inakshe Privacy Notice

Effective date: 2026-10-06

This Privacy Notice explains what personal data the Controller collects, for what purposes, and how the Controller manages it. The Service is primarily addressed to Users from the European Union. The primary legal framework is Regulation (EU) 2016/679 (the "GDPR"), together with Regulation (EU) 2022/2065 — the Digital Services Act ("DSA"). Because the Controller is established in Poland, Polish statutory provisions apply where EU regulation leaves room for Member-State law (e.g., limitation periods, tax recordkeeping) — those are called out in the relevant sections below. Where your local law grants rights stronger than those listed here, we honor the stronger set.

§ 1. Data Controller

The Data Controller is Pavlo Kozub, a sole proprietor doing business as Pavlo Kozub, registered in the Polish Central Register of Economic Activity (CEIDG), registered address: Mochnaniec 39, 30-395 Krakow, Tax ID (NIP): 6762680373, REGON: 540067776 (the "Controller" or "we").

Data-protection contact: [email protected]. General contact: [email protected].

The Controller is not required to appoint a Data Protection Officer under GDPR Art. 37 and has not done so. Where contact on data-protection matters is needed, the Controller handles it directly.

§ 2. What Data We Collect and From Where

2.1. Service Visitors (technical data)

For each HTTP request we automatically process:

• IP address (in server logs and at the content delivery network edge)
• Browser type, operating system, device characteristics (from standard request headers)
• Referrer URL
• Date and time of the request
• Path of the requested resource

Purpose: operation and security of the Service, abuse detection, aggregated traffic statistics without identifying individuals.

2.2. Persons subscribing to the Waitlist

• Email address
• Optionally: first name (if provided in the form)
• Preferred language of communication
• Signup source (welcome page, nomination form — does not identify a third party)
• Date of signup, date of double-opt-in confirmation, date of unsubscription (if applicable)

The Waitlist is used solely to send a one-off notification when the public Catalog launches. The legal basis for processing is consent (GDPR Art. 6(1)(a)), expressed by selecting the relevant checkbox in the form.

inakshe Newsletter (planned service): recurring communication about Catalog development, new features, and educational content is not part of the Waitlist. Its launch will require separate consents (art. 10 of the Act of 18 July 2002 on Providing Services by Electronic Means — "UŚUDE" — commercial information; art. 393 of the Act of 12 July 2024 — Electronic Communications Law — "PKE" — electronic marketing), collected via a separate checkbox, with the right to withdraw at any time.

2.3. Users with an Account (specialists, organizations, administrators)

• Email address (unique Account identifier)
• First and last name (or name of the organization)
• Cryptographically hashed password (we do not store or know the original)
• User role
• Interface preferences (language, notifications)
• Account-activity history (audit log — identifiers and actions only, not content)
• Managed Card data (see § 2.4(c))

2.4. Specialists and organizations visible in the Catalog — three paths

The Catalog contains professional profiles ("Cards") made available in three modes, with different legal bases and different Controller obligations.

(a) "Scraped" Cards (obtained from public professional sources)

We obtain contact and professional data of professionals from publicly available directories, professional registries, and other lawful public resources, in order to offer them our Platform and to create a useful catalog for persons seeking neuro-affirming specialists.

Data processed in this category is limited to: first and last name, professional contact details, practice address, scope of services provided, public links (professional websites, industry media).

Sources we draw from:

• Official professional registries maintained by national regulatory bodies (medical, physiotherapy, psychology, psychiatry chambers) in the country where the specialist practises, where the registry's rules permit reuse of data in a public catalog
• Public professional websites and LinkedIn profiles of specialists
• Industry NGO directories in the neurodiversity sector (published with a declaration of open access)

Legal bases: GDPR Art. 6(1)(f) (the Controller's legitimate interest consisting in the promotion of the Platform among the relevant health-care and psychological-support specialists and in providing a reliable catalog to those seeking help) in conjunction with GDPR Art. 9(2)(e) ("data manifestly made public by the data subject") — to the extent the data concerns an area of specialization that could be regarded as a special category under GDPR Art. 9(1).

The Controller has documented an internal Legitimate Interest Assessment ("LIA") justifying the overriding of its legitimate interest over the rights and freedoms of data subjects; the document is made available upon reasonable request of a supervisory authority.

Pre-publication mechanism — pre-populate pilot (new in version 1.2):

Before each "scraped" Card is published, we send the specialist an email with a one-click Card-withdrawal link (in the form inakshe.com/remove/<token>, a signed token valid for 30 days). For the first 14 days after the email is sent the Card remains in the "pending-publish" state and is not publicly visible — the specialist has time to react without pressure. Only after a fruitless lapse of that period does the Card enter "scraped" mode and become publicly visible, while preserving all rights listed below.

