Who is responsible for your data?
The controller of personal data is Zodi Labs SA, with its registered office at ul. Wilcza 42/12, 00-679 Warsaw, Poland; KRS 0001147187, NIP 5214100693, REGON 540597698. Generation9 is a brand of Zodi Labs SA.
For data protection matters and to exercise your rights, email dpo@generation9.co or write to the postal address above. For business enquiries, contact info@generation9.co.
What does this policy cover?
This policy covers generation9.co and its language versions, contact with the Generation9 agency, business enquiries and recruitment applications sent to us. It also describes data about people featured in our portfolio.
Use of the Zodi application is covered by the separate Zodi privacy policy. Links to Zodi or social networks take you to separate services. Simply browsing this website or reading this policy does not constitute consent to optional cookies or marketing.
What information do we receive, and from where?
You primarily provide data yourself when you email or call us. This may include your name, work email address, telephone number, company, role, correspondence and any materials you send. We also receive business representatives’ details from their organisations where needed for contact and cooperation.
For recruitment, we may receive contact details, a CV and information about education, qualifications and experience. When a recruitment form is available on the website, it collects the information identified by its fields and a PDF CV. We also record the submission and the statement made in the form.
When serving the website and files, servers process technical information such as IP address, request time and URL, browser type, operating system and error information. Optional analytics starts only after your consent.
Our portfolio may include names, images, profile names and statements of creators, brand representatives or other project participants. These come from our project materials, partners and participants. This website does not collect the contents of your conversations in the Zodi application.
Why do we process data?
Each purpose has its own legal basis. GDPR means Regulation (EU) 2016/679.
| Purpose | Legal basis |
|---|---|
| Serving the website, security, diagnosing errors and preventing abuse | Article 6(1)(f) GDPR — our legitimate interest in operating a secure website. |
| Answering questions and discussing cooperation | Article 6(1)(b) GDPR for steps before entering into a contract with you; Article 6(1)(f) GDPR when dealing with a company representative or another enquiry. |
| Entering into and performing contracts, accounting and legal obligations | Article 6(1)(b) GDPR for a contracting party, Article 6(1)(f) for contact with its representatives, and Article 6(1)(c) for obligations including tax and accounting law. |
| Presenting our experience and completed projects in the portfolio | Article 6(1)(f) GDPR — our legitimate interest in presenting our work — or Article 6(1)(a) GDPR where consent is the basis. Rights to publish images and materials are assessed separately. |
| Optional website usage statistics | Article 6(1)(a) GDPR and the consent required for optional cookies and similar technologies. |
| Establishing, exercising or defending legal claims | Article 6(1)(f) GDPR — protecting our rights, limited to what is necessary. |
If you send us your CV
Data required under employment law is processed under Article 6(1)(c) GDPR in conjunction with Article 22¹ of the Polish Labour Code. Additional information you voluntarily provide for recruitment is processed on the basis of consent (Article 6(1)(a) GDPR), subject to employment law requirements. For applications for cooperation under a civil-law contract, pre-contractual steps may be based on Article 6(1)(b) GDPR.
We do not require health information, beliefs, ethnicity or other special categories of data. Do not send them unnecessarily. Additional data and consent for future recruitment are voluntary; withholding them does not prevent participation in the current recruitment process.
Sending a CV is not consent to indefinite retention or future recruitment. Such use requires separate consent specifying a retention period.
How does website analytics work?
With consent, we use Google Analytics 4, provided to users in the EEA by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Statistics help us understand which content is useful and whether visitors proceed to contact, our portfolio and Zodi.
Measurement covers page views, website language, basic device and browser information, cookie identifiers and selected interactions: clicking contact, opening a case study, playing a project video and following a link to Zodi. The automatic background video does not count as a deliberate case-study playback.
We do not send form contents, CVs, messages, telephone numbers or email addresses to Analytics. Page URLs are sent without query strings or fragments; allowed UTM campaign labels may be sent separately. Do not put personal information in those labels. Referrer information is limited to the domain. Google processes IP addresses when receiving connections; according to GA4 documentation, Analytics does not log or store IP addresses.
