OFFERANDUM PRIVACY POLICY

Effective September 24, 2026 · Version 1.0

This policy explains what personal information we process when you use Offerandum, contact us, or use a quote form that a company built with Offerandum. It applies to offerandum.com and the services we provide.

CONTENTS

1. Who we are and how to contact us
2. Our roles: controller and processor
3. What information we collect
4. Sign-in and account security
5. Why we use it, on what basis and for how long
6. Visitors to a company's quote form
7. Letters to businesses and the pages behind their codes
8. E-mails to businesses outside Poland
9. Who receives the data
10. International transfers
11. Your rights
12. Notice for residents of US states
13. Cookies and browser storage
14. Automated quotes and profiling
15. Security and changes to this policy

WHO WE ARE AND HOW TO CONTACT US

Offerandum is operated by Damian Krychowski, a sole proprietor registered in Poland, doing business as Offerandum, ul. Marii Skłodowskiej-Curie 8/22, 42-400 Zawiercie, Poland, Polish tax identification number (NIP) 6492262191. We have no entity in the United States.

For anything about personal information, write to contact@offerandum.com or to the postal address above. Because we are established in the European Union, we process personal information under the EU General Data Protection Regulation (GDPR), wherever you are.

OUR ROLES: CONTROLLER AND PROCESSOR

We are the controller of the personal information we process to run Offerandum: your contacts with us, your account and the accounts of your users, billing, and the technical data of our website.

We are a processor for the enquiries (leads) that visitors send through a company's quote form. The company that receives the enquiry decides why and how it is used and is the controller. Our work for that company is governed by the Data Processing Agreement. If you sent an enquiry through a company's form, section 6 describes our role and how to reach the right controller.

WHAT INFORMATION WE COLLECT

• Contact with Offerandum: your name, e-mail address, phone number, company name and whatever you write in a message or contact form, depending on the fields you fill in. Messages from the contact form go to our e-mail. If you tick a marketing consent in the form, we record it separately together with proof of it (details). If you ask for a live demonstration, our reply contains a link to pick a time in Cal.com; the details you give when booking, including your name, e-mail address and the chosen time, go to Cal.com, and the demonstration takes place in Google Meet (recipients).
• Account sign-up: the e-mail address, company name, website address, phone number, country and remarks given in the sign-up form, the example form you ask for, and the requests for a form you send later from the panel. If you sign up from a demonstration page prepared for your business, we connect the account to that demonstration and carry over its logo and color.
• Account and cooperation: the details of each account user, e-mail address, company details and contact persons, permissions, form settings, subscription and billing information, and information about how the service is used.
• Payments: when you pay by card, Stripe collects your card details and billing information. We receive confirmation of the payment, the card brand and the last four digits, never the full card number.
• Enquiries: contact details, quote parameters, the place of delivery or installation, remarks and anything else typed into a company's form, the calculated result and the PDF documents generated. The scope depends on the company's form. We process these as a processor for that company.
• Letters to businesses: details of businesses we write to about Offerandum and of the people we address, collected by us from public sources, and information about the use of the codes printed in those letters (details).
• Technical data: IP address, information about requests to the service, events and errors, and data needed to protect the service from abuse. An IP address may also be attached to a message from the contact form.

We receive this information from you, from the company that gives you an account or names you as a contact person, and from your use of the service. Details of businesses we write to come from public sources. Providing information is voluntary, but the required fields are needed to handle the function, reply to you or perform the agreement. Without the billing details the law requires we cannot invoice the service. Do not enter health information or other sensitive categories of personal information in a quote form.

SIGN-IN AND ACCOUNT SECURITY

You sign in with a one-time code or link from an e-mail message, with a passkey, or with Google. Sign-in is available to authorized users of accounts created as part of our cooperation with a company and of accounts created with the sign-up form. Google and passkeys are optional; you can use e-mail messages without connecting a Google account or adding a passkey.

