brzusio.pl Privacy Policy

Last updated: 8 August 2026In force since: 8 August 2026Version 2.0

PLEN

This Privacy Policy has been drafted in Polish and constitutes the implementation of the information obligations under Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the "GDPR"). The English version is provided for convenience only. In the event of any discrepancy, the Polish version shall prevail.

§1. Introduction and key information

  1. This Privacy Policy describes how the Seller processes the personal data of Customers of the brzusio.pl mobile application and website (the "App").

  2. The provision of our service requires the processing of special categories of personal data within the meaning of Article 9 GDPR – photographs revealing health status (pregnancy). Such processing takes place exclusively on the basis of the Customer's explicit, separate consent. The Customer has the right to withdraw such consent at any time.

  3. The Seller does not use Customers' photographs or 3D Models for marketing, promotional, portfolio or any other purposes not directly related to the fulfilment of the Order. Scans and 3D Models are shared exclusively with the sub-processors identified in §8 of this Policy, only to the extent necessary to provide the service.

  4. Acceptance of this Policy is a condition of using the App. Placing an Order which includes processing of a Scan requires the additional, separate consent referred to in §7.

§2. Personal data controller

The controller of Customers' personal data is:

Creative Industries Mateusz Ziemniewicz
ul. Boksytowa 24, 91-360 Łódź, Poland
Tax identification number (NIP): 9471933368

(the "Controller").

Contact for personal data protection matters:

  • E-mail: rodo@brzusio.pl
  • Postal address: ul. Boksytowa 24, 91-360 Łódź (with the annotation "RODO")

§3. Data Protection Officer

  1. The Controller has not appointed a formal Data Protection Officer within the meaning of Article 37 GDPR. Such appointment is not currently mandatory given the scale of the activity.

  2. In all matters concerning personal data protection, the Customer may contact the Controller at rodo@brzusio.pl. The Controller undertakes to respond to requests without undue delay and in any case within the deadlines provided for in Article 12 GDPR.

  3. The Controller monitors the scale of processing of special category data and will appoint a formal Data Protection Officer if the scale of activity so requires under applicable law.

§4. Definitions

Customer – a natural person using the App whose personal data is processed by the Controller.

Scan – a digital set of photographs of the Customer's body taken in the App for the purpose of generating a 3D Model.

3D Model – a three-dimensional digital model generated from a Scan using the services of the 3D generation provider.

Product – a physical, hand-made figurine constituting the materialisation of the 3D Model.

Sub-processor – an entity to which the Controller entrusts the processing of personal data under a data processing agreement, within the meaning of Article 28 GDPR.

Third country – a country other than a Member State of the European Economic Area (EEA).

SCC – Standard Contractual Clauses approved by the European Commission Implementing Decision (EU) 2021/914 of 4 June 2021, constituting a legal basis for the transfer of personal data to third countries.

DPF – the EU-U.S. Data Privacy Framework, the legal framework recognised by the European Commission decision of 10 July 2023 as ensuring an adequate level of protection of personal data transferred to certified organisations in the United States.

§5. Categories of personal data processed

The Controller processes the following categories of Customers' personal data:

5.1. Account data:

  • e-mail address,
  • name and surname (if provided),
  • account identifier (UID), generated automatically,
  • password hash (the Controller does not know the password in plain text; authentication is handled by Firebase Authentication),
  • account creation date, last login date,
  • language and interface preferences.

5.2. Order data:

  • Order number,
  • recipient's name and surname, delivery address,
  • telephone number (if required by the chosen carrier),
  • invoicing data (name and surname or company name, NIP, address),
  • Order content (Product specification),
  • transaction data (amount, currency, payment status, transaction identifier in the Payment Operator's system),
  • fulfilment statuses, status change dates, shipment tracking number.

5.3. Special category data (Article 9 GDPR):

  • Scans – photographs of the Customer's body uploaded to the App for the purpose of generating a 3D Model. Photographs revealing the Customer's pregnancy are treated as data concerning health within the meaning of Article 9(1) GDPR.
  • 3D Models – digital representations of the Customer's body generated from Scans, which may be considered biometric data to the extent that they enable the identification of a natural person.