Specialist's right to object and remove a Card: Regardless of the stage (pending-publish or published), any specialist may at any time:

• Withdraw the Card in one click via the link received by email (inakshe.com/remove/<token>). The Card is immediately hidden publicly (soft-delete). The Controller receives automatic notification and may restore the Card within 90 days if the specialist changes their mind. Permanent erasure from the database (hard-delete) occurs on an express request sent to [email protected] within 30 days of the request.
• Write to [email protected] with subject "Takedown" providing name + city + link to the Card — if the one-click withdrawal link has expired, been lost, or did not arrive; removal occurs within 48 hours of a verified report.
• Object to processing (GDPR Art. 21) — we respond within 30 days; upon acknowledgement of the objection we cease processing within the scope of the objection.
• Claim the Card — after identity verification via an email magic link, the specialist obtains full control over their Card and may edit or remove it.

(b) "Nominated" Cards (submitted by a third party)

Our Nomination feature allows users to submit a specialist whose services they have used or whom they trust. The third party (nominator) provides: specialist's name and city, scope of work, professional contact details, their own email, and an optional justifying comment.

Before a "nominated" Card is published:

1. We verify the nominator's email (double opt-in),
2. We send the specialist an invitation with right of first refusal — the specialist confirms, claims the Card, requests modifications, or requests not to be listed in the catalog,
3. The Card becomes publicly visible only upon the specialist's acceptance or after a fruitless lapse of 14 days from sending the invitation, in which case the Card remains in "scraped" mode (basis in § 2.4(a)) and is subject to the standard right to object.

We process nominator data solely to verify the nomination and defend against potential claims (GDPR Art. 6(1)(f)) — for 24 months, after which it is permanently deleted.

(c) "Owner-managed" Cards (managed directly by the specialist)

The specialist creates an Account, concludes with the Controller an agreement for electronic services (see Terms § 7–8), fills out their Card themselves, and is the administrator of their own content. Legal basis: performance of the contract (GDPR Art. 6(1)(b)).

2.5. Persons contacting us by email

The sender's email address, the content of the message, and any data provided on the sender's own initiative. These data serve only to respond to the message and are kept for the period necessary to conclude the correspondence + 12 months for evidentiary purposes.

§ 3. Purposes and Legal Bases for Processing

§ 4. Recipients of Data (Processors)

The Controller uses the following external service providers ("processors"), who process personal data on its behalf under data processing agreements (DPAs) meeting the requirements of GDPR Art. 28:

• Amazon Web Services EMEA SARL (Luxembourg; data stored in the EEA, Frankfurt region) — Service hosting, database, transactional email delivery. AWS Data Processing Addendum.
• Cloudflare, Inc. (San Francisco, USA) — content delivery network (CDN), DNS management, DDoS protection. Cloudflare DPA.

The list is updated on an ongoing basis. Before adding a new processor (e.g., processing payment data for a future paid subscription) we will inform data subjects at least 14 days in advance.

The Controller does not sell, rent, or share personal data with third parties for marketing purposes.

§ 5. Transfers Outside the European Economic Area (EEA)

Most data is stored exclusively in the EEA region (Frankfurt). However:

• AWS EMEA SARL stores data in the EU, but its parent Amazon Web Services, Inc. (USA) may have limited administrative access. Transfer basis: Standard Contractual Clauses (SCCs) approved by Commission Implementing Decision 2021/914 + the EU–US Data Privacy Framework (adequacy decision of 10 July 2023).
• Cloudflare, Inc. (USA) — traffic is served from EEA edge nodes but certain configuration operations occur in the USA. Transfer basis: SCCs + Data Privacy Framework.

For a copy of transfer safeguards — please write to [email protected].

§ 6. Special Categories of Data (GDPR Art. 9)

The Platform does not collect, from end users, health data, religious affiliation, political opinions, sexual orientation, or other special categories of data within the meaning of GDPR Art. 9(1).

Regarding specialist profiles: the area of specialization (e.g., "affirmative psychotherapy for adults on the autism spectrum") may, under certain interpretations, be regarded as a special category of data. In such cases its publication is based on GDPR Art. 9(2)(e) ("data manifestly made public by the data subject") or on the specialist's explicit consent in owner-managed mode (GDPR Art. 9(2)(a)).

Search queries entered by visitors (e.g., "ADHD psychologist Kraków") are not stored in a manner permitting linking to a specific person — we save only aggregated statistics without identifiers.

§ 7. Your Rights

Under the GDPR you have the right to:

1. Access your data (Art. 15) — receive confirmation and a copy of the data processed.
2. Rectify the data (Art. 16) — correct out-of-date or inaccurate data.
3. Erase the data ("right to be forgotten", Art. 17) — subject to limitations arising from legal obligations (tax books, defense against claims).
4. Restrict processing (Art. 18).
5. Data portability (Art. 20) — receive the data in a structured, commonly used format (JSON).
6. Object to processing based on legitimate interest (Art. 21) — in particular, specialists may object to processing in the Catalog under § 2.4(a).
7. Withdraw consent at any time (Art. 7(3)) where processing is based on consent — without affecting the lawfulness of processing before withdrawal.
8. Not be subject to automated decisions (Art. 22) — see § 9.
9. Lodge a complaint with the supervisory authority — President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, https://uodo.gov.pl.

