§ 1. Joint Controllers and Data Protection Officer
Joint Controllers of the personal data of clients and contacts of MTA Group are the following companies, each with its registered office at ul. Świętego Marcina 29/8, 61-806 Poznań, Poland, each registered with the District Court Poznań – Nowe Miasto i Wilda, 8th Commercial Division, and each with a fully paid share capital of PLN 5,000.00:
- a) MTA Digital sp. z o.o. — KRS: 0000561985, NIP: 7831727441, REGON: 361723055;
- b) MTA Performance sp. z o.o. — KRS: 0000784788, NIP: 7010922437, REGON: 383274210;
- c) Anchor.Team sp. z o.o. — KRS: 0000969275, NIP: 7831856345, REGON: 521897892;
- d) Force of Nature Europe sp. z o.o. — KRS: 0001050399, NIP: 7831885358, REGON: 525999520;
- e) Zero Fluff Digital sp. z o.o. — KRS: 0001174081, NIP: 7831930082, REGON: 541841870;
- f) SharkPress Agency sp. z o.o. — KRS: 0001181847, NIP: 7831932253, REGON: 542142080.
Joint controllership arrangement (Art. 26 GDPR)
The Joint Controllers act as equals; there is no hierarchy between them. The essence of the arrangement, as required by Art. 26(2) GDPR, is as follows:
- Single point of contact: gdpr@mtagroup.org, monitored by MTA Digital sp. z o.o. as the operational lead.
- MTA Digital sp. z o.o. coordinates responses to requests under Arts. 15–22 GDPR and maintains this Privacy Policy.
- You may exercise your rights against any one of the Joint Controllers, regardless of the arrangement between them (Art. 26(3) GDPR).
- The Joint Controllers bear joint and several liability for damages under Art. 82(4) GDPR.
- The full joint controllership agreement is available on reasoned request sent to gdpr@mtagroup.org.
Data Protection Officer
A Data Protection Officer has been appointed under Art. 37 GDPR and notified to the Polish supervisory authority (PUODO).
Data Protection Officer: Mateusz Mikołajczyk
Email (preferred): gdpr@mtagroup.org
Postal address: ul. Świętego Marcina 29/8, 61-806 Poznań, Poland
In person: by prior appointment
§ 2. Purposes, Legal Bases and Retention
We obtain personal data from two sources:
- directly from you — through contracts, forms, newsletter sign-ups and meetings;
- from publicly available business sources — for business-to-business outreach only, as described in § 7.
| Purpose | Legal basis | Retention |
|---|---|---|
| Concluding and performing service contracts (marketing, paid media, SEO, analytics, lead generation, web and app development) | Art. 6(1)(b) GDPR — performance of a contract | Duration of the service plus the limitation period for claims |
| Day-to-day operations and cooperation with contractors | Art. 6(1)(b) GDPR | Duration of the business relationship plus the limitation period for claims |
| Handling contact form submissions and enquiries | Art. 6(1)(a) GDPR — consent; Art. 6(1)(b) — steps prior to a contract; Art. 6(1)(f) — legitimate interest | Until consent is withdrawn |
| Website analytics and usage statistics | Art. 6(1)(f) GDPR — legitimate interest | Up to 50 months |
| Establishing, exercising and defending claims | Art. 6(1)(f) GDPR | Until the limitation period for claims expires |
| Accounting and tax obligations | Art. 6(1)(c) GDPR — legal obligation (Polish Accounting Act Art. 74(2), Tax Ordinance Art. 86(1)) | 5 years from the end of the financial year following the transaction |
| Newsletter delivery | Art. 6(1)(a) GDPR — consent | Until consent is withdrawn |
| Social media presence (Facebook, Instagram, LinkedIn, X, YouTube, TikTok) | Art. 6(1)(f) GDPR — promotion of our services | Duration of our use of the platform |
| Online meetings and consultations with prospective clients | Art. 6(1)(b) and Art. 6(1)(f) GDPR | Duration of the business relationship plus the limitation period for claims |
| Growth Strategy Assessment and other self-assessment tools on this site | Art. 6(1)(b) GDPR — steps prior to a contract; Art. 6(1)(f) — follow-up proposals | 12 months, unless you become a client or ask us to delete the data earlier |
| Recruitment (including the TL-Strategist in-Training programme) | Art. 6(1)(b) GDPR; Art. 6(1)(a) for future recruitment processes | Duration of the recruitment process; with consent, up to 12 months afterwards |
| Case studies, blog content and client testimonials | Art. 6(1)(f) GDPR — promotion of our services; Art. 6(1)(a) where an individual is identified | Until you object or consent is withdrawn |
| IT operations, security and cookie technology | Art. 6(1)(f) GDPR | Cookie lifetime, plus the duration of the underlying purpose |