5.4. Technical data:

  • model, operating system and OS version of the mobile device,
  • IP address (processed transiently for security purposes),
  • application installation identifier (Firebase Installation ID),
  • push notification token (Firebase Cloud Messaging) – stored if the Customer has enabled notifications and granted the system permission; deleted when notifications are disabled and upon deletion of the Account,
  • error and technical logs.

5.5. Communication data:

  • the content of correspondence in connection with complaints, customer service inquiries, and contact in personal data matters.

The Controller processes personal data for the following purposes and on the following legal bases:

6.1. Operating the Account and providing services in the App.
Legal basis: Article 6(1)(b) GDPR (performance of a contract for the provision of electronic services).
Scope of data: §5.1.
Period: §10.1.

6.2. Order fulfilment (acceptance, production, shipping, after-sales support).
Legal basis: Article 6(1)(b) GDPR (performance of the sales contract).
Scope of data: §5.1, §5.2, §5.3.
Period: §10.2 and §10.3.

6.3. Generation of the 3D Model from the Scan.
Legal basis with respect to special category data: Article 9(2)(a) GDPR (the Customer's explicit, separate consent), subject to §7.
Legal basis with respect to other data: Article 6(1)(b) GDPR.
Scope of data: §5.3.
Period: §10.3.

6.4. Issuing and storing invoices and accounting documentation.
Legal basis: Article 6(1)(c) GDPR (legal obligation – the Polish Accounting Act, Tax Ordinance, VAT Act).
Scope of data: §5.2 (in the scope of identification and transaction data).
Period: §10.4.

6.5. Handling complaints and processing consumer claims.
Legal basis: Article 6(1)(b) GDPR (performance of the contract) and Article 6(1)(c) GDPR (legal obligation arising from the UPK).
Scope of data: §5.1, §5.2, §5.5.
Period: §10.5.

6.6. Ensuring the security of the App, detecting abuse, pursuing and defending claims.
Legal basis: Article 6(1)(f) GDPR (the Controller's legitimate interest in protecting the integrity of the service and protecting claims).
Scope of data: §5.4 and, to the necessary extent, §5.1 and §5.2.
Period: §10.6.

6.7. Transactional communication (Order confirmations, status notifications, invoices, responses to inquiries).
Legal basis: Article 6(1)(b) GDPR (performance of the contract).
Scope of data: §5.1, §5.2.
Period: §10.2.

6.8. Marketing communication (newsletters, information about new Products).
Legal basis: Article 6(1)(a) GDPR (the Customer's consent) and Article 10 of the Polish Act on the Provision of Electronic Services (consent to receive commercial information).
The granting of consent is voluntary. Consent may be withdrawn at any time in the App settings or via the "unsubscribe" link in the message.
Scope of data: §5.1.
Period: until withdrawal of consent.

6.9. Exercising the rights of data subjects (Articles 15-22 GDPR).
Legal basis: Article 6(1)(c) GDPR (legal obligation).
Scope of data: §5.1, §5.2, §5.5 and other categories to the extent necessary to fulfil the request.
Period: §10.5.

  1. Photographs constituting the Scan, to the extent that they reveal pregnancy or other information about health status, are special category data within the meaning of Article 9 GDPR. The processing of such data is permissible only on the basis of one of the conditions set out in Article 9(2) GDPR.

  2. The Controller processes Scans on the basis of the Customer's explicit, separate, voluntary consent (Article 9(2)(a) GDPR). Such consent:

    a) is not the same as consent to the Terms or consent to the processing of other categories of data,
    b) is given by a separate declaration (a separate checkbox) on the screen preceding the first Scan,
    c) is recorded in the Controller's systems together with a timestamp and the version identifier of this Policy.

  3. The Customer has the right to withdraw consent at any time. Consent may be withdrawn:

    a) using the "Withdraw consent to photo processing" function in the Account settings,
    b) by e-mail sent to rodo@brzusio.pl,
    c) by deleting the Account (resulting in the full withdrawal of all consents).

