BROKER.FARM — PRIVACY POLICY

Version: 1.0
Effective date: 4 November 2026
Website: https://www.broker.farm/
Privacy contact: valeriya@berrini.farm

Broker.farm brings business messages, offers, negotiations and orders into one workspace. This Privacy Policy explains how we handle personal data when you visit our website, request a call, register an account, use our Service, buy Message Credits or contact our team.

There is an important distinction: we manage certain personal data for our own business purposes, but the business correspondence that customers connect to Broker.farm is generally processed on their behalf. This Policy explains both roles without treating our customers' messages as our own marketing data.

KEY POINTS

Who is responsible? Broker.farm is operated by Wojciech Oksiński, doing business as IT Wojciech Oksiński in Poland.
Your organisation controls its correspondence. The business that connects email, WhatsApp or other authorised sources generally decides why its communications are processed. We process that information under our Data Processing Agreement (DPA).
Messages may be stored without AI Analysis. Depending on Service settings and available Message Credits, customer-connected Messages and attachments may be retained without being submitted for AI Analysis, as explained in the Terms and DPA.
We manage website visits, meeting requests, accounts and payments. We act as controller for our own website, sales enquiries, meeting scheduling, account administration, security, billing, business relationships and permitted marketing.
AI supports our customers' business workflows. AI-assisted processing of customer-connected correspondence is generally carried out on the customer's behalf under the DPA.
We use technical and business service providers. These may include hosting, identity, communications, meeting-scheduling, analytics and payment providers. Recipients and international transfers are described below.
Questions or requests? Contact valeriya@berrini.farm.

1. WHO WE ARE AND WHAT THIS POLICY COVERS

1.1. The controller for the activities described in this Policy is Wojciech Oksiński, conducting business under the name IT Wojciech Oksiński, ul. Sienna 72a/203, 00-833 Warsaw, Poland, NIP 1231152265, REGON 363313210 (referred to as Broker.farm, we, us or the Provider).

1.2. Contact for privacy questions and requests: valeriya@berrini.farm.

1.3. This Policy covers personal data processed for our own purposes in connection with:

visits to our website and its contact forms;
sales enquiries and requests for a call;
creation and administration of Organisation Accounts, including invitations and access permissions;
the purchase and administration of Message Credits, invoices and payments;
onboarding, service messages, support and complaints;
security, abuse prevention, regulatory compliance and legal claims; and
our own business communications and marketing.

1.4. This Policy describes our obligations under the EU General Data Protection Regulation (GDPR) where it applies. People outside the European Economic Area (EEA) may have additional rights under the laws applicable to their situation.

2. TWO ROLES: CONTROLLER AND PROCESSOR

2.1. Customer-controlled correspondence and workspace data

2.1.1. A business customer can connect authorised email accounts, WhatsApp sources and message archives to Broker.farm. The Service helps its team organise messages, offers, price lists, negotiations, orders and information extracted from those communications.

2.1.2. The customer normally determines the purpose of processing this information and acts as a controller. If the customer processes it on behalf of another organisation, the customer may itself be a processor. In these cases, Broker.farm acts as a processor or sub-processor under the Broker.farm Data Processing Agreement (DPA).

2.1.3. Customer-controlled information may contain names, roles, email addresses, phone numbers, email and WhatsApp messages, attachments, information about suppliers and buyers, business transactions and other information about people who have never visited our website.

2.1.4. The customer is responsible for determining the lawful grounds for its own processing, providing privacy information where required and deciding which Users may access its workspace. We process Customer Personal Data to deliver, secure and support the Service in accordance with the customer's documented instructions and the DPA.

Selected authorised members of our team may technically access customer-controlled Messages, attachments, extracted information and other workspace records through administrative tools, including records associated with different Organisation Accounts. Such access is restricted to legitimate operational purposes, including assisted Onboarding, support, troubleshooting, extraction-quality checks, security, Customer-requested export and deletion, and is subject to the confidentiality and security safeguards described in the DPA.

2.1.5. If your information appears in the correspondence or files of a Broker.farm customer, please contact that organisation about your data-protection rights. We will assist the organisation in responding as required by the DPA. We do not independently use customer-connected correspondence as our own prospect list or marketing database.

2.1.6. Customer-connected Messages and attachments may be received and stored before AI Analysis takes place. This includes Messages associated with contacts marked Ignored, Messages from unclassified senders and Messages received during a zero-credit period. Receiving and storing a Message does not necessarily mean that it has been submitted to an AI provider.

The eligibility of retained Messages for subsequent AI Analysis, the handling of Messages after a credit top-up and the suspension of Message collection are governed by the customer's Service settings, the Terms and the DPA. Marking a contact Ignored or temporarily suspending AI Analysis does not, by itself, delete previously stored personal data.

