§ 2. Purposes and legal bases
We process your data to conclude and perform the contract for services available in the Odoardo™ ecosystem (Article 6(1)(b) GDPR), including running your Odoardo ID™ account and fulfilling orders and subscriptions.
We also process data to meet our legal obligations, such as issuing invoices and keeping accounting records (Article 6(1)(c) GDPR).
Before performing an order whose value reaches a threshold we set, we compare your name, or the company name given in the order, with the EU lists of persons and entities subject to restrictive measures (sanctions). We do this to meet the obligations of the European Union's regulations on restrictive measures, which prohibit making funds and economic resources available to the persons on those lists (Article 6(1)(c) GDPR). The check is made by a member of our team. Its result, date and note are recorded with the order and kept for as long as the order's data.
To keep the Platform secure, to pursue claims, to compile analytical statistics and to name business customers as references (name, place name, logo) we process data on the basis of the Controller's legitimate interest (Article 6(1)(f) GDPR).
We send commercial information only on the basis of your consent (Article 6(1)(a) GDPR), and each of the three consents is separate. Consent to commercial information by e-mail covers messages linked to your own activity: reminders of a composition or an entry left unfinished, suggestions of products and programmes that complement your orders (including The Filmable Book by Odoardo™ and collaboration with artists), invitations to return after a subscription ends and, if you have an entry in The Filmable Book by Odoardo™, reminders and messages about the next thresholds of its visits. Consent to commercial information by telephone covers telephone calls and text messages (SMS) to the telephone number given in Odoardo ID™. Subscribing to Odoardo Letters™, confirmed through a link from your mailbox, is consent to receive only the successive issues of Odoardo Letters™. You can withdraw any of these consents at any time — in your Odoardo ID™ profile or by writing to [email protected], and the e-mail consent and the Odoardo Letters™ subscription also with one click on the “unsubscribe” link present in every such message. Withdrawing consent does not affect the lawfulness of processing carried out on the basis of that consent before its withdrawal.
We choose the content of marketing messages on the basis of your account category and purchase history (basic profiling). We do not take automated decisions producing legal effects concerning you, or similarly significantly affecting you.
If you collaborate with us as an Odoardo Art™ artist, we process your first name, surname, pen name, photograph, recorded message to recipients, biography and letter to the patron to perform the collaboration agreement (Article 6(1)(b) GDPR) — for the duration of the collaboration and, after it ends, for as long as we sell copies made earlier and provide services relating to copies already released. In performance of that agreement (Article 6(1)(b) GDPR) we also send you informational messages about the catalogue and the collaboration — they are not commercial information, and you can opt out of them with one click. From the record of each such message we remove its content after 12 months and the recipient's address after 400 days at the latest, leaving only the fact that it was sent. After the collaboration ends we keep what the AI assistants of released works and the history of the catalogue need: your first name and surname or pen name, portrait, biography, letter to the patron, the texts about the work and the work itself. Your telephone number and the recorded message to recipients are deleted when the collaboration ends. Your postal address and payment details are kept on the terms of the clause “Payments to artists”. Your e-mail address is the address of your Odoardo ID™ account and is deleted together with the account. The rest of the collaboration data — the portfolio link, your own description and the curators' notes — is anonymised 6 years after the collaboration ends, when the limitation period for claims runs out. If no copy of your work was ever released, after the same period we also anonymise your first name and surname, pen name, portrait and texts, and the work itself where no licence you granted covers it. The permission to use your likeness and the rules for those messages are set out in the Artist Collaboration Terms. The work's AI assistant (Odoardo Soul™) in Odoardo Art™ answers on the basis of what you give us about yourself and the work. For that purpose, in performance of the collaboration agreement (Article 6(1)(b) GDPR), we send OpenAI your first name and surname, your pen name if you use one, your country, the title of the work, your grammatical gender, your biography, the letter to the patron and the texts about the work. The grammatical gender serves only so that the assistant speaks of you in the correct form. We continue to send them after the collaboration ends, for as long as the AI assistant of the released copies operates. In performance of the same agreement, the biography, the letter to the patron and the texts about the work are translated into the site's other languages with the help of an OpenAI model.