The e-mail message carries a code valid for 15 minutes, which works only in the browser that asked to sign in, and a link. We store only hashes of the code and the link. A passkey is created by your device or password manager under the WebAuthn standard; the private key stays with you, and we store the public key, the credential identifier, the name of the browser and system it was added from, and the dates it was added and last used. A passkey works only on the offerandum.com domain. You manage passkeys in the account settings; adding or removing one requires signing in within the last 10 minutes, and removing one ends your sessions on other devices. We keep passkeys until you remove them or the account is deleted.

If you choose Google, we receive from Google the account identifier, the e-mail address, whether it is verified and, if there is one, the organization's domain. We use them to confirm identity and connect the Google account to your Offerandum account, and we store a permanent identifier of that connection. We get no access to the content of your Google mail, contacts or files. Google receives the information needed to handle the sign-in, including connection data and the fact that you chose Offerandum, and applies the Google privacy policy to its own operations.

The legal basis for sign-in is Art. 6(1)(b) GDPR when you are a party to the agreement, or Art. 6(1)(f) GDPR when you use the account as a company's representative: our legitimate interest in giving access to authorized people. We keep the Google connection until you disconnect it or the account is deleted. You manage it in the account settings; a change requires you to confirm your identity again.

Before you first enter a company's panel you accept, on the company's behalf, the Terms of Service and the Data Processing Agreement, and confirm that you have read this policy. We then record: your e-mail address, the company you act for, the versions of the documents and the wording of your statement, the date and time, the IP address and browser information. We send a confirmation with the documents as PDF files to your address. We keep this record after the account is deleted as well, until the limitation period for claims under the agreement with the company ends, under Art. 6(1)(f) GDPR: our legitimate interest in showing on what terms we provide the service.

The operator account requires an additional code from an authenticator app or a one-time recovery code. Recovery codes are stored as hashes. We log authentication events and operator actions, with the identifier of the person, the company, the resource, the time and the result, to protect access and for accountability (Art. 6(1)(f) GDPR). The security log is kept for 90 days and removed in a daily clean-up. Material needed to explain a specific incident or to defend a claim may be preserved separately for the duration of the matter.

WHY WE USE IT, ON WHAT BASIS AND FOR HOW LONG

Marketing consents

Sending an enquiry or creating an account is not a consent to marketing. The contact form has two separate, optional consents: e-mail messages, and phone calls and text messages. The form can be sent without them, and leaving them unticked does not affect our reply.

When you tick a consent we record: the channel, the e-mail address or phone number it concerns, the exact wording of the consent and of the notice shown next to it with its version number, the date and time, the IP address, browser information and where on the site the form was. You confirm an e-mail consent with a button on the page linked from a message sent to that address; the link works for 7 days, and without confirmation we send no marketing. We keep these records to be able to demonstrate consent (Art. 7(1) GDPR), under Art. 6(1)(c) GDPR.

You can withdraw consent at any time, as easily as you gave it: with the link in a message from us, by writing to contact@offerandum.com or by saying so on a call. Withdrawal does not affect the lawfulness of earlier processing. After withdrawal we keep the record of giving and withdrawing consent, to be able to show it and not to contact you that way again.

VISITORS TO A COMPANY'S QUOTE FORM

Offerandum lets companies publish quote forms on their own websites and on pages hosted by us. The company you send an enquiry to decides its purpose and scope and how it follows up. Read the company's notice and privacy policy shown at the form.

For these enquiries Offerandum is a processor: on the company's behalf we receive and store enquiries, show them to the authorized users of its panel, generate PDFs and send messages about the enquiry or the quote. We do not use enquiries entrusted to us for our own marketing. For a form used to contact Offerandum itself, the controller is Damian Krychowski.

The legal basis and retention of an enquiry are decided by the company as controller. How Offerandum processes it, including return or deletion when the cooperation ends and what happens to backups, is set out in the Data Processing Agreement with the company, with its annexes: the list of subprocessors and the security measures. This policy does not replace that agreement.

