Privacy notice
Last updated: 2026-10-01
This notice explains how GRUPA CME (“HardTally”, “we”) handles personal data when you visit hardtally.com or write to us. It covers this website and enquiries only. Data that customers put into the HardTally product is covered by the customer agreement and the data processing agreement, which are published before the first paid pilot.
Who is responsible
GRUPA CME, LEŚMIANA 1/8, 80-280 GDAŃSK, POLAND, is the controller of the personal data described in this notice. You can reach us at [email protected].
What this website does not do
This website sets no cookies. It uses no analytics, tracking pixels or advertising, and loads no third-party scripts; fonts are served from our own domain. It has no forms, so it does not collect anything you type.
Technical data when you visit
To deliver pages and protect the site, our hosting provider processes standard technical data for each request: IP address, browser type, the page requested, the referring page, and the time. We use this only to operate and secure the website, based on our legitimate interest (Art. 6(1)(f) GDPR), and we do not combine it with other data. It is kept only as long as needed for operation and security, according to our hosting provider’s log retention.
When you write to us
When you email us to request a Department Discovery, a Guided Discovery Session, or anything else, we process what you send, usually your name, work email, company, role and message. We use it to reply and to arrange what you asked for. The legal basis is taking steps at your request before a contract (Art. 6(1)(b) GDPR) or our legitimate interest in answering business enquiries (Art. 6(1)(f) GDPR).
If an enquiry does not lead to a customer relationship, we delete it 12 months after our last exchange. If you become a customer, the customer agreement governs how long we keep it.
We do not sell personal data, and we do not add you to marketing emails. We send news about HardTally only if you ask for it.
Who else processes it
- Our hosting provider, to deliver the website.
- Our email provider, to receive and store email.
Both act on our instructions under data processing terms. You can ask us which providers we use. We aim to process data in the EU/EEA. Where a provider processes data outside the EEA, we rely on the safeguards GDPR requires, such as an adequacy decision or the European Commission’s standard contractual clauses.
Your rights
You can ask us to give you access to your data, correct it, delete it, restrict its processing, or provide it in a portable format. You can also object to processing based on our legitimate interest. Write to [email protected]; we reply within one month.
You can also lodge a complaint with a data protection supervisory authority. In Poland, this is the President of the Personal Data Protection Office (UODO), uodo.gov.pl.
We do not use automated decision-making or profiling.
Changes
When this notice changes, we update the date at the top of this page.