SuitBadge app privacy notice

Version of 10 November 2026

Service provider and data controller for the app:
Business Safety Coaching International Sp. z o.o., Romana Dmowskiego 22/112, 43-100 Tychy, Poland, NIP PL6463026358.
info@bsci.coach

1. Who this notice is for

This notice explains how we process personal data when you use the SuitBadge app and the SuitBadge page service. If you visit someone’s SuitBadge page or fill in a form on it, read the notice for page visitors instead.

2. What data we process

Account: a random internal ID, the sign-in identifier given by Firebase Authentication, your name and your language. Your email address is kept by Firebase for signing in; we do not store it in our database.
Your page: name of the page (subdomain), texts, images, links, theme and the published version.
Your pins: tag code, the names you give them, the saved destinations and which one is active.
Contacts collected with your forms: the answers and your notes. We process them on your behalf, under the data processing agreement, and they are encrypted.
Statistics: daily counts of taps, visits, clicks, contacts and votes. They contain no data about the visitors.
Technical logs of our functions, kept for 14 days, without IP addresses.
Messages you send us by email.

3. Purposes and legal bases

We do not use your data for advertising, we do not sell it and we do not create profiles.

To provide the service you asked for: account, page, pins, forms, statistics (Article 6(1)(b) GDPR, contract).
To keep the service secure, prevent abuse and handle reports of illegal content (Article 6(1)(f), our legitimate interest in a safe service).
To comply with legal obligations, for example orders from authorities and the Digital Services Act (Article 6(1)(c)).

4. How we protect your data

Pseudonymisation: in our database you are only a random internal ID. The link to your sign-in account is stored as a keyed hash (HMAC-SHA256) whose key is kept separately.
The answers to your forms and your notes are encrypted field by field with AES-256-GCM.
All data is encrypted at rest and in transit (TLS).
Each request is checked against your sign-in token: no user can read or change another user’s data.
Data is stored in the European Union (AWS, Frankfurt).

5. Service providers and transfers

Each provider acts on our instructions under a data processing agreement, except Apple and Google as identity providers you choose, which also act under their own privacy terms.

Amazon Web Services EMEA SARL: hosting, database and file storage in Frankfurt (Germany). Pages and images are delivered through the Amazon CloudFront network, which can serve them from locations outside the EU.
Google Ireland Ltd and Google LLC (Firebase Authentication): sign-in, your email address and the sign-in identifier. Data may be transferred to the United States under the EU-US Data Privacy Framework and the Standard Contractual Clauses.
Apple, only if you choose Sign in with Apple: Apple confirms your identity and may give us a relay email address, which we do not store.

6. How long we keep data

Account, page and pins: until you delete your account. Deletion from the app is immediate; technical backups of the database are overwritten within 7 days.
Contacts collected with forms: until you delete them or delete your account.
Statistics: until you delete your account. They contain no personal data of visitors.
After a change of page name, the old name redirects to the new one for 90 days.
Abuse reports: 12 months.
Technical logs: 14 days.

7. Your rights

You have the right of access, rectification, erasure, restriction, data portability and objection (Articles 15 to 22 GDPR). In the app you can export all your data (Account, Export my data) and delete your account (Account, Delete account). For anything else write to us: we answer within one month.

You can lodge a complaint with the Polish supervisory authority (UODO, uodo.gov.pl) or with the authority of the country where you live or work, for example the Garante in Italy.

8. Data on your phone

The app keeps your settings and a copy of your data on your phone so that it also works without a connection. It does not use advertising identifiers or tracking tools. Signing out or deleting the app removes this copy.

9. Automated decisions and age

We make no decisions based solely on automated processing that have legal or similarly significant effects on you. The app is for professionals and companies: you must be at least 18 years old.

10. Changes

If we change this notice in a substantial way, we tell you in the app at least 30 days in advance.