Privacy policy
Last updated: 8 October 2026.
01Data controller
The controller of personal data processed in connection with your use of mes-ai.org is Star spółka z ograniczoną odpowiedzialnością (a Polish limited liability company), with its registered office at ul. Zatorska 62A/4, 51-215 Wrocław, entered in the National Court Register under KRS 0000933782, tax ID (NIP) 8952235795, share capital PLN 20,000.00, paid up in full (the "Company", "we"). The Company is represented by its management board — Bartosz Starkiewicz (President of the Management Board) and Michał Gajek (Member of the Management Board), each acting alone.
Contact: e-mail sales@mes-ai.org, phone +48 504 815 922.
Data protection officer: the Company has not appointed a data protection officer.
02What data we collect
a) Contact form. When you submit the form we process: your name (required), e-mail address (required), company name, the areas you are interested in (Production, Quality, Health & Safety, Maintenance), your message, and the language of the page from which you submit. You may put other data in the message — please do not include data that is not needed for your enquiry, in particular special-category data.
b) Technical data. When you visit the site and when you submit the form, the hosting service processes your IP address and basic request data (date and time, requested address, browser type). When you submit the form, the IP address is also used to limit the number of submissions (at most 5 within 10 minutes per address). The counter is held only in the memory of the server function, is not written to a database or file, and disappears when the function instance ends or after 10 minutes. The form also contains a hidden anti-spam field that visitors do not see or fill in.
c) Direct contact. If you e-mail sales@mes-ai.org or call us, we process the correspondence data (e-mail address, content, and possibly name, company, phone number).
d) What we do not do. We do not store form submissions in a database or in files on our website — a submission reaches the Company's mailbox as an e-mail. We use no analytics, profiling or advertising tools. We make no automated decisions about you, including profiling (Art. 22 GDPR).
We collect data from you. If you contact us as a company representative, data about you may have been passed to us by your employer.
03Purposes and legal bases
| Purpose | Legal basis (GDPR) | Reasoning |
|---|---|---|
| Replying to enquiries by form, e-mail or phone; discussing MES.AI | Art. 6(1)(f) — our legitimate interest in communicating with people interested in our offer | You initiate the contact; the data is minimal (two mandatory fields); no profiling; you can expect a reply |
| Sending an offer at your request when you act on your own behalf (e.g. a sole trader) | Art. 6(1)(b) — steps at the request of the data subject prior to entering into a contract | Only for people who ask for an offer themselves |
| Site security, protection from spam and abuse (submission limit, anti-spam field, server logs) | Art. 6(1)(f) — our interest in security and continuity of the service | Short-term and necessary; related to Art. 32 GDPR |
| Establishing, exercising and defending legal claims; archiving correspondence for the period in section 5 | Art. 6(1)(f) — our interest in legal protection | Only correspondence still needed |
See section 6 for the right to object. Replying to your enquiry is not marketing; if we later want to send you commercial information beyond a reply, we will do so only as the applicable rules allow (including consent where required). At present we send no newsletter or other commercial information beyond replying to your enquiry and continuing the conversation about it.
Is providing data mandatory? There is no statutory or contractual obligation to provide data. Name and e-mail are, however, necessary for us to answer a form enquiry (you can also phone or e-mail us). Other fields are optional.
04Recipients of data (including transfers outside the EEA)
| Recipient | Role | Purpose | Location |
|---|---|---|---|
| Resend, Inc. | processor (Art. 28 GDPR) | sending the form message to the Company's mailbox | USA; sending from an EU region (Ireland, eu-west-1), but Resend keeps its account, logs and metadata in the USA |
| Vercel Inc. | processor (Art. 28 GDPR) | hosting the site and running the form function | USA; the form function runs in Frankfurt (region fra1) |
| dhosting.pl Sp. z o.o., ul. Pamiętna 14B/2, 02-972 Warsaw, NIP 7010198361 | processor (Art. 28 GDPR) | hosting the sales@mes-ai.org mailbox where we keep correspondence | Poland (the provider states its data centre is in Warsaw) |
| Legal and accounting advisers and IT providers (where needed) | processors or separate controllers, depending on the service | legal, accounting and technical support | PL/EU |
| Public authorities | separate controllers | where required by law | PL/EU |
Only members of the Company’s management board have access to the sales@mes-ai.org mailbox.
Transfers outside the European Economic Area. Resend and Vercel are based in the USA. Transfers rely on: (i) the European Commission's standard contractual clauses (Decision 2021/914) incorporated into those providers' data processing agreements; (ii) for Resend and Vercel, also certification under the EU-U.S. Data Privacy Framework (Commission adequacy decision of 10 July 2023). You can obtain a copy of the safeguards by writing to the address in section 1.
05Retention
| Data | Period | Reasoning |
|---|---|---|
| Form message / mailbox correspondence — enquiry without further cooperation | up to 12 months after the last contact, then deleted | time to continue sales talks and protect against claims relating to the enquiry |
| Correspondence leading to a contract | rules in a separate customer notice (contract term + limitation + tax/accounting duties) | different basis and purpose |
| Copy of the message in Resend logs | up to 30 days after the message is sent (per the provider’s documentation); Resend account data is deleted within 90 days of termination | provider terms |
| IP address in the submission-limit counter | up to 10 minutes, in function memory only | spam limiting |
| Request logs at the hosting service (IP, time, resource) | up to 1 day (function-invocation logs on the Pro plan); other technical data — under the provider’s terms | security and diagnostics |
06Your rights
You have the right to: access your data (Art. 15), rectification (16), erasure (17), restriction of processing (18), to object to processing based on our legitimate interest (21 — on grounds relating to your particular situation; after an objection we stop processing unless we demonstrate compelling legitimate grounds), and, where applicable (processing under Art. 6(1)(b)), data portability (20). Send your request to the address in section 1; we reply within one month.
You may also lodge a complaint with the supervisory authority: the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl. If you live or work in another EU Member State, you may also complain to the supervisory authority of that State (Art. 77 GDPR). If you are in the United Kingdom, you may contact the Information Commissioner’s Office (ico.org.uk).
07Cookies and similar technologies
The site does not store cookies on your device, does not use browser local storage (localStorage, sessionStorage) and contains no analytics, advertising or tracking scripts. The only script on the page handles submission of the form after you submit it. We therefore do not ask for cookie consent.
Fonts. The fonts (Geist, Geist Mono) are loaded from our own server — we do not connect to third-party font servers for this.
Links. The site links to our LinkedIn profile. A connection to LinkedIn is made only after you click the link; from then on LinkedIn's privacy policy applies.
08Contact on data matters
For matters concerning personal data write to sales@mes-ai.org or call +48 504 815 922.
This policy is drafted in Polish; the English version is a translation. In case of discrepancy the Polish version prevails.