RawQuotes Privacy Policy

This Privacy Policy (hereinafter: "Policy") contains information about the processing of your personal data in connection with using the "RawQuotes" application, operating at the internet address https://app.rawquotes.io, together with its informational website available at https://rawquotes.io (hereinafter: "Application").

Any terms written with a capital letter that are not otherwise defined in the Policy have the meaning given to them in the Terms, available at: https://rawquotes.io/terms.

Controller of personal data

The Controller of your personal data is Eryk Sidor, running a business under the name: Codelab Eryk Sidor (address of the permanent place of business: ul. Henryka Wolińskiego 26/42, 20-491 Lublin, Polska), entered into the Central Register and Information on Economic Activity kept by the minister competent for the economy, holding NIP: 7142049824, REGON number: 380070902 (hereinafter: "Controller").

If you respond to a Survey displayed on a website, or your feedback was added to the Application by one of our customers (a Customer), the controller of your data is that Customer, not the Controller — for details, see the section "If you respond to a Survey or your feedback was added to the Application" below.

Contact with the Controller

In all matters related to the processing of personal data you can contact the Controller by:

• email — at: support@rawquotes.io;
• traditional mail — at: ul. Henryka Wolińskiego 26/42, 20-491 Lublin, Polska.

Data Protection Officer

The Controller has not appointed a Data Protection Officer. In all matters concerning the protection of personal data, contact the Controller in the manner indicated above.

Personal data protection measures

The Controller applies modern organisational and technical safeguards to ensure the best possible protection of your personal data, and guarantees that it processes it in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter: "GDPR"), the Act of 10 May 2018 on the Protection of Personal Data (Ustawa z dnia 10 maja 2018 r. o ochronie danych osobowych), and other provisions on the protection of personal data.

A description of the technical safeguards in use is available at rawquotes.io/security#safeguards.

Information about processed personal data

Using the Application requires the processing of your personal data. Below you will find detailed information about the purposes and legal bases of the processing, as well as the period of processing and whether providing the data is mandatory or voluntary.

Conclusion and performance of the Account Service Agreement

• Personal data processed: name (or another display name), email address, password (in the form of a cryptographic hash), date of email address verification, date of last login.
• Legal basis: Article 6(1)(b) GDPR (the processing is necessary for the performance of the Account Service Agreement concluded with the data subject, or to take steps at their request prior to concluding it).
• Voluntariness: providing the above personal data is a condition for concluding and performing the Account Service Agreement (providing it is voluntary, but the consequence of not providing it will be the inability to conclude and perform the aforementioned agreement, including creating an Account).
• Processing period: the Controller will process the above personal data until the Account is deleted, and after that time — until claims arising from the Account Service Agreement become time-barred.

Conclusion and performance of the Application Usage Service Agreement

• Personal data processed:
  • first and last name or company name,
  • email address,
  • residential/business address (street, house number, apartment number, town, postal code, country),
  • VAT ID (required for a paid Plan),
  • customer identifier at the Payment Operator, and information about the Plan and Subscription.
  
  You provide your billing data (company name, address, country and VAT ID) in the Account settings in the Application; the Controller passes it to the Payment Operator (Stripe) to the extent necessary to process the payment. The Controller does not receive or store the full data of your payment card.
• Legal basis: Article 6(1)(b) GDPR (the processing is necessary for the performance of the Application Usage Service Agreement concluded with the data subject, or to take steps at their request prior to concluding it).
• Voluntariness: providing the above personal data is a condition for concluding and performing the Application Usage Service Agreement (providing it is voluntary, but the consequence of not providing it will be the inability to conclude and perform that agreement).
• Processing period: the Controller will process the above personal data until claims arising from the Application Usage Service Agreement become time-barred.

Granting Invited Users access to the Account

• Personal data processed: the email address of the person being invited, and, once the invitation is accepted — the data indicated in the "Conclusion and performance of the Account Service Agreement" module.
• Source of data: the email address of the person being invited is provided by the Customer sending the invitation.
• Legal basis: Article 6(1)(f) GDPR (the processing is necessary for the purposes of the legitimate interests pursued by the Controller, in this case enabling the Customer to grant access to the Account to persons acting on its behalf).
• Voluntariness: providing the above personal data is voluntary, but necessary in order to send the invitation (the consequence of not providing it will be the inability to grant access to the Account).
• Processing period: until the invitation expires (7 days), and once it is accepted — in accordance with the "Conclusion and performance of the Account Service Agreement" module; in every case until an effective objection is raised.