Together with an enquiry we store the exact wording of the controller notice shown in the form and of each marketing consent of the company that was shown, and whether it was ticked, so that the company can demonstrate what was agreed to. Those consents concern contact with that company, not with Offerandum.

The AI assistant in a form

Some forms have an assistant: a panel where you describe what you need, and the assistant fills in the fields and answers questions about the form. The assistant is a bot based on a large language model and introduces itself as one. Using it is voluntary; everything can be typed by hand.

To reply, we send the model provider the text of your message, the earlier messages in that conversation and a description of the form's fields with their current values. We do not send the company's price list or the code of the form, and your contact details go there only if you type them into the conversation. We use three model providers: Google (Gemini API), OpenAI (API) and Anthropic (Claude API); which one serves a given form follows from its configuration. All three act on our instructions, do not use the conversations to train their models and keep them at most for as long as needed to detect abuse, under their terms for API services.

Until you send the enquiry, the conversation exists only in your browser and is not stored on our side. When you send the enquiry, the conversation goes to the company with it: it is stored like the answers in the form, visible to the authorized users of that company's panel, not attached to any e-mail, and deleted together with the enquiry. The company receiving the enquiry is the controller of this content too. Do not write anything into the conversation that you do not want the company to receive, in particular health information or other sensitive categories.

The assistant's replies are not an offer. The assistant does not know the prices; the quote is always calculated by the form from the rules and prices set by the company, and only a quote confirmed by the company is binding. You can dictate messages with your microphone; speech recognition is then done by your browser under its provider's rules, and only the recognized text reaches us.

Images and videos in a form that were generated or modified with AI carry an "AI" mark, and the assistant carries a disclaimer that it is a bot. Both follow the EU Artificial Intelligence Act, which applies to Offerandum as an EU provider; they are not a US requirement.

Usage statistics of a form

A company sees in its panel how many people opened its form, which page they reached, which fields they changed and whether they saw a quote. These are only counts summed per form and per day: the identifiers and names of fields come from the form's code, and for fields with a list of options we count which options were chosen. We also count where a visitor came from: the domain of the referring page (never the full address), campaign parameters from the page address (utm_source, utm_medium, utm_campaign) and the page on which the form sits; click identifiers of ads are not stored. The form script embedded on a company's website may keep this information in the browser tab's memory (sessionStorage) until the tab is closed, so that a visit from an ad stays visible after moving to another page. We never store a typed value, content or contact details this way, and we use no cookies or third-party tools for it. The source of the visit is also recorded with a sent enquiry, as an attribute visible to the company. So that one visit is counted once, we keep a random session identifier for two hours, the same one that protects the form from bots; it cannot tell who you are. We process statistics on behalf of the company that publishes the form, under its legitimate interest in evaluating and improving the form (Art. 6(1)(f) GDPR), and do not use them for our own purposes.

To access, correct or delete an enquiry, contact the company you sent it to. If you write to us, we help direct your request to the right controller.

LETTERS TO BUSINESSES AND THE PAGES BEHIND THEIR CODES

We send paper letters about Offerandum to some businesses, based on public information. This is direct marketing of our own services, carried out under our legitimate interest (Art. 6(1)(f) GDPR). We do not e-mail or call those businesses without consent or a request from them.

Where the data comes from. We collect business details ourselves from public sources: business registers, company websites and public business profiles such as Google Maps listings. We record the business's name and registration details, its address, publicly listed contact details and, if the letter is addressed to a person, that person's name and role, together with the source. Each letter contains a notice about this processing (Art. 14 GDPR) with the kinds of sources we use.

