Privacy Policy

I. Introduction

HeroCoders Sp. z o.o. (“HeroCoders”, “we” or “us”) is committed to protecting and respecting your privacy. We want to tell you how we use and protect your personal information (“Personal Data”). This includes informing you of your rights regarding your Personal Data that we hold.

We believe that the EU General Data Protection Regulation (“GDPR”) is an important step forward in the protection of your Personal Data, and we are committed to GDPR compliance across our organization and provide GDPR related assurances in this Privacy Policy (“Policy”). In addition, we also take into account other data protection legislation that may apply to us, most notably, the California Consumer Privacy Act of 2018, as amended by the California Privacy Rights Act (collectively, “CCPA”), which requires us to provide the additional disclosures below regarding our privacy practices. Please refer to the dedicated Section XI of this Policy to know more about your rights under the CCPA.

This Policy covers the information we collect about you when you use our products or services, including all of our SaaS/Cloud software products and our downloadable software products (collectively, the “Apps”) and all public websites (“Website(s)”) provided and/or maintained by HeroCoders, or otherwise interact with us (for example, by contacting us through e-mail or the support portal). We refer to all of these Apps and Websites, together with our other services as “Services” in this Policy.

Depending on the context, “you” means an individual end-user of our Services, a representative or contact person of a Customer, external Contractor, Vendor, Marketing Partner or other organisation interacting with us, a visitor of our public Websites, or another individual who otherwise interacts with us.

Certain processing activities may be subject to separate privacy notices provided directly to the relevant individuals. Where such a notice applies, it supplements or, in relation to the processing described in that notice, replaces the information provided in this Policy.

II. Data controller

The controller of your Personal Data is HeroCoders Sp. z o.o., a company incorporated under the laws of Poland, with its registered office in Gdańsk, Poland (postal code: 80-119) at ul. Zosi 16, entered into the Register of Entrepreneurs of the National Court Register by the District Court Gdańsk-Północ in Gdańsk, VII Commercial Division of the National Court Register, under KRS number: 0000910925, Tax ID: PL5833433174, National Business Registry Number: 389423957, with the share capital of PLN 75,000.00.

You can contact us by e-mail at support@herocoders.com.

Please note that in some cases HeroCoders may act as a processor of Personal Data on behalf of the other data controller. In such cases, HeroCoders does not determine the purposes or means of processing Personal Data. More information in this regard can be found in Section III of this Policy.

III. Notice to End Users

Our Apps are intended for use by organizations. Where the Apps are made available to you through an organization (e.g., your employer), that organization is the administrator of the Apps and acts as a data controller of your Personal Data, while HeroCoders processes it on their behalf as a data processor. If this is the case, please direct your data privacy questions to your administrator, as your use of the Apps is subject to that organization’s policies.

Administrators are able to:

• restrict your access to the Apps and therefore restrict your ability to edit, modify, or delete your Personal Data; and
• access, modify, and remove the information about you.

Even if the Apps are not currently administered or made available to you by an organization, if you use an e-mail address provided by an organization (such as your work e-mail address) to access the Apps, then the owner of the domain associated with your e-mail address (e.g. your employer) may assert administrative control over your account and your use of the Apps at a later date. Please contact your organization or refer to your administrator’s organizational policies for more information.

To the extent that our Apps operate within the Atlassian environment, Atlassian is not responsible for the processing of End User Personal Data by us - we are responsible for the privacy, security, and integrity of End User Personal Data processed by us or our Apps, as described in the Data Processing Agreement and this Policy.

The scope of the Personal Data processed and other details of the respective Personal Data processing activities can be different and depend on the specific App that you choose to use. To make things more comprehensive, we provide more details about this in a separate table available at https://www.herocoders.com/legal/personal-data-access.

Data location

HeroCoders may process Personal Data both within the European Economic Area (“EEA”), e.g. in Poland, as well as outside the EEA, e.g. in the United States.

With respect to the Checklists for Jira Enterprise application, Customers may be able to select a preferred data location for the hosting of certain data, such as Europe or the United States. Such functionality is intended to provide Customers with greater control over the geographic location of hosted data and to support their data residency requirements. Nevertheless, Customers acknowledge that the provision of the Apps may involve certain ancillary or incidental processing activities outside the selected region, where necessary for the operation, support, maintenance, security, or improvement of the Apps and subject to appropriate safeguards required under applicable law. Additional information concerning data residency may be made available through Atlassian’s website https://support.atlassian.com/security-and-access-policies/docs/understand-data-residency/.
‍

Sub-processors

Recipients of Personal Data may include entities supporting HeroCoders in the provision of the Apps, the full list of which is available at https://www.herocoders.com/legal/subprocessors.
‍

Data subjects’ rights

As a processor of Personal Data, we will assist our Customers with responding to individual rights requests that they receive under the GDPR. In many cases, Customers may be able to address these types of requests by logging into the applicable product and using settings available within such product or your account. Where this is not possible, please contact us at  support@herocoders.com to request assistance with any such individual rights requests.

IV. Purposes, legal bases, scopes of Personal Data and retention periods
‍

1. Apps
‍

Purposes of Personal Data processing

If you use our Apps or are responsible for a Customer's use of our Apps, HeroCoders may process Personal Data:

• to conclude, perform, and administer agreements concerning our Apps, including licences, subscriptions, and related billing matters;
• to ensure the proper functioning, security, reliability, and performance of our Apps and to diagnose and resolve technical issues;
• to provide in-app messages, notices, guidance and other communications relating to the use of our Apps;
• to analyse the use of our Apps in order to understand product adoption and usage patterns and to improve and develop our Apps and Services.