Handling complaints

• Personal data processed: first and last name, email address.
• Legal basis: Article 6(1)(c) GDPR (the processing is necessary for compliance with a legal obligation to which the Controller is subject, in this case the obligations of:
  • responding to a complaint — Article 7a of the Consumer Rights Act;
  • fulfilling the Customer's rights arising from the provisions on the Controller's liability in the event of Non-conformity of the Digital Performance with the Agreement concerning its provision).
• Voluntariness: providing the above personal data is a condition for receiving a response to a complaint or for exercising the Customer's rights arising from the provisions on the Controller's liability in the event of Non-conformity of the Digital Performance with the Agreement concerning its provision (providing it is voluntary, but the consequence of not providing it will be the inability to receive a response to the complaint and to exercise the aforementioned rights).
• Processing period: the Controller will process the above personal data for the duration of the complaint procedure, and, where the Customer's rights are exercised — until they become time-barred.

Conducting the verification procedure and examining appeals against decisions on the handling of impermissible content

• Personal data processed: first and last name/name, contact details, including email address.
• Legal basis: Article 6(1)(c) GDPR (the processing is necessary for compliance with a legal obligation to which the Controller is subject, in this case the obligations of:
  • providing a mechanism for reporting impermissible content (Article 16 of Regulation (EU) 2022/2065 on a Single Market For Digital Services and amending Directive 2000/31/EC (Digital Services Act) (hereinafter: "DSA"));
  • examining complaints (Article 20 DSA)).
• Voluntariness: providing the above personal data is a condition for receiving a response to a report or for exercising the User's rights arising from the DSA (providing it is voluntary, but the consequence of not providing it will be the inability to receive a response to the report and to exercise the aforementioned rights).
• Processing period: the Controller will process the above personal data for the duration of the verification and appeal procedure, and, where the User's rights are exercised — until they become time-barred.

Handling requests submitted by Users

• Personal data processed: name, email address, other data contained in a message to the Controller (including a message requesting an export of Account data).
• Legal basis: Article 6(1)(f) GDPR (the processing is necessary for the purposes of the legitimate interests pursued by the Controller, in this case responding to a request received).
• Voluntariness: providing the above personal data is voluntary, but necessary in order to receive a response to the request (the consequence of not providing it will be the inability to receive a response).
• Processing period: the Controller will process the above personal data until an effective objection is raised, or the purpose of the processing is achieved (whichever of the above events occurs first).

Publishing Reviews of the services

• Personal data processed: name, optionally — other data contained in the Review.
• Legal basis: Article 6(1)(f) GDPR (the processing is necessary for the purposes of the legitimate interests pursued by the Controller, in this case making the Review available for informational and promotional purposes).
• Voluntariness: providing the above personal data is voluntary, but necessary in order to add the Review (the consequence of not providing it will be the inability to add the Review).
• Processing period: the Controller will process the above personal data until an effective objection is raised, or the purpose of the processing is achieved (whichever of the above events occurs first).

Fulfilling tax obligations (including issuing VAT invoices, retaining accounting records)

• Personal data processed: first and last name/company name, residential/registered address, NIP or another tax identification number.
• Legal basis: Article 6(1)(c) GDPR (the processing is necessary for compliance with a legal obligation to which the Controller is subject, in this case obligations arising from tax law).
• Voluntariness: providing the above personal data is voluntary, but necessary for the Controller to fulfil its tax obligations (the consequence of not providing it will be the inability of the Controller to fulfil the aforementioned obligations).
• Processing period: the Controller will process the above personal data for a period of 5 years from the end of the year in which the deadline for paying the tax for the preceding year fell.

