This document defines the rules for processing personal data collected in connection with the website www.minthcm.com (hereinafter referred to as the “Site”), which is run by “eVolpe Consulting Group Spółka z ograniczoną odpowiedzialnością spółka komandytowa” with its registered office and address: Aleje Solidarności 46, 61-696 Poznań, Poland, entered in the Register of Entrepreneurs by the District Court Poznań Nowe Miasto and Wilda in Poznań, Poland, under KRS number 0000494749, NIP 7811892697, phone: +48 783 372 094, email: contact@minthcm.com (hereinafter referred to as the “Administrator”).
Last updated: 14 September 2026
I. General Provisions
- Personal data is administered by the Administrator. In all matters relating to the processing of personal data and the exercise of your rights, you may contact the Administrator at contact@minthcm.com or at the postal address indicated above.
- This Policy applies to personal data processed through the Site: data submitted in forms, data collected automatically through cookies and similar technologies, and data contained in server logs. It does not apply to the MintHCM software itself when installed and operated by a third party, nor to external websites linked from the Site.
- Personal data is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) and with the Act on the Provision of Services by Electronic Means of 18 July 2002 (consolidated text, Journal of Laws of 2024, item 1513, as amended).
- Providing personal data is voluntary. However, if you do not provide the data marked as required in a form, the Administrator will not be able to respond to your enquiry or arrange a demo call.
II. Purposes, Legal Bases and Retention Periods
| Purpose | Categories of data | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Responding to enquiries and booking demo calls (contact and demo forms) | Name, business e-mail address, phone number, company, job title, content of the message and any other data you choose to provide | Art. 6(1)(b) – steps taken at your request prior to entering into a contract; Art. 6(1)(f) – legitimate interest in handling correspondence | For the duration of the correspondence and up to 3 years afterwards |
| Sending commercial and marketing information by electronic means | E-mail address, name, company, engagement data (opens, clicks) | Art. 6(1)(a) – consent, in conjunction with the Act on the Provision of Services by Electronic Means and the Electronic Communications Law | Until consent is withdrawn; the record of consent is then kept for evidentiary purposes |
| Statistics and measuring how the Site is used | Online identifiers, cookie identifiers, IP address, device and browser data, pages viewed, referrer, interactions | Art. 6(1)(a) – consent (statistics category) | See the tables in section VI |
| Marketing, business-audience identification and optimisation of campaigns | Online identifiers, IP address, company data derived from the IP address, behavioural data, session recordings | Art. 6(1)(a) – consent (marketing category) | See the tables in section VI |
| Remembering cookie choices | Consent record, cookie identifiers | Art. 6(1)(c) – legal obligation to demonstrate consent; Art. 6(1)(f) – legitimate interest in the correct operation of the Site | Up to 12 months |
| Security of the Site, prevention of abuse, protection of forms against automated submissions | IP address, date and time of the request, browser identifier, server logs, CAPTCHA challenge data | Art. 6(1)(f) – legitimate interest in the security of IT systems | Server logs: up to 12 months |
| Establishing, exercising or defending legal claims | Data necessary for that purpose from the categories above | Art. 6(1)(f) – legitimate interest | Until the relevant claims become time-barred |
III. Personal Data Protection
Personal data is collected by the Administrator with due diligence and is adequately protected against unauthorised access, loss, destruction or alteration, by means of appropriate technical and organisational measures within the meaning of Art. 32 GDPR. These include encrypted transmission (TLS), access control on a need-to-know basis, and hosting the tools under the Administrator’s control on its own infrastructure within the European Union.
IV. Information in Forms
- The Administrator collects information provided voluntarily by the user of the Site. Together with the form submission, technical information about the connection may be recorded, such as the time of submission and the IP address.
- Data provided in forms is processed for the purpose arising from the function of the particular form, as described in section II.
- Data provided in forms is not sold and is not disclosed to third parties for their own marketing purposes. It may be entrusted to processors providing services to the Administrator, as described in section V.
- Forms on the Site are processed by a marketing-automation system operated by the Administrator on its own infrastructure (domain
ma.minthcm.cloud) and are protected by a self-hosted proof-of-work CAPTCHA service (domaincap.evolpe.cloud).
