Privacy Policy

TheBroda sp. z o.o., trading as Help Context, protects your privacy. This policy explains what personal data we collect, why, how long we keep it and what rights you have under the EU General Data Protection Regulation 2016/679 (GDPR).

1. Data controller

The controller of your personal data is TheBroda sp. z o.o., registered office in Warsaw, ul. Wierna 12/1, 03-890 Warszawa, Poland; Tax ID (NIP) 5242831345; KRS 0000677402; REGON 367267919.

For any question about this policy or your data, write to [email protected]. We have not appointed a data protection officer.

2. Our Meta app “Help Context Clients API”

“Help Context Clients API” (app ID 950248784442210) is our team’s working tool for clients whose ads we run on Meta (Facebook and Instagram). Through the Meta Marketing API it connects to a client’s advertising assets on Meta (the ad account, Page, pixel or dataset, and product catalog), only within our work for that client and the access the client has given us. The app does not offer Facebook Login and is not meant for private individuals.

What it reads and changes: the settings and status of ad accounts, campaigns, ad sets and ads; ad statistics (impressions, reach, clicks, spend, conversions and their value), which Meta provides in aggregate, with no data about the people who saw the ads; basic Page data such as the number of followers; and the settings of pixels, catalogs and the audiences Meta builds from traffic on the client’s site (we cannot see who is in them). At the client’s request we use the app to create and change campaigns, ads, audiences and catalogs.
Meta lead forms: if a client uses lead forms in its ads and asks us to handle them, the app can receive what people enter in the form (for example name, email, phone). We pass these data to the client and process them only on its behalf.
Why: running and optimizing campaigns, reports for the client, and checking spend and conversion tracking.
Legal basis and roles: our contract with the client. We process personal data found in the client’s assets (for example from lead forms) as a processor on behalf of the client, who remains their controller. We process the data of the client’s contact persons as a controller, to perform the contract and in our legitimate interest (Art. 6(1)(b) and (f) GDPR).
Where the data are kept: the statistics and settings we need for reports are stored in our agency’s reporting system, a database at Supabase (EU region, Ireland). Only our team has access. We do not sell these data, share them with other clients or use them for our own advertising.
How long: for the duration of our work with the client and 12 months after it ends; then we delete them from our systems. The client can ask us to delete them sooner. Billing documents are kept as long as the law requires.
How to revoke access and delete data: a client can remove the app’s access at any time in its Meta business settings, or write to us at [email protected]. We answer a request to delete the data the app obtained without undue delay and within one month at the latest, and delete them from our systems, except data we must keep by law (such as billing records).

Use of the app is also governed by the Meta Platform Terms and Meta’s Developer Policies. People who see the ads are informed about how their data are processed by Meta, a separate controller, in the Meta Privacy Policy.

3. Data we collect on the website

Request forms: your name, email, phone (if you give it), marketing budget, website or a few words about the business, where your customers are, what you want to promote, whether you have run ads before, a comment and the consent tick, together with the page and form the request came from, the site language, and the date and time.
Our ad landing pages ua.help-context.com and en.help-context.com, whose requests reach the same CRM: the same details, plus what those pages record with every form submission, as their privacy policies say: the page address, the referring page, the UTM parameters from the link, the browser language and time zone, and the browser type.
Visit source, only with analytics consent: how you reached help-context.com (UTM parameters, the ad click ID and the referring site) on your first visit and your last visit from an outside source. Without this consent, the form sends only the address of the page where you fill it in.
Technical data: IP address, browser and device type, the time of the request and the page address, logged by our hosting server and by Cloudflare. A request record keeps only an irreversible hash of the IP address, computed with a secret key, to prevent abuse.
Cookies: necessary ones always run; analytics and advertising ones run only with your consent (see section 10).
Client data: data from the contract, invoices and work correspondence.

4. How we use your data and on what legal basis

Answering your request, the free audit and preparing an offer: steps taken at your request before a contract, Art. 6(1)(b) GDPR.
Performing a contract if you become a client: Art. 6(1)(b) GDPR; accounting and tax obligations: Art. 6(1)(c) GDPR.
Spam protection, security, defense against claims and our own marketing analytics without cookies: our legitimate interest, Art. 6(1)(f) GDPR.
Visit statistics, the visit source in your request, ad measurement and remarketing: only with the consent you give in the cookie banner, Art. 6(1)(a) GDPR. You can withdraw it at any time.