Verifying the tax status of the contracting party

• Personal data processed: company name, address of the registered office or permanent place of business, country, VAT ID or NIP, and the public register's response to the query about that number (including the date of the check and the query identifier assigned by the register).
• Source of data: you provide the company name, address, country and number in the Account settings; for verification, the Controller passes the number to the public register competent for the country of the registered office and receives its response. These registers are: the list of VAT taxpayers kept by the Head of the National Revenue Administration and the REGON register kept by the President of Statistics Poland (Poland), the VIES system operated by the European Commission (other Member States of the European Union), and the UID register kept by the Swiss Federal Statistical Office (Switzerland).
• Legal basis: Article 6(1)(c) GDPR (the processing is necessary for compliance with a legal obligation to which the Controller is subject, in this case documenting the status of the contracting party for the purposes of value added tax).
• Voluntariness: providing the above personal data is voluntary, but necessary to purchase a paid Plan (the consequence of not providing it, or of a negative verification result, will be the inability to conclude the Application Usage Service Agreement for a paid Plan).
• Processing period: the Controller will process the above personal data for a period of 6 years from the end of the calendar year in which the check was carried out, also after the Account has been deleted.

Fulfilling obligations related to the protection of personal data

• Personal data processed: first and last name, the contact details you provide (email address; correspondence address; phone number).
• Legal basis: Article 6(1)(c) GDPR (the processing is necessary for compliance with a legal obligation to which the Controller is subject, in this case obligations arising from the provisions on the protection of personal data).
• Voluntariness: providing the above personal data is voluntary, but necessary for the Controller to properly perform its obligations arising from the provisions on the protection of personal data, including exercising the rights granted to you by the GDPR (the consequence of not providing the above data will be the inability to properly exercise the aforementioned rights).
• Processing period: the Controller will process the above personal data until the limitation periods for claims arising from a breach of the provisions on the protection of personal data expire.

Establishing, pursuing or defending against claims

• Personal data processed: first and last name/company name, email address, residential/registered address, NIP.
• Legal basis: Article 6(1)(f) GDPR (the processing is necessary for the purposes of the legitimate interests pursued by the Controller, in this case establishing, pursuing or defending against claims that may arise in connection with the performance of Agreements concluded with the Controller).
• Voluntariness: providing the above personal data is voluntary, but necessary in order to establish, pursue or defend against claims that may arise in connection with the performance of Agreements concluded with the Controller (the consequence of not providing the above data will be the inability of the Controller to take the aforementioned action).
• Processing period: the Controller will process the above personal data until the limitation periods for claims that may arise in connection with the performance of Agreements concluded with the Controller expire.

Account security and abuse prevention

• Personal data processed:
  • the email address used in a login attempt,
  • the date and time of the login attempt and its outcome,
  • the device's IP address,
  • information about the web browser and operating system (the so-called user agent).
• Legal basis: Article 6(1)(f) GDPR (the processing is necessary for the purposes of the legitimate interests pursued by the Controller, in this case protecting Accounts against unauthorised access and limiting the number of login, registration and password reset attempts).
• Voluntariness: providing the above personal data is voluntary, but necessary in order to ensure the security of Accounts (the consequence of not providing it will be the inability to log in to the Application).
• Processing period: the Controller will process the above personal data for a period of 360 days from the date of the login attempt, and entries relating to the Account — no longer than until it is deleted, or until an effective objection is raised.

Account activity log

• Personal data processed:
  • Account and user identifier,
  • the date and time of the operation,
  • the device's IP address,
  • user agent,
  • the address and type of the operation together with the resource identifier,
  • the outcome of the operation,
  • the submitted data, excluding passwords, tokens and keys.
  
  The above data is saved automatically for every operation that changes data in the Application (creation, modification, deletion), carried out by a logged-in User or via an API key, including when a User's role is granted or changed and when an API key is created together with its permissions.
  In addition, for every call to the Application's MCP server (https://mcp.rawquotes.io), including reading data, a denial of access and exceeding the call limit, the following are saved: the Account identifier, the type and identifier of the API key or of the application connected by authorisation (e.g. an AI assistant), the identifier of the User who issued the key or gave the authorisation, the name of the function called, the project and Survey identifiers, the number of items returned, the outcome of the call, the IP address, and the date and time. The content of queries and of the data returned is not saved.
• Legal basis: Article 6(1)(f) GDPR (the processing is necessary for the purposes of the legitimate interests pursued by the Controller, in this case accountability for actions on the Account, providing Clients with information about the history of actions on their Account, disclosing data to authorised authorities upon their request, and establishing, pursuing or defending against claims).
• Voluntariness: providing the above personal data is voluntary, but necessary in order to carry out operations in the Application (the consequence of not providing it will be the inability to carry out operations in the Application).
• Processing period: the Controller will process the above personal data for a period of 180 days from the date the operation or call was carried out — also after the Account is deleted (entries are not deleted together with the Account), or until an effective objection is raised.