Legal basis for Personal Data processing

The legal basis for processing your Personal Data is, depending on the circumstances:

• the necessity to perform the contract or take steps at your request prior to entering into the contract as a party to that contract (Article 6(1)(b) GDPR) - where you are a natural person who is personally a party to the relevant agreement, insofar as processing is necessary to enter into or perform that agreement;
• HeroCoders' legitimate interest (Article 6(1)(f) GDPR) in administering agreements with business Customers and communicating with their representatives, maintaining relevant contractual records and establishing, exercising or defending claims arising from the Customer relationship, administering licences and subscriptions, ensuring the functionality, reliability and security of the Apps, diagnosing technical issues, providing relevant in-app communications, analysing App usage and improving our products and Services;
• compliance with applicable legal obligations (Article 6(1)(c) GDPR) - where licence, subscription, billing or related information must be processed to comply with applicable tax, accounting or other statutory obligations;
• your consent (Article 6(1)(a) GDPR) - where a specific optional in-app communication, functionality or related tracking activity is based on your consent;

Scope of the processed Personal Data

When using our Apps, we may process certain information about you. This information is made accessible to HeroCoders since our Apps need to work together with the host products such as Jira from Atlassian, Microsoft Teams from Microsoft and monday.com from monday.com Ltd.

The scope of the Personal Data processed and other details of the respective Personal Data processing activities can be different and depend on the specific App that you choose to use. To make things more comprehensive, we provide more details about this in a separate table available at https://www.herocoders.com/legal/personal-data-access.

As part of our Apps, we have access to the contact information (e.g., your name, phone number, billing and technical e-mail address) and license information (e.g., number of licenses, term of the license, etc.) you provide when you subscribe to a license for any of our Apps or when you renew maintenance for our Apps on the partner platform.

For App analytics, we may process customer or instance identifiers (including cloudID or similar instance-related information), pseudonymised or randomised user identifiers, feature-interaction and event data, timestamps and related technical metadata. We do not use names, e-mail addresses or readable Atlassian user/account identifiers for such analytics.
‍

Retention period

For Personal Data processed by HeroCoders as a data controller:

• Personal Data processed for Customer contract administration will be retained for the duration of the Customer relationship and thereafter for the period necessary to establish, exercise or defend legal claims. Contractual, tax or accounting documentation subject to statutory retention requirements will be retained for the applicable statutory period;
• operational licence and Customer contact data will generally be retained for the duration of the licence or subscription and for up to one year after its expiry, unless longer retention results from applicable Partner Platform rules or is necessary for legal claims;
• technical logs, diagnostic and error data will generally be retained for no longer than one year;
• Personal Data relating to in-app communications and interactions with those communications will generally be retained for no longer than 12 months;
• App analytics data will generally be retained in pseudonymised or randomised form for no longer than 12 months. Information that has been irreversibly anonymised is no longer Personal Data and may be retained for statistical and analytical purposes.

For Personal Data processed by HeroCoders as a data processor:

SaaS/Cloud Apps

SaaS/Cloud Apps (e.g. Checklists Free/Pro/Enterprise for Jira, Clockwork Lite/Pro for Jira, Portfolio for Jira, Checklist for MS Teams, Clockwork for monday.com) are hosted by HeroCoders. In that case, we may store the information or data provided by you on our secured servers, but we currently utilize a third-party to provide this service. With SaaS/Cloud Apps, we have access to user information as provided in this Policy and https://www.herocoders.com/legal/personal-data-access, which may include data regarding how and when the Apps are utilized.

We store Personal Data for varying lengths of time depending on the circumstances:

• Information you share on the Apps is stored until the End User, who modified or created the text (or any other authorized user), deletes that text and all related information.
• If your account is deactivated, terminated, or disabled, all data and content you have provided or that has been provided on or through your account will remain active and accessible for as long as necessary to allow your team members or other users to make full use of the Apps.
• After uninstalling the App, we store data for up to ninety (90) days to make sure it is there if you want to renew your subscription and start using the App again. If you want us to remove the data earlier, please contact us.

Downloadable Apps

Downloaded Apps provided by Okapya Software Solutions Inc. (www.okapya.com , "Okapya"), through HeroCoders as an exclusive reseller store all information in the Atlassian Jira on-premise product where they are installed. All data is located in your IT system (server or data center) that hosts the Atlassian Jira on-premise product.

No information stored on the installation IT system is made available to us when you download, install, or use these Apps. These Apps do not transmit data from your IT system or from the End-User’s web browser to us or to any third-party, unless you choose to configure it otherwise.

Information received from the Partner Platforms

The contact and license information we collect about our Customers (i.e. company information and contact information of the contact persons) is stored in our databases for a year after the license expires, unless retention is required under applicable platform policies or by law (e.g., Atlassian allows us to see the expired license information in the Marketplace admin section according to the Atlassian and Marketplace policies).

Joint Controllers

In relation to the management of Customer licences and billing for on-premise downloadable Apps provided by Okapya, HeroCoders and Okapya act as joint controllers of the relevant Personal Data to the extent covered by their joint-controller arrangement. You may obtain the essential content of the joint-controller arrangements by contacting us at support@herocoders.com. Irrespective of these arrangements, you may exercise your applicable data-protection rights against either data controller (more information on your rights can be found in  Section X of this Policy).

‍

2. External Contractors, Vendors, Marketing Partners, and their representatives
‍

Purposes of Personal Data processing

HeroCoders may process Personal Data concerning Contractors, Vendors, Marketing Partners, prospective Contractors, Vendors or Marketing Partners and their representatives or contact persons in order to:
‍

• assess prospective Contractors and Vendors, including their business, legal, security, privacy, and compliance suitability;
• establish and manage business relationships;
• negotiate, conclude, perform and administer agreements;
• conduct business correspondence and coordinate ongoing cooperation; and
• where applicable, periodically assess existing Contractors and Vendors and manage third-party risks.