  4. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

  5. Effects of withdrawal of consent:

    a) the Customer's Scans are promptly deleted from the Controller's systems and the systems of sub-processors, no later than within 30 days,
    b) 3D Models generated from Scans are deleted (unless the Customer requests otherwise), unless they are necessary for the fulfilment of an Order in progress,
    c) the fulfilment of new Orders involving 3D Model generation is not possible without renewed consent,
    d) Orders in progress at the time of withdrawal may be continued to completion, unless the Customer requests otherwise; a request to discontinue an Order may affect the Customer's rights under the Agreement in accordance with the Terms.

§8. Data recipients — current sub-processors

  1. The Controller entrusts the processing of personal data to sub-processors exclusively under data processing agreements (Article 28 GDPR) and, in the case of transfer outside the EEA, under the safeguards referred to in §9.

  2. Current sub-processors of the Controller:

    8.2.1. Payment Operator – Stripe

    • Entity name: Stripe Payments Europe Ltd. (operationally: Stripe, Inc., USA)
    • Registered office: 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland (EU); Stripe, Inc. – San Francisco, USA
    • Purpose: payment processing and refunds
    • Scope of data: transaction data, payment card data (processed exclusively on Stripe's side; the Controller does not store full card data)
    • Privacy policy: https://stripe.com/privacy
    • Transfer basis: SCC and EU-U.S. Data Privacy Framework (Stripe, Inc. is certified)

    8.2.2. Hosting and infrastructure – Google / Firebase

    • Entity name: Google Ireland Limited and Google LLC
    • Registered office: Gordon House, Barrow Street, Dublin 4, Ireland (EU); Google LLC – Mountain View, USA
    • Purpose: App hosting, database (Firestore), authentication (Firebase Authentication), file storage (Firebase Storage), serverless functions (Cloud Functions)
    • Scope of data: all categories of data processed by the App
    • Privacy policy: https://firebase.google.com/support/privacy
    • Transfer basis: SCC and EU-U.S. Data Privacy Framework (Google LLC is certified)
    • Data location: EU regions and multi-region in accordance with the Firebase project configuration

    8.2.3. 3D Model generation – artificial intelligence service provider (Tripo AI)

    • Entity name: Holymolly Ltd – operator of the service trading as "Tripo AI" / "Tripo3D" (www.tripo3d.ai)
    • Registered office: 3A-8, 12/F, Kaiser Centre, No. 18 Centre Street, Sai Ying Pun, Hong Kong (Hong Kong Special Administrative Region of the People's Republic of China)
    • Purpose: generation of the 3D Model from the Customer's Scans using artificial intelligence services
    • Scope of data: the Scan image files only (special category data – §5.3) and a technical task identifier assigned by the provider. Images are transmitted as files with technical names (photo_0.jpg … photo_3.jpg). The provider does not receive the Customer's first name, surname, e-mail address, delivery address, telephone number, Order number, Account identifier (UID) or payment data, and is not able, on the basis of the data supplied by the Controller, to link the images received to a specific individual.
    • Provider's terms of service: https://www.tripo3d.ai/terms
    • Provider's privacy policy: https://www.tripo3d.ai/privacy
    • Transfer basis: the Customer's explicit consent given after having been informed of the risks (Article 49(1)(a) GDPR). Hong Kong is not covered by a European Commission adequacy decision, and the provider has not entered into Standard Contractual Clauses or a separate data processing agreement within the meaning of Article 28 GDPR with the Controller — the relationship between the parties is governed solely by the provider's Terms of Service. The specific risks associated with such a transfer are described in §9(3). The Controller informs the Customer of those risks before obtaining consent and does not transfer Scans in the absence of consent.
    • Use for AI model training: the provider's undertaking in this respect follows from clause 5.2.2 of the provider's Terms of Service, applicable to paid accounts, which reads: "Company will not use Inputs and Outputs as training data to train, validate, test, or improve any AI Technology." The Controller uses the service exclusively under a paid account to which that undertaking applies. The Controller does not hold any separate, bilateral commitment from the provider going beyond the wording of its Terms of Service, and has no technical means of independently verifying compliance with it.
    • Provider-side retention: the provider's Terms of Service (clause 4) impose no obligation on the provider to store Inputs or Outputs; deletion of data associated with an account occurs upon its closure (clause 10.5). The provider publishes no retention schedule, and its privacy policy specifies no retention periods. The Controller has no means of verifying when the provider actually deletes transmitted Scans.
    • Provider's liability: the provider's Terms of Service disclaim warranties as to generation Outputs (clause 3.2) and cap its liability (clause 4), and submit disputes to the law of Hong Kong and HKIAC arbitration (clause 11). This in no way limits the Controller's liability towards the Customer — the Controller is liable for the acts and omissions of the provider it uses in the performance of its obligation as for its own (Article 474 of the Polish Civil Code).
    • Change of provider: a change of the 3D generation provider constitutes a material change of a sub-processor handling special category data and is subject to the procedure in §8(4). Until the conditions of that procedure are met, any testing of other providers is carried out exclusively on synthetic data or on material made available by the Controller for that purpose, without processing real Customer Scans.