Administering the Application

• Personal data processed:
  • IP address,
  • server date and time,
  • address of the requested subpage,
  • information about the web browser,
  • information about the operating system.
  
  The above data is saved automatically in so-called server logs, each time the Application is used, including when Surveys are displayed through the Widget (administering it without the use of server logs and automatic saving would not be possible).
  In order to detect and fix errors in the Application, the Controller also uses an error monitoring service (Sentry). It receives error reports, request traces and performance profiles, without request bodies and IP addresses. They contain the full address of the requested subpage together with its parameters (when a Survey is displayed, this includes the Respondent identifier passed by the Customer, if the Customer passes one), the server date and time, the content of error messages, the identifiers of the logged-in User and of their Account and, where an error concerns a subscription, the identifier of that subscription.
• Legal basis: Article 6(1)(f) GDPR (the processing is necessary for the purposes of the legitimate interests pursued by the Controller, in this case ensuring the proper functioning and security of the Application).
• Voluntariness: providing the above personal data is voluntary, but necessary to ensure the proper functioning of the Application (the consequence of not providing it will be the inability to ensure that the Application functions properly).
• Processing period: server logs are stored for 90 days, and then automatically deleted.

Website analytics (rawquotes.io)

• Purpose: counting visits to the informational website https://rawquotes.io (landing), to the Application panel https://app.rawquotes.io and to the documentation site https://docs.rawquotes.io, and attributing revenue, including from purchases made in the Application panel, to the source a visit came from, using the DataFast service.
• Personal data processed:
  • IP address and information about the web browser (user agent) — used by DataFast to compute a hash, not stored in the browser,
  • address of the visited subpage (on the informational website, in the Application panel or on the documentation site) and the address of the page or campaign the visit came from,
  • after your consent only: a random visitor identifier saved in your browser.
• Legal basis:
  • without your consent (the default): Article 6(1)(f) GDPR (the processing is necessary for the purposes of the legitimate interests pursued by the Controller, in this case measuring the reach of the website and the effectiveness of the sources that bring visitors). DataFast then works in cookieless mode: it saves nothing in your browser except a temporary session entry (sessionStorage) and a technical buffer of events waiting to be sent (localStorage, datafast_event_queue), and it recognises a visit by a hash of the IP address, user agent and domain, computed on DataFast's side with a salt that changes about every 24 hours;
  • after you click "Accept" in the cookie banner: Article 6(1)(a) GDPR (consent). DataFast then saves a visitor identifier in your browser, which makes it possible to recognise your later visits.
• Withdrawing consent: you can change or withdraw your choice at any time — as easily as you gave it — through the "Cookie settings" link in the footer of the website or — in the Application panel, which has no footer — through the "Cookie settings" item in the account menu, by choosing "Reject". Withdrawing consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal; after withdrawal, DataFast returns to cookieless mode.
• Voluntariness: consent is voluntary; refusing it has no effect on your ability to use the website.
• Processing period: without consent — the hash changes about every 24 hours, so visits cannot be linked beyond that period; with consent — until you withdraw consent or the identifier expires (see the table in the "Cookies and browser local storage" section).

Direct marketing

• Purpose: sending you, by email, information about new features of the Application, tips on using it, and offers from the Controller. The content of these messages is not tailored to your preferences (see the "Profiling" section).
• Personal data processed: email address, the date consent was given.
• Legal basis: Article 6(1)(a) GDPR (consent) in conjunction with Article 398 of the Polish Act of 12 July 2024 — Electronic Communications Law. You give consent by ticking the checkbox when creating an Account or when accepting an invitation to an Account, or by turning on the "Product news and offers" option in the "Email preferences" section of the Account settings (profile, "General" tab). Each User gives consent for themselves — the Customer's consent does not cover Invited Users.
• Withdrawing consent: you can withdraw consent at any time by turning off the "Product news and offers" option in the "Email preferences" section of the Account settings. Withdrawing consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.
• Voluntariness: consent is voluntary; not giving it or withdrawing it has no effect on your ability to create an Account or use the Application.
• Processing period: the Controller will process the above personal data for this purpose until consent is withdrawn or the Account is deleted (whichever of the above events occurs first).