2.2. Personal data controlled by Broker.farm

2.2.1. We act as an independent controller when we decide why and how to process information for our website, sales contacts, account administration, payments, support, security, compliance and our own business operations.

2.2.2. A support request may involve both roles. For example, we are the controller of the support contact details and the request record, while any customer-controlled message content inspected to resolve the request remains subject to the DPA.

3. WHAT WE PROCESS, WHY AND ON WHICH LEGAL BASIS

The table below concerns processing for which we act as controller. Legal bases refer to Article 6(1) GDPR.

Activity	Personal data	Purpose	Legal basis
Website operation	IP address, request and security logs, browser and device information, essential session identifiers	Deliver the website, maintain availability and protect it against misuse	Art. 6(1)(f) GDPR: our legitimate interest in operating and securing the website
Request a call / Book a meeting	Name, work email address, proposed meeting date and time where provided, time zone where provided, enquiry details, meeting invitation information, contact attempts and follow-up correspondence	Respond to an expressly requested business enquiry, contact the person, arrange a meeting and provide the requested information about Broker.farm	Art. 6(1)(f) GDPR: our legitimate interest in responding to requested business enquiries and arranging meetings; Art. 6(1)(b) where the individual is personally taking steps to enter into a contract
Meeting scheduling and video calls	Participant names and email addresses, meeting date and time, time zone, invitation details, meeting identifiers and communications associated with arranging or attending the meeting	Schedule and conduct requested business meetings using calendar and video-conferencing services	Art. 6(1)(f) GDPR: our legitimate interest in conducting requested business meetings and maintaining business relationships; Art. 6(1)(b) where applicable to a contracting individual
Sales enquiries and business relationships	Name, business email, phone number where provided, job title, organisation, correspondence and professional contact details	Answer enquiries, discuss the Service, prepare offers and manage business relationships	Art. 6(1)(f) GDPR: our legitimate interest in B2B communication and relationship management; Art. 6(1)(b) where the individual is personally taking steps to enter into a contract
Registration and Organisation Accounts	Name, work email, organisation name and country, role, account and acceptance records, optional VAT/NIP/NIF/Tax ID, information needed to verify authority	Register and administer an account, identify the contracting organisation and confirm authority	Art. 6(1)(f) GDPR: our legitimate interest in administering B2B accounts and protecting organisations; Art. 6(1)(b) where the individual is the contracting party
Login, invitations and permissions	Account identifiers, email addresses, User roles, invitation records, authentication events, session information and access activity	Authenticate Users, maintain authorised access, investigate suspicious activity and protect accounts	Art. 6(1)(f) GDPR: our legitimate interest in securing and administering the Service; Art. 6(1)(b) where necessary to perform a contract with the individual
Message Credits, purchases and invoices	Organisation and billing details, billing contacts, Tax IDs, purchased packages, credit balances and history, transaction amounts, payment references and invoices	Process orders, administer credit entitlements, document purchases and meet fiscal obligations	Art. 6(1)(f) GDPR: B2B order administration; Art. 6(1)(b) for contracts with individuals; Art. 6(1)(c) for applicable tax and accounting duties
External payment processing and disputes	Checkout and transaction references, payment status, billing information, refund and dispute information; payment card details are provided through the payment service provider's checkout where applicable	Complete and reconcile payments, prevent fraud and handle refunds, disputes and chargebacks	Art. 6(1)(f) GDPR: payment administration and fraud prevention; Art. 6(1)(b) where the individual is the contracting party; Art. 6(1)(c) where records are legally required
Onboarding and support	User contact details, support messages, requests, diagnostic information and relevant account history	Assist with account setup, answer questions, resolve errors and handle complaints	Art. 6(1)(f) GDPR: customer support and service reliability; Art. 6(1)(b) where the individual is the contracting party; Art. 6(1)(c) where required by law
Security, misuse and legal matters	Necessary account, device, access, event and transaction records, evidence relating to reported incidents	Detect and investigate misuse, protect the Service, defend legal claims and respond to lawful requests	Art. 6(1)(f) GDPR: security and protection of legal claims; Art. 6(1)(c) for applicable legal obligations
Marketing and product news	Business contact details, subscription and consent choices, communications and objection records	Send permitted product updates, offers and marketing communications	Art. 6(1)(f) or Art. 6(1)(a) GDPR, as applicable, together with any separate prior consent required for the communication channel
Vercel Web Analytics and website measurement	Page-view and referral information, technical browser and device characteristics, approximate location information and other limited measurement data processed by the configured analytics service	Understand aggregate website traffic, performance and use of website pages	Art. 6(1)(f) GDPR where personal data is processed and legitimate interests are applicable; Art. 6(1)(a) where consent is required for the particular technology or processing
Other optional analytics or similar technologies	Cookie or similar identifiers, interaction information and other technical data, depending on the technology actually enabled	Measure website use, assess performance or improve the website where such tools are enabled	Art. 6(1)(a) GDPR where consent is required; another legal basis only where genuinely applicable

