Privacy policy
1. Who we are
This policy explains how Horus Group sp. z o.o. handles personal data on horuslabs.net, horusgroup.net, horussignal.net and horusstack.com and in our business contacts. Horus Group sp. z o.o. runs the brands Horus Labs, Horus Signal and Horus Stack.
The controller of your personal data is Horus Group sp. z o.o., ul. Romana Dmowskiego 3/9, 50-203 Wrocław, Poland, entered in the Register of Entrepreneurs of the National Court Register (KRS) under number 0001132931, registry files kept by Sąd Rejonowy dla Wrocławia-Fabrycznej we Wrocławiu, VI Wydział Gospodarczy Krajowego Rejestru Sądowego, NIP 8982313152, share capital PLN 5,000.
Contact for anything about your data: privacy@horuslabs.net, or by post to the address above. We have not appointed a data protection officer.
2. What we process, why, on what basis and for how long
You visit any of our sites
- Data
- IP address, browser and device type, page address, referring page, time of the request
- Purpose
- To deliver the pages, keep the sites secure and fix errors
- Legal basis
- Art. 6(1)(f): our legitimate interest in running safe, working websites
- How long
- Kept by our hosting providers for a short time under their security rules, longer only while a security incident is handled. We do not use these logs to identify visitors
You view a page (usage statistics)
- Data
- Page address, referring page, browser type, country, page load times
- Purpose
- To see which pages are read and how fast they load
- Legal basis
- Art. 6(1)(f): our legitimate interest in knowing how our sites are used
- How long
- Cloudflare keeps aggregated statistics only, with no profile of you
You book a call
- Data
- Name, email, the time you pick, anything you write in the booking form
- Purpose
- To arrange and hold the call and prepare for it
- Legal basis
- Art. 6(1)(f): our legitimate interest in answering business enquiries. Art. 6(1)(b) if you contact us about a contract with you personally
- How long
- As long as we have a business relationship with you or a realistic prospect of one (see below)
We talk on a call
- Data
- Your name and role and what is said on the call. Calls may be transcribed by Google Meet, which shows this to everyone on the call
- Purpose
- To keep accurate notes of what was agreed and follow up
- Legal basis
- Art. 6(1)(f): our legitimate interest in keeping a reliable record of business conversations
- How long
- As long as we have a business relationship with you or a realistic prospect of one (see below)
You write to us by email or through Telegram, X or LinkedIn
- Data
- Name, contact details, what you write
- Purpose
- To reply and keep the conversation going
- Legal basis
- Art. 6(1)(f): our legitimate interest in answering messages
- How long
- As long as we have a business relationship with you or a realistic prospect of one (see below)
You are a founder, investor or partner we contact or work with
- Data
- Name, role, company, business contact details and profiles, notes from our conversations
- Purpose
- To find companies and investors to work with, offer them our services and keep the relationship going
- Legal basis
- Art. 6(1)(f): our legitimate interest in offering our services to businesses (direct marketing) and managing business relationships
- How long
- As long as we have a business relationship with you or a realistic prospect of one, unless you object earlier
We learn from our conversations
- Data
- Notes and transcripts of calls and messages
- Purpose
- To understand what founders and investors need and to improve our services and our writing. Anything we publish is anonymised and names neither you nor your company
- Legal basis
- Art. 6(1)(f): our legitimate interest in improving our services
- How long
- As in the rows above. Anonymised notes are no longer personal data
You sign a contract with us, or you represent a company that does
- Data
- Data needed to perform the contract and invoice it
- Purpose
- To perform the contract and meet tax and accounting duties
- Legal basis
- Art. 6(1)(b) if you are the contracting party. Art. 6(1)(f) if you represent a company: our legitimate interest in performing contracts with it. Art. 6(1)(c) for tax and accounting records
- How long
- For the contract and then as long as tax and accounting law requires, as a rule 5 years from the end of the year concerned
Any of the above, if a dispute arises
- Data
- The data relevant to the dispute
- Purpose
- To establish, exercise or defend legal claims
- Legal basis
- Art. 6(1)(f)
- How long
- Until the claims are time-barred
We keep the data of business contacts while we have a business relationship with you or a realistic prospect of one, and then delete or anonymise it. You can ask us to delete it at any time.