Feedback requests

• Purpose: occasionally sending you, by email, short questions about how the Application is working for you.
• Personal data processed: email address, and, if you unsubscribe from feedback requests — the date you unsubscribed.
• Legal basis: Article 6(1)(f) GDPR (the processing is necessary for the purposes of the legitimate interests pursued by the Controller, in this case developing and improving the Application on the basis of feedback from its Users).
• Right to object: you can object to this processing at any time by turning off the "Feedback requests" option in the "Email preferences" section of the Account settings (profile, "General" tab). The Controller then records the date you unsubscribed and stops sending you feedback requests.
• Voluntariness: the processing concerns the email address provided when creating an Account or accepting an invitation to an Account; unsubscribing from feedback requests has no effect on your ability to use the Application.
• Processing period: the Controller will process the email address for this purpose until an effective objection is raised or the Account is deleted (whichever of the above events occurs first), and the date you unsubscribed — until the Account is deleted or feedback requests are turned back on in the Account settings.

If you respond to a Survey or your feedback was added to the Application

RawQuotes Surveys are displayed on the websites of our customers (Customers). If you respond to such a Survey:

• the controller of your data is the owner of the website on which the Survey is displayed. The Controller processes your Responses solely on that owner's instructions, acting as a processor, under a data processing agreement. For the rights described in the "Your rights" section, contact the website's owner in the first instance;
• the Survey is not fully anonymous. Together with your Response, a random identifier assigned to your browser is saved (stored in your browser's local storage, described in the "Cookies and browser local storage" section), as well as the date the Response was given. This allows the website's owner to recognise that several Responses come from the same browser;
• your IP address is used to limit the number of Responses submitted (protection against abuse) and is saved in server logs on the terms described in the "Administering the Application" module; it is not saved together with the Response;
• the content of your Responses to questions is analysed using the AI Model in order to group it into Themes — the rules are described in the "Artificial intelligence" section below;
• the website's owner may retrieve Responses in full via the API, including the MCP server, also into an artificial intelligence assistant or model of its choosing. Such onward transfer takes place at the decision and under the responsibility of the website's owner — the website's owner provides information about it;
• Responses are stored for the period indicated in the Price List for the Plan purchased by the website's owner, counted from the day the Response was given. After that period elapses, and also when the website's owner deletes the Response earlier, the Response immediately becomes unavailable and is physically deleted within 30 days; backup copies containing the deleted Response are overwritten in a cycle of no more than 7 days. If the website's owner enters a Response manually in the Application panel, its content and the Respondent identifier, and, if it creates the Response via the API, the Respondent identifier, are in addition saved in the activity log of its Account and kept for 180 days from the day they were saved, also after the Response or the Account is deleted.

A Customer may also add to the Application feedback it received outside it, e.g. by file import, paste or the API (Feedback Items). If a Feedback Item contains your feedback or your personal data, the controller of that data is that Customer, and the Controller processes it solely on the Customer's instructions, acting as a processor; for the rights described in the "Your rights" section, contact that Customer in the first instance. The content of a Feedback Item, together with the name and description of the source it was added to, is analysed using the AI Model on the terms described in the "Artificial intelligence" section below. A Feedback Item is stored for the period indicated in the Price List for the Customer's Plan, counted from the day the Feedback Item was added to the Application, and is deleted on the terms described above for Responses. The content of a Feedback Item added by paste or via the API is in addition saved in the activity log of the Customer's Account and kept for 180 days from the day it was saved, also after the Feedback Item or the Account is deleted. The Customer may retrieve Feedback Items via the API, including the MCP server, on the terms described above for Responses.

Artificial intelligence

The Application uses a language model supplied by an external provider of artificial intelligence models for two purposes: grouping Responses to questions into Themes, and supporting the User in creating Surveys. Data transferred to the model is processed on servers in the United States and potentially other third countries.

