1. Controller
The controller of your personal data is Timerise Sp. z o.o., registered in Wrocław, Poland, ul. Księcia Witolda 49 lok. 15, 50-202 Wrocław, KRS 0000895019, NIP 8971890756 ("Timerise"). For anything about your personal data write to builders@timerise.ai or to our registered address. Timerise has not appointed a data protection officer.
2. What data we process
- identification and contact: name, email address, phone number, country and, if you act as a business, its name and contact persons; for a copyright transfer agreement — your address and PESEL or identity document number;
- partner profile: program role, roles and shares, badges, referral link (slug), skills, the professional profiles you give us (such as GitHub or LinkedIn);
- payment: details of the issuer of your invoices (your business or an invoicing platform), Polish or foreign tax number, tax residence and certificate of residence, bank account, invoices, the shares paid to you;
- program activity: briefs attributed to your link, the projects you take part in, your correspondence with Timerise;
- technical: when you apply to the program — IP address, approximate location (country, city) derived from it and browser information; console login data, access logs for project repositories and environments and, when you accept the agreement, the date, time, IP address, browser, the version and language you accepted and your roles and shares from the table in the agreement.
You give us the data yourself. If you act for a business, that business may have given us your data.
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| reviewing your application to the program (the "Apply" form) and contacting you about certification | Art. 6(1)(b) GDPR (steps taken at your request before entering into a contract) |
| making and performing the partner agreement and project agreements: console account, attributing briefs and roles, access to environments, paying shares | Art. 6(1)(b) GDPR (contract); where a business is the party — Art. 6(1)(f) GDPR (our legitimate interest in dealing with its representative) |
| tax and accounting obligations: documenting payouts, withholding where required, keeping records | Art. 6(1)(c) GDPR (legal obligation) |
| proof of acceptance of the agreement, security of project environments and client code, establishing, pursuing and defending claims | Art. 6(1)(f) GDPR (Timerise's legitimate interest) |
| public partner profile on the Timerise website: your name (or business name), program role, badges, skills and links to the professional profiles you give us | Art. 6(1)(b) GDPR (contract — the public profile is part of the program, section 4 of the partner agreement) |
4. Recipients
Your data may be received by:
- IT service providers Timerise uses: GitHub (code repositories), Vercel (console and website hosting), Supabase (console database), Google (email and documents — Google Workspace), Anthropic (Claude) and OpenAI (AI models used in the console and in project work);
- communication providers: Slack (notifying the Timerise team of your application) and Twilio SendGrid (sending email);
- Useme (useme.com) or another invoicing platform through which you issue invoices — as far as needed to issue the invoice and pay you, as a separate controller under its own terms;
- the accounting office that keeps Timerise's books, the bank that makes payouts, legal and tax advisers;
- Timerise's clients — only your name, role and the details needed to work together on a project you take part in;
- public authorities where the law requires it (such as the tax office or social security).
5. Transfers outside the EEA
Some IT service providers may process data in the United States or other countries outside the European Economic Area. We transfer data only on the basis of a European Commission adequacy decision (including the EU-US Data Privacy Framework) or standard contractual clauses approved by the Commission. You can get a copy of the safeguards by writing to builders@timerise.ai.
6. How long we keep data
- data from an application that did not lead to taking part in the program — 12 months from the application;
- data related to the agreement — while it lasts and then until claims become time-barred (generally 3 years, counted to the end of the calendar year);
- payment and tax records — for 5 years from the end of the year in which the tax payment deadline passed;
- proof of acceptance of each version of the agreement — while the agreement lasts and until claims become time-barred;
- access logs for environments — 12 months;
- data processed on the basis of consent — until you withdraw it.
7. Your rights
You have the right to access your data, to have it rectified or erased, to restrict its processing, to data portability, and to object to processing based on Timerise's legitimate interest. Where processing is based on consent, you may withdraw it at any time; this does not affect the lawfulness of processing before withdrawal. You may also lodge a complaint with the President of the Personal Data Protection Office (Prezes UODO, ul. Stawki 2, 00-193 Warsaw, Poland) or with the supervisory authority in the country where you live or work.
8. Do you have to give us data
Giving us data is voluntary, but without identification, contact and technical data you cannot take part in the program, and without payment data we cannot pay your shares or meet our tax obligations.
9. Automated decisions
We do not make decisions about you based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect you. Attributing a brief to a referral link is automatic, but you may challenge it as section 6 of the partner agreement provides.
10. Language
This notice is also available in Polish; if the versions differ, the Polish version prevails.