Privacy policy

This Privacy Policy describes how SpeedNetworking collects, uses, and protects the personal data of platform users and of attendees of events organized by our customers. We comply with Regulation (EU) 2016/679 (GDPR) and the Polish Personal Data Protection Act of May 10, 2018.

1. Data controller

The data controller within the meaning of Art. 4(7) GDPR is:

For events organized on the SpeedNetworking platform, the data controller for attendees' personal data is the event organizer (the customer using the workspace). SpeedNetworking then acts as a data processor under a data processing agreement (DPA), concluded automatically when the workspace is created.

2. Contact for data processing matters

For matters related to personal data processing, exercising your rights, or reporting an incident, please contact us at:

• E-mail: hej@speednetworking.cloud
• DSAR request form: /dsar/ (available in the workspace panel)
• Mailing address: Outspace sp. z o.o., ul. Michała Kleofasa Ogińskiego 2, 85-092 Bydgoszcz

A Data Protection Officer has not been appointed due to the nature and scale of processing. Where necessary, the controller acts directly as the point of contact for GDPR matters.

3. Purposes and legal bases of processing

We process personal data for the following purposes:

3.1. Providing the platform service (account and workspace)

Legal basis: Art. 6(1)(b) GDPR (performance of a contract for electronic services). Scope: account registration, login, workspace management, subscription invoicing, technical support.

3.2. Organizing and running an event

Legal basis: Art. 6(1)(b) GDPR (the contract concluded between the attendee and the event organizer upon registration) and Art. 6(1)(f) GDPR (the organizer's legitimate interest in conducting B2B networking). Scope: attendee registration, pairing in rounds, generating video rooms, running chat, presenting mutual matches after the event ends.

3.3. Pre-event swipe and AI matching

Legal basis: Art. 6(1)(a) GDPR (the attendee's consent, given optionally before swiping begins). Scope: showing a photo, a short bio, and a LinkedIn URL to other attendees of the same event for mutual interest assessment. Swipe decisions (like / maybe / pass) are used by the matcher algorithm to generate pairs in the first rounds.

3.4. AI ice-breakers and chat moderation

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in improving conversation quality). Scope: anonymized attendee profiles (industry, interests, a short bio without identifying data) sent to the Claude Haiku model to generate personalized conversation questions. Chat content is scanned by AI moderation for spam, harassment, and illegal content.

3.5. Marketing and newsletter

Legal basis: Art. 6(1)(a) GDPR (consent) and Art. 10 of the Polish Act on Providing Services by Electronic Means. Scope: sending the newsletter, information about new features, promotions, and educational content. Consent is voluntary and can be withdrawn at any time by clicking the "unsubscribe" link in the footer of every message.

3.6. Invoicing and tax obligations

Legal basis: Art. 6(1)(c) GDPR (legal obligation — the VAT Act, the Accounting Act). Scope: company data (name, NIP, address), invoicing details, transaction history. Invoices are generated and archived in the wFirma system.

3.7. Site analytics and technical monitoring

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in ensuring service quality and security). Scope: anonymized usage statistics, server logs, application error monitoring (Sentry), performance monitoring (response times, availability).

4. Categories of data processed

Depending on the context of your interaction with the platform, we process the following categories of personal data:

4.1. Organizer account data (workspace owner)

• Full name
• E-mail address (login)
• Password (stored as a bcrypt/argon2 hash — we have no access to the plaintext password)
• Phone number (optional)
• Company invoicing details: name, NIP, address, REGON
• 2FA secrets (TOTP) — stored in encrypted form
• Login logs (date, IP, user agent) — retained for 90 days

4.2. Event attendee data

• Full name
• E-mail address
• Company name and industry (optional)
• Job title (optional)
• LinkedIn URL (optional)
• Short bio and swipe photo (optional, only with consent)
• Swipe decisions (like / maybe / pass) and mutual matches
• Chat messages from round conversations
• Attendee ratings after rounds (optional)

4.3. Technical data

• IP address (anonymized in analytics)
• User agent (browser and OS type)
• Session and preference cookies
• Push device identifiers (if push notifications are enabled)

4.4. Payment data

We do not store payment card data or bank account numbers. Payments are handled exclusively by Stripe Payments Europe Ltd. — we only receive the transaction identifier and its status (paid / refunded / failed).