The codes in a letter. A letter contains two addresses with a code assigned to the business: a page with a demonstration of the form we prepared for it, and a page where the business can decide about messages from us or object. The same decisions are available at the bottom of the demonstration page. When somebody uses them, we record the date and time of the visit, the type of device (phone, tablet or computer), whether the code was scanned or typed, and the actions in the demonstration: starting to use the form, seeing a quote, sending the demonstration form, opening the price panel and clicking the button to book a call. We do not record values typed into the demonstration form, and that form sends nothing. We use no cookies for this. We process this information to know whether the letter arrived and to adjust further contact, under Art. 6(1)(f) GDPR.

Consents and a call-back request. The consent page from a letter uses the same consent register as the contact form (details): an e-mail consent is confirmed by a link sent to the given address, and the consent record shows the letter code it came from. On the demonstration page you can ask for a call: we use the number, name and preferred time only to call you back about the demonstration, at your request (Art. 6(1)(f) GDPR). You can also book a call in Cal.com; the letter code then goes into the booking so that we know which demonstration it concerns.

Objection. You can object to processing for direct marketing at any time: with the button on the consent page from the letter, at offerandum.com/zgoda/<code>, by e-mail to contact@offerandum.com or by phone. After an objection we send no more letters and delete the business's and the addressee's details, the letter pages and the demonstration prepared for it and our notes about the contact. Consents given earlier from that business's code page are recorded in the register as withdrawn. We keep only the business's tax number, website address and postal address, so that we do not add it to a mailing again.

How long. We keep the details of businesses that did not respond for no longer than 12 months after the last letter. If a business asks for contact or we start working together, we continue to process the data as data of contact with Offerandum and cooperation (purposes and retention). You have the rights described under Your rights, including the right to complain to the Polish supervisory authority.

E-MAILS TO BUSINESSES OUTSIDE POLAND

To some businesses outside Poland, at present in the United States, we write by e-mail instead of by post, based on public information. This is direct marketing of our own services, carried out under our legitimate interest (Art. 6(1)(f) GDPR) and, in the United States, in accordance with the CAN-SPAM Act. We write to the business address the company publishes for enquiries, or to the person the company's own website or public listing names as running it; never to a private address. We do not call a business unless it asks us to.

Where the data comes from. We collect business details ourselves from public sources: the company's website, its Google Maps listing, business directories such as the Better Business Bureau, and state business registers. We record the business's name and legal name, its address, its publicly listed e-mail address and phone number and, if the message is addressed to a person, that person's first and last name and role, together with the source. Before the first message we may check with a verification service whether the e-mail address exists, to avoid writing to addresses that no longer work; the service receives only the address.

What we record about a message. A sequence of at most a few messages goes from one of our own mailboxes. We record when each message was sent, whether it was delivered or bounced, and any reply, including its text, so that we can answer it and stop further messages. Automatic answers, such as out-of-office replies, are recorded the same way and change nothing. Every message identifies us, gives our postal address and carries a link and a one-click header that stop further messages; a reply asking us to stop has the same effect.

The demonstration page. A message links to a page with a demonstration of the form we prepared for the business. The link carries the number of the message it came from, so that we know which message was opened. On that page we record what is described under Letters to businesses: the visit, the type of device, and the actions in the demonstration, never the values typed into it. Because e-mail security software opens links before a person does, we treat a page as read only when it stays open for a while or something is done on it.

Opting out. You can stop the messages at any time: with the link in the footer of any message, at offerandum.com/unsubscribe/<code>, with the unsubscribe button of your mail program, by replying "unsubscribe" or by writing to contact@offerandum.com. We act on it at once, and in every case within ten business days. After that we send no more messages and delete the business's and the addressee's details, the demonstration prepared for it and our notes about the contact. We keep only the e-mail address, the company's mail domain, its website address and its postal address, so that we do not write to it again.

How long. We keep the details of businesses that did not respond for no longer than 12 months after the last message. If a business replies, asks for a call or we start working together, we continue to process the data as data of contact with Offerandum and cooperation (purposes and retention). You have the rights described under Your rights; residents of US states will also find what applies to them under Notice for residents of US states.

