) — serving the website, handling requests to the server and, with your consent, visit statistics (Vercel Web Analytics), under Vercel's data processing agreement (Data Processing Addendum), which forms part of the service terms for the plan used by QA10. The form's server function runs in region fra1 (Frankfurt, Germany, EEA) on Amazon Web Services infrastructure, which is Vercel's subprocessor. Static content may be served through Vercel's global edge network. Vercel's current list of subprocessors, with their functions and locations: security.vercel.com/subprocessors.
  • Spam and automated abuse protection: Cloudflare, Inc. (USA) — Cloudflare Turnstile verification.
  • Sending-server infrastructure: provider of server infrastructure/data centre in Poland — infrastructure for the Controller's own mail server (Postal software), operated by the Controller in a data centre in Warsaw, Poland (EEA).
  • Receiving mailbox and correspondence: Google Workspace (Google) — the provider of the hello@qa10.io mailbox, receiving and storing enquiries and handling correspondence, under the Google Workspace terms and Google's data processing agreement (Cloud Data Processing Addendum). QA10's Google Workspace contracting party is Google Cloud Poland sp. z o.o. (Warsaw); through Google, data may be processed by Google LLC and other Google group companies as subprocessors. List of Google Workspace subprocessors: workspace.google.com/terms/subprocessors.

Under the Turnstile Privacy Addendum, Cloudflare acts as a processor on behalf of QA10 when protecting the website and as an independent controller when improving bot detection. Cloudflare's documentation states that Turnstile does not access, store or transmit form entries.

Vercel as an independent controller. Under Vercel's data processing agreement (Data Processing Addendum), usage data and metadata generated through the use of its services (Service-Generated Data), to the extent they are personal data, are processed by Vercel as an independent controller under its own privacy policy, among other things to operate, improve and support its services. Vercel retains this data while it needs it for those purposes and then anonymises or deletes it.

Advisers and independent controllers. Data may be disclosed to accounting, tax or legal advisers where necessary to handle a matter or meet legal obligations. An adviser's role depends on the actual service and applicable law: they may act as an independent controller for their own professional duties or as a processor on behalf of QA10. We do not assign one role to all advisers.

Authorities authorised by law. Disclosure takes place only on the relevant legal basis and to the required extent. Authorities exercising their own statutory functions do not then act as processors for QA10; authorities receiving data in a particular inquiry are not recipients within the meaning of Art. 4(9) GDPR.

TikTok. The form in the ad runs in the TikTok app. The operator of TikTok also processes the data you enter as a separate controller, under its own privacy policy and Lead Generation terms, not on behalf of QA10. For users in the EEA, these are TikTok Technology Limited (Dublin, Ireland) and TikTok Information Technologies UK Limited (United Kingdom) as joint controllers. TikTok states that it may use this data, for example, to prefill future forms, but does not use answers to questions added by the advertiser. TikTok's rules are described in the TikTok Privacy Policy.

The form sends data to the website server, which sends an email notification. The form does not save the enquiry to a separate database or its logs. However, the enquiry passes to the Controller's own sending server (Postal) and then to the Google Workspace mailbox, so this does not mean that no data is retained. Credentials for the sending server remain on the server and are not exposed to the browser. We do not track email opens or clicks.

The website offers a conversation with the AI agent Q. The data processed during a conversation with Q is described on the Agent Q page. The form does not forward submitted enquiries to AI models.

Information about current providers and data processing is available at hello@qa10.io.

7. International transfers

The Vercel server function handling the form runs in region fra1 (Frankfurt, Germany, EEA). The Controller's own sending mail server using Postal runs in Warsaw, Poland (EEA); data is not transferred outside the EEA through this server. Static website content may be served through Vercel's global edge network. Under Google's data processing agreement, Google Workspace data may be processed in any country where Google or its subprocessors maintain facilities. The Vercel Web Analytics documentation does not state the region where statistics data is processed. Under Vercel's data processing agreement, Vercel's primary processing facilities are in the United States, so we assume that statistics data is processed in the USA.

Data may be transferred outside the EEA by service providers: Vercel Inc. (USA) and its subprocessors, including for visit statistics, service monitoring and technical support, and Google LLC (USA) and Google group companies acting as subprocessors, including for data centre operations, service maintenance and technical support. Provider personnel access is limited to the scope required by their functions and the rules set out in their data processing agreements.