Legal basis for Personal Data processing

The legal basis for processing your Personal Data is, depending on the circumstances:
‍

• the necessity to perform the contract or take steps at your request prior to entering into the contract as a party to that contract (Article 6(1)(b) GDPR) - where the Contractor, Vendor or Marketing Partner is a natural person and processing is necessary to take steps at that person's request before entering into an agreement or to perform that agreement;
• HeroCoders' legitimate interest (Article 6(1)(f) GDPR) in assessing prospective Contractors and Vendors, managing third-party risks, establishing and managing business relationships, concluding and administering agreements with legal entities, communicating with their representatives or contact persons, periodically assessing existing third parties, maintaining relevant business and contractual records, and establishing, exercising or defending legal claims;
• compliance with applicable legal obligations (Article 6(1)(c) GDPR) - where processing is necessary to comply with applicable tax, accounting or other statutory obligations.

Scope of the processed Personal Data

HeroCoders may process identification and business contact data, company affiliation and professional role, contractual and correspondence data, information relating to the relevant business relationship and, where applicable, payment, tax or settlement data. In connection with Contractor or Vendor assessment and management, HeroCoders may also process information contained in security, privacy, compliance, audit or certification documentation necessary to assess the third party and manage related risks.
‍

Retention period

Personal Data relating to prospective Contractors, Vendors or Marketing Partners will generally be retained for the period necessary to conduct the relevant assessment or correspondence and, where cooperation is not established, no longer than three years from the end of the calendar year in which the assessment was completed or the last meaningful contact occurred, unless further retention is necessary for legal claims or compliance purposes.
‍
Where cooperation is established, Personal Data will be retained for the duration of the relevant relationship and thereafter for the period necessary to comply with applicable legal obligations or establish, exercise or defend legal claims. Ordinary correspondence that is no longer necessary for contractual, compliance or claims-related purposes will generally be deleted no later than three years after the end of the relevant relationship. Tax and accounting documentation will be retained for the applicable statutory retention periods.
‍

3. Support Services
‍

Purposes of Personal Data processing

HeroCoders may process your Personal Data to provide and document support services (including technical support), where you request such services or where your Personal Data are relevant to a support request submitted by a Customer or another authorised user.
‍

Legal basis for Personal Data processing

The legal basis for processing your Personal Data is, depending on the circumstances:
‍

• the necessity to perform the contract or take steps at your request prior to entering into the contract as a party to that contract (Article 6(1)(b) GDPR) - where you are a natural person personally party to the relevant agreement and processing is necessary to provide contractual support;
• HeroCoders' legitimate interest (Article 6(1)(f) GDPR), in providing technical support, investigating and resolving reported issues, ensuring the proper functioning, security and reliability of the Services, documenting support activities and establishing, exercising or defending legal claims.

Scope of the processed Personal Data

When you contact us for support, or where your Personal Data are included in a support request submitted by another authorised person, we may process your name, e-mail address, company, role or professional function where relevant, support-ticket information, correspondence, technical information concerning the reported issue and any screenshots, attachments, logs or other materials provided in connection with the support request.
‍

Retention period

Support-case data will generally be retained for the period necessary to investigate and resolve the reported issue and thereafter until the end of the third calendar year following closure of the case, unless longer retention is necessary in connection with an ongoing dispute, legal claim, security incident or legal obligation.
‍

Joint Controllers

Regardless of the information provided above, HeroCoders informs that in the case of a support request concerning on-premise services provided by Okapya Software Solutions Inc., where HeroCoders acts solely as a reseller, HeroCoders and Okapya act as joint controllers of users’ Personal Data for the purpose of providing support services in this regard. You may obtain the essential content of the joint controller arrangements by contacting us at support@herocoders.com. We inform that, irrespective of these arrangements, you may exercise your rights against either of the data controllers (more information on your rights can be found in Section X of this Policy).
‍

4. Websites
‍

Purposes of Personal Data processing

If you use our Websites, HeroCoders may process your Personal Data in order to ensure the functionality and security of the Website, as well as for analytical and statistical purposes.
‍

Legal basis for Personal Data processing

The legal basis for processing your Personal Data is, depending on the circumstances:
‍

• HeroCoders' legitimate interest (Article 6(1)(f) GDPR) in operating and securing the Websites, maintaining necessary technical logs, preventing abuse and detecting or investigating technical or security incidents;
• your consent (Article 6(1)(a) GDPR) - where Personal Data are processed through non-essential preference, statistical/analytics, marketing cookies or similar technologies.

The use of non-essential cookies or similar technologies is additionally subject to applicable consent requirements under the Polish Electronic Communications Law.
‍

Scope of the processed Personal Data

If you visit our Websites, we may automatically collect information about you, for example: technical information, IP addresses, information about the type of device you use to access our Websites, the manner in which you interact with our Websites, and other information collected through cookies or similar technologies.
‍

Retention period

Necessary server, technical, and security logs will generally be retained for no longer than one month, unless further retention is necessary to investigate a technical or security incident or establish, exercise or defend legal claims. Data processed using non-essential cookies or similar technologies will be retained until consent is withdrawn or the applicable cookie/provider retention period expires, as applicable. Records necessary to demonstrate users' cookie choices, including consent or withdrawal records, may be retained for the period necessary to demonstrate compliance and give effect to the user's preferences.
‍

5. Social Media
‍

Purposes of Personal Data processing

HeroCoders may process Personal Data for the purpose of operating and managing its social media profiles, promoting the HeroCoders brand and business activities, communicating with social media users, and carrying out analytical and statistical activities related to social media engagement.
‍

Legal basis for Personal Data processing

The legal basis for processing Personal Data is HeroCoders' legitimate interest (Article 6(1)(f) of the GDPR), consisting of operating and managing social media profiles, promoting the HeroCoders brand and business activities, communicating with users, and carrying out statistical and analytical activities related to social media engagement.
‍

Scope of the processed Personal Data

When you interact with our profiles, we may process Personal Data such as identification data (your name or username) and other data obtained in connection with the operation of our social media profiles (e.g., information provided in comments or private messages).
‍

Retention period

Personal Data processed through social-media platforms will be retained for as long as necessary for the relevant interaction, communication or profile-management purpose and in accordance with the functionality and retention rules of the relevant platform. Where information is exported from the platform or otherwise retained separately by HeroCoders, it will be retained only for as long as necessary for the relevant business, legal or evidentiary purpose.
‍

Joint Controllers

In relation to LinkedIn Page Insights, where applicable, HeroCoders and LinkedIn Ireland Unlimited Company act as joint controllers of the relevant Personal Data to the extent described in LinkedIn's Page Insights Joint Controller Addendum. Other social-media platform providers may process Personal Data as separate controllers or, where applicable, joint controllers in accordance with the rules applicable to the relevant platform. HeroCoders does not have full influence over processing operations independently determined by those providers.