To exercise these rights: send a message to [email protected] describing your request. We respond without undue delay and in any case within one (1) month of receipt (GDPR Art. 12(3)). In justified cases this period may be extended by an additional two months with written reasons.

Fast path — Waitlist unsubscription

• Click "Unsubscribe" at the bottom of every email, or
• Send a message to [email protected] with subject "Unsubscribe"

Unsubscription takes effect immediately upon receipt of the request.

Fast path — Specialist Card removal ("Takedown")

• Send a message to [email protected] with subject "Takedown" providing: specialist's name, city, link to the Card, and proof of professional identity (professional-licence number — numer PWZ, licence number, link to an official profile).

Removal occurs within 48 hours of a verified request.

§ 8. Cookies and Similar Technologies

The Service uses strictly necessary cookies and browser local storage only, required to deliver the requested service (language preference, authentication session, CSRF token).

We do not use cookies for marketing purposes, profiling-based analytics, or third-party cookies for cross-site tracking.

Cookies strictly necessary for the Service do not require prior consent under art. 5(3) of the ePrivacy Directive (2002/58/EC) and its national implementations — information suffices, which this section provides.

If cookies of other categories (analytics, remarketing) are introduced in the future, we will introduce a consent banner with granular options before their first use.

§ 9. Automated Decision-Making

The Controller does not apply automated decision-making, including profiling producing legal effects or similarly significantly affecting the data subject (GDPR Art. 22).

We do not operate automatic "matching" of persons seeking help with specific specialists. The Service's search engine works on the basis of simple keyword matching and user-selected filters — without machine-learning-based recommendation components.

§ 10. Data Security

The Controller applies technical and organizational security measures appropriate to the risk, in particular:

• Transport encryption (HTTPS) for all traffic with the Service
• Encryption of data at rest using standard industry algorithms
• Cryptographic hashing of passwords (the original password is never stored or logged)
• Limiting administrative access to the database to a minimal circle of persons
• Regular automatic backups kept according to the internal security policy
• The data-minimization principle (we collect only data necessary for the declared purposes)
• Audit records of all administrator operations (see § 12)

§ 11. Personal Data Breaches

In the event of a personal-data breach likely to result in a high risk to the rights and freedoms of natural persons, the Controller:

• Notifies UODO within 72 hours of becoming aware (GDPR Art. 33)
• Notifies the data subjects without undue delay (GDPR Art. 34)
• Documents the breach internally in accordance with GDPR Art. 33(5)

The breach-response procedure is maintained in an internal document and updated at least once a year.

§ 12. Retention Periods — Detailed

§ 13. User's Age

Browsing the Service is available without age restrictions. Use of services requiring an Account — creating an Account, submitting Nominations, claiming Cards — is available exclusively to adults with full legal capacity (Polish Civil Code — KC — art. 10–11).

The Service is not intended for collecting personal data of children. If we learn that an Account has been created by a minor, we will promptly delete the Account and associated data. Reports of suspected breaches of this rule should be sent to [email protected].

Specialists published in the Catalog must have full legal capacity and conduct their professional activity in accordance with Polish law or the law of the country where they practise.

§ 14. Changes to this Privacy Notice

This Notice may be updated. Material changes (addition of new categories of data, change of legal bases, addition of a new processor, change of retention periods) will be announced by:

• publishing the amended Notice in the Service with a version and date in the header,
• email to persons with an Account or subscribed to the Waitlist, sent at least 14 days before the changes take effect.

The version history is available in the Service's code repository.

§ 15. Contact

• General privacy inquiries and GDPR-rights requests: [email protected]
• General contact: [email protected]
• Card removal (Takedown): [email protected] with subject "Takedown"
• Reports of a privacy violation of another user / illegal content: see Terms § 15 (Moderation and DSA)

§ 16. Supervisory Authority

President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych) ul. Stawki 2 00-193 Warsaw https://uodo.gov.pl

For cross-border breaches concerning residents of other EU Member States, the Polish UODO remains competent (lead supervisory authority within the meaning of GDPR Art. 56).

Sources and Legal Bases

• Regulation (EU) 2016/679 — GDPR
• Regulation (EU) 2022/2065 — Digital Services Act (DSA)
• Directive 2002/58/EC — ePrivacy (cookies, art. 5(3))
• Act of 18 July 2002 on Providing Services by Electronic Means (UŚUDE)
• Act of 12 July 2024 — Electronic Communications Law (PKE)
• Act of 23 April 1964 — Polish Civil Code (Kodeks cywilny; art. 10–11, art. 22¹, art. 118)
• Commission Implementing Decision 2021/914 (Standard Contractual Clauses — SCCs)
• Commission Implementing Decision 2023/1795 (Data Privacy Framework — US adequacy)