If, in a conversation with the Odoardo™ assistant, you ask to be contacted and give your details — first name, surname, telephone number or e-mail address, sometimes the name of your place — we pass them to our team so that somebody from us gets in touch about that one matter. The basis is steps taken at your request before entering into a contract (Article 6(1)(b) GDPR). Details given this way are not marketing consent: they enter no mailing, and we do not contact you outside that matter. The request itself is saved with the conversation, so that it is clear what it concerned and when it was made.
We process an entry to The Filmable Book by Odoardo™ and its frame to run the yearbook and to publish the profile and the yearbook, on the basis of performing the terms of entry (Article 6(1)(b) GDPR). Once the entry is in the yearbook, the basis is our legitimate interest in keeping an accurate record of the edition that is not rewritten afterwards (Article 6(1)(f) GDPR). We do not erase the entry on request to the extent that it is necessary for the establishment, exercise or defence of legal claims (Article 17(3)(e) GDPR). You may object to that processing on grounds relating to your particular situation. We consider every objection individually and report the outcome. The likeness of people visible in a published frame comes to us from you and we publish it on the basis of our legitimate interest (Article 6(1)(f) GDPR), and a person visible in the frame may object and request that the frame be removed. The frame of a withdrawn entry, including a replacement frame awaiting approval, is deleted at the moment of withdrawal, because its publication ends, and all that remains as evidence of the licence granted is the licence record with the frame's cryptographic digest, without the photograph itself. We keep that record for 6 years from the withdrawal of the entry and then anonymise it. Deleting the account withdraws the entries that did not reach the yearbook, and the frames of distinguished entries and laureates stay in the yearbook. The details are set out in the The Filmable Book by Odoardo™ Submission Terms.
If you report content as illegal or ask for a frame to be removed from The Filmable Book by Odoardo™, we process your name, e-mail address and the content of the report. The purpose is to handle the matter and to establish, pursue and defend claims (Article 6(1)(c) and (f) GDPR). The data is kept for 6 years from the closing of the matter and then anonymised.
Where we are the controller of conversations and recordings — in a conversation with the assistant on the Platform, with the Odoardo Soul™ AI assistant of an Odoardo Alibi™ box or an Odoardo Art™ work and on a letter's page, and where a customer uses Odoardo Lens™ or Odoardo Soul™ purely for personal or household purposes — we process them to hold the conversation or to provide the service. The basis is performance of the service you ask for (Article 6(1)(b) GDPR) and, where there is no contract between us, our legitimate interest in running and securing the service (Article 6(1)(f) GDPR).
If you collaborate with us as an Odoardo Art™ artist, we process your bank account number to pay your remuneration and settle taxes. If you do not run a business, we also process your country of tax residence and, if you are resident in Poland, your PESEL number and tax office, or, if you are resident outside Poland, your foreign tax identification number and date of birth. If you run a business, we process the business name and tax number (NIP). The basis is performance of the collaboration agreement (Article 6(1)(b) GDPR) and a legal obligation under tax law, including the obligation to prepare the PIT-11 or IFT-1R information return (Article 6(1)(c) GDPR). The most important of these details, the PESEL number included, are stored encrypted. We keep this data, together with the address and the date of birth, for the duration of the collaboration and, after it ends, until the tax obligations expire, which is 5 years from the end of the year in which we made the last payment. We then anonymise it.
If a partner identifier is stored in your browser, when you open an account we record which partner referred you and, with every order, that partner and their commission rate. A referral passed to us in another way, for example by telephone, may be recorded by our team. The purpose is to settle the commission owed to the partner, and the basis is our legitimate interest in settling that collaboration (Article 6(1)(f) GDPR). How the identifier is stored in your browser is described in the clause “Partner attribution”.
To measure the Platform's performance and protect it against abuse, with every request we record the path visited, the response time, the page language and the IP address and, if you are signed in, the account's e-mail address. For the performance statistics the country a request comes from is determined by the api.country.is service, to which we send only the network part of an IPv4 address, its last number set to zero — a part that cannot be linked to any person. An IPv6 address is not sent at all. No personal data leaves our infrastructure for this, so that service is not a recipient of personal data. We do not combine these records into profiles and do not use them for marketing. The basis is our legitimate interest in the Platform running efficiently and securely (Article 6(1)(f) GDPR). The retention period is set out in the clause “Technical data”.