| Business contact with companies over WhatsApp Business: sending a website prototype, a feedback survey, and further correspondence | Art. 6(1)(f) GDPR — legitimate interest in direct marketing towards companies (recital 47) | 24 months from the last contact |
| Voice calls handled by an AI assistant — outbound after the recipient's prior consent, and inbound to our business number; the recording, its transcript and what was agreed | Art. 6(1)(f) GDPR, and Art. 6(1)(a) GDPR for the consent required by Art. 398 of the Polish Electronic Communications Law for outbound calls | Recording — 12 months; transcript and agreed points — 24 months from the last contact |
| Preparing and sharing a prototype website for the company, and counting visits to that prototype | Art. 6(1)(f) GDPR — presenting our offer on a concrete example | Prototype — until you object, and no longer than 24 months; visit record — 45 days |
§ 3. Recipients and Processors
We do not disclose personal data to third parties other than (a) with your explicit consent or (b) where required by law. Beyond that, data is entrusted to service providers acting on our instructions, each bound by a data processing agreement, and only to the extent necessary.
Used directly by this website (mtagroup.org)
- Vercel Inc. — hosting and request routing for this site (HTTP metadata, IP address, request logs).
- Google Ireland Limited / Google LLC — Google Tag Manager and Google Analytics for usage statistics, and embedded YouTube players. YouTube may set its own cookies and acts as an independent controller for the data it collects through the embedded player.
- Growth Strategy Assessment — the assessment on our /growth-assessment page is served from an external application hosted on the Lovable platform (Lovable Labs Incorporated) and infrastructure of its providers. Answers you submit there are processed for the purpose described in § 2.
IT, infrastructure and internal operations
Google LLC and Google Ireland Limited, Vercel Inc., Cloudflare, Inc., Home.pl S.A., OVH sp. z o.o., Web INnovative Software sp. z o.o., Autenti sp. z o.o., Asana, Inc., Notion Labs, Inc., Loom, Inc., Pipedrive Inc., Mango Technologies, Inc. (ClickUp), Supabase, ZIELINAMEDIA sp. z o.o.
Payments and transactional email
Stripe Technology Company, Limited (Ireland), Clerk Inc., Resend — used for payment processing, authentication and transactional messages on the group's payment subdomains.
Advertising and analytics platforms
Google (Ads, Analytics 4, Tag Manager), Meta Platforms Ireland Ltd. (Facebook and Instagram Ads, Meta Pixel), LinkedIn Ireland Unlimited Company (LinkedIn Ads and Insight Tag), TikTok Technology Limited (TikTok Ads and Pixel), X Corp. (X Ads and Pixel), Microsoft Ireland Operations Ltd. (Microsoft Advertising, Microsoft Clarity), HubSpot, Inc. (CRM, forms, chat, visitor analytics).
Contact channels and the voice assistant
WhatsApp Ireland Limited and Meta Platforms Ireland Limited — the WhatsApp Business Platform we use to message companies and receive their replies. Meta processes recipients' phone numbers, message content, and delivery and read statuses. This is a separate purpose from advertising; Meta's role as an advertising platform is covered in the entry above.
ElevenLabs, Inc. — the voice assistant that holds conversations on our behalf, and transcription of call recordings handled through the virtual telephony described below. It processes the recording of the speaker's voice, its transcript, and the details given during the call: first name and surname, email address, phone number, company name and the meeting time agreed.
Twilio Inc. — sending SMS messages.
Netpeak LTD (the Ringostat service) — virtual telephony and call handling. It processes the caller's number, the number dialled, the date, duration and status of the call, and the call recording.
Cloudflare, Inc. — hosting for the website prototypes at prototypy.essa.agency and the record of visits to them. The record covers the country and city derived from the IP address, the browser type and the referring page; it does not include the IP address itself.
AI productivity and research tools
Google LLC (Gemini for Workspace), OpenAI, L.L.C. (ChatGPT Business), Anthropic PBC (Claude Team), ClickUp, Inc., Fireflies.ai Inc. These tools may process the content of correspondence, documents and meeting recordings or transcripts. Under the applicable business terms, customer data is not used to train the providers' models.