More information regarding social media platforms can be found at:

• LinkedIn: LinkedIn Ireland Unlimited Company (Wilton Place, Dublin 2, Ireland).
  
  The principles of Personal Data processing are available on the website https://pl.linkedin.com/legal/privacy-policy?trk=homepage-basic_footer-privacy-policy.
  
  Information regarding the mutual arrangements between the controllers is available on the website https://legal.linkedin.com/pages-joint-controller-addendum.
• YouTube: Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland)
  
  The principles of Personal Data processing are available on the website https://www.youtube.com/howyoutubeworks/user-settings/privacy/.
  ‍
  

6. Contact with us, sales, and pre-sales
‍

Purposes of Personal Data processing

If you contact us through various communication channels (e.g., by e-mail or via a contact form), HeroCoders may process your Personal Data in order to enable the establishment of contact and to conduct further communication.
‍
Where you contact us regarding our products or Services, request a demo or commercial information, or otherwise request or agree to commercial follow-up, including at an event or conference, we may also process your Personal Data to manage the enquiry, conduct sales and pre-sales communication, provide product demonstrations and manage the prospective Customer relationship.
‍

Legal basis for Personal Data processing

The legal basis for processing your Personal Data is, depending on the circumstances:

• the necessity to perform the contract or take steps at your request prior to entering into the contract as a party to that contract (Article 6(1)(b) GDPR) - where you are a natural person taking steps at your request prior to entering into an agreement with HeroCoders;

• HeroCoders' legitimate interest (Article 6(1)(f) GDPR) in responding to enquiries, managing B2B sales leads and prospective Customer relationships, maintaining appropriate CRM records, conducting commercial and other appropriate follow-up, providing requested product information or demonstrations, and developing business relationships.

Scope of the processed Personal Data

HeroCoders may process Personal Data such as identification data, contact data, company and professional role, product interests, demo/meeting information, event or badge information, source of the lead, correspondence, follow-up notes and CRM status.
‍

Retention period

Personal Data shall be generally processed for the period necessary to conduct correspondence, including responding to submitted questions or requests, and thereafter until the expiry of the limitation period for any potential claims. However, depending on the content of the correspondence, Personal Data may be processed for a longer period, for example in the case of active customers, Personal Data may be processed for the duration of the cooperation and subsequently until the expiration of potential claims. Where the contact concerns a prospective Customer relationship that does not result in cooperation, the data will generally be retained for no longer than three years following the last meaningful interaction.
‍

7. Marketing activities
‍

Purposes of Personal Data processing

HeroCoders may process your Personal Data to send you occasional company news, updates, related Apps and Services, promotions, special offers or service information regarding our Services if you have consented to or requested such communications.
‍

Legal basis for Personal Data processing

The legal basis for the processing of Personal Data is, depending on the circumstances:

• HeroCoders’ legitimate interest (Article 6(1)(f) of the GDPR) in the form of direct marketing. Where required, the use of electronic communications or terminal equipment for direct-marketing purposes is based on your prior consent in accordance with Article 398 of the Polish Electronic Communications Law.
• your consent (Article 6(1)(a) GDPR) - where the processing of Personal Data itself is specifically based on consent.

Marketing activities carried out using electronic means of communication, such as e-mail, are conducted solely after obtaining your consent to receive commercial information. You may withdraw your consent to receive electronic marketing communications and/or object at any time to the processing of your Personal Data for direct-marketing purposes by using the “unsubscribe” feature in the relevant communication or by contacting us directly. If you object to processing for direct-marketing purposes, your Personal Data will no longer be processed for such purposes.
‍

Scope of the processed Personal Data

HeroCoders may process Personal Data such as contact details (e-mail address) and other Personal Data obtained in connection with the conduct of marketing activities.
‍

Retention period

Following withdrawal of the relevant consent or an objection to direct marketing, your Personal Data will be removed from active marketing lists and no further direct-marketing communications will be sent. We may retain the minimum information necessary to record the consent, withdrawal or objection, prevent further communications and establish, exercise or defend legal claims for up to three years.
‍

8. Online meetings
‍

Purposes of Personal Data processing

HeroCoders may process Personal Data in order to organize and conduct an online meeting and, if you give your voluntary consent, to record the meeting and document its course, as well as to transcribe the recording (including automated transcription).
‍

Legal basis for Personal Data processing

The legal basis for the processing of Personal Data is:
‍

• HeroCoders’ legitimate interest (Article 6(1)(f) of the GDPR), consisting of the need to organize and conduct the meeting and to ensure business communications;
• your consent (Article 6(1)(a) of the GDPR) with respect to recording the online meeting and preparing its transcript (including automated transcription).

Scope of the processed Personal Data

HeroCoders may process Personal Data such as:

• Personal Data provided in the electronic forms regarding the meeting request, such as your full name and e-mail address;

• Personal Data obtained during the online meeting, including your voice and any other information shared during the meeting.