§ 3. Data we did not obtain from you
We write to businesses, institutions and editorial offices we do not know yet. The contact details we use for that come from public sources — the National Court Register, the Central Register and Information on Economic Activity, public information bulletins and the entities' own websites — or from our own research, and with every entry we record the source and the date it was established. We do not buy address lists.
The purpose is to present the Odoardo™ offer to businesses and institutions, and to invite editorial offices to prepare material about Odoardo™. The basis is our legitimate interest in direct marketing (Article 6(1)(f) GDPR).
We write to businesses and institutions by post. We e-mail an editorial office only at an address the office itself designated for press materials or patronage requests, and for every such address we record the page where it was designated and the date it was checked. Where an office has designated no such address, an invitation to media patronage goes by post or through the form on its website.
The name of the organisation, its postal address, the professional contact details of the person listed as the contact point, and the record of our correspondence with it. If somebody scans the QR code on our letter, we record the date of the scan and the conversation held with the assistant on the letter's page with the organisation's details. The first paragraph of the letter is prepared by an OpenAI language model, to which we send the name of the organisation, the town, the addressee's position and information about the organisation taken from a public source.
We keep this data until an objection is raised, but no longer than 3 years from the last contact, and then anonymise it. An objection, an “unsubscribe” click or a single message asking us to stop ends the contact at once and permanently. All that then remains is an entry whose purpose is that we never write again. We print this information on every letter, and every message carries a one-click unsubscribe link.
§ 4. Guests of our customers
Where a customer uses Odoardo Lens™ or a standalone Odoardo Soul™ object in the course of their business, the controller of the data of a guest who records a video postcard in their space or brings a phone to their object is that customer — the owner of the space — and we process it on their instruction as a processor. The purposes of the processing are set by that controller, and it is the controller who answers the guest's requests. The conditions of the entrustment, the retention periods included, are set in the data processing agreement we conclude with every such customer. We name the controller on the object's page and on the recording page. The cases in which we are the controller are described in the clause “Conversations and recordings we control”.
A guest wishing to exercise their rights should contact the owner of the space. We will always help our customer answer, and a guest may also write to us — we will pass the request on. What an object remembers about a phone the guest erases themselves, without asking anyone, with the “Forget me” button on the object's page.
Before a guest starts recording in Odoardo Lens™, they make a statement consenting to their shots being edited into a video postcard, to the finished film being made available to them at an individual address, and to the use of their likeness for that purpose. They may also, separately and freely, consent to the place's brand using the film in its communication. With the video postcard we record the exact wording of both statements and the date they were made, as well as the date on which consent to the brand's use was withdrawn, as evidence that the statement was made. The owner of the space sees in Odoardo ID™ which video postcards carry consent to use by its brand.
§ 5. Retention periods
Data processed to perform the contract is kept for its duration and, afterwards, for as long as needed to pursue claims or meet legal obligations. Where we are the controller of Odoardo Lens™ recordings, because the customer uses the service for personal or household purposes, recordings and video postcards are kept for the periods set in the Odoardo Lens™ terms.
Data processed on the basis of consent is kept until that consent is withdrawn. An address submitted to Odoardo Letters™ that nobody confirmed is deleted after 30 days. An address for which an Odoardo ID™ account was opened but which nobody confirmed with a code is also deleted after 30 days, together with the details given in the registration form. In both cases the entry remains without the address, anonymous.
Aggregated statistics that do not allow an individual to be identified may be kept indefinitely for analytical and research purposes.
Diagnostic logs are kept in full for up to 90 days, and records of errors and warnings for up to 12 months — after that their content, IP address and e-mail address are anonymised. Performance data has its IP address and e-mail address stripped after 30 days — only statistics remain. The record of a marketing message loses its content after 12 months and the recipient's address after 400 days at the latest — only the fact that it was sent remains. The content of other correspondence — including order confirmations, which are the durable medium carrying the contract terms — is kept for the limitation period for claims (up to 6 years) and then deleted together with the address, leaving only the record that a message was sent. Conversations with the Odoardo™ assistant held while signed in are kept with the account, and the content of all other conversations with the Odoardo™ assistant and with Odoardo Soul™ is anonymised at the latest 24 months after the last message. An object remembers a phone only if you choose that on its page. What it then remembers — your first name, if you gave one, and a summary of earlier conversations — is anonymised after a year without another visit. You can erase it at once with the “Forget me” button on the object's page. The history of events on your account (sign-ins, changes of details) is kept for as long as the account exists and is anonymised when the account is deleted — the network address digest and the browser details are removed from it.