Accounting, legal and advisory services; delivery
MSRR Szymańska sp. z o.o. sp.k., Krafton Accounting XON sp. z o.o. sp.k., legal advisers, and courier companies where physical delivery is required.
Embedded third-party widgets
Where we embed a YouTube or Vimeo player, or a Clutch.co review widget, the relevant provider sets its own cookies and acts as an independent controller for the data collected through that widget.
§ 4. Transfers Outside the EEA
Where personal data is transferred outside the European Economic Area, we rely on the safeguards under Chapter V GDPR:
- EU–US Data Privacy Framework (European Commission adequacy decision of 10 July 2023) for processors that are active participants in the Framework, including Google, Meta, Microsoft, LinkedIn, HubSpot, Clerk, Resend, Vercel, Cloudflare, OpenAI, Anthropic, Fireflies.ai, ClickUp, ElevenLabs and Twilio. Current certification status can be verified at dataprivacyframework.gov.
- Standard Contractual Clauses (Commission Implementing Decision 2021/914, Module Two — controller to processor), used as the primary mechanism for providers that do not participate in the Framework, and as a fallback for all other processors.
- UK adequacy regulations together with the International Data Transfer Addendum, for transfers routed through United Kingdom entities, including Netpeak LTD (Ringostat).
§ 5. Your Rights
In relation to your personal data you have the right to:
- access your data and obtain a copy of it (Art. 15 GDPR);
- have inaccurate data corrected (Art. 16 GDPR);
- have your data erased (Art. 17 GDPR), subject to statutory exceptions such as the five-year accounting retention period and the defence of legal claims;
- restrict processing (Art. 18 GDPR);
- data portability (Art. 20 GDPR);
- object to processing, including to direct marketing and profiling (Art. 21 GDPR);
- not be subject to a decision based solely on automated processing that produces legal effects concerning you, and to request human intervention (Art. 22 GDPR);
- withdraw consent at any time, where processing is based on Art. 6(1)(a) or Art. 9(2)(a) GDPR. Withdrawal does not affect the lawfulness of processing carried out before it.
To exercise any of these rights, write to gdpr@mtagroup.org. We respond within 30 days, in line with Art. 12(3) GDPR.
§ 6. Right to Lodge a Complaint
If you believe that the processing of your personal data infringes data protection law, you may lodge a complaint with the President of the Personal Data Protection Office (PUODO), ul. Stanisława Moniuszki 1A, 00-014 Warsaw, Poland, on the basis of Arts. 77–79 GDPR.
§ 7. B2B Outreach
We contact businesses directly with offers of our services. This section explains that processing, including the information required by Art. 14 GDPR where we did not obtain your data from you.
Legal basis
Art. 6(1)(f) GDPR — our legitimate interest in direct marketing addressed to businesses, which Recital 47 GDPR expressly recognises. We maintain a documented legitimate interests assessment and review it periodically.
Data we process
Exclusively business-related data: first name and surname where published, business email address, job title, company name, public LinkedIn profile URL, our communication history with you, publicly available information about the company, technical information about its website, the company's phone number where it is published, the content of any correspondence you have with us over WhatsApp, and the recording and transcript of a phone call where one took place.
Where the data comes from
- company websites, including contact and team pages;
- public professional profiles, in particular LinkedIn;
- business databases and contact-finding tools: Apollo.io, Clay, FindyMail and Prospeo;
- publicly available podcasts, conference materials and press coverage;
- public technical registers, such as certificate transparency logs;
- industry directories;
- company listings on Google Maps and Google Places, including the phone number, address and opening hours published there by the company itself;
- AI research assistants operating as our processors under § 3 (Google Gemini, OpenAI ChatGPT and Anthropic Claude research features).
To find out which specific sources were used for your contact details, write to gdpr@mtagroup.org; we reply within 30 days.
Retention and opt-out
- Active leads: up to 24 months from the last contact.
- After an opt-out: your details are moved to a suppression list and kept solely to make sure we do not contact you again.
- On an explicit deletion request: deleted within 30 days at the latest.
You can opt out by replying to any of our messages with "STOP" or "not interested", by using the unsubscribe link in the message, or by writing to gdpr@mtagroup.org.
Email tracking
Our outreach messages may contain an open-tracking pixel. We use that data solely for aggregate campaign statistics. It is not combined with external behavioural profiles and is not used to profile individual recipients.
