Skip to content
TeamCo Cloud
Book a call
PLEN

Privacy Policy

Effective date: 26.10.2026
Last updated: 26.10.2026
Version 2.0

This Privacy Policy describes what personal data we process on the teamco.cloud website, for what purpose, on what legal basis, to whom we disclose it, and how long we retain it. It covers contact and recruitment forms, bot protection on forms, website analytics, cookies and browser storage, and technical server logs.

The controller of your personal data is: TeamCo Cloud sp. z o.o.

  • Address: ul. Prezydenta Gabriela Narutowicza 77/8, 20-019 Lublin, Poland
  • KRS: 0001021732
  • NIP: 5252946133
  • REGON: 524624858
  • Data protection contact: hello@teamco.cloud

The Controller has not appointed a Data Protection Officer (DPO). For matters concerning personal data processing, please contact the Controller directly at the e-mail address above.

We use service providers who process data on our behalf under data processing agreements (Art. 28 GDPR), and — in the cases described below — providers acting as separate controllers:

2.1 Google

Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland; affiliate: Google LLC, USA). Role: data processor. Services:

  • Google Tag Manager (GTM) — tool that deploys analytics tags. Fires analytics tags exclusively after you grant consent for the Analytics category.
  • Google Analytics 4 (GA4) — website usage statistics. Operates exclusively after you grant consent for the Analytics category. Before your choice and without consent, the website sends no data to Google Analytics. We do not transmit names, e-mail addresses, phone numbers, message content, or IP addresses to Google Analytics.
  • Google Ads — advertising system used to measure campaign effectiveness and record conversions (form submissions). Google Ads tags fire exclusively after you grant consent for the Marketing category (ad_storage, ad_user_data, ad_personalization) in the cookie banner.
  • Google reCAPTCHA Enterprise — bot and spam protection for forms. The script runs on form pages as a necessary security element, transmitting behavioural signals and the IP address read by Google. Our server checks a single-use token with Google and does not send your IP address to Google. Details and legal basis: Section 3.2.
  • Google Cloud — Firebase Hosting (website hosting), Cloud Functions (receiving forms and recording consent), Firestore (storing consent logs and form protection rate limiters), Cloud Logging (technical logs). Services configured in europe-central2 (Warsaw). Website content may be delivered via Google's CDN, including servers outside the EEA.
  • Google BigQuery — copy of statistical data from Google Analytics 4, stored in the EU region; read-only access for the company team. Details: Section 3.5.
  • Google Workspace — company electronic mail. Processes data from messages you send directly to our e-mail addresses and from our replies.

Data processed by Google may be transferred to Google LLC in the USA. The basis is the European Commission's adequacy decision of 10 July 2023 for the EU–US Data Privacy Framework (DPF), supplemented by Standard Contractual Clauses (SCC).

Google Privacy Policy: policies.google.com/privacy

2.2 Salesforce

Role: data processor — CRM system used to manage form submissions. Form data is first sent to our Cloud Function in Google Cloud (Warsaw), which validates it and checks reCAPTCHA protection, before forwarding it to Salesforce. Where data is transferred outside the EEA, this is based on the safeguards provided in Chapter V GDPR, in particular the Standard Contractual Clauses approved by the European Commission.

Salesforce Privacy Policy: salesforce.com/company/privacy

We process personal data solely for the purposes described below, on the indicated legal bases:

3.1 Contact and Recruitment Forms

Forms: permanent recruitment, on-demand specialists, extended team, post a job offer, contact, AI Engine, Boost.

Purpose: answering your inquiry and preparing the service you request (recruitment, job posting, commercial contact).

Legal basis: steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR); when writing on behalf of a company — our legitimate interest in handling business inquiries (Art. 6(1)(f) GDPR). The checkbox on the form confirms you have read this Privacy Policy.

Scope of data: first name, last name, e-mail address, company name, job title, message content, phone number (optional), link to job offer (optional, job posting form), form type.

Data flow: data is sent to our server function submitLead in Google Cloud (Warsaw) and, after validation, to Salesforce (Section 2.2). The website does not store form contents; server logs record only form type, status, and error code.