Retention period

Personal Data shall be stored for the duration of the online meeting and no longer than 30 days thereafter. Where information obtained in connection with the meeting becomes part of another documented business activity, such as a prospective Customer relationship, Customer, Contractor, Vendor or Marketing Partner relationship, contractual matter or legal claim, the relevant information may be retained under that processing activity for its applicable retention period.
‍
If a meeting is recorded and/or transcribed, the recording and transcript will be erased without undue delay following withdrawal of consent or when no longer necessary for the purpose for which they were created and, in any event, no later than three months from the date of recording. Where particular information must be retained for a legal claim, only the information necessary for that purpose may be retained separately for the applicable period.
‍

9. Trust Center
‍

Purposes of Personal Data processing

When using our Trust Center, HeroCoders may process Personal Data in order to ensure the functionality and security of the Trust Center, provide access to HeroCoders' documents related to data protection and information security, enable the conclusion and administration of a non-disclosure agreement (NDA), and manage voluntary subscriptions to Trust Center update notifications.
‍

Legal basis for Personal Data processing

The legal basis for the processing of Personal Data is:

• HeroCoders’ legitimate interest (Article 6(1)(f) of the GDPR), consisting of the necessity to ensure the functionality and security of the Trust Center, as well as to provide documentation required to demonstrate an adequate level of Personal Data protection and information security;
• HeroCoders’ legitimate interest (Article 6(1)(f) of the GDPR) in concluding and administering NDAs with legal entities and processing Personal Data of their representatives, signatories or contact persons;
• your consent (Article 6(1)(a) of the GDPR) for subscribing to the Trust Center updates;
• the necessity to perform the contract or to take steps at your request prior to entering into the contract (Article 6(1)(b) GDPR) - where you are personally a party to an NDA and processing is necessary to enter into or perform that agreement.

Scope of the processed Personal Data

If you visit the Trust Center, we may automatically collect information about you, such as technical information, IP addresses, information about the type of device you use to access the Trust Center, the manner in which you interact with it, and other information collected through cookies or similar technologies.
‍
If you subscribe to Trust Center updates, HeroCoders may process Personal Data such as contact details.
‍
If you submit a request for access to documents, HeroCoders may process Personal Data such as identification data, contact details, and the name of the entity.
‍

Retention period

Personal Data shall be stored for the period necessary to ensure the functionality and security of the Trust Center.
‍
In the case of subscribing to Trust Center updates, Personal Data may be processed until you withdraw your consent or in accordance with platform (Vanta) retention rules, whichever occurs first. Records necessary to demonstrate the granting or withdrawal of consent may be retained for the period necessary to demonstrate compliance or defend against legal claims.
‍
Data relating to document-access requests will be retained for as long as necessary to provide and administer the relevant access and thereafter only where required for security, accountability or legal-claims purposes. Where an NDA is concluded, Personal Data contained in or associated with the NDA will be retained for the duration of the agreement and thereafter until expiry of the applicable limitation periods, unless longer retention is required by law or in connection with a specific legal claim.
‍

10. Status Page
‍

Purposes of Personal Data processing

When using the Status Page, HeroCoders may process Personal Data in order to ensure the functionality and security of the Status Page, as well as to provide notifications regarding the operation of our Apps.
‍

Legal basis for Personal Data processing

The legal basis for the processing of Personal Data is:

• HeroCoders’ legitimate interest (Article 6(1)(f) of the GDPR), consisting of the necessity to ensure the functionality and security of the Status Page;
• your consent (Article 6(1)(a) of the GDPR) for subscribing to status notifications about our Apps.

Scope of the processed Personal Data

If you visit the Status Page, we may automatically collect information about you, such as technical information, IP addresses, information about the type of device you use to access the Status Page, the manner in which you interact with it, and other information collected through cookies or similar technologies. Depending on the notification channel selected, this may include an e-mail address, telephone number or Slack workspace/channel or integration-related information.
‍

Retention period

Personal Data shall be stored for the period necessary to ensure the functionality and security of the Status Page. In the case of subscribing to notifications, Personal Data may be processed until you withdraw your consent or in accordance with platform (Atlassian Statuspage) retention rules, whichever occurs first. Records necessary to demonstrate the granting or withdrawal of consent may be retained for the period necessary to demonstrate compliance or defend against legal claims.
‍

11. Competitions and promotional contests
‍

Purposes of Personal Data processing

HeroCoders may process Personal Data to organise and administer competitions and promotional contests, including managing entries, verifying eligibility, selecting winners, delivering prizes, handling enquiries or complaints and complying with applicable legal obligations.
‍

Legal basis for Personal Data processing

The legal basis for the processing of Personal Data is, depending on the circumstances:

• the necessity to perform the contract or to take steps at your request prior to entering into the contract (Article 6(1)(b) of the GDPR) - where processing is necessary to administer the competition arrangement with the participant;
• HeroCoders’ legitimate interest (Article 6(1)(f) GDPR) in preventing fraudulent or invalid entries, enforcing competition rules, handling complaints, documenting the competition and establishing, exercising or defending legal claims;
• compliance with applicable legal obligations (Article 6(1)(c) GDPR) regarding tax, accounting, reporting and other statutory obligations relating to the competition or prize.

Scope of the processed Personal Data

HeroCoders may process Personal Data such as: identification and contact information, entry and participation data, eligibility information, competition-related content, winner-selection information, prize and delivery details, correspondence and, where necessary in relation to a prize, tax or accounting information.
‍

Retention period

Data will be retained for the period necessary to administer and close the competition. Information necessary to document participation, eligibility, results, complaints or compliance with competition rules may generally be retained for up to three years after the end of the competition. Information relating to prizes and applicable tax/accounting obligations may be retained for the applicable statutory periods.
‍

12. Event, media, and promotional content
‍

Purposes of Personal Data processing

HeroCoders may record, use and publish photographs, video or audio recordings and other event, media or promotional content for documentation, communication, and promotional purposes.
‍

Legal basis for Personal Data processing

The legal basis for the processing of Personal Data is, depending on the circumstances:
‍

• the necessity to perform the contract or to take steps at your request prior to entering into the contract (Article 6(1)(b) of the GDPR) - where recording, production or publication is necessary to perform an agreement directly concluded with an individual speaker, guest or other participant;
• HeroCoders’ legitimate interest (Article 6(1)(f) GDPR) in documenting and communicating our activities through general event, crowd or contextual materials where the processing is proportionate and within the reasonable expectations of the persons concerned;
• your consent (Article 6(1)(a) GDPR) for individually focused, optional or specifically agreed promotional use of a person's image, likeness, voice or submitted content where consent is required or selected as the basis.