    8.2.4. Courier companies and parcel locker operators

    • Purpose: delivery of the Product to the Customer
    • Scope of data: name, surname, delivery address, telephone number (if required), Order number
    • The specific carrier is selected by the Customer at the Order placement stage. The current list of carriers made available in the App is presented during the Order process. Each carrier is an independent controller in respect of the delivery process, on the basis of its own legal relationship with the recipient of the shipment (UPK, Polish Carriage Law).
    • Processing location: the territory of the Republic of Poland (or another EEA country if the Customer has chosen international delivery).

    8.2.5. E-mail service operator (transactional communication) — Resend (Plus Five Five, Inc.)

    • Entity name: Plus Five Five, Inc. (d/b/a Resend), 2261 Market Street #5039, San Francisco, CA 94114, USA
    • Purpose: sending Order confirmations, Order status change notifications, Order cancellation notifications
    • Scope of data: e-mail address, name (or recipient name), Order number, Order amount, Order status, delivery address
    • What we do NOT transmit: Scan content, 3D Models, payment card data, concierge message content
    • Data retention by the provider: in accordance with Resend's policy; e-mails are stored for the period necessary for delivery and delivery status logging
    • Legal basis for processing: Art. 6(1)(b) GDPR (performance of a contract — Order confirmations and status notifications)
    • Transfer basis to the USA: Data Privacy Framework (DPF) — Plus Five Five, Inc. holds EU-US DPF and UK Extension to the EU-US DPF certification; supplemented by Standard Contractual Clauses (SCC) pursuant to Commission Implementing Decision (EU) 2021/914
    • DPA: https://resend.com/legal/dpa
    • Provider's privacy policy: https://resend.com/legal/privacy-policy

    8.2.6. App analytics – Google LLC (Firebase Analytics / Google Analytics for Firebase)

    • Entity name: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (for EEA users: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland)
    • Purpose: aggregated App-usage statistics only (interaction events, screen views, e-commerce events such as add-to-cart / begin checkout / purchase) for the purpose of improving App stability and usability
    • Scope of data: pseudonymous installation identifier (App Instance ID), App user identifier (Firebase Authentication uid), current screen name, e-commerce event parameters (Order amount, transaction id, item id — these do not contain Customer personal data or Scan content), device technical data (model, OS version, locale, App version)
    • What we do NOT transmit: first name, surname, e-mail address, delivery address, Scan content, concierge message content, payment card data
    • Event-data retention on Google's side: 14 months by default (Firebase Analytics configuration); after that period data is deleted or aggregated
    • Legal basis for processing: Customer's explicit consent (Art. 6(1)(a) GDPR) — analytics operate only after the "Analytics" toggle is enabled in the App's Settings screen or selected during registration; off by default
    • Transfer basis to the USA: Data Privacy Framework (DPF) — Google LLC is DPF-certified; additionally Standard Contractual Clauses (SCC) pursuant to European Commission Implementing Decision (EU) 2021/914
    • Withdrawal of consent: at any time by disabling the "Analytics" toggle in the App's Settings; after withdrawal the App ceases transmitting any analytics data (event collection is disabled immediately)
    • iOS App Tracking Transparency (ATT): on Apple devices running iOS 14.5+, the App requests the additional system ATT permission upon first consent; if declined we collect only aggregated data without the IDFA advertising identifier
    • Provider's privacy policy: https://policies.google.com/privacy

