Privacy Policy

Version 1.0 · Effective 18 September 2026

Who we are
The controller of your personal data is IT-Dev sp. z o.o., ul. gen. Władysława Sikorskiego 26, 53-659 Wrocław, Poland, registered in the National Court Register (KRS) under number 0000252663, NIP 8971713178, REGON 020240415, operating under the Engagy360 brand (“we”, “us”).

This policy covers people who visit our website, contact us, request a demo, and represent our customers and partners.

It does not cover employees using the EngagyApp mobile application. If your employer gave you EngagyApp, see the EngagyApp Privacy Policy at https://engagy360.com/engagyapp-privacy-policy. For personal data we process on behalf of our customers within the Engagy360 platform, your employer is the controller and we act as a processor under our Data Processing Agreement, published at https://engagy360.com/dpa.
Contact
Email: office@engagy360.com

Post: IT-Dev sp. z o.o., ul. gen. Władysława Sikorskiego 26, 53-659 Wrocław, Poland

Data protection contact: Grzegorz Łuszczyński, gluszczynski@it-dev.pl

What we collect and why

Providing your data is voluntary, but without contact details we cannot reply to you or perform a contract.

What we do	Data	Legal basis	How long we keep it
Answer your enquiry or demo request	Name, business email, phone, company, message	Our legitimate interest in responding (Art. 6(1)(f) GDPR), or steps before a contract (Art. 6(1)(b))	12 months after our last contact, or longer if it leads to a contract
Enter into and perform a contract	Contact details of your company’s representatives, licence contact, data protection contact, order and account data	Contract (Art. 6(1)(b)) and our legitimate interest in managing the customer relationship (Art. 6(1)(f))	Term of the contract, then as under invoicing below
Invoicing and accounting	Billing details, invoices	Legal obligation (Art. 6(1)(c))	5 years from the end of the tax year, as required by Polish law
Provide support	Contact details and the content of your request	Contract (Art. 6(1)(b)) or legitimate interest (Art. 6(1)(f))	24 months from closing the request
Run and secure our website	IP address, browser and device data, pages viewed, server logs	Legitimate interest in security and availability (Art. 6(1)(f))	12 months
Measure and improve the website	Cookie identifiers, usage data, session recordings (see Section 5)	Your consent (Art. 6(1)(a))	As stated in the Cookie Policy
Defend or pursue claims	Any of the above, as relevant	Legitimate interest (Art. 6(1)(f))	Until claims are time-barred, generally 6 years

Where your data comes from
Usually from you: a contact form, an email, a demo request, an order, or a support request. We may also receive your business contact details from your employer when it orders our services, from a reseller, or from Microsoft when the purchase is made through Microsoft Marketplace. We may also obtain publicly available business contact details, for example from your company’s website or LinkedIn.
Cookies and analytics
Our website uses cookies and similar technologies. Beyond those strictly necessary for the site to work, we use them only with your consent, given through the cookie banner and withdrawable at any time.
1. Google Analytics (Google Ireland Limited) gives us statistics about how the site is used.
2. Microsoft Clarity (Microsoft Ireland Operations Limited) shows us how visitors interact with pages, including recordings of sessions and heatmaps of clicks and scrolling. Clarity masks text entered into forms by default.
Both tools use cookie identifiers and your IP address, which are personal data. Details of each cookie and its lifetime are in our Cookie Policy at https://engagy360.com/cookie-policy.
Who we share data with
1. Our IT providers: hosting, email, and the cloud services we use to run our business.
2. Our CRM, marketing and support tools.
3. Our accounting and legal advisers.
4. Google and Microsoft in connection with the analytics tools above.
5. Microsoft, where you purchase through Microsoft Marketplace.
6. Public authorities, where the law requires it.
Each provider processes data on our instructions under a data processing agreement, except where they act as controllers in their own right.
Transfers outside the EEA
We host our systems in the European Union. Some of our providers, including Google and Microsoft, may process data in the United States. Those transfers rely on the providers’ certification under the EU-U.S. Data Privacy Framework or on the European Commission’s Standard Contractual Clauses. You can ask us for details of the safeguards in place.
Your rights
You can ask us to:
1. give you access to your data and a copy of it,
2. correct it,
3. delete it,
4. restrict how we use it,
5. transfer it to another provider, where it is based on consent or a contract and processed automatically,
6. object to processing based on our legitimate interest, including profiling for marketing,
7. withdraw consent at any time, which does not affect processing carried out before the withdrawal.
Write to office@engagy360.com or to our postal address. You can also complain to the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl.
Automated decisions
We do not make decisions about you by automated means, and we do not profile you in a way that produces legal effects or similarly significantly affects you.
If you use Engagy360 at work
If your employer uses Engagy360 for its intranet in Microsoft 365, your employer is the controller of your personal data and decides how it is used. Ask them for their privacy notice. We act only on their instructions, under our Data Processing Agreement.
1. Your profile data, such as your name, job title, department and photo, stays in your employer’s Microsoft 365 environment. We read it when needed to display the intranet and do not store it, except for a technical identifier of your account.
2. We store the reports and requests you submit through the intranet, and the content your employer’s editors create with our tools.
3. We do not use your data for our own purposes, do not sell it and do not use it for advertising.
To exercise your rights, contact your employer. If you write to us instead, we will pass your request to them.
Changes
We update this policy as needed and publish the current version here with a new date.