• Transferred to the model provider are: the content of the Survey's questions, the labels of the selectable answers, the content of Responses to questions (marked only with a sequential number within the analysed batch), and — when the User generates a Survey — the purpose of the Survey they described.
• Not transferred to the model provider are: the Respondent's browser identifier, IP address, email address, or Account data.
• Before transfer to the model provider, automatically detected email addresses, phone numbers, bank account and payment card numbers, addresses, and national identification and tax numbers (e.g. PESEL, NIP) are removed from the content of Responses, each replaced with a label of its type. Detection takes place on the Controller's servers. First names and surnames are not removed. If detection is unavailable, Responses are not transferred to the model provider.
• Neither the Controller nor the model provider uses Responses or other User Content to train or improve artificial intelligence models.
• The Controller uses the model provider's service in a mode in which the provider deletes the content of prompts and model outputs from its systems within 30 days of their processing. The provider may retain data for longer only where required by law or where its automated safety systems flag the content as violating its usage policies.
• The analysis does not produce any legal effects for Respondents, nor does it similarly significantly affect them — its result is the Themes presented to the Customer.

Profiling

The Controller does not profile your personal data for marketing purposes and does not direct any direct marketing tailored to your preferences at you.

Recipients of personal data

The recipients of personal data will be the following external entities cooperating with the Controller:

• hosting company: OVH Sp. z o.o., ul. Swobodna 1, 50-088 Wrocław (place of processing: Germany);
• backup storage provider: Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany (place of processing: Finland);
• email delivery service provider: EmailLabs — Vercom S.A., ul. Wierzbięcice 1B, 61-569 Poznań;
• online payment system provider: Stripe Payments Europe, Limited (Ireland) and Stripe, LLC (USA);
• artificial intelligence model provider (processing in the USA and potentially other third countries);
• website analytics provider: JustShipIt Pte. Ltd. (Singapore), operator of the DataFast service (processing mostly outside the European Union, including in the USA);
• error monitoring provider: Functional Software, Inc. d/b/a Sentry (USA) (place of processing: Germany);
• an accounting services provider;
• an invoicing software provider.

The recipients of personal data also include the public registers to which the Controller passes the VAT ID in order to verify the Customer's tax status: the Head of the National Revenue Administration (list of VAT taxpayers) and the President of Statistics Poland (REGON register) — for Customers from Poland, the European Commission (VIES system) — for Customers from other Member States of the European Union, and the Swiss Federal Statistical Office (FSO, UID register) — for Customers from Switzerland.

In addition, personal data may also be transferred to public or private entities, if such an obligation arises from generally applicable law, a final court judgment, or a final administrative decision.

The current list of subprocessors that process personal data on behalf of Customers is published at rawquotes.io/security#subprocessors.

Transfer of personal data to a third country

In connection with the Controller's use of the services of an artificial intelligence model provider and of Stripe Payments Europe, Limited (payments), your personal data is transferred to the United States, and in the case of the artificial intelligence model provider — potentially also to other third countries. The transfer of data to Stripe, LLC takes place on the basis of Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 (the EU–US Data Privacy Framework), under which Stripe, LLC is certified, and, should that certification be lost — on the basis of the standard contractual clauses from Commission Implementing Decision (EU) 2021/914 of 4 June 2021. The transfer of data to the artificial intelligence model provider takes place on the basis of the standard contractual clauses from Commission Implementing Decision (EU) 2021/914 (module two), forming part of the data processing agreement concluded with that provider.

In connection with the Controller's use of the DataFast service (analytics of the informational website https://rawquotes.io, the Application panel https://app.rawquotes.io and the documentation site https://docs.rawquotes.io), your personal data is transferred to JustShipIt Pte. Ltd. with its registered office in Singapore. According to DataFast's data processing agreement, most of its infrastructure is located outside the European Union, including in the United States, without indicating the country of each service. DataFast does not conclude standard contractual clauses with the Controller — it relies on its subprocessors' compliance with data protection law, including standard contractual clauses where relevant.

In connection with the Controller's use of the Sentry service (error monitoring of the Application), your personal data is transferred to Functional Software, Inc. with its registered office in San Francisco, USA; the data is stored in Germany. The transfer of data to Functional Software, Inc. takes place on the basis of Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 (the EU–US Data Privacy Framework), under which Functional Software, Inc. is certified, and, should that certification be lost — on the basis of the standard contractual clauses from Commission Implementing Decision (EU) 2021/914 of 4 June 2021.

For Customers with their registered office in Switzerland, the Controller passes the VAT ID (UID number) to the UID register kept by the Swiss Federal Statistical Office (FSO) in order to verify the Customer's tax status. This transfer takes place on the basis of Commission Decision 2000/518/EC of 26 July 2000 on the adequate protection of personal data provided in Switzerland.

You may obtain a copy of the data transferred to the third country from the Controller.

