Skip to main content

Last updated: 3 September 2026

This Privacy Policy explains how Chameleon Interactive sp. z o.o. (“Chameleon Interactive”, “we”, “us”) processes personal data when you visit chameleon-interactive.com, contact us, work with us, or subscribe to Chameleon Insights.

1. Data controller and contact details

The controller of your personal data is:

Chameleon Interactive sp. z o.o.
ul. Jana Heweliusza 11/811
80-890 Gdańsk, Poland
KRS: 0000981392
NIP: 5833454555
REGON: 522531621
Email: data@chameleon-interactive.com

Please use the email address above for privacy questions or to exercise your rights.

2. Personal data we process

Depending on how you interact with us, we may process:

  • contact and identification data, such as your name, business email address, company, job title and telephone number;
  • the content of your messages, enquiries and project communications;
  • newsletter data, including your email address, optional name, subscription status and records needed to demonstrate your request and confirmation;
  • technical and usage data, such as IP address, device and browser information, referring page, pages viewed and cookie or similar-technology identifiers;
  • business and transaction data needed to prepare proposals, perform contracts, issue invoices and maintain accounting records;
  • information you provide when applying for a role or otherwise communicating with us.

We usually obtain this data directly from you, from your organisation, or automatically through our website and its technologies.

3. Why we use personal data, legal bases and retention

  • Newsletter: to send the monthly Chameleon Insights newsletter and administer subscriptions, based on your consent (Article 6(1)(a) GDPR and applicable electronic communications law). We use a confirmation email (double opt-in). We retain active subscriber data until you unsubscribe or withdraw consent, and retain limited suppression and consent evidence where necessary to respect your choice and establish, exercise or defend legal claims. Unconfirmed subscriptions are configured for deletion after 30 days.
  • Enquiries and contact forms: to answer your message and manage business communication, based on our legitimate interest in responding to enquiries (Article 6(1)(f) GDPR) or, where relevant, steps requested before entering into a contract (Article 6(1)(b) GDPR). We normally retain this data for the time needed to resolve the enquiry and then for the applicable limitation period.
  • Contracts and projects: to prepare, enter into and perform contracts (Article 6(1)(b) GDPR), comply with tax, accounting and other legal duties (Article 6(1)(c) GDPR), and protect or pursue legal claims (Article 6(1)(f) GDPR). Retention follows statutory accounting and limitation periods.
  • Website security and operation: to keep the website available, secure and protected against misuse, based on our legitimate interests (Article 6(1)(f) GDPR). Server and security logs are retained only as long as needed for those purposes, unless a longer period is necessary to investigate an incident or establish a claim.
  • Analytics and advertising technologies: to measure website use, evaluate campaigns and improve our services. Where these technologies are not strictly necessary, we rely on your consent (Article 6(1)(a) GDPR and applicable rules governing access to information on your device). You may withdraw consent through the site’s consent controls when available and through your browser settings. See section 6 below.

Where processing is based on our legitimate interests, we balance those interests against your rights and reasonable expectations. Where processing is based on consent, you may withdraw it at any time without affecting processing carried out before withdrawal.

4. Chameleon Insights newsletter and MailPoet

When you select “Join the briefing”, we use the email address you provide to send Chameleon Insights. Subscription is not a condition of using our website or purchasing services. After submitting the form, you must confirm your subscription using the link in the confirmation email. If you do not confirm, you will not receive the newsletter.

You can unsubscribe at any time using the link in every newsletter or by emailing data@chameleon-interactive.com. Withdrawal is as easy as giving consent.

We use MailPoet to manage subscription forms, subscriber records, confirmation emails and newsletter delivery. MailPoet engagement analytics is configured at Basic/None, which disables newsletter open, click and cookie-based tracking. Sending-status data is configured for six-month retention, rendered email content for 30 days, and unconfirmed subscribers for 30 days. If we change these settings, we will update this notice and obtain any consent required before using additional measurement.

5. Recipients, service providers and international transfers

We disclose personal data only when necessary to authorised personnel and trusted providers that support our website, hosting, email, newsletter, analytics, advertising, IT, security, legal and accounting activities. Relevant providers may include MailPoet/Automattic, Google and LinkedIn. They process data under their own privacy terms or under contracts requiring appropriate protection, depending on their role.

Some recipients may process data outside the European Economic Area. Where this occurs, we use a lawful transfer mechanism, such as an adequacy decision or the European Commission’s Standard Contractual Clauses, together with supplementary safeguards where required. You may contact us for information about the safeguards applicable to a transfer.

We may also disclose data where required by law, to public authorities acting within their powers, or when necessary to establish, exercise or defend legal claims.

6. Cookies and similar technologies

Our website uses technologies necessary for core functionality and may use Google Analytics 4, Google Ads conversion measurement and the LinkedIn Insight Tag for analytics and marketing. These services may receive technical data and online identifiers and may combine information in accordance with their own privacy notices.

Strictly necessary technologies may operate without consent where permitted by law. Analytics and advertising technologies require prior consent where applicable. Refusing or withdrawing optional consent must not prevent access to the website’s essential functions. Browser controls may also be used to delete or block cookies, although doing so may affect some features.

A privacy notice does not replace a required consent choice. If optional analytics or advertising technologies load before a valid choice is recorded, please notify us at data@chameleon-interactive.com so we can investigate.

7. How long we keep personal data

We retain personal data only for as long as necessary for the purposes described above, including legal, accounting and security requirements. We consider the amount, nature and sensitivity of the data, the risk of harm, the purpose of processing and applicable legal periods. Data is deleted or anonymised when it is no longer needed, subject to limited records required to honour opt-outs or defend legal claims.

8. Your rights

Subject to the conditions in the GDPR, you may:

  • request access to your personal data and a copy of it;
  • request correction of inaccurate or incomplete data;
  • request deletion or restriction of processing;
  • object to processing based on legitimate interests or to direct marketing;
  • receive data you provided in a portable format where the right applies;
  • withdraw consent at any time; and
  • lodge a complaint with a data protection authority.

In Poland, the supervisory authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl. You may also contact the authority in the EU/EEA country where you live or work, or where the alleged infringement occurred.

To exercise a right, contact data@chameleon-interactive.com. We may ask for information necessary to verify your identity. We normally respond within one month, subject to any lawful extension.

9. Whether you must provide data

Providing data for the newsletter is voluntary, but we cannot send it without your email address and confirmation. Information requested for a contract or legal obligation may be necessary to work with you; we will explain the consequences if required data is not provided.

10. Automated decision-making

We do not use the personal data described in this policy to make decisions based solely on automated processing that produce legal or similarly significant effects on you.

11. Security

We use appropriate technical and organisational measures designed to protect personal data against accidental or unlawful loss, alteration, disclosure or access. No online service can guarantee absolute security.

12. External links

Our website may link to third-party websites. Their operators are responsible for their own privacy practices, and we encourage you to read their privacy notices.

13. Changes to this policy

We may update this policy when our services, providers or legal obligations change. We will publish the revised version here and update the date above. If a change materially affects consent-based processing, we will seek a new consent where required.

14. Contact

Questions about this policy or our handling of personal data may be sent to data@chameleon-interactive.com.

Privacy Policy

© Chameleon Interactive 2026