Legitimate interests. Where we rely on Article 6(1)(f), our interests include responding to business enquiries, administering customer relationships, protecting accounts and transactions, preventing fraud, supporting users and establishing, exercising or defending legal claims. We assess these interests against the rights and interests of the people concerned. You may object to this processing as described in Section 10.

Messages in customer workspaces. The legal bases chosen by a customer for its connected correspondence are not replaced by the legal bases in this table. Those messages are processed by Broker.farm on the customer's behalf under the DPA.

4. WHERE WE OBTAIN DATA

4.1. We receive personal data:

from you: when you browse our website, request a call or meeting, provide proposed scheduling information, register, contact us, use account settings or purchase Message Credits;
from your organisation or colleagues: when an Administrator invites you, assigns you a role or provides your professional contact details;
from business contacts and public sources: for example, a referral, a company's website or a public business register used to identify a Customer or verify representation;
from meeting and communications providers: for example, information about a scheduled meeting, invitation delivery or a response to a calendar invitation;
from payment and technical providers: for example, a transaction status from the payment service provider used at checkout or authentication, security and diagnostic information from infrastructure services; and
from your device or browser: such as technical request information, login activity and information processed through website technologies.

4.2. Where data is obtained from someone other than the person concerned, it may include that person's name, professional role, business contact information, organisation, invitation or authority information and relevant business communications.

4.3. Where Article 14 GDPR applies to our own processing, we provide the required privacy information within the legally applicable period and, in particular, no later than our first communication where that is the earlier applicable trigger, unless a GDPR exception applies or the person already has the information. Publishing this Policy does not replace individual notification when individual notification is required.

4.4. Customer-controlled messages imported into the Service are not collected by us for independent marketing. Our role in processing those messages is described in Section 2 and the DPA.

5. WHAT INFORMATION YOU NEED TO PROVIDE

5.1. To request a call or meeting through our website, you need to provide your name and work email address so that we can identify the enquiry and contact you about scheduling. You may also provide a preferred meeting date or time and time zone, where the relevant fields are available. These details help us arrange a suitable meeting and send an invitation.

If you do not provide the information marked as required in the form, we may be unable to process your meeting request. Providing your contact details for this purpose does not automatically subscribe you to marketing communications.

5.2. To create an Organisation Account, the registration process requires the registering user's name and work email, the organisation's name and country, acceptance of the applicable contractual documents and confirmation of authority to act for the organisation. We may request additional information where necessary to identify the contracting entity or verify access to business correspondence. Without the information necessary for registration or verification, we cannot create or activate the relevant account or integration.

5.3. A VAT number, NIP, NIF or other Tax ID is optional at registration. We may require a Tax ID and other accurate billing details where legally or operationally necessary to complete a paid purchase, issue an invoice or verify a business transaction. A payment cannot be completed where legally required billing information is missing.

5.4. Details included voluntarily in emails, support messages and other free-text fields are not generally mandatory. Please do not include unnecessary personal data or sensitive information.

5.5. When you connect business correspondence to Broker.farm on behalf of your organisation, the organisation determines which data is provided for that purpose. Those data-processing decisions are governed by its own obligations and the DPA.

6. WHO RECEIVES DATA

6.1. Depending on the activity and the services actually used, personal data processed for our own purposes may be received by:

Microsoft Azure, Vercel and other relevant infrastructure providers for website hosting, application infrastructure and associated technical services;
Auth0 (Okta) for User authentication, identity and session-management functions;
Postmark and other relevant communications providers for invitations, Service notifications and transactional emails;
Zapier, where used to transmit website meeting requests and related information to our team or configured scheduling systems;
Google Workspace, including Google Calendar and Google Meet, where used to arrange, invite participants to or conduct requested business meetings;
Vercel Web Analytics, where enabled to measure website traffic and performance using the configured analytics service;
Sentry and relevant infrastructure or security providers for diagnostics, reliability and security;
the external payment service provider identified at checkout, which may include Stripe where that provider is used, for payment processing, transaction status, refunds and disputes;
accountants, legal advisers and other professional consultants, subject to appropriate confidentiality and data-protection obligations;
competent public authorities, where disclosure is required or otherwise authorised by law; and
parties involved in a lawful restructuring or business transfer, subject to applicable safeguards.