WHO RECEIVES THE DATA

We share data, to the extent needed for the given purpose, with the following categories of recipients:

• Cloudflare, Inc. (United States): hosting, databases, file storage, content delivery, traffic protection and sending e-mail. Details: Cloudflare privacy policy.
• Cloudflare Turnstile: protecting forms from bots. Before we start the assistant, play a video, e-mail a quote or accept an account sign-up, Turnstile checks in the background that the form is used by a person. It processes technical data of the browser and the connection, including the IP address, and sets no tracking cookies. The basis is our legitimate interest in protecting the service from abuse (Art. 6(1)(f) GDPR). Details: Turnstile privacy policy.
• Google LLC (Gemini API), OpenAI, L.L.C. (API) and Anthropic Ireland, Limited (Claude API): the language models behind the assistant in forms that have one; each form uses one of them. They receive the conversation with the assistant and the description of the form's fields with their values, never the price list or the form's code. They act on our instructions as subprocessors of the company receiving the enquiry. Details in The AI assistant in a form, the Gemini API terms, the OpenAI business terms and the Anthropic commercial terms.
• Stripe, Inc. (United States): card payments. Stripe receives your card details, billing name and address and the amount, and processes them under its own rules as a payment service provider. We do not receive the full card number. Details: Stripe privacy policy.
• Cal.com, Inc.: booking live demonstrations and calls. When you pick a time through the link in our reply to a demonstration request or with the button on a demonstration page from a letter, Cal.com receives the details you give when booking and, in the second case, the letter code. Details: Cal.com privacy policy.
• Google Ireland Limited (Google Calendar and Google Meet): live demonstrations. A time booked in Cal.com is saved in our Google calendar with a meeting link, and the demonstration takes place in Google Meet. Google processes the name and e-mail address from the booking and, during the meeting, connection data and video and audio if you switch them on. Details: Google privacy policy.
• Google LLC (Google Workspace, Gmail): the mailboxes our messages to businesses outside Poland go from and their replies arrive in. Google processes the messages as our e-mail provider. Details: Google privacy policy.
• E-mail address verification service: before the first message to a business outside Poland, the service receives the e-mail address alone and tells us whether it exists.
• E-mail and IT service providers: handling correspondence and maintaining the service within the tasks entrusted to them.
• Google Ireland Limited (Google Analytics 4) and PostHog, Inc. (PostHog Cloud EU): analysis of the use of the site and, for PostHog, of the panel and of test links, as described in Cookies and browser storage and Analytics of the panel and of test links. PostHog acts on our instructions as a processor and stores the data in the European Union. Provider rules: Google privacy policy, PostHog privacy policy and PostHog data processing agreement.
• Providers of form features: depending on the feature used, Google may receive the part of an address you type in order to show suggestions. Loading Google Fonts or OpenStreetMap maps sends the provider connection data, including the IP address. More: Google privacy policy and OpenStreetMap Foundation privacy policy.
• Accounting and legal advisers: where needed for settlement, advice or the defense of claims.
• Public authorities: where the law obliges us to disclose.

Enquiries from a form go to the company named as their recipient. Providers may act on our instructions or as separate controllers, depending on the service and their own legal obligations.

INTERNATIONAL TRANSFERS

PostHog, Inc. is based in the United States, but stores and processes the analytics data in a data center in the European Union (PostHog Cloud EU). Any support access from outside the European Economic Area rests on the standard contractual clauses included in the PostHog data processing agreement.

We are established in Poland, in the European Economic Area. Our infrastructure provider, Cloudflare, is a US company with a global network, and our AI model providers, our payment processor and our booking tool are US companies. Personal information is therefore processed both in the EEA and in the United States.

If you are in the United States, your information is transferred to us in the EEA to provide the service. For transfers from the EEA to a country without an EU adequacy decision, we rely on the safeguards Chapter V of the GDPR requires: an adequacy decision of the European Commission where it covers the recipient and the transfer (including the EU-U.S. Data Privacy Framework for certified companies), or the EU Standard Contractual Clauses with additional measures where needed.