Records whose existence matters for settlements, statistics or as evidence are anonymised rather than deleted once their retention period ends: the personal data is removed from them, and only the fact of the event remains. Files containing personal data — recordings, photographs and documents — are deleted.
Every consent given and withdrawn, and every acceptance of a document, is recorded together with the verbatim wording of the clause, the date, a digest of the IP address computed with a key of our own, the browser details and the editions of the documents accepted. The record makes it possible to show that consent or acceptance was given by a particular person (Article 7(1) GDPR). The basis is our legitimate interest in being able to show that consent or acceptance was given (Articles 5(2) and 7(1) GDPR) and in defending against claims (Article 6(1)(f) GDPR). The records are kept for as long as the account exists and for 6 years from the withdrawal of the consent or the deletion of the account, after which the IP address digest and the browser details are removed from them. A declaration of withdrawal from the contract made through the withdrawal function in Odoardo ID™ is recorded the same way — with its verbatim content, the date and time, a digest of the IP address computed with a key of our own and the browser details — on the same basis, together with the withdrawal case.
The photos of your room and the description you send in Odoardo ID™ when asking us to choose the works of an Odoardo Art™ chapter are processed only to prepare that proposal, in performance of the contract (Article 6(1)(b) GDPR). We delete them 180 days after they are sent, and earlier together with the account. Only the fact of the request and how it was settled remain.
§ 6. Recipients of data
We pass your data to entities providing services to the Controller, each only as far as the given service requires: DigitalOcean (application hosting, database and file storage), Cloudflare (delivering the Platform's network traffic and protecting it against attacks), Stripe Payments Europe Ltd., established in Ireland (payments), Twilio SendGrid (transactional mail), SMTP2GO (sending Odoardo Letters™, the messages to artists and press correspondence from the odoardopr.com domain), OpenAI — for users in the European Economic Area OpenAI Ireland Ltd., where the contract with that provider so provides — (the language models that hold the conversations of the Odoardo™ assistant and Odoardo Soul™, suggest follow-up questions in a conversation, prepare the summary by which an object recognises a remembered phone, translate artists' texts, and draft the first paragraphs of our letters to businesses and institutions, messages to editorial offices and posts on social media), Google Cloud EMEA Ltd. (Google Workspace, which runs the team's mailbox [email protected] and the team's messenger, which receives, among other things, order numbers and organisation names), Buffer (publishing on our social media profiles) and OpenWeather (the weather where a Odoardo Soul™ object stands — the service receives only the coordinates of that place, with no data about the guest).
For physical products we pass the delivery address and the notification phone number to our shipping broker (Furgonetka) and to the carrier delivering that particular parcel. The carrier is matched to the parcel and the destination, so it is not fixed in advance. It may be, for example, InPost. Only what delivery requires is passed on.
The data an invoice must carry is passed to the Polish National e-Invoicing System (KSeF). The basis is a legal obligation, so this transfer cannot be limited or switched off by consent.
The content of conversations held with the Odoardo™ assistant is sent to OpenAI so that an answer can be generated and follow-up questions suggested below it, and is stored in our infrastructure. It is not used to train language models. If you dictate a question, the recording may be sent to OpenAI solely to turn it into text, and we do not store it. An answer read aloud is voiced from its text by OpenAI or by your browser. The audio of an answer voiced by OpenAI is kept only in the server's memory, for at most 12 hours, so that listening again does not generate it anew. Speech functions built into your browser — reading aloud and speech recognition — work on the terms of the browser's provider. Please do not give, in a conversation, personal data that is not needed for the answer. The exception is the data you give when asking us to get in touch, described in the clause “Asking us to get in touch”. Where else we use artificial intelligence is described in a separate notice.
The Controller does not sell, rent or share your personal data with third parties for marketing purposes without your explicit consent.
