Last updated: 4 November 2026 · Version 2.0 · Controller: UTUBEO sp. z o.o.
This Privacy Policy explains how we handle personal data when you visit www.utubeo.com, contact us, book a call, buy a digital product or work with us. The controller of your personal data is UTUBEO spółka z ograniczoną odpowiedzialnością (UTUBEO sp. z o.o.), ul. Towarowa 20-B, 10-417 Olsztyn, Poland, entered in the Register of Entrepreneurs of the National Court Register kept by the District Court in Olsztyn, VIII Commercial Division of the National Court Register, under KRS number 0000830285, NIP (tax ID / VAT EU) PL7393937798, REGON 385598625 (“Utubeo”, “we”, “us”).
You can reach us about anything related to your data at hello@utubeo.com or by post at the address above. We have not appointed a Data Protection Officer, because the law does not require it for a business of our size and type. Your messages go directly to the management board.
We apply Regulation (EU) 2016/679 (the General Data Protection Regulation, “GDPR”), the Polish Act of 10 May 2018 on the protection of personal data, the Polish Electronic Communications Law of 12 July 2024 (in particular Articles 398–400 on cookies and direct marketing), the Polish Act of 18 July 2002 on providing services by electronic means, and Regulation (EU) 2024/1689 (the AI Act) where it concerns our use of AI tools.
This policy covers personal data we process:
Other websites we link to, and the platforms we use to sell or deliver services (such as Upwork, Stan Store or Stripe), have their own privacy policies. Where those companies decide on their own how to use your data, they are separate controllers.
The table below lists each situation, the data involved, our purpose and legal basis, and how long we keep the data.
| Situation | Data | Purpose and legal basis | How long we keep it |
|---|---|---|---|
| Contact form, email, Upwork message | Name, email, company, website, the content of your message, any other details you choose to give | To reply and to take steps you ask for before signing a contract (Art. 6(1)(b) GDPR). For messages from company representatives, our legitimate interest in business communication (Art. 6(1)(f) GDPR). | Until your enquiry is handled, then up to 2 years for follow-up and record keeping, unless you object earlier or we sign a contract. |
| Booking a call | Name, email, chosen date and time, notes you add, call details | To arrange and hold the call (Art. 6(1)(b) GDPR). | Up to 2 years after the call, or longer if a contract follows. |
| Buying a digital product | Name, email, billing details, tax ID if you buy as a company, order and payment status (we never see your full card number) | To conclude and perform the contract and deliver the product (Art. 6(1)(b) GDPR); to issue invoices and keep accounting records (Art. 6(1)(c) GDPR); to handle complaints and claims (Art. 6(1)(f) GDPR). | For the duration of the contract, then until claims expire (in most cases 6 years, or 3 years for business claims, counted to the end of the calendar year). Accounting records: 5 years from the end of the year in which the tax payment deadline passed. |
| Working with us as a client | Contact details of your representatives, contract and billing data, project communication, materials and account access you provide | To perform the contract (Art. 6(1)(b) GDPR) or, for representatives of a company, our legitimate interest in performing the contract with that company (Art. 6(1)(f) GDPR); accounting and tax duties (Art. 6(1)(c) GDPR). | For the duration of cooperation, then as for claims and accounting records above. |
| Newsletter and free resources | Email, name if given, which emails you open and click | To send you the resource and our emails with tips and offers, only with your consent (Art. 6(1)(a) GDPR and Art. 398 of the Electronic Communications Law). | Until you unsubscribe or withdraw consent. After that we keep a minimal record that you opted out, so we do not write to you again. |
| Contacting business representatives (prospecting) | Name, job title, company, business email or profile, publicly available information about the company | To introduce our services to companies that may need them – our legitimate interest (Art. 6(1)(f) GDPR). We send commercial information by email only where the law allows it. | Up to 12 months after the last contact, unless you become a client. If you object, we keep only what is needed to respect your objection. |
| Website analytics and advertising | Cookie identifiers, device and browser data, pages viewed, clicks, approximate location, ad interactions | To measure how the website works and how our ads perform, and to show our ads to relevant people – only with your consent (Art. 6(1)(a) GDPR and Art. 399 of the Electronic Communications Law). See section 6. | Until you withdraw consent, and no longer than the lifetime of each cookie listed in section 6 and the retention settings of each tool. |