Scope of the processed Personal Data

HeroCoders may process Personal Data such as: image and likeness, voice, photographs, video/audio recordings, name, professional role/company affiliation, statements/interviews and other content contributed or submitted in connection with an event or promotional activity.
‍

Retention period

Materials processed on the basis of legitimate interests will be retained while they remain relevant and necessary for the applicable documentation, communication or promotional purpose and will be reviewed periodically, at least once every three years.
‍
Where processing is based on consent, the relevant material will be processed until consent is withdrawn or the agreed promotional purpose ends, whichever occurs first. Following withdrawal, HeroCoders will cease further use and remove the relevant material from publication channels under its control without undue delay, unless continued retention is required by law or necessary to demonstrate the consent or establish, exercise or defend legal claims.

Legal basis for Personal Data processing

The legal basis for the processing of Personal Data, depending on the relevant purpose, is:
‍

• the necessity to perform the contract or to take steps at your request prior to entering into the contract (Article 6(1)(b) of the GDPR) - where processing is necessary for the performance or settlement of an agreement with a natural person;
• compliance with applicable legal obligations (Article 6(1)(c) GDPR) - where necessary to comply with a legal obligation;
• HeroCoders’ legitimate interest (Article 6(1)(f) GDPR) in business administration, compliance, security, audits, corporate transactions, business analysis or legal protection.

Where special categories of Personal Data are exceptionally necessary for the establishment, exercise or defence of legal claims, Article 9(2)(f) GDPR may additionally apply.
‍

Scope of the processed Personal Data

Depending on the relevant purpose, HeroCoders may process identification and contact data; professional, organisational and business-relationship information; contractual, transaction, payment and settlement data; correspondence and dispute-related information; App, Website, communication and usage information; access, account, system, security and audit records; image, likeness or voice where relevant; and other information necessary for the relevant administrative, compliance, security, transaction or legal purpose.
‍

Retention period

Accounting, tax and payment documentation will be retained for applicable statutory retention periods, generally five years calculated in accordance with the applicable law.
‍
Documentation concerning data-subject requests will generally be retained for no longer than three years from the end of the calendar year in which the request was completed.
‍
Security incident and breach documentation necessary for accountability, security governance or evidentiary purposes may generally be retained for up to five years after closure of the incident, while detailed technical information will be deleted earlier when no longer necessary.
‍
Personal Data processed for audits, regulatory matters or corporate transactions will be retained for the relevant process and thereafter only for the period necessary to document the outcome, comply with applicable obligations or establish, exercise or defend legal claims.
‍
Personal Data processed for internal administration, management reporting or business analysis will not be retained longer than permitted by the retention period applicable to the related processing activity and will be deleted or irreversibly anonymised when no longer necessary for the relevant administrative or analytical purpose.
‍
Data necessary for actual or reasonably anticipated legal claims may be retained until expiry of the applicable limitation period and, where proceedings are initiated, until their final conclusion and enforcement where applicable.
‍
Please note: where HeroCoders acts as a data processor, we will process your Personal Data (including covered by the User Content as defined in our Terms of Service) on behalf of our customers. More information in this regard may be obtained in Section III of this Policy.

V. Sources of obtaining Personal Data

Personal Data may have been obtained:

• directly from you (e.g., if you complete an online form, contact us via the available communication channels, or use our Services), or
• from third-parties, for example your employer or other organisation you represent, event organisers or lead-capture tools where you have requested or agreed to commercial follow-up, business partners or other persons involved in arranging a meeting or business interaction;
• from publicly available professional or business sources where necessary for legitimate business-verification purposes, or
• via Partner Platforms - as part of our Services, we have access to the contact details (e.g., your name, phone number, and e-mail address) and licensing information (e.g., number of licenses, license term, etc.) that you provide when you subscribe to a license for any of our Apps or when you renew maintenance for our Apps on a Partner Platform.

VI. Personal Data recipients

HeroCoders will share the information we have collected about you (including your Personal Data) only if we are required to do so by law, or if:

• HeroCoders engages certain service providers to process information to support our business and our Services;
• HeroCoders engages prospective investors and/or advisers in connection with potential investments, financings, or other corporate transactions, which may involve the sharing of information solely for due diligence purposes, subject to appropriate confidentiality obligations and adequate safeguards;
• a third party acquires HeroCoders, substantially all of its assets, or the relevant part of its business, in which case relevant Personal Data held by HeroCoders may be disclosed or transferred as part of the transaction, subject to applicable data-protection requirements;
• it is necessary in order to protect the rights, property, or safety of HeroCoders, our Customers or others;
• professional advisers, including legal, tax and accounting advisers, auditors and assurance providers, insurers, cybersecurity or forensic advisers, banks and payment institutions, investors, financing parties and transaction counterparties and their advisers, competent supervisory or other public authorities, law-enforcement bodies and courts, where disclosure is necessary for the relevant purpose;
• where relevant to competitions or the publication of event or promotional content, prize or delivery providers, event or media partners, social-media and other publication platforms, and members of the public;
• other participants in meetings or business communications, and event or conference organisers, where disclosure is necessary for the relevant interaction, event participation or agreed follow-up.

We reserve the right, consistent with data privacy and other user data protection requirements applicable to the jurisdiction where Personal Data is stored, and if mandated by applicable law, regulation, legal process, or governmental order, to disclose user Personal Data or other information, but only to the extent required to satisfy those laws, regulations, or orders. Unless prohibited by law or other order, we will provide reasonable notice of any such required or requested disclosure to you and reasonably cooperate to limit such disclosure to the extent allowed by law.