Some recipients process data outside the European Economic Area. DigitalOcean LLC, Cloudflare, Twilio SendGrid, OpenAI and Buffer are established or process data in the United States. Stripe Payments Europe Ltd. and Google Cloud EMEA Ltd. are established in Ireland but may pass data to companies of their group in the United States. Data reaching the United States is transferred on the basis of the European Commission adequacy decision under the EU–US Data Privacy Framework, for certified entities, or on the basis of the standard contractual clauses adopted by the European Commission. SMTP2GO is established in New Zealand, for which the European Commission has adopted an adequacy decision, and we transfer data to it on that basis. A copy of the safeguards applied is available on request sent to [email protected].
We are not required to appoint a data protection officer and have not appointed one. All personal data matters are handled by the Controller at [email protected].
The likeness of Odoardo Art™ artists, to the extent described in the clause “Collaboration with artists”, and the names, place names and logos of customers named as references are also published on our social media profiles, such as LinkedIn, Instagram, Facebook, Pinterest, X, TikTok and YouTube, through the Buffer tool. Published content is also processed by the operator of the given network, on its own terms and as a separate controller.
As far as a given matter requires, we also pass data to: tax and other public authorities where the law requires it, the banks that keep our accounts — for refunds and payments to artists, our legal, tax and accounting advisers, bound by professional secrecy or a confidentiality agreement, and the workshops that engrave, print and make ordered objects on our behalf — where the wording of an engraving, dedication or print contains a name or other data you give us. A guest's request to the staff of the place where the object stands, made in a conversation with the Odoardo Soul™ AI assistant, is passed by the assistant by e-mail to those staff, at the address designated by the object's owner, quoting the guest's words.
§ 8. Your rights
You have the right to be told what data of yours we process, for what purposes and for how long — and to receive a copy of that data. We prepare the full copy when you ask for it in the Help tab of Odoardo ID™.
You may request the rectification of inaccurate data and, in defined cases, its erasure (the “right to be forgotten”). Deleting an account means anonymising it: personal data is removed from the records, and files containing it are deleted. Invoices and order and tax records are kept for the statutory period, and consent records on the terms of the clause “Consent records”. On the basis of our legitimate interest in establishing, pursuing and defending claims (Article 6(1)(f) GDPR) we also keep answers given in a launch brief and messages sent through the Help tab — for 6 years from the closing of the matter they concern. After that time it is anonymised. If you are an artist, after the collaboration ends we keep data on the terms of the clause “Collaboration with artists”. Records of the licences you granted are kept for as long as we use the work, including in copies already sold, because they are the evidence of the licence. Payment details of artists are kept on the terms of the clause “Payments to artists”. A frame entered in The Filmable Book by Odoardo™ that did not reach the yearbook is withdrawn when the account is deleted, on the terms of the clause “Entries to The Filmable Book by Odoardo™”. The effects of deleting the account on services and on the collaboration are set out in the Sales Terms and the Artist Collaboration Terms.
You have the right to restrict processing and — for data processed on the basis of a contract or consent — the right to have it transferred to another controller in a structured format. You can download the data you gave us as one file in Odoardo ID™, on the Settings tab.
You may object to processing based on legitimate interest on grounds relating to your particular situation, and to processing for direct marketing purposes at any time and without giving a reason. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, Poland.
§ 9. Cookies
The Platform uses cookies necessary for it to work: cart (cart contents, 90 days), language (interface language, 12 months), the session cookie, the Odoardo ID™ sign-in cookie (12 months), the cookie protecting forms against request forgery, and partner-consent, which remembers for 180 days your decision about storing a partner identifier, so that the question does not return on every page. On the same footing we use your browser's storage. The tab's storage, which is cleared when the tab is closed, keeps the identifier of your conversation with the Odoardo™ assistant, the identifier of your conversation with a Odoardo Soul™ object or on a letter's page and display settings, such as the lighter version of the page or the fact that a hint has already been shown. If you choose on an object's or a letter's page to have your phone remembered, the identifier of that conversation is kept in the browser's persistent storage — it stays there until the site data is cleared or you use the “Forget me” button, and on our side what the object remembers is anonymised after a year without another visit. Without that choice the conversation ends when the tab is closed. The browser's persistent storage also keeps the identifier of an Odoardo Lens™ recording and your settings, such as reading aloud. These identifiers are random and stay in the browser until the site data is cleared, and on our side they are removed when the conversation or recording is anonymised. All of these entries serve only functions you use yourself, so they require no consent and cannot be switched off without losing those functions.