| Security and website operation | IP address, request data, technical logs | To keep the website available and secure and to block abuse – our legitimate interest (Art. 6(1)(f) GDPR). | Usually up to 30 days, longer only when a log is needed to investigate an incident. |
| Our social media profiles | Your public profile name, comments, messages and reactions | To run our profiles and reply to you – our legitimate interest (Art. 6(1)(f) GDPR). For Facebook and Instagram page statistics we are joint controllers with Meta Platforms Ireland Ltd. | As long as the content stays on the platform, or until you object. |
| Claims, complaints and legal requests | Data needed for the specific case | To establish, pursue or defend claims and to answer authorities (Art. 6(1)(c) and (f) GDPR). | Until the case and any limitation period end. |
Where we rely on our legitimate interest, you can object at any time (see section 9). Where we rely on your consent, you can withdraw it at any time. Withdrawal does not affect what we did lawfully before.
To deliver our services, clients often give us access to their YouTube channels, Google Ads, Meta Business, analytics, CRM or similar accounts. These accounts can contain personal data of the client’s own customers, leads, viewers or audiences.
For that data we act as a processor on behalf of the client, under Article 28 GDPR. We use it only to deliver the agreed service, on the client’s instructions, and we do not use it for our own purposes. The data processing terms are part of our Terms of Use (section “Personal data and processing for clients”) unless we sign a separate data processing agreement.
We ask for access through user roles and permissions, not shared passwords, wherever the platform allows it. When a project ends, we remove our access or ask the client to remove it.
We use AI tools in our work, for example to help with research, analysis of performance data, drafting reports and scripts, and producing or editing images, audio and video. This is how we handle that:
We do not sell personal data. We share it only with companies that help us run the business, and only as far as needed:
Stripe, Upwork, Stan, Meta, Google (for its advertising services), Microsoft and Pinterest also process some data as independent controllers under their own privacy policies. A current list of our processors is available on request.
Some of the providers above are based in, or use servers in, countries outside the EEA, mainly the United States. We transfer data only with a lawful safeguard:
You can ask us for a copy of the safeguards that apply by writing to hello@utubeo.com.
Under the GDPR you have the right to:
To use any of these rights, write to hello@utubeo.com. We reply within one month. In complex cases we may extend this by two more months and will tell you why. We may ask you to confirm your identity.
You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl, or with the data protection authority in the EU country where you live or work.
If you agree to marketing cookies, Google, Meta, Microsoft and Pinterest may use them to place you in advertising audiences (for example people who visited our website) and to show you our ads. This is profiling for advertising. It does not lead to any decision with legal or similarly significant effects for you. We do not make such decisions by automated means.
We use technical and organisational measures suited to the risk: encrypted connections (HTTPS), two-factor authentication on our accounts, access limited to people who need it, permission-based access to client accounts, regular updates and reputable providers. If a personal data breach occurs that is likely to put your rights at risk, we will report it to the supervisory authority within 72 hours and inform you where the law requires it.
Giving data is voluntary. Some data is needed to reply to you, deliver a product or perform a contract. Without it we cannot do that. Tax law requires certain data on invoices.
Our services are for businesses and adults. We do not knowingly collect data from children under 16. If you think a child has given us personal data, write to hello@utubeo.com and we will delete it.
We review this policy when the law, our tools or our services change. The current version is always on this page with its date. If we make important changes that affect you, for example a new purpose of processing, we will tell you by email or with a notice on the website. This version applies from 4 November 2026.
This policy is also available in Polish. Both versions have the same content.