We do not send marketing mailings. We make no decisions about you based solely on automated processing; our CRM may flag a request’s priority, but a person always decides whether we take on a project.

We do not sell personal data. We work with these providers:

Hostinger: hosting of the site, the CRM and the request form, including the request database and its backups; servers in the EU.
Cloudflare: content delivery network and protection of the site against attacks.
Google: our Google Workspace email; Google Tag Manager, Google Analytics 4 and Google Ads only with your consent to cookies.
Meta Platforms: the Meta pixel, only with your consent to advertising cookies.
Supabase: our agency’s infrastructure. The Telegram notifications about requests pass through it without being stored, and it holds the reporting data of our Meta app (section 2); EU region, Ireland.
Telegram: notifications about new requests in our team’s closed work group.
Our accounting office: only client data needed for invoices and tax returns.

Hostinger, Cloudflare, Google Workspace, Supabase and the accounting office process data on our behalf, as processors; Supabase does so under its own data processing agreement (DPA). Google and Meta also use data from advertising cookies for their own purposes, as separate controllers, and Telegram processes messages under its own privacy policy. We pass data to public authorities only when the law requires it.

6. Data retention

Requests that did not lead to work together: up to 3 years from the last activity on the request. Spam: 90 days. Our team’s test requests: 30 days.
Client data: for the term of the contract, then as long as Polish tax and accounting law requires (usually 5 years) or until claims become time-barred, whichever is longer.
Proof of consent: while the consent is valid and, after you withdraw it, until claims become time-barred.
Data from the Meta app: see section 2.
Backups: we back up the CRM database daily and keep each backup for 29 days, so a deleted record leaves the backups within 30 days.

7. Your rights

Under the GDPR you have the right to:

Access: get access to your personal data and a copy of it.
Rectification: have inaccurate data corrected.
Erasure: ask us to delete your data.
Restriction: ask us to restrict the processing of your data.
Data portability: receive the data you gave us in a machine-readable format.
Objection: object to processing based on our legitimate interest.
Withdrawal of consent: withdraw your consent at any time, without affecting the processing done before.

To use your rights, write to [email protected]. We answer without undue delay and within one month at the latest; in complex cases the period can be extended by two more months, and we will tell you. You can change or withdraw your cookie consent with the “Cookie settings” button at the bottom of every page.

8. Data security

The site runs only over an encrypted connection (HTTPS). Only members of our team can sign in to the CRM, with a one-time code sent by email, and to our reporting system. We back up the request database daily. Access to data is limited to the people who need it for their work.

9. International transfers

Some of our providers are based or also process data outside the European Economic Area (EEA), in particular in the US. Such transfers rely on the European Commission’s decision on the EU-US Data Privacy Framework, for companies certified under it, or on standard contractual clauses approved by the European Commission. Supabase is provided by Supabase Pte. Ltd., based in Singapore: our project runs in the EU region (Ireland), and the standard contractual clauses in Supabase’s DPA cover any transfer. Telegram is run by Telegram Messenger Inc., a company outside the EEA whose group has companies in the British Virgin Islands and the United Arab Emirates, countries for which the European Commission has not found an adequate level of data protection. According to Telegram’s privacy policy, the data of users who signed up in the EEA are stored in data centers in the Netherlands and transfers within its group rely on standard contractual clauses, so we keep what reaches Telegram to a minimum. Details, and how to get a copy of the safeguards, are in section 6 of our Privacy Policy.

10. Cookies

Our website uses necessary cookies, which always run, and analytics and advertising cookies, which run only with your consent. For the full list and how to change your choice, see our Cookie Policy.

11. Updates to this policy

We update this policy when our site, tools, providers or the law change. The current version is always on this page, with its effective date at the top.

12. Complaints

If you believe your rights under the GDPR have been violated, you can file a complaint with the Polish data protection authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl, or with the data protection authority of the EU country where you live or work.