Privacy Policy

§ 1. GENERAL INFORMATION

1. This Privacy Policy defines the rules for processing and protecting the personal data of users and customers of the platform available at Justlab.tech (hereinafter referred to as the “Service”).
2. The controller of personal data of Customers (entrepreneurs registering an account in the Service) is: Justlab.
3. Contact regarding personal data protection matters is available at: admin@justlab.tech.
4. The Controller processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR).

---

§ 2. TWO DATA PROCESSING ROLES (Key distinction)

Two independent data processing processes occur within the Service:

1. Customer Data: With regard to data provided during Account registration (name, email, phone, VAT number, billing data), Justlab acts as the Data Controller (DC).
2. Caller Data (third parties calling the Customer): With regard to voice recordings, caller phone numbers, transcriptions and AI-generated call summaries, the Customer is the sole Data Controller. The Service processes this data solely on the Customer’s instructions as a Data Processor, under the terms of a Data Processing Agreement (DPA).

---

§ 3. PURPOSES, LEGAL BASES AND RETENTION PERIODS FOR CUSTOMER DATA

Personal data of Customers (those who create an account in the system) is processed for:

1. Provision of the Service (SaaS): Creating and maintaining the Account, operating the platform and fulfilling the selected Package (Art. 6(1)(b) GDPR) – for the duration of the contract.
2. Accounting and tax purposes: Issuing invoices and storing financial documentation (Art. 6(1)(c) GDPR) – for 5 years from the end of the calendar year in which the tax payment deadline expired.
3. Defense against claims: Establishing, pursuing or defending against potential legal claims, constituting the legitimate interest of the Controller (Art. 6(1)(f) GDPR) – until the statute of limitations expires under the Civil Code.
4. Direct marketing: Informing about news and system updates (Art. 6(1)(f) GDPR) – until the Customer objects.

---

§ 4. DATA PROCESSING AGREEMENT (Call recording data)

1. By registering an Account and accepting the Terms of Service, the Customer entrusts the Service with processing the personal data of their callers for the purpose of providing the Service (transcription, AI analysis, storage in the Customer Panel).
2. The Service as Processor undertakes to:
   • Process data only on documented instructions from the Customer (through configuration and use of the system).
   • Apply appropriate technical and organizational measures to ensure data security (SSL/TLS encryption, database security).
   • Promptly delete recordings and transcriptions at the Customer’s request or after the Customer deletes their Account.
3. The Customer guarantees that they have full legal authority to record and analyze their customers’ calls using AI and that they have fulfilled their information obligations towards them.

---

§ 5. RECIPIENTS AND TRANSFERS OUTSIDE THE EEA

1. For the proper functioning of the SaaS system, personal data may be transferred to trusted external entities with whom the Controller has signed appropriate data processing agreements:
   • Server infrastructure providers (hosting, databases).
   • Language model and speech synthesis providers (e.g. OpenAI, ElevenLabs) – for generating bot responses, transcriptions and summaries.
   • Electronic payment operators (e.g. Stripe) – for automatic subscription billing.
   • Notification system providers (SMS gateways, email systems).
2. Due to the use of global AI technology providers (e.g. OpenAI), data may be transferred outside the European Economic Area (EEA) – to the USA. Such transfer is based on Standard Contractual Clauses (SCC) approved by the European Commission or the Data Privacy Framework, ensuring the highest level of data protection.

---

§ 6. RIGHTS OF DATA SUBJECTS

Each Customer has the right to:

1. Access their data and receive a copy.
2. Rectification (correction) of their data.
3. Erasure of data (“right to be forgotten”) – unless this conflicts with tax obligations.
4. Restriction of data processing.
5. Object to direct marketing data processing.
6. Data portability.
7. Lodge a complaint with the supervisory authority – the President of the Personal Data Protection Office (UODO) in Poland, or the relevant supervisory authority in your country.

---

§ 7. COOKIES AND TRACKING TECHNOLOGIES

1. The Service uses cookies (small text files stored on the User’s device) for:
   • Essential purposes: Maintaining the logged-in Customer’s session in the Panel, ensuring security.
   • Analytical/Statistical purposes: Analyzing website traffic to continuously optimize the landing page.
2. The Customer may at any time change their cookie settings in their browser or block them entirely, though this may affect the proper functioning of some Customer Panel features.

---

§ 8. FINAL PROVISIONS

1. The Controller reserves the right to make changes to this Privacy Policy to adapt it to new technologies or changes in law.
2. Customers will be informed of any changes electronically via the Customer Panel or email.
3. The current version of this Privacy Policy is effective from 17.05.2026.

§ 9. Google Calendar Integration and Use of Google API Data

1. As part of the automatic voice assistant service, JustLab.tech allows Users to voluntarily connect their account with Google Calendar (Google Calendar API).
2. We access the User’s calendar (permission scope: https://www.googleapis.com/auth/calendar.events) exclusively for two strictly defined purposes:
   • Read: Checking availability (free slots) in real time during a phone call handled by the AI assistant.
   • Write: Automatically adding new events (meeting bookings) once confirmed by the caller.
3. Limited Use Policy: The use and transfer to other applications of any information received through the Google API by the JustLab.tech platform fully complies with the Google API Services User Data Policy, including the strict Limited Use requirements.
4. We guarantee that data from Google Calendar:
   • Is processed solely for the proper functioning of the voice assistant.
   • Is not and will never be sold to third parties.
   • Is not shared with external data brokers, advertising agencies or used for marketing purposes.
5. Users may at any time disconnect their Google Calendar from JustLab.tech via their Panel settings or directly from their Google account security settings. Disconnecting immediately revokes our system’s read and write permissions.