VII. Obligation to provide Personal Data

Providing Personal Data is generally voluntary, but it may prove necessary in order to achieve the purposes of processing. In some cases, providing the Personal Data may be mandatory where this obligation results from applicable laws. Refusing to provide the Personal Data may make it impossible to achieve the purposes of processing, e.g. it may prevent us from establishing a business relationship or contact, participating in an online meeting, or using our Services.

VIII. Data transfers

HeroCoders may process Personal Data both within the EEA, e.g. in Poland, as well as outside the EEA, e.g. in the United States. Where your Personal Data is transferred outside the EEA, we will transfer the Personal Data to a country in respect of which the European Commission has issued an adequacy decision, or will implement appropriate safeguards to protect your Personal Data, including the Standard Contractual Clauses adopted by the European Commission. You may obtain a copy of these safeguards by contacting us at support@herocoders.com.

IX. Automated decision-making, including profiling

HeroCoders does not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you within the meaning of Article 22 GDPR.

X. Your rights

HeroCoders, as a data controller, will respect your legal rights to your Personal Data.  Below are the legal rights that you have under law:
‍

The right to access

You have the right to access your information, including obtaining a copy thereof. Please contact HeroCoders at support@herocoders.com if you have any questions or you wish to access the Personal Data HeroCoders holds about you or wish to obtain a copy thereof.
‍

The right to rectification

If the information HeroCoders holds about you is inaccurate or not complete, you have the right to ask us to rectify it. Please contact us at support@herocoders.com if you need us to rectify your information.
‍

The right to erasure

This is sometimes called ‘the right to be forgotten’. If you want HeroCoders to erase all your Personal Data (provided we do not have a legal reason to continue to process and hold it), please contact us at support@herocoders.com.
‍

The right to restrict processing

You have the right to ask HeroCoders to restrict how we process your Personal Data. If you want us to restrict processing of your Personal Data, please contact us at support@herocoders.com.
‍

The right to data portability

You have the right to receive your Personal Data in a structured, commonly used, machine-readable format and to transmit those Personal Data to another data controller, in the cases provided for by law. If you wish to exercise your right to data portability, please contact us at support@herocoders.com.
‍

The right to object

You have the right to object to HeroCoders processing your Personal Data to the extent that your Personal Data is processed on the basis of HeroCoders’ legitimate interests. If you wish to object, please contact us at support@herocoders.com.
‍

The right to object to direct marketing

Where your Personal Data are processed for direct-marketing purposes, you have the right to object to such processing at any time. This right is not dependent on your particular situation. If you object, your Personal Data will no longer be processed for direct-marketing purposes. You may exercise this right by using the “unsubscribe” functionality in the relevant marketing communication or by contacting us at support@herocoders.com.
‍

The right to withdraw consent

If you have given us your consent to process your Personal Data but change your mind later, you have the right to withdraw your consent at any time, which will not affect the lawfulness of the processing carried out on the basis of your consent before it was withdrawn. If you want to withdraw your consent, please contact us at support@herocoders.com.
‍

The right to complain to a Supervisory Authority

You have the right to lodge a complaint with a competent Data Protection Authority, in particular the one in the EEA country of your habitual residence or place of work – in accordance with the applicable laws. We encourage you to inform us of your request before lodging a complaint with the supervisory authority, which will allow us to ensure that your rights are properly exercised.
‍

XI. California privacy rights

If you are a California resident, the provisions in this section apply in addition to the rest of this Policy. The CCPA requires us to provide the additional disclosures below regarding our privacy practices.
‍
For purposes of this Section XI, references to “Personal Data” mean “Personal Information” as defined under the CCPA.
‍

Personal Data we collect

Over the last twelve (12) months, we have collected the types of Personal Data listed below:

• Identifiers, such as name, e-mail address, IP address or online identifiers;
• Commercial information, such as information concerning products, licences, subscriptions, transactions, competitions or prizes;
• Internet or other electronic network activity information, such as information concerning interaction with our Websites, Apps or online Services;
• Professional or employment-related information, such as company affiliation, position or professional role;
• Audio, electronic, visual or similar information, such as photographs, video, voice or meeting/event recordings.

Please note that we may share the Personal Data with our service providers for business purposes (so service providers can deliver their services to us). We do not sell or share Personal Data as the terms “sell” and “share” are defined under the CCPA. More information about the disclosure of Personal Data can be found in Section VI of this Policy.

During the preceding twelve (12) months, HeroCoders may have disclosed the categories of Personal Information identified above, as applicable, to service providers and contractors for business purposes, including hosting and infrastructure, security, analytics, communications, customer and technical support, business administration, accounting and payment processing, and other purposes described in Section IV and VI of this Policy.

HeroCoders does not use or disclose Sensitive Personal Information for purposes that give rise to a right to limit its use or disclosure under the CCPA. HeroCoders does not sell or share the Personal Information of consumers under 16 years of age.

More information on the purposes for collecting Personal Data and the length of time we intend to retain Personal Data can be found in Section IV of this Policy, and more information on the categories of sources from which Personal Data is collected can be found in Section V of this Policy.
‍

Your rights

You are entitled to certain rights over your Personal Data under the CCPA. Specifically, as a resident of California, you have the right to:

• know about the categories and specific pieces of Personal Data that we have collected about you and access a copy of your Personal Data (“Right to Know”);
• have inaccurate Personal Data about you corrected (“Right to Correction”);
• request deletion of your Personal Data that we have collected (“Right to Deletion”);
• opt out of the sale or sharing of your Personal Data (“Right to Opt-Out”). Please note that HeroCoders does not sell or share Personal Data as those terms are defined under the CCPA.

You may designate an authorized agent to submit a request on your behalf to exercise your rights. In such a case, the agent must be authorized with documented, signed permission to submit the request (e-mail shall be sufficient). Please note that we may ask you and/or your agent to provide certain information to verify your and/or your agent’s identity and authorization before fulfilling the request. The information we request will depend on your prior interactions with us.