Your rights

In connection with the processing of personal data, you have the following rights:

• the right to information about what personal data concerning you is processed by the Controller, and to receive a copy of that data (the so-called right of access). Issuing the first copy of the data is free; the Controller may charge a fee for subsequent copies;
• if the processed data becomes outdated or incomplete (or otherwise incorrect), you have the right to demand its rectification;
• in certain situations you may ask the Controller to erase your personal data, e.g. where:
  • the data is no longer needed by the Controller for the purposes it informed you of;
  • you have effectively withdrawn your consent to the processing of data — unless the Controller has the right to process the data on another legal basis;
  • the processing is unlawful;
  • the need to erase the data results from a legal obligation to which the Controller is subject;
• where personal data is processed by the Controller on the basis of consent to processing given, or in order to perform an Agreement concluded with it, you have the right to transfer your data to another controller;
• where personal data is processed by the Controller on the basis of consent to processing given by you, you have the right to withdraw that consent at any time (withdrawing consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal);
• if you consider that the processed personal data is incorrect, that its processing is unlawful, or that the Controller no longer needs certain data, you may demand that, for a specific, necessary period (e.g. to verify the correctness of the data or to pursue claims), the Controller does not carry out any operations on the data, but only stores it;
• you have the right to object to the processing of personal data whose basis for processing is the Controller's legitimate interest. Where an objection is effectively raised, the Controller will stop processing the personal data for the aforementioned purpose;
• you have the right to lodge a complaint with the President of the Personal Data Protection Office, where you consider that the processing of personal data infringes the provisions of the GDPR.

You may delete your Account, together with all data saved on it, at any time yourself in the Account settings (the "Security" tab), except for data processed for the period indicated in the "Account activity log" section, which is not deleted together with the Account. You may receive a copy of your Account data by writing to support@rawquotes.io — the Controller provides it within 7 days.

Cookies and browser local storage

1. The Controller informs you that the Application uses "cookie" files (cookies) and browser local storage (localStorage), saved on your end device. These are small files or text entries that can be read by the Controller's system.
2. The Controller uses cookies and browser local storage primarily to ensure the proper functioning of the Application — they make it possible to maintain a logged-in session, remember the selected colour theme, and recognise that further Responses to the same Survey come from the same browser. On the informational website https://rawquotes.io, in the Application panel (https://app.rawquotes.io) and on the documentation site (https://docs.rawquotes.io), the Controller also uses them for statistical purposes (website analytics, described in the "Website analytics (rawquotes.io)" section) — cookies only after your consent, and without consent only the temporary session entry and the technical event buffer described in the table below. The Controller does not use cookies for marketing purposes.
3. The Controller may place both persistent and temporary (session) files on your device. Session files are usually deleted when the browser is closed, whereas closing the browser does not delete persistent files.
4. On the informational website https://rawquotes.io, in the Application panel (https://app.rawquotes.io) and on the documentation site (https://docs.rawquotes.io), the Controller displays a cookie banner with two equal options: "Accept" and "Reject". Analytics cookies are saved only after you click "Accept"; your choice is remembered in the rawquotes_consent cookie, and you can change or withdraw it at any time through the "Cookie settings" link in the footer of the website or — in the Application panel, which has no footer — through the "Cookie settings" item in the account menu.
5. Data collected through cookies does not allow the Controller to identify you outside the Application.
6. The Controller uses the following cookies and browser local storage entries:

The informational website https://rawquotes.io (landing), the Application panel https://app.rawquotes.io and the documentation site https://docs.rawquotes.io save the rawquotes_consent cookie (shared, on the root domain) and the DataFast entries described in the table above (the same DataFast website identifier); the rules for their use are described in the "Website analytics (rawquotes.io)" section. The Widget entry described in the table above is saved on the Customer's website — the obligation to obtain the Respondent's consent to saving it, where required, rests with the Customer (Terms, § 4(8)).

7. Through most commonly used browsers you can check whether cookies and local storage entries have been installed on your end device, as well as delete them and block their being saved in the future by the Application. Disabling or restricting the handling of cookies may, however, cause difficulties in using the Application, e.g. in the form of having to log in again or being unable to log in to the Application panel.

Final provisions

Matters not regulated by the Policy are governed by the generally applicable provisions on the protection of personal data.

The Policy is in force from 23 October 2026.