    8.2.7. Stability monitoring and push notifications – Google LLC (Firebase Crashlytics, Firebase Cloud Messaging)

    • Entity name: Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA (for EEA users: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland)
    • Purpose: (a) Crashlytics – detecting and diagnosing App crashes in order to maintain its stability; (b) Cloud Messaging (FCM) – delivering push notifications about Order status changes and messages from customer support
    • Scope of data: Crashlytics – crash stack trace, device model and OS version, App version, pseudonymous installation identifier, timestamp; FCM – device token, notification content (title and short description relating to Order status)
    • What we do NOT transmit: Scan content, 3D Models, payment card data, delivery address, concierge message content
    • Legal basis for processing: Art. 6(1)(f) GDPR (legitimate interest – maintaining service stability) for Crashlytics; Art. 6(1)(b) GDPR (performance of the contract) for Order status notifications, it being noted that sending push notifications requires the device's system permission and can be switched off at any time in the App's Settings or in the system settings
    • Transfer basis to the USA: Data Privacy Framework (DPF) — Google LLC is DPF-certified; additionally Standard Contractual Clauses (SCC) pursuant to European Commission Implementing Decision (EU) 2021/914
    • Provider's privacy policy: https://firebase.google.com/support/privacy

  3. The full list of sub-processors is updated on an ongoing basis in this §8(2).

  4. Notification of a change of sub-processor:

    a) In the event of a material change of a sub-processor processing special category data (§5.3), the Controller notifies Customers at least 14 days in advance:

    • by e-mail to the address indicated in the Account,
    • by notification within the App.

    b) The Customer may, within the period indicated in the notification, object by:

    • withdrawing consent to the processing of special category data in accordance with §7,
    • deleting the Account.

    c) Failure to object within the period indicates acceptance of the change.

    d) A change in respect of sub-processors not processing special category data does not require prior notification, but this Policy is updated promptly upon implementation of the change.

  5. The Controller does not share Customers' personal data with entities other than those listed in this paragraph, with the exception of:

    a) cases of statutory obligation (e.g. a request from law enforcement, tax authorities, courts),
    b) cases necessary for the defence or pursuit of claims (e.g. disclosure of data to legal counsel, court-appointed expert),
    c) cases of the Customer's consent expressed in another, separate declaration.

§9. Transfer of data outside the European Economic Area (EEA)

  1. Some of the Controller's sub-processors identified in §8 have their registered offices outside the EEA — in the United States (Stripe, Google, Resend) and in Hong Kong (the 3D Model generation provider, §8.2.3). For this reason, Customers' personal data may be processed in third countries.

  2. Legal basis for transfer with respect to each of the third countries:

    • United States: the European Commission decision of 10 July 2023 on the adequate level of protection of personal data ensured under the EU-U.S. Data Privacy Framework (DPF) – with respect to sub-processors certified under the DPF; supplementary or alternative: Standard Contractual Clauses (SCC) approved by Implementing Decision (EU) 2021/914 of 4 June 2021.
    • Hong Kong: the Customer's explicit consent given after having been informed of the risks (Article 49(1)(a) GDPR). Hong Kong is not covered by an adequacy decision, and the Controller has not been able to obtain Standard Contractual Clauses or an Article 28 GDPR data processing agreement from the provider. The transfer takes place solely with the Customer's consent given after reviewing the risks described in paragraph 3.
    • Other third countries: in each case based on a European Commission decision on the adequate level of protection, SCCs, or other mechanisms provided for in Articles 46-49 GDPR.

  3. Risks associated with transferring Scans to Hong Kong. The Controller states expressly that the transfer of Scans to the 3D Model generation provider is covered neither by an adequacy decision nor by appropriate safeguards within the meaning of Article 46 GDPR. This entails, in particular, the following risks:

    a) the level of personal data protection in the recipient country may be lower than that guaranteed within the EEA;
    b) the Controller holds no enforceable contractual commitments from the provider regarding security of processing, retention periods or onward transfers to other entities — only the provider's unilaterally determined Terms of Service apply;
    c) public authorities of the recipient country may have powers of access to data that are not limited in a manner equivalent to European Union standards, and the Customer may have no effective judicial remedy against such access;
    d) the contract with the provider is governed by the law of Hong Kong and disputes are resolved by arbitration in Hong Kong (HKIAC), which substantially impedes pursuing claims directly against the provider;
    e) the Controller has no technical means of verifying whether and when the provider has actually deleted the transmitted Scans.

