Privacy policy

Holuto is the controller of the personal data described here. For any question or request about them, write to contact@holuto.com.

When you create a workshop account in the app at app.holuto.com, you give us your company’s tax ID (NIP). We look it up in the public REGON register of Statistics Poland (GUS) and save the company name and address held in the register. You also give us your workshop’s name and address, your full name, your email address, the phone number you will log in with and a password (we store only its hash), and we record the language of the app.

To protect sign-up from abuse, we limit how often it can be sent, and AWS WAF checks that a real browser sends it, storing an aws-waf-token cookie in your browser. If our server fails while handling your sign-up, the error report can include the data you sent and goes to Sentry.

We use these data to create and run your account (Art. 6(1)(b) GDPR) and in our legitimate interest in preventing fraud (Art. 6(1)(f) GDPR). Without the required fields we cannot create the account.

We keep the account data for as long as the account exists and delete them after it is closed, except what the law requires us to keep.

Amazon CloudFront delivers this site. To serve the pages and protect the site from abuse, our servers process your IP address, browser details and the addresses you request. The legal basis is our legitimate interest in a secure, working site (Art. 6(1)(f) GDPR).

The site stores the following in your browser:

• c15t (cookie and local storage): your cookie choices, kept for 1 year. Strictly necessary.
• ph_…_posthog (cookie and local storage): a random analytics identifier, kept for up to 1 year. Only if you accept analytics.

Only if you accept analytics, we use PostHog (EU Cloud, data stored in Frankfurt) to understand how the site is used: pages viewed, clicks and heatmaps, recordings of your visit, page performance, JavaScript errors, and your approximate location derived from your IP address. Recordings hide what you type into form fields.

The legal basis is your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time under Cookie settings at the bottom of every page; this does not affect processing that took place before.

We do not sell personal data. The following providers process them on our behalf under data processing agreements:

• Amazon Web Services: hosting, content delivery, AWS WAF and email delivery (Amazon SES), with our servers in Frankfurt
• PostHog: analytics, only with your consent, in its EU Cloud in Frankfurt
• Sentry: error reports from our server

CloudFront serves pages from the location nearest to you, which may be outside the European Economic Area, and our providers are based in the United States. Where data leave the EEA, the transfer relies on the European Commission’s Standard Contractual Clauses or the EU–US Data Privacy Framework.

You have the right to access your data, have them corrected or deleted, restrict their processing, receive them in a portable format, object to processing based on our legitimate interest, and withdraw your consent. To exercise them, write to contact@holuto.com.

You can also lodge a complaint with a data protection authority, in Poland the President of the Personal Data Protection Office (uodo.gov.pl).

We do not make decisions about you based solely on automated processing.

When this policy changes, we update this page and the date at the top.