3.2 Form Protection: reCAPTCHA and Rate Limiting

Purpose: protecting forms against bots, spam, and abuse.

a) Google reCAPTCHA Enterprise: Google's script on form pages evaluates whether a form is being completed by a human. Google receives signals on page usage and the IP address read by Google. Our server sends Google only a single-use token to verify, without your IP address. The script loads on form pages without separate consent, as it is strictly necessary to securely submit the form you requested. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) — website security and transmission integrity.

b) Rate limiter: to limit submissions from a single address, our server stores a cryptographic hash of your IP address (HMAC-SHA256 with a secret pepper; the IP cannot be reversed from this record) and the submission count for that hour. Legal basis: legitimate interest (Art. 6(1)(f) GDPR) — protecting the service against overload. Location: Google Cloud Firestore, Warsaw. Retention: 1 hour.

3.3 Direct Correspondence

When you send a message directly to hello@teamco.cloud or other company addresses on the teamco.cloud domain, data is processed in Google Workspace to handle correspondence. Legal basis: Controller's legitimate interest (Art. 6(1)(f) GDPR).

3.4 Website Analytics (Google Analytics 4 via Google Tag Manager)

Purpose: understanding website usage and measuring which traffic sources generate inquiries. Before your choice and without consent, the website sends no data to Google Analytics.

Legal basis: consent (Art. 6(1)(a) GDPR), Analytics category.

We collect: browser identifier from cookie _ga, device and browser data, approximate location (city/region), traffic source, visited page type, button and link clicks, form funnel progression (field name, never field contents), viewed job offers, applied filters, search queries (excluding e-mail addresses and numeric runs), Core Web Vitals. We do not collect names, e-mails, phones, message text, or IP addresses in analytics events. Data is not used to identify individuals or for profiling under Art. 22 GDPR.

3.5 BigQuery Analytics Export

Data from Google Analytics 4 (described in Section 3.4) is exported daily to our Google BigQuery database in the EU region to analyse trends alongside search visibility metrics (Google Search Console, Chrome User Experience Report — aggregated data not relating to individuals). Read-only access for authorized team members. Company AI tools have no access to personal data. Legal basis: same consent as for Google Analytics (Art. 6(1)(a) GDPR). Retention: 26 months.

3.6 Consent Log

Purpose: demonstrating that you granted or withdrew consent. Legal basis: legal obligation to demonstrate consent (Art. 7(1) GDPR) in conjunction with Art. 6(1)(c) GDPR. We record: random consent ID generated by your browser, decision type (accept, reject, custom, withdrawal), category states, banner version, language, build version, server timestamp. We do not record names, e-mails, or IP addresses. Location: Google Cloud Firestore, Warsaw. Retention: 13 months from recording.

3.7 Technical Server Logs (Google Cloud)

Purpose: security, availability, and diagnostic monitoring. Legal basis: legitimate interest (Art. 6(1)(f) GDPR). Recorded: IP address, User-Agent, requested URL, response status code, timestamp. Retention: 30 days.

3.8 Advertising Campaigns (Google Ads)

Purpose: measuring ad campaign performance and recording conversions. Legal basis: consent (Art. 6(1)(a) GDPR), Marketing category. Google Ads tags fire only after consent is granted in the cookie banner.

3.9 Obligation to Provide Data

Providing data in forms is voluntary, but without required fields we cannot process your inquiry. Phone number and job offer link are optional. Consent for analytics and marketing is entirely voluntary; refusal does not limit website use or form submissions.

The website uses cookies and browser storage (localStorage and sessionStorage) on your device:

4.1 List of Storage Keys and Cookies

  • teamco_cookie_consent (localStorage, Necessary) — your cookie consent choices. Retention: until cleared.
  • teamco_cookie_consent_at (localStorage, Necessary) — timestamp of your choice. Retention: until cleared.
  • teamco_cookie_consent_meta (localStorage, Necessary) — consent ID and banner version. Retention: until cleared.
  • teamco_cookie_consent_pending (localStorage, Necessary) — retrying consent log on network error. Retention: until successful server record.
  • teamco_lang (localStorage, Necessary) — preferred language. Retention: until cleared.
  • theme (localStorage, Necessary) — light or dark mode. Retention: until cleared.
  • teamco_audience (sessionStorage, Analytics) — employer or candidate visit context. Retention: until tab closed.
  • _ga (cookie, Analytics, Google) — distinguishes visitors. Retention: 2 years.
  • _ga_<id> (cookie, Analytics, Google) — session state. Retention: 2 years.
  • _GRECAPTCHA (cookie, Necessary, Google) — risk analysis and bot protection on forms. Retention: 6 months.

