1. Controller and contact
atstratus S.A., the website operator and owner of the atstratus.ai brand, is the controller of personal data processed in connection with your use of atstratus.ai. For privacy questions or to exercise your rights, contact privacy@atstratus.com.
This policy applies to atstratus.ai. If you follow a link to another website, including a manufacturer's website or atstratus.com, please review that website's privacy information.
2. Data we process
- Technical data: IP address, request time, requested page address, browser and device information, and error or security-event data. These are processed to deliver the website and in infrastructure logs.
- Correspondence: information you provide in a message, such as your name, email address, company, phone number and enquiry.
- Meeting bookings: first and last name, email address, selected time and discussion topic, and booking, cancellation or rescheduling information.
- Analytics after consent: visits, page views, referring sources, scrolls, outbound-link and file-link clicks, and browser, device and approximate-location information provided by Google Analytics.
Providing information in correspondence is voluntary, but we may be unable to reply without contact details. Technical data are needed to serve the website. Analytics consent is optional and is not a condition for accessing content.
3. Purposes and legal bases
- Enquiries and business correspondence: our legitimate interest in replying to messages and maintaining business contact — Article 6(1)(f) GDPR. Where your enquiry directly concerns entering into a contract with you, necessary pre-contractual steps rely on Article 6(1)(b) GDPR.
- Website delivery, security and display: our legitimate interest in operating the website, diagnosing errors and preventing abuse — Article 6(1)(f) GDPR.
- Website usage analysis: your consent — Article 6(1)(a) GDPR. Optional analytics tools run only after you consent.
- Legal obligations and claims: Article 6(1)(c) GDPR where processing is required by law, or Article 6(1)(f) GDPR for establishing, exercising or defending legal claims.
We do not sell your personal data. This website does not use advertising profiling or make solely automated decisions about you that produce legal or similarly significant effects.
4. Providers and recipients
Data may be received by authorised people acting on behalf of atstratus S.A. and service providers needed to operate the website and handle correspondence, including:
- Vercel: hosting, content delivery and infrastructure protection. See the Vercel Privacy Notice.
- Google Analytics 4: website measurement after your consent. See Google's Privacy Policy and data processing terms.
- Google Fonts: the website retrieves fonts from Google's servers. Your browser therefore sends technical request data, including your IP address, to Google. Fonts also load without Analytics consent. See the Google Fonts FAQ.
- HubSpot: contact forms, a shared inbox, CRM correspondence history and meeting bookings. Form data are used to answer your enquiry; submitting the form does not subscribe you to a newsletter. See the HubSpot Privacy Policy and Data Processing Agreement.
- Google Calendar, Google Meet and reCAPTCHA: calendar integration, online meetings and form spam protection. reCAPTCHA may process technical data, including your IP address, browser information and interactions with the form. See Google’s Privacy Policy.
- Email and IT service providers: as needed to handle correspondence and maintain our systems.
We may also disclose data to authorities entitled to receive it under applicable law and to advisers where necessary to protect our rights.
5. Transfers outside the EEA
Using global providers may involve processing outside the European Economic Area, including in the United States. Vercel states that it participates in the EU–U.S. Data Privacy Framework. Google's processing terms provide transfer mechanisms, including standard contractual clauses and recognised adequacy mechanisms, depending on the transfer.
HubSpot provides data-transfer mechanisms, including standard contractual clauses, described in its Data Processing Agreement. The provider documents linked above describe these safeguards. To obtain information about transfers affecting your data or a copy of relevant safeguards, contact privacy@atstratus.com.
7. Google Analytics scope
Analytics helps us understand which content is useful and how visitors navigate the website. Measurement includes page views, scrolls, outbound links and file-link clicks. We do not send form-field contents or information from your correspondence, such as your name, email address or message, to Analytics. Automatic form and site-search measurement is disabled. For page views, we remove query parameters and # fragments from the page and referrer addresses we send.
Google Signals, ad personalisation and advertising consent are disabled. The Google Search Console link lets us analyse aggregated data about the website's visibility in search.
8. How long we keep data
- Correspondence: usually for 3 years, unless longer storage is needed to meet legal obligations or establish, exercise or defend legal claims.
- Technical data: for as long as needed to operate and protect the website, subject to the provider's log-retention cycle; incident-related data may be retained until the incident or associated claims are resolved.
- Google Analytics: event-data retention is set to 2 months and user-data retention to 14 months. The user-data period resets on new activity. These settings do not apply to standard aggregated reports, which may remain available longer. More about Google Analytics retention.
- Privacy choices and Analytics cookies: the periods listed in the cookies section.
9. Your rights
Where provided by the GDPR, you can request access and a copy of your data, rectification, erasure, restriction and data portability. You can object to processing based on legitimate interests on grounds relating to your particular situation. Where processing relies on consent, you can withdraw it at any time.
Send requests to privacy@atstratus.com. We may ask for information needed to verify your identity. We respond without undue delay, normally within one month; the period may be extended where permitted by law.
You may complain to a supervisory authority, particularly in the country of your habitual residence, workplace or the alleged infringement. In Poland, this is the President of the Personal Data Protection Office: uodo.gov.pl.
10. Security and minors
We use technical and organisational measures to protect data, including HTTPS connections to the website and restricted data access. No transmission or storage method can guarantee absolute security.
This is a business website and is not directed at people under 16. If you believe that someone under 16 has provided us with personal data, please contact us so we can investigate.
11. Policy changes
We may update this policy when website features, tools or legal requirements change. The current version is published on this page with its update date. If a change requires new consent, we will request it before starting the relevant processing.