Contact over WhatsApp
We also message companies that have published a phone number over WhatsApp. The message carries a link to a website prototype we prepared and a short survey. The survey asks for your first impression of the prototype, whether it reflects the character of your company, what you would change first, and whether we should get in touch. Giving an email address in the survey is optional and is used only to send you the link and an invitation to talk.
You object the same way as by email: reply with "STOP" or "not interested". This channel has no unsubscribe link because the platform does not provide one — a reply in the conversation has the same effect. The number then goes onto a suppression list kept solely so that we do not contact you again.
Calls handled by the voice assistant
Some calls are handled by a voice assistant acting on our behalf. Asked directly, it says that it is an automated system, and on request it hands the matter to a person.
We do not call without prior consent. WhatsApp sends a call permission request on our behalf, and the call only takes place once the recipient accepts it. Consent can be withdrawn at any time, either during the call or by writing to gdpr@mtagroup.org.
The call is recorded and transcribed. From its content we keep the first name and surname, email address, contact number, company name, the meeting time agreed and what the caller is looking for. Recordings are kept for 12 months; transcripts and agreed points for 24 months from the last contact.
Separately, we receive inbound calls on +48 886 650 062; the same rules apply, except for call consent, because you are the one calling us.
The prototype website prepared for your company
Before we get in touch, we build an example website for your company from publicly available information: the name, address, range of services, reviews and photographs the company has published. The page is excluded from search engine indexing and exists only to show what working together could look like.
We count visits to such a prototype: the country and city derived from the IP address, the browser type and the referring page. We keep that record for 45 days and do not combine it with external profiles.
We delete a prototype on request, within 30 days of a message to gdpr@mtagroup.org.
Automated qualification and profiling
We score publicly available information about a company to estimate whether our services are a good fit. This only determines whether we reach out; it produces no legal or financial effects for you and is therefore not an automated decision within the meaning of Art. 22(1) GDPR. You may nevertheless request human intervention, express your point of view and contest the outcome by writing to gdpr@mtagroup.org.
An automated system may also hold a conversation with you and propose a meeting time. It makes no decision that produces legal effects for you or similarly significantly affects you — a person confirms the time agreed, and price and scope are always discussed with a person. You can ask to speak to a person instead of the automated system at any point.
Sole traders and Polish electronic communications law
For individual entrepreneurs registered in the Polish CEIDG register, Art. 398 of the Polish Electronic Communications Act (PKE) applies in addition to the GDPR. Where contact details have been published in a business context we rely on legitimate interest and include an enhanced opt-out notice referring to that provision; otherwise we obtain prior consent. Our Data Protection Officer reviews this activity quarterly.
Outreach sub-processors
Instantly (cold-email platform), Supabase (lead database, hosted in the European Union), n8n (workflow automation, self-hosted by us), Apollo.io, Clay, FindyMail and Prospeo (business data and email verification), the WhatsApp Business Platform (Meta), ElevenLabs (voice assistant) and Cloudflare (prototype hosting).
§ 8. Cookies and This Website
This site uses necessary cookies, and — only after you accept the relevant category in the consent banner — statistical and marketing cookies. Necessary cookies are required for the site to work; every other category is optional and loads only with your consent.
Cookie types
- Session cookies — maintain your session until you close the browser. They do not usually identify you on their own, but may do so in combination with other data.
- Persistent cookies — remain after the session ends and are used to remember preferences.
- Third-party cookies — set by the providers named in § 3. They may identify a device through its IP address, a device identifier or a similar identifier.
Cookie categories
- Necessary — basic functions such as navigation and access to secure areas.
- Preferences — remember choices such as language and region.
- Statistical — help us understand how the site is used; may collect behavioural data.
- Marketing — used to display relevant advertising; may cover location, preferences and browsing history.
How to opt out
- through the consent banner, which offers per-category control;
- through your browser settings (see the help pages for Chrome, Firefox, Edge, Opera and Safari);
- for Google Analytics, using the browser add-on at tools.google.com/dlpage/gaoptout.
Additional information
- We may use tracking pixels to measure interactions with our emails and our website.
- We keep server logs (including IP addresses and technical data) to monitor traffic, diagnose faults, and detect and prevent abuse.
- We do not use cross-site tracking technologies, and we do not sell personal data for behavioural advertising across unrelated services.
- This site does not respond to "Do Not Track" browser signals.
Last updated: 31 August 2026. In case of discrepancies between this translation and the Polish version, the Polish version governs.