3. Where the data of business contacts comes from
When we did not get your data from you, it comes from company websites, your public profiles on LinkedIn and X, public registers (for example SEC Form D filings), press and event lists, databases of companies, funding rounds and investors, or an introduction by someone who knows you. If you ask, we tell you where we got your data.
4. Who receives the data
We use providers who process data for us under a data processing agreement:
Cloudflare, Inc. (USA)
- What they do for us
- DNS, network, security, usage statistics, and hosting of horusgroup.net, horussignal.net and horusstack.com
- Transfers outside the EEA
- EU-US Data Privacy Framework, Standard Contractual Clauses as fallback
Railway Corporation (USA)
- What they do for us
- Hosting of horuslabs.net
- Transfers outside the EEA
- Standard Contractual Clauses
Cal.com, Inc. (USA)
- What they do for us
- Booking calls
- Transfers outside the EEA
- EU-US Data Privacy Framework, Standard Contractual Clauses as fallback
Google Ireland Limited and Google LLC (Google Workspace)
- What they do for us
- Email, calendar, video calls and their transcripts, documents
- Transfers outside the EEA
- Standard Contractual Clauses, and the EU-US Data Privacy Framework for Google LLC
We also use software for notes and documents, code hosting and AI-assisted drafting and analysis. These providers may be based in the United States and are covered by the safeguards in section 5. Our accountants and legal advisers see data when their work needs it, under a duty of confidentiality. We give data to public authorities only when the law requires it.
Companies we work for, and investors and partners we introduce them to, receive the data this work needs.
Telegram, X and LinkedIn decide themselves how they process the messages you send through them. Their own privacy policies apply.
5. Transfers outside the European Economic Area
Some providers are based in the United States. We transfer data to them only on the basis of the European Commission's adequacy decision for the EU-US Data Privacy Framework (Implementing Decision (EU) 2023/1795), where the provider is certified, or of the Standard Contractual Clauses adopted by the Commission (Implementing Decision (EU) 2021/914). You can ask us for a copy of the safeguards at the contact address above.
6. Your rights
You have the right to access your data, to have it corrected, erased or restricted, to data portability where the law provides it.
Right to object. Where we rely on our legitimate interests (art. 6(1)(f)), you can object at any time on grounds relating to your particular situation, and we will stop unless we show compelling legitimate grounds or need the data for legal claims. Where we use your data to contact you about our services, you can object at any time without giving a reason, and we will stop.
To use any of these rights, write to privacy@horuslabs.net. We reply within one month.
You can also lodge a complaint with the Polish supervisory authority: Prezes Urzędu Ochrony Danych Osobowych (President of the Personal Data Protection Office), ul. Stanisława Moniuszki 1A, 00-014 Warszawa, uodo.gov.pl, or with the authority in the EU country where you live or work.
7. Giving us data
You do not have to give us any data. Visiting our sites needs only the technical data your browser sends. To book a call you must give a name and an email address, otherwise we cannot arrange it. If you or your company sign a contract with us, the data needed to perform it is a contractual requirement, and invoice data is required by tax law. Without it we cannot sign the contract or issue the invoice.
8. Automated decisions
We do not make decisions about you by automated means only, and we do not profile you in a way that has legal or similarly significant effects on you.
9. Cookies and your device
Our sites do not set cookies. Our fonts are served from our own servers, so your browser does not contact third parties to load them.
We use Cloudflare Web Analytics to count page views and measure page speed. It reads page timing data from your browser and sends it to Cloudflare. It does not set cookies or use local storage and does not track you across other websites. If you do not want this, you can block scripts from static.cloudflareinsights.com in your browser settings or with a content blocker, and our sites keep working.
Our network provider Cloudflare sends a technical instruction (Network Error Logging) that lets your browser report failed connections to Cloudflare, so connection problems can be found and fixed. It does not report successful visits, and Cloudflare states that it does not keep your IP address for these reports. Our sites also tell your browser to always connect to them over HTTPS (HSTS).
When you open the booking page on cal.com, Cal.com's own cookie rules apply on that page.
10. Security
We use encrypted connections (HTTPS) on all our sites, limit access to data to the people who need it and use providers with recognised security standards.
11. Changes
When we change this policy, we update the date at the top. The current version is always on this page.