V. Recipients of the Data
Personal data may be disclosed to the following categories of recipients:
- providers of hosting, IT maintenance, e-mail and infrastructure services;
- providers of the analytics, testing, marketing-automation and advertising tools listed in section VI, acting as processors or, where indicated, as separate controllers;
- providers of legal, accounting and advisory services;
- public authorities, where disclosure is required under applicable law.
The Administrator concludes data processing agreements with its processors as required by Art. 28 GDPR.
VI. Cookies and Similar Technologies
- Cookies are small text files stored on your device by your browser. The Site also uses comparable technologies such as local storage, pixels and script-based identifiers. Some of them are deleted when you close your browser (“session cookies”), while others remain on your device for a defined period and allow you to be recognised on a subsequent visit (“persistent cookies”).
- Cookies and similar technologies are grouped into four categories: functional (strictly necessary for the Site to work and to record your choices – used on the basis of legitimate interest and impossible to switch off), preferences (remember settings that improve your experience), statistics (help to understand how the Site is used) and marketing (identification of business audiences, measurement and optimisation of campaigns, detailed behavioural analysis).
- Except for the functional category, no cookies or similar technologies are placed on your device, and no statistics or marketing scripts are loaded, until you give your consent in the cookie banner.
VI.1. Functional and preference technologies
| Name / provider | Purpose | Retention |
|---|---|---|
cmplz_* – consent management platform, first-party | Stores your cookie choices per category, the status of the banner and the version of the policy you were shown. | Up to 12 months |
Cap CAPTCHA – cap.evolpe.cloud, self-hosted by the Administrator; the computation library is delivered from the open-source CDN jsDelivr | Protects forms against automated submissions by issuing a proof-of-work challenge. Your IP address is disclosed to the CDN when the library file is downloaded. | Duration of the challenge |
| WordPress session and security cookies – first-party | Basic operation of the content management system. | Session or up to 12 months |
VI.2. Statistics
| Service / provider | Purpose and data | Retention |
|---|---|---|
Plausible Analytics – self-hosted by the Administrator at plausible.evolpe.it | Privacy-friendly traffic statistics. Does not use cookies and does not store an individual identifier on your device; visits are counted using anonymised, non-reversible daily hashes. Data does not leave the Administrator’s infrastructure. | No cookies; aggregated statistics only |
| Google Analytics 4 and Google Tag Manager – Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland | Measuring traffic, sources and user interactions with the Site. Cookies _ga and _ga_<container>. Google Tag Manager is a tag container loaded on every page; before consent is given it operates in Google Consent Mode, which means that no identifier is written to your device and only non-identifying, aggregated signals are sent. | Up to 24 months |
| VWO – Wingify Software Pvt. Ltd., Delhi, India (data processed in the provider’s EU region) | A/B testing and optimisation of Site content. Cookies _vwo_uuid, _vwo_uuid_v2, _vwo_ds, _vwo_sn, _vis_opt_* and a corresponding entry in local storage; allow a consistent variant of a page to be shown to you and its performance to be measured. | From session length up to 12 months, depending on the cookie |
VI.3. Marketing
| Service / provider | Purpose and data | Retention |
|---|---|---|
| Hotjar – Hotjar Ltd., Level 2, St Julian’s Business Centre, 3 Elia Zammit Street, St Julian’s STJ 1000, Malta | Behavioural analytics: heatmaps, scroll and click maps and recordings of your session on the Site (mouse movements, scrolling, clicks, pages visited, approximate location based on IP address, device and browser data). Form field contents are suppressed by default. Cookies _hjSessionUser_* and _hjSession_* and local storage entries. | _hjSession_*: 30 minutes; _hjSessionUser_*: up to 12 months |
| Albacross – Albacross Nordic AB, Kungsgatan 26, 111 35 Stockholm, Sweden | B2B visitor identification: matches your IP address against a database of company networks in order to determine which organisation is visiting the Site, and records the pages viewed. Cookies nQ_cookieId and nQ_userVisitId. | nQ_userVisitId: session; nQ_cookieId: up to 12 months |
| Apollo.io – Apollo.io Inc., 535 Mission Street, San Francisco, CA 94105, USA | Website visitor tracking and data enrichment for sales and marketing purposes, including association of visits with business contact records. Identifier apolloAnonId in local storage and an event-collection endpoint. | Until the local storage entry is deleted |
| Embedded third-party content (e.g. video players, maps, social media embeds, reCAPTCHA), where present in individual articles or pages | Such content is blocked by the consent management platform and is loaded only after you accept the marketing category. Once loaded, the provider receives your IP address and may set its own cookies. | Set by the relevant provider |
The footer of the Site contains ordinary hyperlinks to profiles on LinkedIn, Facebook, X (Twitter) and GitHub. These are links only – no content is embedded and no data is transmitted to those providers until you click a link and leave the Site.