4.2 Consent Categories

  • Necessary — website operation: remembering consent choices, language, theme, and bot protection for forms (Google reCAPTCHA). Do not require consent.
  • Functional — remembering additional preferences. Currently no tools in this category.
  • Analytics — website statistics (Google Analytics 4). Require consent.
  • Marketing — advertising measurement and remarketing (Google Ads). Require consent.

4.3 Managing Cookie Consent

On your first visit, a cookie banner is displayed with options to accept or customise. We implement Google Consent Mode v2 — by default all analytics and marketing tags are set to denied until you consent. Before your choice, no analytics data is sent.

Every choice and change is recorded in our consent log (Section 3.6). You can change or withdraw your consent at any time using the “Cookie settings” link in the footer. Withdrawal does not affect lawful processing prior to withdrawal.

You can also manage cookies through your browser settings.

Some personal data may be transferred outside the EEA: to Google LLC (USA) — based on the European Commission's adequacy decision of 10 July 2023 (EU–US Data Privacy Framework) and Standard Contractual Clauses; to Salesforce — based on the safeguards provided in Chapter V GDPR, in particular Standard Contractual Clauses. The consent log, rate limiters, and server functions run in Warsaw; BigQuery analytics export is stored in the EU region. Website content may be delivered via Google's CDN, including servers outside the EEA.

  • Form inquiries (Salesforce): 2 years from the last contact regarding the inquiry; longer only if a contract is concluded (for contract duration and statutory limitation periods).
  • Pseudonymous analytics data (Google Analytics 4): 14 months.
  • BigQuery analytics export: 26 months.
  • Consent log (Firestore): 13 months from recording.
  • Form protection rate limiter (Firestore): 1 hour.
  • Technical logs (Google Cloud): 30 days.
  • reCAPTCHA data: single-use token; data collected by Google per Google reCAPTCHA Enterprise terms.
  • Cookie preferences (localStorage): until manually cleared by the user.
  • Visit context (sessionStorage teamco_audience): until tab closed.

Under GDPR (Arts. 15–22), you have the following rights:

  • Right of access (Art. 15) — to obtain confirmation and information on how we process your personal data.
  • Right to rectification (Art. 16) — to have inaccurate data corrected or incomplete data completed.
  • Right to erasure (Art. 17) — right to be forgotten when data is no longer necessary for its original purposes.
  • Right to restriction of processing (Art. 18) — to restrict processing under certain circumstances.
  • Right to data portability (Art. 20) — to receive your data in a structured, commonly used format.
  • Right to object (Art. 21) — to object to processing based on legitimate interests.
  • Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting prior lawful processing.
  • Right to lodge a complaint (Art. 77) — you have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland; www.uodo.gov.pl) if you believe processing violates the law.

We will respond without undue delay and in any event within one month of receipt; this may be extended in line with Art. 12(3) GDPR, in which case we will tell you. Contact: hello@teamco.cloud.

The Controller implements appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure, or destruction:

  • Encryption of data in transit using TLS/SSL protocols (HTTPS certificate).
  • Two-factor authentication (2FA) on administrative accounts across systems.
  • Regular software updates and access control policies.
  • Brand fonts (Megabyte) are self-hosted on Firebase Hosting — not loaded from external CDNs, avoiding data transfers to third parties.

The website does not engage in automated decision-making, including profiling under Art. 22 GDPR, producing legal effects or similarly significantly affecting individuals.

The website contains standard links to our social media profiles (e.g. LinkedIn). Clicking opens an external third-party site operating under its own privacy policy. The website does not embed social media widgets or tracking scripts.

The Controller reserves the right to amend this Privacy Policy. Any updates will be published on this page with an updated effective date.

Last updated: 26.10.2026 (Version 2.0)