Skip to content
Cohorta™
Sign up

Documents

Privacy Policy

This is a translation. The Polish version is legally binding. Read the Polish version.

1. Data controller

The controller of personal data is YES FOR sp. z o.o., ul. Świętokrzyska 61, 32-650 Kęty, Poland, entered in the register of entrepreneurs of the National Court Register (KRS) kept by the District Court for Kraków-Śródmieście in Kraków, 12th Commercial Division of the National Court Register, under KRS number 0001181754, NIP (tax identification number) 5492485016, REGON 542135795, share capital PLN 100,000.00. The controller has not appointed a Data Protection Officer. For data protection matters, please get in touch through the contact form.

2. What data we collect

  • Account data: email, first name, surname, avatar.
  • Transaction data (payment metadata from Stripe, without card numbers).
  • Content created on the platform: posts, comments, messages, course materials, certificates.
  • Technical data: IP address, user agent, time and context of the visit.
  • Session and functional cookies.

3. Purposes of processing and legal basis

  • Providing the account service, Article 6(1)(b) GDPR (performance of a contract), retained for as long as the account is active plus 3 years.
  • Processing payments, Article 6(1)(b) and (c) GDPR (tax obligations), retained for 5 years for accounting documents.
  • Transactional communication (notifications about courses and certificates), Article 6(1)(b) GDPR, retained for the duration of the subscription.
  • Our own marketing, Article 6(1)(f) GDPR (legitimate interest) or consent under Article 6(1)(a).
  • Security and logs, Article 6(1)(f) GDPR, retained for 90 days.
  • Establishing and pursuing claims, Article 6(1)(f) GDPR, retained until the claims become time-barred.

4. Who we share data with

We use the following processors:

  • Supabase Inc., database and authentication hosting (EU region, SCCs for transfers to the US).
  • Vercel Inc., application hosting.
  • Stripe, payment operator (Ireland/US).
  • Resend, transactional email provider.
  • Fakturownia.pl, issuing VAT invoices.
  • Google Ireland Ltd., Google Analytics and Google Tag Manager, only when the workspace administrator enables analytics and only after you consent to analytics cookies.

5. Transfers outside the EEA

Some processors are based in the US (Stripe, and in part Supabase and Vercel). Transfers take place on the basis of standard contractual clauses (SCCs) and the Data Privacy Framework.

6. Rights of the data subject

Under the GDPR you have the right to:

  • access your data (Article 15),
  • rectification (Article 16),
  • erasure (the right to be forgotten, Article 17),
  • restriction of processing (Article 18),
  • data portability (Article 20),
  • object to processing (Article 21),
  • withdraw consent at any time,
  • lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland.

To make a request, get in touch through the contact form. We reply within one month of receiving the request.

7. Cookies

Strictly necessary cookies (Supabase Auth, to keep you signed in) and functional cookies (theme and language preferences) are always active, because the platform does not work without them.

Analytics cookies (Google Analytics, Google Tag Manager) load only after you give your consent in the cookie banner. They are not set until you consent. You can withdraw your consent at any time by clearing cookies in your browser, and we will ask again. We do not use marketing or advertising cookies without your consent.

8. Security

We use TLS encryption in transit, Row-Level Security in the database, restricted access through authenticated server actions and sanitisation of user content. In the event of a personal data breach, we notify the Polish supervisory authority (UODO) within 72 hours in accordance with Article 33 GDPR.

9. Changes to this policy

We give appropriate advance notice of changes to the Policy through the platform panel and by email. This version applies from 1 June 2026.

Version of 21 August 2026. The previous version applied from 1 June 2026; the change concerns the entity operating the platform, which since August 2026 has been YES FOR sp. z o.o.