1. Who we are and whom this Policy covers
1.1 The controller of personal data is [legal name], [registration number], [address] (hereinafter “Znovu”, “we”).
1.2 This Policy applies to:
- visitors to the website znovu.ai;
- persons who have applied to the Launch Programme, booked an audit or contacted us;
- representatives of brands that are or may become our clients: owners, managers and employees.
1.3 Znovu is an AI agency accountable for results: it launches and runs brands’ apps, repeat sales and customer acquisition. The apps run on the SalesBox platform. If you are a customer of a brand and use its app, that brand is the controller of your data. Znovu and SalesBox process such data only on the brand’s behalf (see the Data Processing Agreement) and do not use it for their own purposes. Please direct requests concerning such data to the brand. If you contact us, we will forward your request to the brand within 5 business days.
1.4 We process data in accordance with Regulation (EU) 2016/679 (GDPR) and, where applicable, the Law of Ukraine “On Personal Data Protection”.
2. What data we collect
| Category | Data |
|---|---|
| Application | brand name, website, country, revenue and advertising budget (as a range), store platform, number of physical stores, email, WhatsApp / Telegram |
| Traffic source | UTM parameters, referring page, ad click identifiers (fbclid, gclid, wbraid, gbraid), Meta identifiers (_fbp, _fbc) — only if they are already present in your browser |
| Technical | IP address, browser and device type, request time — in hosting and attack-protection logs |
| Communications | correspondence, messenger messages, notes from audits and calls |
| Contractual | brand’s company details, contracts, invoices, payment history. We do not receive payment card data |
The mandatory application fields are brand name and email: without them we cannot respond. All other data is provided at your discretion.
3. Purposes and legal bases
| Purpose | Legal basis (Art. 6 GDPR) |
|---|---|
| Responding to applications, selection for the Program, free advertising audit | steps prior to entering into a contract at your request — Art. 6(1)(b) |
| Entering into and performing the contract, support, reporting | contract — Art. 6(1)(b) |
| Accounting and tax records | legal obligation — Art. 6(1)(c) |
| Understanding which advertising an application came from (UTM, click identifiers) | legitimate interest in evaluating our own advertising — Art. 6(1)(f) |
| Website security, prevention of spam and fraud | legitimate interest — Art. 6(1)(f) |
| News, useful materials, event invitations | consent — Art. 6(1)(a); may be withdrawn at any time |
We do not make decisions about you based solely on automated processing that produce legal or similarly significant effects.
4. Whom we share data with
We do not sell personal data. We share it only with providers that help us operate, and only to the extent necessary:
| Recipient | Purpose |
|---|---|
| Cloudflare | website hosting, content delivery, attack protection |
| CRM system (Twenty) | tracking applications and deals |
| Calendly | booking an audit, if you choose a time slot |
| Email services and messengers | correspondence with you |
| AI services (including OpenAI) | assistance in processing requests and texts; data submitted via the API is not used to train models |
| Banks, accounting and legal advisers | payments, accounting, protection of rights |
| Public authorities | only upon a lawful request |
5. Transfers outside the EEA
Some members of our team may work from outside the EEA, including from Ukraine, and some providers (Cloudflare, Calendly, OpenAI) operate from the United States. We work only with providers that ensure GDPR compliance. For such transfers we apply the safeguards provided for in Art. 44–49 GDPR: the Standard Contractual Clauses approved by the European Commission (Commission Implementing Decision (EU) 2021/914) or the provider’s certification under the EU-U.S. Data Privacy Framework. A copy of the relevant safeguards is available on request.
6. Retention periods
| Data | Period |
|---|---|
| Applications that did not result in a client relationship | 2 years from the last contact |
| Clients | term of the contract + 3 years (limitation period) |
| Accounting records | the period required by law |
| Technical logs | up to 1 year |
| Marketing consents | until withdrawn |
7. Your rights
Under Art. 15–21 GDPR, you have the right to:
- know what data about you we process and obtain a copy of it;
- request rectification or erasure of your data;
- restrict processing or object to it, including processing based on legitimate interest;
- receive the data you provided to us in a machine-readable format (portability);
- withdraw consent at any time — this does not affect the lawfulness of processing before withdrawal;
- lodge a complaint with a supervisory authority in the country of your habitual residence, place of work or place of the alleged infringement. In Poland, this is the President of the Personal Data Protection Office (UODO); in Ukraine, the Ukrainian Parliament Commissioner for Human Rights.
How to exercise your rights: write to privacy@znovu.ai. We respond without undue delay and in any event within one month.
8. Data protection
- Data is transmitted only over secure channels (HTTPS / TLS).
- Access is granted only to staff who need it, with two-factor authentication for critical systems.
- Employees and contractors are bound by confidentiality obligations.
- Incidents are recorded and investigated. We notify the supervisory authority and affected individuals of high-risk incidents within the time limits set by the GDPR.
9. Cookies
The website znovu.ai currently does not set analytics or advertising cookies. Fonts are loaded from our own server, without requests to third-party services. If you go to the Calendly page, it may use its own cookies in accordance with its own policy.
If we add analytics or advertising pixels, they will be activated only after you give consent in the banner, and this Policy will be updated.
10. Changes
The current version is always available on this page. We notify clients of material changes by email 30 days in advance.
11. Contacts
[legal name], [address]
Personal data enquiries: privacy@znovu.ai
Responsible person: Andrii Stakhov, founder