We do not use this integration for Google Signals, advertising personalisation, remarketing or user-provided data collection. User-level and event-level GA4 data is retained for 2 months, without resetting that period on new activity; aggregated statistical reports may remain available longer.
Details: Google privacy policy, Google Analytics data safeguards.
Who may receive data?
Access is limited to authorised personnel at Zodi Labs SA and service providers needed to operate the website and handle your matter: hosting, file and database storage, email and office tools, IT support and, where relevant, legal and accounting advisers. We enter into the required agreements with processors acting on our behalf.
The website and its files use Vercel infrastructure, including Vercel Blob. The provider is Vercel Inc., based in the USA; its processing is described in the Vercel privacy notice. Google receives analytics data only after consent as explained above.
We may disclose data to authorities entitled to receive it under law. We do not sell visitors’ personal data. Links to Instagram, LinkedIn and other services open separate websites whose operators apply their own policies.
Can data be transferred outside the EEA?
We use the global infrastructure of Vercel and Google. Providing these services and technical support may involve processing or accessing personal data outside the European Economic Area, including in the United States.
Transfers outside the EEA require a basis under Chapter V GDPR: for example, a European Commission adequacy decision, including the EU–US Data Privacy Framework for an entity and activity covered by current certification, or standard contractual clauses and supplementary safeguards where needed. A provider being based in the USA does not by itself mean it is certified. You can request information or a copy of applicable safeguards, with confidential information protected, at dpo@generation9.co.
How long do we keep information?
We keep correspondence for the time needed to respond and conclude the matter or cooperation. Contract and accounting records are kept for the duration of the contract and the period required by tax and accounting law. Data needed for legal claims is retained until the applicable limitation period expires and, in the event of a dispute, until its final resolution.
Recruitment data is used until the relevant recruitment process ends. We then delete it unless a separate basis justifies further retention, such as consent to future recruitment for a specified period or the necessity of defending legal claims. Records kept solely for defending claims are not used for later recruitment.
Portfolio materials are kept for the justified duration of presenting the project, taking account of rights to the materials, consents, objections and requests from the people concerned. Technical logs are retained as necessary for security and troubleshooting, as determined by infrastructure settings; information relating to a specific incident may be kept until it is resolved and for protecting legal claims. Cookie and Analytics retention periods are stated above.
What are your rights?
You may request access to your data and a copy, rectification, erasure or restriction of processing and, where provided by law, data portability. You can withdraw consent at any time without affecting the lawfulness of earlier processing.
Where processing relies on a legitimate interest, you may object on grounds relating to your particular situation. An objection to direct marketing does not require reasons. Each request is assessed under the GDPR; the right to erasure does not override statutory retention duties.
Email dpo@generation9.co. We normally respond within one month of receiving a request; for complex requests this may be extended by two further months, with notice given within the first month. If we reasonably doubt your identity, we may ask for necessary additional information. We do not routinely require a copy of an identity document.
You may lodge a complaint with the President of the Polish Personal Data Protection Office or another competent supervisory authority in the EEA.
Your data or image in our portfolio
If material on the website concerns you and needs correcting, identify the information, page URL and correct details. We may request proportionate supporting information. You may also request removal, restricted publication or object to processing. We will verify your identity or authority to act and assess the request under the applicable legal basis. This does not grant an unrestricted right to change accurate data or third-party materials.
Voluntary data, security and updates
Providing information when contacting us is voluntary, but without details needed for your matter we may be unable to respond or cooperate. We identify data required by law or contract in the relevant process. Refusing analytics cookies does not restrict access to the website.
This website does not make solely automated decisions producing legal or similarly significant effects on you, including recruitment decisions. We use appropriate organisational and technical measures, including access controls and encrypted HTTPS transmission.
We may update this policy when functionality, providers or laws change. The current version is available at the same address with its date. If a purpose requiring consent changes, we will ask for fresh consent before starting that processing.