    Consent to this transfer is separate from all other consents and may be withdrawn at any time (§7). The Controller states expressly that this consent is a precondition for making a Scan and generating a 3D Model, and therefore for using the core function of the App — it is not, however, a precondition for browsing the App or contacting the Controller. Withdrawal of consent produces the effects described in §7(5). The Controller minimises the scope of the transfer in accordance with §8.2.3 — the provider receives the image files alone, without any data identifying the Customer.

  4. The Controller applies additional technical and organisational measures minimising the risk of transfer, in particular:

    a) encryption of data in transit (TLS 1.2+),
    b) encryption of data at rest on the sub-processor's infrastructure,
    c) limiting the scope of data transferred to the minimum necessary to provide the service,
    d) periodic verification of sub-processors' practices in respect of data protection.

  5. The Customer has the right to receive a copy of the applied transfer safeguards (SCC, DPF documentation) upon request to rodo@brzusio.pl.

§10. Data retention period

10.1. Account data (§5.1) – stored for the duration of the Account. After deletion of the Account, the data is deleted promptly, no later than within 30 days, subject to any obligation to retain data arising from other legal bases (invoices, pursuit of claims).

10.2. Order data (§5.2) – stored:

  • for the duration of Order fulfilment,
  • subsequently for the duration of the consumer warranty (2 years from delivery of the Product),
  • subsequently for the period of limitation of claims arising from the Agreement (typically 6 years from the day on which the claim became due, in accordance with Article 118 of the Polish Civil Code, or 3 years for claims related to business activity).

10.3. Special category data (§5.3 – Scans and 3D Models):

  • Scans: stored for the period necessary to generate the 3D Model and for 90 days from the date of Order fulfilment (status "Delivered" or equivalent), in order to enable possible reproduction of the Model in the event of a complaint or Customer's request. After 90 days, Scans are automatically deleted.
  • Scans – extended retention option: the Customer may, in the Account settings, grant separate consent to the storage of Scans beyond 90 days in order to enable repeat orders without performing a new Scan. Consent is voluntary, may be withdrawn at any time, and Scans are promptly deleted upon withdrawal.
  • 3D Models: stored for the duration of the Account or until the Customer's request for deletion, in order to enable preview, repeat orders or other functions made available in the App. Upon deletion of the Account, 3D Models are deleted together with other Account data.

10.4. Accounting and tax documentation (invoices, VAT records, transaction data) – stored for the period required by law, in particular:

  • 5 years from the end of the tax year to which they relate – in accordance with Article 86 § 1 of the Polish Tax Ordinance and Article 112 of the VAT Act,
  • during this period the data is stored exclusively to the extent necessary to fulfil tax obligations and is not used for other purposes.

10.5. Complaints and communication data (§5.5) – stored for the period necessary to handle the complaint and for the period of limitation of any claims arising therefrom.

10.6. Technical and security logs (§5.4) – stored for a maximum of 12 months for the purpose of ensuring security and detecting abuse, unless they constitute evidence in complaints, judicial or administrative proceedings, in which case they are stored for the duration of such proceedings.

10.7. Data processed on the basis of marketing consent – until withdrawal of consent.

§11. Rights of the data subject

The Customer, as the data subject, is entitled to the following rights under the GDPR:

11.1. Right of access (Article 15 GDPR) – the Customer may request information on what data is processed, for what purpose, to whom it is disclosed, for how long it is stored, and obtain a copy of the data.

11.2. Right to rectification (Article 16 GDPR) – the Customer may request correction of inaccurate data or completion of incomplete data.

11.3. Right to erasure ("right to be forgotten", Article 17 GDPR) – the Customer may request deletion of their data, in particular where:

  • the data is no longer necessary for the purposes for which it was collected,
  • the Customer has withdrawn the consent on which processing was based,
  • the Customer has objected to the processing,
  • the data was processed unlawfully.

This right does not apply to the extent that processing is necessary to fulfil a legal obligation (e.g. retention of invoices) or to establish, exercise or defend claims.

