Privacy policy

1. Who is responsible for the data

Gluu is run by Substancja Wiążąca sp. z o.o., with its registered office in Warsaw, ul. Chmielna 2 lok. 31, 00-020 Warszawa, Poland, entered in the Register of Entrepreneurs of the National Court Register kept by the District Court for the Capital City of Warsaw, 12th Commercial Division, under KRS number 0001261652, tax ID (NIP) 5253102845, REGON 545522297, share capital PLN 5,000 (“we”). We run the gluu.events website and the Gluu application (app.gluu.events), and we organise events for our customers.

For matters concerning personal data, write to kontakt@gluu.events.

Our role depends on whose data it is:

• We are the controller of the data of people who visit the website, send an enquiry or use an account in the application, and of our customers’ contact details.
• We are a processor of event guests’ data. The event organiser enters it, or guests provide it when replying to an invitation. The controller of this data is the organiser, usually the guest’s employer. We process it only on the organiser’s instructions, under a data processing agreement (Article 28 GDPR).

2. Visiting gluu.events

The server records technical connection data: IP address, time, the page visited and browser type. We do this to keep the website working and secure (Article 6(1)(f) GDPR). We keep this data for a short time, according to the hosting provider’s settings.

The website sets one cookie, and only when you choose a language with the PL/EN switch. It uses no analytics tools and does not track visitors. Fonts are served from our own server, not from Google’s servers.

3. Enquiries about organised events

• Data: name, the chosen way of contact, email address or phone number (the one the chosen way of contact needs, the other optionally), event details (kind, date, number of people, the help you need) and its description.
• Purpose: answering the enquiry, preparing an offer and arranging a call. If you book a call in the calendar, we also keep its time.
• Legal basis: Article 6(1)(b) GDPR, steps taken at your request before entering into a contract. If you write on behalf of a company: Article 6(1)(f) GDPR, our legitimate interest in answering enquiries.
• Retention: until the offer discussions end, no longer than 12 months after the last contact. If we sign a contract, for its duration and until claims become time-barred.
• Providing data is voluntary. Without an email address or phone number we cannot answer.

4. Accounts in the Gluu application

• Data: name, work email address, the customer’s company name, your role in the company, phone number (if you give it), profile photo (if you add one) and account settings, such as language.
• Purpose: creating and running the account, providing the service, contacting you about the account.
• Legal basis: the contract with the customer (Article 6(1)(b) GDPR). If you use the account as the customer’s employee: our legitimate interest in providing the service to the customer (Article 6(1)(f) GDPR).
• Retention: for the duration of the contract with the customer, then until claims become time-barred.
• Team invitations: the invited person’s email address and who invited them and when. The address is given by the person sending the invitation. We use it to send the invitation email (valid for 7 days) and to add that person to the team (Article 6(1)(f) GDPR). We keep it together with the customer’s account data.
• Invoice details: the company’s full name, address and VAT number, if you enter them in the application. We use them to issue the VAT invoice for services you order, such as full-service event planning (Article 6(1)(b) and (c) GDPR). We issue invoices in the Polish National e-Invoicing System (KSeF) and keep accounting records for as long as tax law requires, as a rule 5 years from the end of the tax year (Article 6(1)(c) GDPR).

AI assistants (ChatGPT, Claude). If a person in the customer’s team connects their AI assistant to Gluu, or the customer creates a connector access key, we record the connection (the assistant, the person and the time of consent) and log connector calls: the tool name, the data passed, the time and the result. We do this for security and troubleshooting (Article 6(1)(f) GDPR). We keep the calls for no longer than 12 months, and the connection until it is disconnected or the account is deleted. Data that the assistant reads from Gluu goes to its provider (OpenAI for ChatGPT, Anthropic for Claude) under the agreement between the customer or that person and the provider, to which we are not a party.

5. Event guests

We process this data on behalf of the event organiser (see section 1).

• Data: name, email address, phone, company, job title, LinkedIn profile, reply to the invitation, details of an accompanying person, children’s age and gender, diet and food allergies, answers to the organiser’s questions and the invitation history (for example when we sent a message and whether it was delivered).
• Purpose: running the event on the organiser’s instructions: the event page, email invitations and reminders, collecting replies, the guest list for catering and logistics.
• Information about diet and allergies may concern health. Answering these questions is voluntary. The organiser uses the answers only to plan meals.
• Every message sent to many guests includes an unsubscribe link.
• Retention: until the organiser deletes it, and no longer than 30 days after the organiser’s contract with us ends (when the organiser’s account is deleted).
• At a guest’s request the organiser can delete all of the guest’s data in one step: the contact, invitations in every event, answers, accompanying people and the message history. If the guest unsubscribed from the organiser’s messages, only a hash of the email address remains, from which the address cannot be read, so the guest gets no more messages from that organiser.
• The email delivery provider (Postmark) also keeps the content of sent emails for up to 45 days after sending. Deleting a guest’s data in Gluu does not shorten that period.

To exercise your rights, contact the event organiser. If you write to us, we will pass your request to the organiser and help them fulfil it.

6. Cookies and browser storage

• The gluu.events website sets one cookie: the language chosen with the PL/EN switch. The application reads the same cookie to open in the same language.
• The application stores only what it needs to work: a cookie with your chosen language, a session cookie after you log in, and a random device identifier in browser storage. The identifier lets the application skip highlighting changes you made on the same device.
• We use no advertising or analytics cookies. Strictly necessary cookies do not require consent.

7. Recipients

We use providers that process data on our behalf under data processing agreements:

• Vercel Inc. (USA): hosting of the website and application. Application servers run in Frankfurt.
• Neon Inc. (USA): database. Data is stored in Frankfurt.
• ActiveCampaign, LLC, Postmark service (USA): sending email, including invitations to guests.
• Ably Realtime Ltd (United Kingdom): real-time notifications in the application. It receives no guest data, only change identifiers and the browser’s IP address.
• Google Ireland Limited: searching for event venue addresses (Google Maps), and email and calendar for correspondence and booking calls.
• WhatsApp Ireland Limited: if you choose WhatsApp as the way of contact in an enquiry, we talk through that service.
• Comarch S.A. (Poland): the Comarch ERP Optima accounting system, in which we issue VAT invoices and send them to the Polish National e-Invoicing System (KSeF).

Data may be transferred to the USA and the United Kingdom on the basis of European Commission adequacy decisions (for the USA: the EU-US Data Privacy Framework) or standard contractual clauses.

We do not sell personal data or use it for advertising.

8. Security

Connections are encrypted (HTTPS). Only authorised people have access to the data. The link a guest uses to reply contains a random key that is hard to guess. Connector access keys are stored only as hashes.

9. Your rights

You have the right to access, rectify and erase your data, to restrict its processing and to data portability. Where we rely on legitimate interest, you may object. You may also lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warszawa, Poland).

We do not make decisions based solely on automated processing and do not profile.

10. Changes

When we change this policy, we will update the date at the top of the page.