We undertake to treat you like everyone else and not discriminate against you if you choose to exercise your rights. To submit the request to exercise your rights, you or your authorized agent can send an e-mail to support@herocoders.com.

XII. Cookies
‍

What are cookies?

Cookies are small files which are stored on a user’s computer or other electronic device. They are designed to hold a modest amount of data specific to a particular client and website. This allows the server to deliver a page tailored to a particular user, or the page itself can contain some script which is aware of the data in the cookie and so is able to carry information from one visit to the website to the next.
‍

Enabling and disabling cookies

We can place cookies on your device by default if they are strictly necessary for the use of our Websites. For all other types of cookies, we need your consent.
‍
Unless you choose otherwise, we can store and process only those cookies that are necessary for the operation of our Websites. If you don’t want to be tracked by other types of cookies, you can refuse to give your initial consent or opt out later.
‍
Cookie settings on the Websites (i.e., providing or withdrawing consent, or selecting which cookies we may use) can be managed in the following ways:

• directly from our Websites – by making a selection via the cookie banner displayed when you visit the Website, and then by clicking the cookie icon located in the bottom left corner of the Website;
• through the cookie settings in your web browser. Below you will find information on how to manage cookies in the following browsers:
  
  a) Mozilla Firefox: https://support.mozilla.org/en-US/kb/websites-say-cookies-are-blocked-unblock-them  
  b) Chrome: https://support.google.com/chrome/answer/95647?hl=en&sjid=13193149854576902628-EU   
  c) Edge: https://support.microsoft.com/en-au/windows/manage-cookies-in-microsoft-edge-view-allow-block-delete-and-use-168dab11-0753-043d-7c16-ede5947fc64d  
  d) Opera: https://help.opera.com/en/latest/web-preferences/  
  e) Safari: https://support.apple.com/en-gb/guide/safari/ibrw850f6c51/mac
  

You may also view your browser’s help pages or information on how to manage cookies at https://allaboutcookies.org.
‍

What types of cookies do we use?

We use various types of cookies on our Websites.
‍
Cookies may be classified according to their storage duration, purpose, and the entity placing the cookie:

According to storage duration:

• session cookies – stored until you close your browser.
• persistent cookies – remain on your device after closing the browser for a specified period or until you delete them manually.

According to their purpose:

• necessary (technical) cookies – these cookies are essential for the functioning of our Websites and therefore cannot be disabled. Their use does not depend on your consent. You can configure your browser to block these cookies or to notify you about them. However, certain elements of our Websites may not function properly without them. Necessary cookies are used only to provide functionality that is essential to the operation, security or use of our Websites.
• preferences cookies – these cookies make our Websites more efficient and more personalized. They are used to tailor our Websites’ operation to your needs. They may be set by us or by third-party providers whose services we use on our Websites. If you do not allow these cookies, some or all of these services may not function correctly. These cookies may only be used based on your consent.
• statistics cookies – these cookies help us understand how users interact with our Websites, which enables us to improve its content and the services available on it. They help us measure visitor numbers and traffic sources, allowing us to enhance our Websites’ performance. They enable us to determine which parts of our Websites are most popular and how visitors navigate through it. These cookies may only be used based on your consent.
• marketing cookies – these cookies are used to remember your preferences and display advertising content that matches your expectations. These cookies may also be set on our Websites by advertising partners, who may use them to build profiles of your interests and to display advertisements on other websites. These cookies may only be used based on your consent. If you do not allow them, the content displayed on our Websites will be less personalized.

Detailed information about the cookies we use, including their descriptions and storage durations, can be found in the cookie banner by clicking on “Details”.

According to the entity placing the cookie:

• first-party cookies – cookies placed on our Websites by us.
• third-party cookies – cookies placed on our Websites by our advertising partners or other service providers. The providers that place cookies on our Websites are listed in the information displayed in the cookie banner. To obtain more information about how they use cookies, please refer to the relevant third-party website and review the privacy policies of the entities that provide such cookies.

Information collected through cookies or similar technologies may constitute Personal Data where it identifies, relates to, or can reasonably be linked to an identifiable individual. Where such information constitutes Personal Data, it is processed in accordance with this Policy. Please note that cookie providers may act as separate controllers of Personal Data.

XIII. Google Analytics

We use Google Analytics to analyze traffic on the Websites and the activities undertaken by you while browsing the Websites, as well as to create reports on the functioning of our Websites. Through this tool, we process statistical and analytical information related to the users of our Websites. You may additionally opt out of Google Analytics data collection by installing Google’s Analytics Opt-out Browser Add-on (please note that if you do not consent to the use of cookies originating from Google Analytics, they will not be used, regardless of whether the aforementioned plugin is installed).

Further information on the terms of use and data protection can be found on the following websites: https://www.google.com/analytics/terms/gb.html and https://policies.google.com/?hl=en.

XIV. Links to other websites

From time to time, the Websites or Services may contain links to and from other websites, advertisers, and affiliates. The Websites may also contain links to social media platforms. If you follow a link to any of these websites or social media platform, please note that these websites or social media platform may have their own privacy notices and that we do not accept any responsibility or liability for any such notices. Please check these notices, where available, before you submit any Personal Data to these websites or social media platforms.

XV. Data Protection Officer (DPO)

HeroCoders’ Data Protection Officer contact information:

Paweł Maliszewski
HeroCoders sp. z o.o.
Ul. Zosi 16, 80-119 Gdańsk
Poland

You can contact the Data Protection Officer by e-mail at dpo@herocoders.com.

XVI. Changes to this Policy

HeroCoders may change this Policy from time to time in the future. Any such changes will be posted here and, where appropriate, notified to you in document form, for example through notifications in the Trust Center (you can subscribe to such notifications here). We advise you to check back frequently to see any updates or changes.