Privacy and Cookie Policy
Data controller: Sofudio Sp. z o.o., registered office in Olsztyn, Poland, ul. Bajkowa 1/1A, 10-696 Olsztyn, entered in the Register of Entrepreneurs kept by the District Court in Olsztyn, 8th Commercial Division of the National Court Register.
Contact on personal data matters: contact@bzp.ai
1. Scope of this policy
This policy explains how we process the personal data of visitors to https://bzp.ai (the “Website”) and users of the BZP platform at https://legal.bzp.ai (the “Platform”), in accordance with Regulation (EU) 2016/679 (the “GDPR”).
Documents and data that a Client uploads to the Platform (e.g. contracts, letters, case files) are processed on the Client’s behalf, with us acting as a processor under a data processing agreement. For that data, the Client is the controller.
2. Purposes and legal bases
| Purpose | Legal basis | Retention |
|---|---|---|
| Displaying the Website and keeping it secure | Legitimate interest (Art. 6(1)(f) GDPR) | Up to 30 days (server logs) |
| Registration, Account management and providing the services | Performance of a contract (Art. 6(1)(b) GDPR) | For the term of the agreement, then until claims become time-barred |
| Sharing materials with a Partner Lawyer for Certification | Performance of a contract (Art. 6(1)(b) GDPR) | For the duration of Certification and the period required by professional rules |
| Billing and accounting | Legal obligation (Art. 6(1)(c) GDPR) | 5 years from the end of the tax year |
| Handling enquiries and complaints | Legitimate interest (Art. 6(1)(f) GDPR) | Until the matter is closed, then until claims become time-barred |
| Marketing our own services to business clients | Legitimate interest (Art. 6(1)(f) GDPR) | Until you object |
| Analytics cookies (if enabled) | Consent (Art. 6(1)(a) GDPR) | Until consent is withdrawn |
| Establishing, pursuing and defending claims | Legitimate interest (Art. 6(1)(f) GDPR) | Until claims become time-barred |
3. Recipients
Data may be shared with parties that help us provide the services, only to the extent necessary:
- hosting and infrastructure providers with servers in the European Economic Area,
- payment operators handling Plan billing,
- our accountants and legal advisers,
- Partner Lawyers – only for Certification you have ordered,
- AI model providers – only when the User chooses that model: Anthropic (Claude), Google (Gemini), OpenAI (GPT).
The default “LegalAI by BZP” model runs on our infrastructure in the EEA and does not send data to external AI providers. We do not use Users’ documents or content to train models.
4. Transfers outside the EEA
Choosing an external AI model may involve transferring data outside the European Economic Area, in particular to the USA. Such transfers rely on the mechanisms in Chapter V GDPR, for example a European Commission adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses. You can obtain a copy of the safeguards by writing to contact@bzp.ai.
5. Your rights
You have the right to access your data, rectify it, have it erased, restrict processing, data portability, object to processing based on legitimate interest, and withdraw consent at any time (without affecting the lawfulness of earlier processing). You also have the right to lodge a complaint with the President of the Polish Personal Data Protection Office (UODO, ul. Stawki 2, 00-193 Warsaw) or another EU supervisory authority.
6. Voluntary provision and profiling
Providing data is voluntary but necessary to create an Account and use the Platform. We do not make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you (Art. 22 GDPR).
7. Security
We apply technical and organizational measures appropriate to the risk, including encryption of data in transit and at rest, access control and a tamper-proof audit log of operations in the Platform.
8. Cookies and similar technologies
The Website uses only mechanisms that are strictly necessary for it to work. Fonts are served from our own server, not from third-party providers.
| Name | Type | Purpose | Duration |
|---|---|---|---|
| bzp_cookie_consent | Browser local storage, essential | Remembers your cookie choice | Until you delete it |
| Platform session cookies (https://legal.bzp.ai) | Essential | Logging in and keeping your session | Until logout or as set by the Platform |
The Website currently uses no analytics or marketing cookies. If we introduce them, they will only run after you consent in the banner, and this table will be updated. You can change your choice at any time by clicking “Cookie settings” in the page footer. You can also delete and block cookies in your browser settings.
9. Changes to this policy
We may update this policy, for example when the law or our services change. The current version is always available on the Website.