5. Data recipients (processors)

We use trusted third-party providers who process data on our behalf under data processing agreements (DPAs) containing appropriate data protection clauses:

The list of providers is updated as the platform evolves. Any change that materially affects the scope or location of data processing is communicated to users before it takes effect.

Event attendee data is additionally available to the event organizer (workspace owner) and to members of the organizer's team who have been assigned appropriate roles in the admin panel (Owner, Administrator, Collaborator).

6. Data retention period

We keep data no longer than necessary to fulfill the purpose for which it was collected, or until legal obligations expire:

• Organizer account — for the duration of the subscription and for 30 days after it ends (window to cancel deletion)
• Event attendee data — for 12 months from the event date (unless the organizer shortens this period)
• Chat messages — for 90 days after the event ends (then anonymized)
• VAT invoices — for 5 years as required by the Accounting Act
• Technical logs — for 90 days
• Analytics cookies — up to 13 months
• Newsletter — until consent is withdrawn

After the retention periods expire, data is deleted or anonymized in a way that makes it impossible to re-link it to a specific person (the anonymize_old_attendees command runs automatically once a day).

30-day deletion window: after a workspace or account deletion request is submitted, all data is marked as "pending deletion" and physically deleted after 30 days. During this time, the operation can be reversed by the account owner.

7. User rights

Every person whose data we process has the following rights under the GDPR:

• Right of access (Art. 15 GDPR) — obtain a copy of your data in a machine-readable format
• Right to rectification (Art. 16 GDPR) — correct outdated or inaccurate data
• Right to erasure ("right to be forgotten", Art. 17 GDPR)
• Right to restriction of processing (Art. 18 GDPR)
• Right to data portability (Art. 20 GDPR) — export in JSON/CSV format
• Right to object to processing based on legitimate interest (Art. 21 GDPR)
• Right to withdraw consent at any time (Art. 7(3) GDPR)
• Right to lodge a complaint with the supervisory authority (PUODO)

To exercise the above rights, submit a DSAR (Data Subject Access Request) via the form: /dsar/ or by e-mail to hej@speednetworking.cloud. We respond within a maximum of 30 days of receiving a complete request (extendable by a further 60 days in complex cases, of which we will inform you).

8. Cookies and analytics

We use cookies and similar technologies (localStorage, IndexedDB). In line with the ePrivacy Directive and EDPB guidelines, we divide cookies into four categories, whose acceptance status is stored in a ConsentRecord object:

• Necessary (always on) — Django session, CSRF token, workspace context. Cannot be disabled without losing functionality.
• Functional — interface preferences (theme, language), staying signed in. Active after consent is given.
• Analytics — anonymous usage statistics (time on page, navigation paths). Active after consent is given.
• Marketing — ad campaign conversion tracking, retargeting. Active only after consent is given.

Cookie consents can be changed at any time in the page footer ("Cookie settings" link). The history of consent changes is archived as evidence of compliance with Art. 7(1) GDPR.

9. Data transfers to third countries

Some of our providers (Stripe, Anthropic, Postmark, Daily.co, Voyage AI, Cloudflare, Sentry) are based in the United States. Data transfers take place on the basis of:

• The European Commission's Standard Contractual Clauses (SCC) pursuant to Decision 2021/914
• A Data Protection Agreement (DPA) concluded with each provider
• For certified providers — the EU-US Data Privacy Framework (Commission decision of July 2023)

For the Anthropic integration, we additionally apply a zero data retention policy — no data sent to the Claude model is used for model training or stored longer than necessary to return a response (up to 30 days for abuse detection purposes).

10. Policy updates

This Privacy Policy may be updated periodically. We will announce material changes (e.g. adding a new processor, changing a legal basis, expanding the scope of data) via:

• E-mail to the address provided at account registration (with 14 days' notice)
• A notification in the workspace panel after signing in
• A banner on the homepage for 30 days after the new version is published

Every update is versioned in the repository with its effective date. Previous versions of the policy are available on request at hej@speednetworking.cloud.