Cloudflare describes its mechanisms in its data processing addendum, Cal.com in its privacy policy and Stripe in its privacy policy. For information about the safeguards for a specific transfer and how to get a copy of them, write to contact@offerandum.com.

YOUR RIGHTS

Under the GDPR, and regardless of where you live, you have the right to access your personal information and get a copy of it, to have it corrected or deleted, to restrict its processing and to receive it in a portable format. You can object to processing based on our legitimate interest for reasons related to your particular situation, and to direct marketing at any time.

Withdrawing consent does not affect the lawfulness of earlier processing. Send requests to contact@offerandum.com. Where necessary, we ask for information that lets us confirm your identity. We reply within one month; for a complex request we may extend this by two further months and tell you why. You also have the right to lodge a complaint with a supervisory authority; ours is the President of the Personal Data Protection Office in Poland (Prezes Urzędu Ochrony Danych Osobowych): uodo.gov.pl.

If your request concerns an enquiry you sent through a company's form, the company is the controller and we forward your request to it, or you can contact the company directly.

NOTICE FOR RESIDENTS OF US STATES

This section is for residents of US states with privacy laws. It does not claim that any particular state law applies to Offerandum; it states plainly what we do.

What we collect and why. The categories of personal information we collect are listed in section 3: identifiers and contact details (name, e-mail address, phone number, company, postal address), commercial information (subscription, orders, payments, correspondence), account and sign-in information, the content of enquiries sent through a company's form (as a processor for that company), details of businesses we write to, and internet and device information (IP address, browser, requests and events). We use them for the purposes in section 5: providing and billing the service, replying to you, security and abuse prevention, marketing with your consent, letters to businesses, complying with law and defending claims.

What we do not do. We do not sell personal information. We do not share personal information for cross-context behavioral advertising. We do not use sensitive personal information to infer characteristics about you, and we do not process personal information of a person we know to be under 16. We do not use a company's enquiries or form statistics for our own purposes.

Who receives it. The recipients are listed in section 8. They are service providers acting on our instructions (hosting, payments, AI models, booking, analytics after consent) or separate controllers where they process data for their own purposes.

How long. The retention criteria are in section 5.

Your requests. You can ask to know what personal information we hold about you, to correct it, to delete it and to receive a copy, and you will not be treated differently for exercising these rights. Send requests to contact@offerandum.com or to the postal address in section 1. We verify a request with the e-mail address on file or, where needed, with further details, and reply within 45 days; if we need more time, we tell you. An authorized agent may act for you if you give the agent written permission and we can verify your identity. If we decline a request, you may ask us to reconsider by replying to our answer.

Enquiries sent to a company. For an enquiry you sent through a company's quote form, the company is responsible for answering your request; we forward requests we receive and help the company fulfil them.

COOKIES AND BROWSER STORAGE

Cookies are small pieces of information a site stores on your device. For sign-in we use strictly necessary cookies that page scripts cannot read. Local browser storage (localStorage) holds panel settings and local work on forms; we do not keep the sign-in token there. Necessary session data and sign-in protection do not require the consent used for optional analytics.

You can inspect and delete site data in your browser's privacy settings. Deleting sign-in data requires signing in again, and deleting settings restores the default panel view.

On the public pages of the site we use Google Analytics 4 and PostHog to analyze visits, spot usability problems and improve the site. Cookies and browser storage for these tools are set only after you consent in the cookie banner; the legal basis for processing personal information for this purpose is Art. 6(1)(a) GDPR. Without consent, Google Analytics does not run and PostHog counts the visit without storing anything on the device: the visit identifier exists only in the memory of the open page and goes when it is closed. The basis for that counting is our legitimate interest in evaluating and improving the site (Art. 6(1)(f) GDPR).