11.4. Right to restriction of processing (Article 18 GDPR) – the Customer may request restriction of processing in the situations specified in the provision, in particular pending verification of the accuracy of the data or processing of an objection.

11.5. Right to data portability (Article 20 GDPR) – the Customer may request to receive their data in a structured, commonly used, machine-readable format and to have it transmitted to another controller.

11.6. Right to object (Article 21 GDPR) – the Customer may object to processing based on the Controller's legitimate interest (§6.6).

11.7. Right to withdraw consent (Article 7(3) GDPR) – with respect to processing based on consent (§6.3 and §6.8), the Customer may withdraw consent at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.

11.8. Right not to be subject to automated decision-making (Article 22 GDPR) – see §12.

11.9. Manner of exercising rights:

a) The Customer may exercise their rights by e-mail to rodo@brzusio.pl, specifying the scope of the request.
b) Some rights may be exercised directly in the App (e.g. Account deletion, data editing, withdrawal of consent).
c) The Controller responds to a request without undue delay and in any case within 1 month of receipt. In complex cases, the period may be extended by a further 2 months, of which the Customer will be informed.
d) The exercise of rights is free of charge, except for unfounded or excessively repeated requests, in respect of which the Controller may charge a reasonable fee or refuse to act on the request.
e) The Controller may request additional information from the Customer to confirm the identity of the requesting person.

§12. Profiling and automated decision-making

  1. The Controller does not make decisions based solely on automated processing (including profiling) which produce legal effects or similarly significantly affect the Customer.

  2. As part of the provision of the service, artificial intelligence is used to generate the 3D Model from Scans. This process:

    a) is technical in nature (transformation of an image into a 3D model),
    b) does not include assessment of the Customer's personal characteristics (e.g. profiling for marketing or credit purposes),
    c) does not affect the Customer's rights under the Agreement or other provisions of law,
    d) the result (the 3D Model) is verified by the Controller before commencement of Product production.

  3. The Controller does not train any artificial intelligence models on Customers' Scans or 3D Models. With respect to the 3D Model generation provider, the undertaking not to use the transferred data as training data follows from clause 5.2.2 of the provider's Terms of Service, applicable to paid accounts, which the Controller uses (for the full wording of the clause and its limitations, see §8.2.3). The Controller states at the same time that this is an undertaking contained in the provider's unilaterally determined terms and not a separate guarantee granted to the Controller, and that the Controller has no technical means of verifying compliance with it. Selecting a provider whose terms did not contain an undertaking to that effect would require a prior amendment of this Policy under §8(4) and §16(2)(a).

§13. Cookies and device identifiers

  1. The mobile App does not use cookies in the classic sense (these are characteristic of web browsers).

  2. The App uses the following technical mechanisms equivalent to cookies:

    a) Application installation identifier (Firebase Installation ID) – serves to identify a specific installation of the App on the Customer's device, necessary for the provision of the service.
    b) Authentication token (JWT) – stored locally after login, serves to maintain the session.
    c) Local cache – stores data needed for offline operation of the App (e.g. translations, product configuration).
    d) Push notification token (Firebase Cloud Messaging) – stored only after the Customer enables notifications (§5.4, §8.2.7).

  3. The mechanisms listed in paragraph 2(a)–(c) are necessary for the operation of the App and do not require separate consent, in accordance with Article 397(3) of the Polish Electronic Communications Law of 12 July 2024 (access necessary to provide the service requested by the user). The mechanism in point (d) requires the Customer's consent and the device's system permission.

  4. Optional tools implemented in the App: usage analytics (Firebase Analytics — §8.2.6) operates only after consent has been given and is off by default; crash monitoring (Firebase Crashlytics — §8.2.7) operates on the basis of the Controller's legitimate interest and does not cover Scan content or identifying data. The App does not perform advertising profiling and does not transfer data to advertising brokers. The implementation of any further tool of this kind will be preceded by an update of this Policy and the addition of the sub-processor to the list in §8.

§14. Data security

  1. The Controller applies technical and organisational measures ensuring protection of personal data appropriate to the risk, in accordance with Article 32 GDPR, in particular:

    a) encryption of data transmission (TLS 1.2+),
    b) encryption of data at rest on sub-processors' infrastructure (Firebase, Stripe),
    c) role-based access control (RBAC) in the administrative panel,
    d) multi-factor authentication (where made available by the sub-processor),
    e) Firestore and Firebase Storage security rules preventing unauthorised access,
    f) periodic verification of security rules and configuration,
    g) data minimisation (processing only data necessary for the purpose).

