Privacy policy

What personal data we collect

We keep collection narrow on purpose. The categories below are exhaustive — we do not collect data outside this list.

• Identity and contact data: name, email, company name, optional industry and message — only when you submit the contact form, the AI Readiness Assessment, or the exit-intent newsletter form.
• Assessment responses: the 12 quiz answers and the resulting score and tier (early / developing / mature). We do not collect any health, political, religious or other special-category data.
• Booking metadata: when you book a strategy call via Cal.com, Cal.com captures your name, email, time zone and chosen slot. That data is governed by Cal.com's privacy policy in addition to ours.
• Technical data: IP address (truncated for analytics), browser type, device type, referrer URL — captured by analytics tools only after you grant consent in the cookie banner.
• Usage data: pages visited, clicks on tracked CTAs, time on page, session replays — captured by Microsoft Clarity and Google Analytics only after analytics consent.
• Marketing data: LinkedIn profile match for retargeting audiences, and Meta Pixel events (page views, a submitted contact form, never its contents) for measuring and retargeting Facebook / Instagram ads — only after you grant marketing consent.

Why we use it

Each purpose is tied to a specific legal basis under Article 6 GDPR.

• Respond to inquiries and deliver requested content (legal basis: contract performance / pre-contractual measures).
• Send the AI Readiness Assessment report and at most four follow-up emails over 14 days (legal basis: explicit consent given via the assessment form's checkbox; you can opt out at any time).
• Improve the site through analytics (legal basis: explicit consent via the cookie banner — Necessary cookies are stored on legitimate-interest basis only).
• Run B2B retargeting via LinkedIn and measure and retarget ads on Facebook / Instagram via Meta Pixel (legal basis: explicit consent — the marketing category is off by default).
• Notify our team in real time about high-tier leads via Slack (legal basis: legitimate interest in qualifying leads — the data shared is the same as you submitted).

Who we share your data with

We use a small set of vetted processors. Each is contractually bound by Data Processing Agreements (DPAs) and, where relevant, Standard Contractual Clauses (SCCs) for international transfers.

How long we keep it

We delete what we no longer need. Retention windows below are maximums — we shorten them when shorter is sufficient.

• Contact form submissions and assessment results: 36 months from last contact, then deleted unless you became a client (in which case standard accounting retention applies — typically 5-7 years per Polish/EU tax law).
• Email subscription data: until you unsubscribe + 30 days for processing.
• Analytics data (Google Analytics, Clarity): 14 months for event-level data, then aggregated and de-identified.
• Cookie consent record: 13 months from last interaction (per ICO/CNIL guidance), then we ask again.
• Server logs (Vercel): 30 days for diagnostics, then deleted automatically.

Cookies and similar technologies

Our cookie banner divides cookies into three categories. You see the banner on first visit and can change your choice any time via the link in the footer.

• Necessary: required for the site to function (session, locale preference, security tokens). Cannot be disabled. Examples: ha-locale, ha-consent.
• Analytics: only set if you opt in. Used by Google Analytics 4 (anonymized IP) and Microsoft Clarity (session replays with form fields auto-masked). Cookie names follow each provider's standard (e.g. _ga, _clck).
• Marketing: only set if you opt in. Used by LinkedIn Insight Tag (cookie names: bcookie, lidc, UserMatchHistory, and similar) and Meta Pixel (cookie names: _fbp, fr) for ad measurement and retargeting.
• We do not use any cookies for behavioural advertising decisioning by third parties beyond LinkedIn and Meta (and only with your explicit consent).

Your rights

Under the GDPR (Articles 15-22), you have the following rights regarding your personal data. To exercise any of them, email contact@hohmann.pl — we respond within 30 days.

• Right of access: ask for a copy of the data we hold about you.
• Right to rectification: ask us to correct inaccurate or incomplete data.
• Right to erasure ('right to be forgotten'): ask us to delete your data, subject to legal retention obligations.
• Right to restrict processing: ask us to limit how we use your data while a complaint or correction is being resolved.
• Right to data portability: ask for a machine-readable copy of data you provided so you can move it elsewhere.
• Right to object: object to processing based on legitimate interest, including for marketing.
• Right to withdraw consent: withdraw at any time, without affecting processing that already happened.
• Right to lodge a complaint with a supervisory authority: in Poland this is UODO (uodo.gov.pl); in other EU member states see the local DPA.

International transfers

Some processors are based outside the European Economic Area (mainly the United States). Where applicable, we rely on the EU-US Data Privacy Framework certification of those processors and on Standard Contractual Clauses (SCCs) approved by the European Commission. We monitor the legal status of these transfers and adjust our stack if certifications are withdrawn or invalidated.

Security

We use TLS encryption in transit, secure cookies (HttpOnly, Secure, SameSite=Lax where applicable), strict CSP headers via Vercel, and limited access to processor admin panels. We do not store passwords because we don't have an authenticated user area on this site. If you suspect a security incident affecting your data, email contact@hohmann.pl — we will investigate and, if confirmed, notify affected users and supervisory authorities within 72 hours per GDPR Article 33.

Children

This site is intended for B2B audiences and is not directed at children under 16. We do not knowingly collect data from children. If you believe a child has submitted data, email contact@hohmann.pl and we will delete it.

Changes to this policy

We update this policy when our processing practices change (e.g. adding a new processor or new processing purpose). The 'last updated' date at the top reflects the latest revision. For material changes, we notify subscribers via email and reset the cookie consent prompt.

How to contact us

All data protection questions go to contact@hohmann.pl. We aim to respond within one business day for general questions and within 30 days for formal data subject requests, per GDPR Article 12.