Privacy Policy

Fundacja Rozwoju Przedsiębiorczości “Twój StartUp” (commercial brand: BM Shadow)

NIP: 5213641211 · REGON: 146433467

Registered address: ul. Pory 60 m. 32, 02-757 Warsaw, Poland

Contact: bmshadow@bmshadow.com

When you complete our diagnosis or contact form, we collect:

• Email address
• Telephone number
• The name of your company or business
• Any additional information you voluntarily share with us (message, budget, project details)

In addition, through analytics (Google Analytics) and advertising (Meta Pixel) tools, we automatically collect browsing data (see section 6, Cookies).

We use the information you provide in order to:

• Contact you by email or WhatsApp in response to your enquiry
• Assess your case and offer you a tailored proposal or diagnosis
• Manage the commercial relationship through our CRM
• Send you informational or promotional communications about our services (only where you have given your consent)
• Measure the performance of our website and advertising campaigns

Your data may be processed by:

• Our CRM provider, for commercial follow-up
• Meta (WhatsApp Business / Meta Pixel), for messaging and advertising measurement
• Google (Google Analytics), for website traffic analysis

We do not sell or transfer your data to third parties for purposes other than those described here.

We retain your data for as long as an active or prospective commercial relationship exists, and for a maximum of 24 months from the last contact, unless the law requires a different period or you request earlier erasure.

We use first-party and third-party cookies (Google Analytics, Meta Pixel) to analyse how the site is used and to display relevant advertising. You may accept or reject these cookies through the banner shown when you enter the site, and change your choice at any time.

Under the GDPR and applicable law, you have the right to:

• Access the data we hold about you
• Request its rectification if it is inaccurate
• Request its erasure (the “right to be forgotten”)
• Object to processing for marketing purposes
• Withdraw your consent at any time

To exercise any of these rights, write to us at bmshadow@bmshadow.com.

We may update this policy from time to time. Any changes will be published on this page together with the date of the latest update.

• Performance of a contract or pre-contractual steps: account creation, providing BMS Reviews, BMS Stand, BMS ID and BMS Club, support and billing.
• Legal obligation: retention of invoices and accounting/tax records.
• Consent: analytics and advertising cookies, and promotional messages. You may withdraw it at any time without affecting prior lawfulness.
• Legitimate interest: service security, fraud prevention and replying to contact requests.

• Customer accounts: while the subscription is active and afterwards for the limitation period of possible claims.
• Invoices and tax data: as required by applicable tax law (in Poland, usually 5 years from the end of the tax year).
• Unconverted contact requests: up to 24 months from the last contact.
• BMS Club customer data: while the business keeps its programme or until the customer requests erasure.
• Cookie preferences: up to 12 months, after which we ask again.

To provide the service we use providers that process data on our behalf:

• Supabase (hosting, database and authentication).
• Cloudflare (web hosting, content delivery and security).
• Stripe (payments, subscriptions and invoices).
• Brevo (BMS Club promotional emails and unsubscribe handling).
• Transactional email provider (account and reward notices).
• Google (Google Analytics) and Meta (Meta Pixel, WhatsApp Business), only with your consent where applicable.

Some providers may process data outside the European Economic Area. Such transfers rely on an adequacy decision (e.g. the EU-US Data Privacy Framework for certified providers) or on Standard Contractual Clauses approved by the European Commission, with supplementary measures. Ask us at bmshadow@bmshadow.com for details.

• bm_cookie_consent (essential, local storage): stores your cookie choice. Up to 12 months.
• Login session (essential, local storage): keeps you signed in to the dashboard. Until you sign out.
• Language and club token (essential, local storage): remember your language and loyalty card on that device.
• _ga, _ga_* (analytics, Google Analytics): aggregate visit measurement. Up to 2 years. Consent only.
• _fbp (advertising, Meta Pixel): campaign measurement. Up to 3 months. Consent only.

Analytics and advertising cookies are not loaded until you accept them. Rejecting is as easy as accepting, and you can change your choice at any time via “Cookie settings” in the footer.

When you join a business's loyalty programme or leave your email on a BMS ID profile, that business or professional is the controller. BM Shadow acts as processor under Art. 28 GDPR, per the Data Processing Agreement in our Terms & Conditions. Promotions are sent only to people who explicitly opted in, and always include an unsubscribe link.

• You may lodge a complaint with a supervisory authority: in Poland, the President of the Personal Data Protection Office (UODO, uodo.gov.pl), or the authority of your EU country of residence.
• United Kingdom: equivalent rights apply under the UK GDPR; you may complain to the ICO.
• California (CCPA/CPRA): we do not sell personal data. If advertising cookies could be deemed “sharing”, you can opt out by rejecting them in the banner; we also honour Global Privacy Control signals.
• Commercial emails identify the sender, include a postal address and an unsubscribe link processed automatically.
• We do not make decisions based solely on automated processing with legal effects on you. Our services are not directed at children under 16.