VI.4. Profiling and automated decision-making
Where you consent to the marketing category, your behaviour on the Site is analysed and, through Albacross and Apollo.io, may be associated with the organisation you are browsing from. This constitutes profiling within the meaning of Art. 4(4) GDPR and is used to tailor communication and to prioritise sales contact. The Administrator does not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you within the meaning of Art. 22 GDPR.
VI.5. Managing your cookie choices
You may change or withdraw your consent at any time, with effect for the future, using the “Manage Consent” button available on every page of the Site. Withdrawal is as easy as giving consent and does not affect the lawfulness of processing carried out before the withdrawal. When consent for a category is withdrawn, the corresponding scripts stop loading and the related cookies and local storage entries are removed from your device.
You may also block or delete cookies in your browser settings. Please note that blocking functional cookies may prevent parts of the Site from working correctly.
VII. Server Logs
Like most websites, the server automatically records information about every request: the IP address, the date and time, the requested resource, the HTTP status, the referrer and the browser identifier. This data is used solely for technical administration, diagnostics and security, is not combined with your identity for any other purpose, and is deleted after no more than 12 months.
VIII. Transfers of Data Outside the European Economic Area
Some of the providers listed in section VI process data outside the European Economic Area, or rely on sub-processors that do so – in particular Google (transfers to Google LLC in the United States), Apollo.io (United States) and VWO / Wingify (India).
Such transfers take place on the basis of the safeguards provided for in Chapter V GDPR – principally the Standard Contractual Clauses adopted by the European Commission and, where applicable, the adequacy decision underlying the EU–U.S. Data Privacy Framework, supplemented by additional technical and organisational measures. You have the right to obtain a copy of the safeguards applied by contacting the Administrator at contact@minthcm.com.
The tools hosted by the Administrator itself – Plausible Analytics, the Mautic marketing-automation system and the Cap CAPTCHA service – process data exclusively on the Administrator’s own infrastructure within the European Union.
IX. Your Rights
Under the GDPR you have the right to:
- access your personal data and obtain a copy of it (Art. 15 GDPR);
- rectification of data that is inaccurate or incomplete (Art. 16 GDPR);
- erasure of your data – the “right to be forgotten” (Art. 17 GDPR);
- restriction of processing (Art. 18 GDPR);
- data portability – to receive the data you provided in a structured, commonly used, machine-readable format and to have it transmitted to another controller, where processing is based on consent or on a contract and is carried out by automated means (Art. 20 GDPR);
- object at any time, on grounds relating to your particular situation, to processing based on legitimate interest; where data is processed for direct marketing purposes, you may object at any time without giving any reason, after which processing for that purpose will stop (Art. 21 GDPR);
- not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you (Art. 22 GDPR);
- withdraw your consent at any time, where processing is based on consent, without affecting the lawfulness of processing carried out before the withdrawal (Art. 7(3) GDPR).
To exercise any of these rights, contact the Administrator at contact@minthcm.com or at the postal address given at the beginning of this Policy. The Administrator will respond without undue delay and in any event within one month of receiving the request.
You also have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR), in particular in the Member State of your habitual residence, place of work or place of the alleged infringement. The competent authority for the Administrator is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland – uodo.gov.pl.
X. Links to Other Websites
The Site contains links to external websites, including profiles on social media and repositories such as GitHub. The Administrator is not responsible for the privacy practices of those websites and encourages you to read the privacy policies published there.
XI. Changes to this Policy
This Policy may be updated, in particular when new tools are introduced on the Site or when the applicable law changes. The current version is always published at this address, together with the date of the last update. If the changes concern the purposes or the scope of processing that requires consent, you will be asked for your consent again.