• Google Analytics 4: statistics of visits, traffic sources, page views and events. The information processed includes cookie identifiers and data about the browser, device and use of the site. The cookies _ga and _ga_* distinguish users and keep session information; their default lifetime is 2 years. Details: Google Analytics cookies.
• PostHog: statistics of page views and events (clicks, scrolling, use of the example forms and videos, account sign-up), click maps and session recordings that replay movement on the page with the content of every input masked. Data about the device, browser, pages visited, traffic source and interactions is processed; the IP address serves only to determine an approximate location. With consent, PostHog sets a ph_* cookie and a local storage entry for 1 year, to recognize a return visit. The data is processed in a data center in the European Union (PostHog Cloud EU). Details: PostHog privacy policy.

You can accept or decline optional analytics in the cookie banner. Declining does not block the basic functions of the site. You can change or withdraw your choice at any time through "Cookie settings" in the footer. Withdrawal stops these tools from running further and does not affect the lawfulness of earlier processing. Cookie lifetimes are shown in the cookie banner; a cookie's lifetime is separate from how long the provider keeps analytics data.

We store your choice in localStorage under the key offerandum_cookie_consent, with the date and the version of the consent rules. The choice is valid for 180 days; after that we ask again. Saving new settings reloads the page and replaces the previous choice. When consent is withdrawn, we delete the cookies and local storage entries of these tools that are accessible to the site.

The tools run on the public pages of the site, including the sign-in and sign-up pages, where the content of every input is always masked. They do not run inside companies' quote forms or on the hosted pages with those forms. In the company panel and the operator panel PostHog runs without cookies, as described below.

Analytics of the panel and of test links

To know which panel features are used and where something gets in the way, we record in PostHog events from the company panel and the operator panel: views, operations performed (saves, publications, exports, settings changes), application errors and session recordings in which every text and every input is masked, so a recording shows the way through the panel and not the content of leads or price lists. Events are linked to the signed-in account (account identifier, e-mail address, role) and to its company. The panel sets no cookies and stores nothing in the browser for this purpose. We also record opens of form test links, that is when and from what kind of device somebody looked at a form prepared for a company, without the content of what was entered, and facts about the cooperation with the company (account created, form published, number of enquiries received, payments), without the content of enquiries. The basis is our legitimate interest in developing the service and running the cooperation with the company (Art. 6(1)(f) GDPR); you can object by writing to kontakt@offerandum.com. PostHog deletes session recordings automatically after 90 days; we keep the other events no longer than for the duration of the cooperation with the company and 2 years after it ends.

AUTOMATED QUOTES AND PROFILING

A quote form calculates a price automatically from the parameters entered and from the rules and prices set by the company. The result may be stored in the enquiry and in a PDF document. What the quote means and on what terms a contract with that company may be concluded follow from the information at the form and the content of the offer.

The AI assistant makes no decisions: it fills in the fields as you described them, and you see and can change every value before sending. The quote comes only from the form's rules and does not depend on the conversation.

In running our own accounts and contacts, Offerandum makes no decisions about you based solely on automated processing that have legal or similarly significant effects, and does no advertising profiling. How a company uses a quote is explained by that company.

SECURITY AND CHANGES TO THIS POLICY

We use technical and organizational measures appropriate to the kind of data, including access control and transport encryption. Access to data is limited to the people who need it to do their work. The measures we commit to for companies' enquiries are described on the security measures page.

If another entity takes over running Offerandum, in particular a company to which the Offerandum business is contributed or sold, it becomes the controller of the personal information described in this policy, for the same purposes and on the same terms. We announce it on this page and tell the people whose details we hold by e-mail, naming the new controller. Consents given to Offerandum remain valid and can be withdrawn at any time, as before.

This policy may be updated when the service, our providers or the law change. The current version is always on this page, with its effective date at the top. Websites of companies that publish quote forms and other sites we link to have their own privacy rules.

Questions about this policy: contact@offerandum.com.