Privacy Policy

1. Data controller

The controllers are:

• Bohdan Shtohryn: unregistered business activity (Poland)
• Anton Musiienko: unregistered business activity (Poland)

We operate under the brand Aesthetic Branding Institute (ABI) at abi.business.

2. Contact for privacy requests

Email: abi.cooperation@gmail.com
Phone: +48 452 759 393

3. Data we collect

Contact form: name (required), email address (required), message content (required), phone number (optional), selected plan (optional).

Technical data: when you visit the site, the hosting server logs data such as your IP address, date and time, and browser type. See sections 5 and 6.

Browser storage: your cookie consent choice, theme, language, and the plan selected in the pricing section. Details are in our Cookie Policy.

4. Purposes and legal bases (GDPR Art. 6)

• Responding to enquiries and correspondence: Art. 6(1)(b) (steps taken at your request before entering into a contract) and Art. 6(1)(f) (legitimate interest: replying to a person who contacted us, and establishing, pursuing or defending legal claims related to that correspondence).
• Internal handling of enquiries (notifying the team about a new enquiry): Art. 6(1)(f), for the same purpose as above.
• Analytics and Google tags: Art. 6(1)(a) (consent given through the cookie banner). Storing and reading information on your device: Art. 173 of the Polish Electronic Communications Law (Prawo telekomunikacyjne).

5. Recipients

Your data may be shared with the recipients below. For each, we state the role, the country of processing, and the transfer mechanism outside the European Economic Area (EEA).

• Supabase (Supabase Inc.): form database and the function that processes form submissions. Role: processor. Storage: project region (EU).
• Resend: email notification of a new enquiry. Role: processor.
• Telegram: team chat notification (name, email, phone, plan, message content). Role: internal team communication tool.
• Vercel: site hosting and server logs. Role: processor.
• Google Ireland Limited (and Google LLC): Google Ads conversion tag, loaded only after consent to analytics cookies.

We use data processing agreements (Art. 28 GDPR) with processors where required. If a provider processes data outside the EEA, we rely on GDPR transfer mechanisms (e.g. standard contractual clauses).

6. Retention

Contact form data: up to 24 months after the last contact, or until a valid erasure request or objection, whichever comes first, unless the law requires longer storage.

Copies of notifications sent by email and Telegram are kept for the same period, unless the law requires longer storage.

Hosting server logs: according to the hosting provider's policy (Vercel).

7. Your rights

You have the right to: access your data (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), objection (Art. 21), and withdrawal of consent at any time (Art. 7(3)). Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal.

You can change or withdraw your cookie consent in Cookie settings in the footer of the site.

Send requests to abi.cooperation@gmail.com. You may lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (UODO), uodo.gov.pl.

8. Voluntary data

Providing data in the contact form is voluntary. However, your name, email address and message are needed to reply to your enquiry; without them we cannot process it.

9. Automated decisions

We do not make decisions about you based solely on automated processing, including profiling, that would produce legal effects or similarly significantly affect you.