  2. The Controller cannot guarantee absolute security of transmission on the Internet but endeavours to minimise the risk to the maximum extent.

  3. Personal data breach: in the event of a personal data breach, the Controller acts in accordance with Articles 33 and 34 GDPR, in particular:

    a) reports the breach to the supervisory authority (the Polish President of the Personal Data Protection Office, "PUODO") without undue delay and no later than within 72 hours of becoming aware of the breach, where the breach may result in a risk to the rights and freedoms of natural persons,
    b) notifies the Customers concerned where the breach may result in a high risk to their rights and freedoms.

§15. Provisions in the event of cessation of activity

  1. In the event of intention to cease operating the App or to fully cease business activity, the Controller undertakes:

    a) to notify Customers at least 30 days in advance by e-mail to the address indicated in the Account and by notification within the App,
    b) to make available to Customers the function to download their 3D Models and Account data in a structured format (in line with the right to data portability),
    c) after the period indicated in the notification, to permanently delete all Customers' personal data from the Controller's systems and the systems of sub-processors, subject to data the retention of which is required by law (in particular invoices and accounting documentation).

  2. In the event of transfer of business (sale, merger, transformation) to another entity, the Controller ensures continuity of data processing in accordance with this Policy or notifies Customers of the change of controller, with the option to withdraw consent and delete data prior to transfer.

§16. Changes to the Privacy Policy

  1. The Controller may amend this Privacy Policy in the event of changes to the law, the manner of data processing, the list of sub-processors or for other important reasons.

  2. Classification of changes:

    a) Material changes (extension of processing purposes, change of legal basis, addition of a new category of sub-processors processing special category data, change of retention periods to longer ones) – require notification of Customers at least 14 days in advance and, with respect to processing based on consent, renewed consent.

    b) Editorial changes (drafting corrections, clarifications, update of contact data, update of specific sub-processors within the same service category without changing the country of processing) – take effect upon publication of the amended Policy.

  3. The current Policy is available in the App in the "Privacy policy" tab and on the brzusio.pl website at https://brzusio.pl/legal/polityka-prywatnosci.

  4. Each version of the Policy is identified by a version number and an effective date, stated at the beginning of the document. The version number in force at the time consent is given is recorded together with that consent (§7(2)(c)).

  5. Version history:

    Version 1.0 (in force from 29 April 2026) — first version of the Policy.
    Version 2.0 (in force from 8 August 2026) — identification of the 3D Model generation provider by name (§8.2.3) together with the basis for the transfer to Hong Kong and a description of the risks (§9(3)); addition of sub-processors: Resend (§8.2.5), Firebase Analytics (§8.2.6), Firebase Crashlytics and Cloud Messaging (§8.2.7); clarification of the undertaking concerning AI model training (§12(3)); inclusion of push notifications (§5.4, §13); update of the legal basis for device access following the entry into force of the Electronic Communications Law (§13(3)).

§17. Complaint to the supervisory authority

The Customer has the right to lodge a complaint with the supervisory authority for personal data protection:

President of the Personal Data Protection Office (PUODO)
ul. Stawki 2, 00-193 Warsaw, Poland
www.uodo.gov.pl
Hotline: +48 606-950-000

The Customer may lodge a complaint without prior contact with the Controller; however, the Controller encourages prior contact at rodo@brzusio.pl for prompt clarification of the situation.

§18. Final provisions

  1. Matters not regulated by this Policy are governed by the GDPR and the Polish Act of 10 May 2018 on the Protection of Personal Data.

  2. This Policy enters into force on 29 April 2026.

  3. For any questions regarding the processing of personal data, the Customer may contact the Controller at rodo@brzusio.pl.

This Privacy Policy has been drafted in Polish. The English version, available at brzusio.pl/legal/en/polityka-prywatnosci and in the "Privacy policy" tab in the App, is provided for convenience only. In the event of any discrepancy between language versions, the Polish version shall prevail.

Related document: Terms of Sale.