The Platform uses no analytical or advertising cookies. Traffic is measured without cookies and without profiling, on the terms of the clause “Performance and security of the service”. On the order page, Stripe's payment script writes its own cookies __stripe_mid (up to a year) and __stripe_sid (30 minutes), which serve only to prevent payment fraud. They are necessary for payment, so they need no consent, and Stripe processes this data as a separate controller, on its own terms. The forms that send a message or accept a report on the strength of the e-mail address given (signing in, registration, subscribing to Odoardo Letters™, confirming the address when ordering and reporting abuse) we protect against automated submissions ourselves: the browser performs a short computation before sending, and the number of attempts from one address is limited. Nothing is written to your device for it, and no data goes to any third party (Article 6(1)(f) GDPR).
Visits to a space's public profile in The Filmable Book by Odoardo™, and plays of a video postcard, are counted as unique without anything being written to your device. In place of an identifier we use a cryptographic digest computed from the IP address and the browser with a key of our own. The address cannot be recovered from the digest. Beside it we store only the date of the visit and, for a video postcard, also the class of device and the page language. After 400 days the digest is removed and the record becomes anonymous. The basis is our legitimate interest in counting reach honestly (Article 6(1)(f) GDPR).
If you reach us from a partner's link, the referrer identifier is written to your browser's storage only with your consent, which we ask for in a notice shown on the first such visit. The identifier does not expire by itself — it stays in the browser until the site data is cleared. Your decision is remembered by the partner-consent cookie described in the clause “Necessary cookies”, and what happens to the identifier when you open an account and when you order is described in the clause “Partner referrals”. Refusing limits access to nothing on the Platform.
You can manage cookies in your web browser's settings and delete stored files at any time. Blocking Stripe's cookies makes it impossible to pay for an order. Switching off the necessary cookies limits the Platform's basic functions.
§ 10. Reports and documents in Odoardo Space™
If you report abuse of an address from the Odoardo Space™ portfolio, we process your name and e-mail address, if you give them (a report of phishing or impersonation may come without them), the content of the report and the link to the evidence, as well as the data of the lessee the report concerns. The purpose is to review the report, give notice of its outcome, and establish, pursue and defend claims. The basis is our legitimate interest in responding to breaches and protecting the address portfolio (Article 6(1)(f) GDPR) and, where the law obliges us to act, a legal obligation (Article 6(1)(c) GDPR). We disclose your data to the lessee only where this is necessary to handle the matter or required by law.
If you lease an address indicating a profession of public trust, a title or a regulated activity, we process the document confirming the entitlement that you upload in Odoardo ID™ and our decision to accept or reject it. We delete the document itself when we decide, and keep only the verification data: the name of the register in which we checked the entitlement, the entry number, the date of the document, the outcome and the date of the decision. The basis is performance of the lease, which cannot go live without the entitlement being confirmed (Article 6(1)(b) GDPR).
An abuse report, together with the reporter's data, is kept for 6 years from the closing of the matter and then anonymised. A document confirming an entitlement is kept until the decision and, if no decision is taken, no longer than the record of the matter. The verification data and the record of the decision to accept or reject are kept for the duration of the contract and 6 years after it ends or, if the address never went live, for 6 years from the decision or from the expiry of the deadline for uploading the document. After the matter is closed or the contract ends, the basis is our legitimate interest in establishing, pursuing and defending claims (Article 6(1)(f) GDPR). Deleting the account does not shorten these periods, and access to this data is limited to the people handling the matter.
If you are a lessee, we may pass your data to the registrar and to the body running the registry of the address's extension where their rules require it, and to authorities entitled by law to request it.
If a third party makes it plausible that an address you lease, or the way it is used, infringes its rights, we may disclose to it your name or business name and e-mail address, to the extent necessary to pursue its claims. The basis is the legitimate interest of that person in pursuing claims and our legitimate interest in not being a shield for an infringement (Article 6(1)(f) GDPR). We notify you of the disclosure unless the law or an authority's request does not allow it.
Setting the records your e-mail provider requires (such as MX, SPF and DKIM) at the registrar gives us no access to your correspondence. We do not receive, store or read the messages sent to or from a leased address, including an address associated with health care, and we do not process their content. They are handled by the e-mail provider you choose.