Legal bases for these transfers (as of 2026-11-09):

  • Adequacy decision (Art. 45 GDPR). Vercel Inc. and Google LLC are listed as active participants in the EU-U.S. Data Privacy Framework in the official U.S. Department of Commerce list. Transfers to these companies rely on Commission Implementing Decision (EU) 2023/1795 of 10 July 2023. The EU General Court dismissed the action against that decision on 3 September 2025 (T-553/23); the appeal in case C-703/25 P is pending before the Court of Justice.
  • Standard contractual clauses (Art. 46(2)(c) GDPR). Vercel's data processing agreement (Data Processing Addendum, Schedule 3) incorporates the standard contractual clauses approved by Commission Implementing Decision (EU) 2021/914 (Module Two: controller to processor, and Module One: controller to controller, for data Vercel processes as an independent controller). Google's data processing agreement (Cloud Data Processing Addendum) provides for these clauses for transfers to subprocessors where a mechanism based on an adequacy decision does not apply. These clauses continue to provide a basis for transfers should Decision 2023/1795 cease to apply.

Turnstile sends technical signals and the verification token to Cloudflare, Inc. (USA), which may involve processing outside the EEA, including in the USA. Cloudflare states in its Privacy Policy that it relies on its EU-U.S. Data Privacy Framework certification for EEA-to-USA transfers. This statement does not confirm the location of each Turnstile operation or the safeguard for every onward transfer.

Enquiries submitted through the form in a TikTok ad are stored on TikTok servers. TikTok states that its servers are located in different regions and that the location depends on where the user's account is registered. TikTok's privacy policy describes how TikTok transfers this data outside the EEA.

You may request current information on processing locations and the basis for a particular transfer, as well as a copy of the safeguards applied to it, at hello@qa10.io.

8. Automated decision-making and profiling

The Controller does not subject you to automated decisions within the meaning of Art. 22 GDPR — decisions producing legal effects or similarly significantly affecting you, taken solely on an automated basis.

The form passes your enquiry to the QA10 team. It does not generate an automatic quote, place an order or create an obligation to buy. Project scope, price and schedule are agreed individually.

9. Your rights

You have the following rights:

  • access to your data and obtaining a copy (Art. 15 GDPR);
  • rectification of inaccurate data or completion of incomplete data (Art. 16 GDPR);
  • erasure — the "right to be forgotten" (Art. 17 GDPR);
  • restriction of processing (Art. 18 GDPR);
  • data portability (Art. 20 GDPR) — for data processed by automated means on the basis of consent or contract;
  • objection to processing based on the Controller's legitimate interest, including direct marketing (Art. 21 GDPR);
  • withdrawal of consent at any time, where processing is based on consent — without affecting the lawfulness of processing carried out before withdrawal (Art. 7(3) GDPR); you can withdraw consent to visit statistics using the “Privacy settings” link in the page footer;
  • lodging a complaint with the supervisory authority — the President of the Personal Data Protection Office (Polish DPA), ul. Stanisława Moniuszki 1A, 00-014 Warsaw, UODO contact details.

We respond to requests without undue delay and within one month of receiving the request. Where necessary, taking into account the complexity or number of requests, this period may be extended by a further two months. We inform you of the extension and its reasons within one month of receiving the request (Art. 12(3) GDPR). Requests should be sent to hello@qa10.io.

10. Data security

The form validates required fields, request size and request origin, and limits repeated submission attempts. Submitted text is escaped to prevent it from running as HTML in the email notification. The public website uses HTTPS.

A successful submission means that the Controller's own sending server (Postal) accepted the message. It is not confirmation of mailbox delivery or reading. If acceptance cannot be confirmed, the form preserves your entered data and offers email contact.

11. Cookies and similar technologies

The use of cookies and similar technologies is described in a separate document: Cookie Policy. qa10.io does not use tracking or marketing cookies. We run visit statistics only with your consent; they do not use cookies.

12. Changes to this Policy

The Controller reserves the right to update this Policy in the event of changes in applicable law, in processing practices or in the scope of services. We will notify significant changes by publishing an updated version on the website and, where required, through a direct communication to affected data subjects.

13. Contact

For all matters concerning personal data processing: