Privacy Policy

The data controller responsible for your personal data is:

Heorhi Talochka

Biruty 8/50A, 03-504 Warsaw, Poland

Email: team@geeksbureau.com

Information you provide directly:

• Palm photograph (uploaded for reading generation).
• Birth date, birth time, and birth place.
• Name or nickname (optional, for personalization).
• Answers to quiz/preference questions within the reading flow.
• Email address (if provided for reading delivery).

Information collected automatically:

• Device type, browser type, operating system.
• IP address (anonymized for analytics).
• Pages visited, time spent, and interaction data via analytics tools.
• Cookies and similar technologies (see Cookie Policy).

Payment information: We do not collect or store payment card details. All payment processing is handled by Stripe (Stripe, Inc.), a PCI DSS Level 1 certified payment provider. Stripe's privacy policy is available at https://stripe.com/privacy.

We use your personal information for the following purposes:

• To generate and deliver your personalized reading.
• To process payments for paid features via Stripe.
• To improve and optimize the Service through aggregated, anonymized analytics.
• To communicate with you regarding your reading or support inquiries.
• To comply with legal obligations.

We process your personal data on the following legal bases:

• Consent (Art. 6(1)(a)): By uploading your photo and providing personal details, you consent to their processing for reading generation. You may withdraw consent at any time.
• Contract performance (Art. 6(1)(b)): Processing necessary to deliver the service you purchased.
• Legitimate interest (Art. 6(1)(f)): Analytics and service improvement using anonymized data.
• Legal obligation (Art. 6(1)(c)): Where required by applicable law.

Palm photographs: Encrypted and automatically deleted within 24 hours of upload.

Reading results: Stored for up to 30 days to allow you to access your reading, then automatically deleted.

Payment records: Retained for the period required by applicable Polish tax and accounting laws (5 years from the end of the fiscal year in which the transaction occurred).

Analytics data: Aggregated and anonymized; retained for up to 24 months.

We do not sell, rent, or trade your personal data to third parties. We may share limited data with:

• Stripe (Stripe, Inc., USA): For payment processing only. Stripe is certified under the EU-US Data Privacy Framework.
• Analytics providers (e.g., Google Analytics): Anonymized usage data only.
• AI service providers: For reading generation; data is processed under strict contractual obligations (Data Processing Agreements) and not retained by providers beyond processing.
• Law enforcement: Only when required by a valid legal order.

Your data may be transferred to and processed in countries outside the European Economic Area (EEA), including the United States. We ensure appropriate safeguards are in place, including:

• EU-US Data Privacy Framework certification (for US-based providers like Stripe).
• Standard Contractual Clauses (SCCs) approved by the European Commission.
• Adequacy decisions by the European Commission where applicable.

We implement industry-standard technical and organizational security measures, including:

• TLS/SSL encryption for all data in transit.
• Encryption of palm photographs at rest.
• Access controls limiting data access to authorized personnel only.
• Regular security assessments and monitoring.

As a data subject, you have the following rights:

• Right of access (Art. 15): Request a copy of your personal data.
• Right to rectification (Art. 16): Request correction of inaccurate data.
• Right to erasure (Art. 17): Request deletion of your data.
• Right to restrict processing (Art. 18): Request limitation of processing.
• Right to data portability (Art. 20): Receive your data in a structured, machine-readable format.
• Right to object (Art. 21): Object to processing based on legitimate interest.
• Right to withdraw consent (Art. 7(3)): Withdraw consent at any time without affecting the lawfulness of prior processing.
• Right to lodge a complaint: You may file a complaint with the Polish supervisory authority - Prezes Urzedu Ochrony Danych Osobowych (PUODO), ul. Stawki 2, 00-193 Warsaw, Poland, https://uodo.gov.pl.

To exercise any of these rights, contact us at team@geeksbureau.com. We will respond within 30 days.

The Service is not intended for individuals under the age of 18. We do not knowingly collect personal data from minors. If we become aware that we have collected data from a person under 18, we will promptly delete it.

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated effective date. We encourage you to review this page periodically.

For any questions, requests, or complaints regarding this Privacy Policy or your personal data, please contact us at:

Heorhi Talochka

Email: team@geeksbureau.com

Address: Biruty 8/50A, 03-504 Warsaw, Poland