Privacy Policy

1. Introduction & Who We Are

This Privacy Policy explains how Altuxo Sp. z o.o. ("Altuxo", "we", "us", or "our"), a limited liability company registered in Poland, European Union, collects, uses, and protects personal data in connection with Comfly — our cloud-based Customer Communication Management (CCM) platform.

Altuxo Sp. z o.o. is the data controller for personal data processed in relation to our marketing website and the operation of our business, as described in this policy.

Registered office: Aleja Jana Pawła II 27, 00-867 Warsaw, Poland

You can contact us about privacy matters at any time:

• Privacy and data protection: comfly.privacy@altuxo.pl
• General support: comfly.support@altuxo.pl

We are committed to processing personal data lawfully, fairly, and transparently in accordance with the General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and applicable Polish data protection law. Comfly is GDPR-native and hosted within the European Union.

2. Scope of This Policy

This policy applies to:

• Our marketing website at https://comfly.io; and
• The Comfly application at https://app.comfly.io (the "Service").

It describes how we handle personal data of website visitors, prospective customers, account holders, and authorized users of the Service. Where our customers process personal data of their own end recipients through Comfly, a separate controller/processor relationship applies (see Section 5).

3. What Personal Data We Collect

Depending on how you interact with us, we may collect:

• Account data: name, email address, organization name, job title, login credentials, and user role.
• Billing data: billing contact details, company information, tax identifiers, and transaction records. Card and payment details are handled by our payment provider; we do not store full card numbers.
• Usage and technical data: IP address, device and browser type, log data, feature usage, timestamps, and diagnostic information.
• Cookies and similar technologies: see Section 6.
• Content and documents processed in the Service: documents, templates, data sets, recipient lists, and generated communications that you or your organization upload to or create within Comfly ("Customer Content"). This may contain personal data of your own contacts.
• Support communications: information you provide when contacting support, submitting a request, or corresponding with us.

4. How and Why We Use Data (Legal Bases)

We process personal data on the following GDPR Article 6 legal bases:

• Performance of a contract (Art. 6(1)(b)): to create and manage accounts, provide the Service, process subscriptions, and offer support.
• Legal obligation (Art. 6(1)(c)): to meet accounting, tax, and other statutory requirements.
• Legitimate interests (Art. 6(1)(f)): to secure and improve the Service, prevent fraud and abuse, analyze aggregated usage, and communicate about service-related matters. We balance these interests against your rights.
• Consent (Art. 6(1)(a)): for non-essential cookies, certain analytics, and optional marketing communications. You may withdraw consent at any time.

5. Controller and Processor Roles

For personal data contained in Customer Content that our customers process through Comfly, the customer is the data controller and Altuxo acts as a data processor, processing such data only on the customer's documented instructions and to provide the Service.

A Data Processing Agreement (DPA) that meets the requirements of GDPR Article 28 is available to our customers and governs this relationship, including security obligations, sub-processing, and assistance with data subject requests.

For personal data relating to account administration, billing, the website, and our own business operations, Altuxo is the controller.

6. Cookies & Analytics

Our website and Service use cookies and similar technologies to enable core functionality, remember preferences, maintain sessions, and understand usage. Some cookies are strictly necessary; others are used for analytics or preferences and are set only where required with your consent.

Where consent is required, we display a cookie banner allowing you to accept or reject non-essential cookies. You can also manage cookies through your browser settings. We use analytics in a privacy-conscious manner to measure and improve performance.

7. Data Sharing & Sub-Processors

We do not sell personal data. We share personal data only with trusted service providers acting on our behalf, and only as necessary to operate the Service. These categories of sub-processors include:

• Cloud infrastructure provider (hosting, storage, and computing within the EU);
• Payment provider (subscription billing and payment processing);
• Email delivery provider (transactional and communication emails);
• AI assistant provider (powering AI-assisted features within the Service).

Each sub-processor is bound by appropriate contractual obligations, including data protection terms. A current list of sub-processors is available to customers on request.

We may also disclose personal data where required by law, to protect our rights, or in connection with a corporate transaction, subject to appropriate safeguards.

8. International Transfers

Comfly is hosted within the European Union, and we aim to keep personal data within the European Economic Area (EEA). Where a transfer outside the EEA is necessary (for example, a sub-processor with operations abroad), we implement appropriate safeguards such as Standard Contractual Clauses (SCCs) approved by the European Commission and additional measures where appropriate.

9. Data Retention

We retain personal data only as long as necessary for the purposes described in this policy:

• Account and Customer Content: for the duration of the subscription and a limited export window after termination (see our Terms of Service), after which data is deleted or anonymized.
• Billing records: for the period required by accounting and tax law.
• Technical logs: for a limited period for security and troubleshooting.

When data is no longer needed, we securely delete or anonymize it.

10. Security Measures

We implement appropriate technical and organizational measures to protect personal data, including encryption in transit, access controls, authentication, network protections, logging and monitoring, regular backups, and least-privilege practices. No system is perfectly secure, but we work continuously to maintain a high standard of protection.

11. Your Rights Under GDPR

Subject to applicable conditions, you have the right to:

• Access your personal data;
• Rectify inaccurate or incomplete data;
• Erase your data ("right to be forgotten");
• Restrict processing;
• Data portability (receive your data in a structured, machine-readable format);
• Object to processing based on legitimate interests;
• Withdraw consent at any time, without affecting prior lawful processing.

To exercise these rights, contact comfly.privacy@altuxo.pl. If Altuxo acts as a processor for Customer Content, please direct your request to the relevant controller (our customer), and we will assist them.

You also have the right to lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), or with the supervisory authority in your country of residence.

12. Children

The Service is not directed to children under the age of 16, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact comfly.privacy@altuxo.pl so we can take appropriate action.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the updated version with a revised "Last updated" date and, where changes are material, provide additional notice. Continued use of the Service after an update constitutes acceptance of the revised policy.

14. Contact

For any questions or requests regarding this Privacy Policy or your personal data, contact:

Altuxo Sp. z o.o.
Email: comfly.privacy@altuxo.pl
Aleja Jana Pawła II 27, 00-867 Warsaw, Poland