PrivacyPolicy

This Privacy Policy explains in detail how H1 Spółka z ograniczoną odpowiedzialnością, operating as HORAIZON Labs (“we”, “us”, or “our”), collects, uses, stores, and protects your personal data when you visit horaizonlabs.com, interact with our content, or contact us.

We are committed to protecting your privacy and handling your data in a transparent, lawful, and responsible manner — in full compliance with the General Data Protection Regulation (EU) 2016/679 (GDPR) and applicable Polish data protection law, including the Act of 10 May 2018 on the Protection of Personal Data.

Please read this policy carefully before using our website or submitting any personal data to us.

A data controller is the entity that determines the purposes and means of processing personal data. For all data processing activities described in this policy, the data controller is:

• Art. 6(1)(b) — Contract performance: When you contact us to discuss collaboration, partnership, or service engagement, processing your contact data is necessary to take steps at your request prior to entering into any agreement.
• Art. 6(1)(f) — Legitimate interests: We rely on this basis for Hotjar analytics, server log processing, website security, and performance monitoring. We have conducted a legitimate interest balancing test and concluded our interests are not overridden by your fundamental rights, given the limited nature and privacy protections in place. You retain the right to object (see Section 09).
• Art. 6(1)(a) — Consent: Where we rely on consent for any future communications, we will explicitly request it and provide a clear mechanism to withdraw it at any time without detriment.

• Responding to your inquiries, messages, and contact form submissions
• Evaluating and following up on potential collaboration, partnership, or investment opportunities
• Improving website usability, navigation, and content based on behavioral analytics
• Ensuring website security, detecting fraud, and preventing unauthorized access
• Maintaining server performance and diagnosing technical issues
• Complying with our legal and regulatory obligations
• Internal record-keeping and business administration

We do not sell, rent, or share your personal data for third parties' own commercial purposes. Data is shared only in the following limited circumstances:

• Hotjar Ltd (Malta, EU) — as a data processor for behavioral analytics, bound by a Data Processing Agreement under GDPR Art. 28.
• Hosting and infrastructure providers — operating within the EU/EEA and bound by contractual data protection obligations.
• Legal and professional advisors — where necessary for legal advice, audit, or compliance purposes, subject to professional confidentiality.
• Regulatory or law enforcement authorities — where legally required by applicable law, court order, or binding regulatory authority request.

Hotjar Ltd. is incorporated and operates within the European Union (Malta). Data collected by Hotjar is primarily processed within the EEA. Where any transfer outside the EEA occurs, appropriate safeguards are ensured under GDPR Chapter V, including:

• Adequacy decisions issued by the European Commission
• Standard Contractual Clauses (SCCs) approved by the European Commission
• Certification under the EU-US Data Privacy Framework

Your contact form data and email correspondence are not transferred outside the EEA in the ordinary course of our operations.

We retain personal data only as long as necessary for the purposes for which it was collected, or as required by applicable law:

Upon expiry of the applicable retention period, personal data is securely deleted or irreversibly anonymized.

As a data subject, you have the following rights under the GDPR. We are committed to facilitating their exercise promptly and without undue delay.

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, accidental loss, destruction, alteration, or disclosure:

• Encryption of data in transit via HTTPS/TLS protocols
• Access controls limiting who can access personal data internally
• Use of reputable third-party processors with established security practices
• Regular review of our security measures and data processing practices
• Incident response procedures to address potential data breaches

In the event of a personal data breach likely to result in risk to your rights, we will notify the competent supervisory authority within 72 hours and inform affected individuals without undue delay where required by law.

No method of transmission over the internet is 100% secure. If you suspect a breach, contact us immediately at hello@horaizonlabs.com.

Our website and services are not directed at, and are not intended for use by, children under the age of 16. We do not knowingly collect personal data from minors.

If we become aware that we have inadvertently collected personal data from a child under 16, we will take immediate steps to delete that data. Please contact us at hello@horaizonlabs.com if you believe this has occurred.

Our website may contain links to third-party websites including partner organizations, portfolio companies, or reference materials. These links are provided for convenience only.

We are not responsible for the privacy practices, content, or security of any third-party websites. We encourage you to review the privacy policy of any external site you visit. The inclusion of a link does not constitute endorsement of the third party's privacy practices.

We reserve the right to update or modify this Privacy Policy at any time to reflect changes in our data processing practices, applicable law, or regulatory requirements. The “Last Updated” date at the top of this page will be revised accordingly.

Where changes are material, we will make reasonable efforts to communicate them — for example by posting a notice on the homepage. Continued use of our website following any changes constitutes acceptance of the updated policy.

For any questions, requests, or concerns relating to this Privacy Policy or our data processing practices, please contact us. We aim to respond to all data subject requests within 30 calendar days.