6.2. Suppliers receive only the information needed for their function and are engaged under the arrangements required for their role. Some service providers act as processors for us; others, including payment providers for certain operations, may act as independent controllers and provide their own privacy information.

6.3. Customer-controlled workspace information may also be processed through technical services such as Microsoft Azure, Hasura Cloud, Vercel, Inngest, Cloudflare R2, Anthropic, Auth0, Postmark and Sentry, to the extent relevant to the functions enabled and the personal data involved. The Customer's independently selected email services and applicable Meta/WhatsApp arrangements may also be involved.

These suppliers may perform different functions and may have different data-protection roles depending on the particular processing activity. Where they process Customer Personal Data on Broker.farm's behalf, the DPA and its authorised sub-processor information govern that processing. Information about our own controller-side processing is provided in this Policy.

6.4. We do not sell personal data to advertisers or treat a customer's connected business correspondence as our independent marketing database.

7. INTERNATIONAL DATA TRANSFERS

7.1. We operate from Poland and serve business customers in different countries. Some suppliers or their authorised personnel may access or process information outside the EEA. Locating a database in the EEA does not necessarily mean that all support, processing or access takes place there.

7.2. Where the GDPR applies and an international transfer requires a transfer mechanism, we use an applicable European Commission adequacy decision, including the EU–US Data Privacy Framework where the relevant recipient is eligible, Standard Contractual Clauses together with any necessary supplementary safeguards, or another lawful mechanism.

7.3. The safeguards, roles and transfers concerning customer-controlled correspondence are addressed in the DPA and applicable supplier arrangements.

7.4. You can request information about safeguards for transfers relating to data that we control by contacting valeriya@berrini.farm, including how to obtain a copy of the applicable safeguards where the GDPR requires it.

7.5. The use of external identity, infrastructure, meeting-scheduling, analytics, automation and payment providers may involve access to or processing of personal data outside the EEA, depending on the relevant supplier, contractual entity, configuration and support arrangements. This may include providers such as Google, Zapier, Auth0 and the payment service provider used at checkout.

Where a restricted international transfer occurs, we apply the relevant safeguards described above. We do not assume that selecting an EEA hosting region prevents all access or onward processing outside the EEA.

8. HOW LONG WE KEEP DATA

We do not keep personal data indefinitely merely because it might be useful. The following periods apply to our own controller-side data. A longer period applies only where a specific legal duty, ongoing dispute, established claim or security investigation justifies it, and the additional data is limited to what is needed.

Category	Retention
Requests for a call or meeting without a later business relationship	Until the enquiry and any requested meeting have been handled, and no longer than 6 months after the last contact, unless a documented legal claim, dispute or other lawful reason justifies longer retention. This includes the related enquiry, scheduling and meeting-invitation information within our control.
Business enquiries that do not result in an account or contract	Up to 24 months after the last substantive communication, unless a specific dispute or legal obligation requires more
Account and organisation administration	During the account relationship; after closure, core records needed to prove the agreement, accepted document versions and administration may be kept for up to 3 years, subject to a longer applicable legal claims period
Invitations and user access details	While needed for the organisation's account; removed or disabled when access ends, except for necessary security and audit evidence retained under the rules below
Billing and accounting documents	For the period required by applicable tax and accounting law; for Polish tax records, generally 5 years from the end of the calendar year in which the tax payment deadline expired, unless another applicable rule or a suspended limitation period changes that date
Purchase and credit-balance history	During the account relationship and, after closure, as long as required to settle transactions, handle disputes and support applicable legal, tax or accounting retention
Support and complaint correspondence	Up to 24 months after the matter is closed, unless necessary for an ongoing dispute, security incident or longer legal duty
Routine website and application security logs	Up to 90 days after collection; records linked to a specific incident or abuse investigation may be retained while the matter is handled and for the applicable claims or legal period
Records of privacy requests	Up to 3 years after a request is closed, unless a specific pending matter or legal obligation requires longer
Marketing contact information	Until the relevant consent is withdrawn, an objection is made or the lawful purpose ends; limited suppression and evidence records may be retained to respect the choice and demonstrate compliance
Cookies and similar technologies	For the session or the period relevant to each technology, as explained in the website's cookie information and consent controls

Customer workspace data. The customer controls the purposes and retention of its connected correspondence, subject to the Service agreement. Under the standard termination process, data is deleted from the active Service within 30 days after termination or an earlier verified deletion instruction, unless an applicable switching, retrieval or legal retention duty requires a different sequence. Backup copies are removed under the controlled backup lifecycle described in the Terms and DPA.

Early deletion and objections. You may ask for erasure or object where the GDPR permits. A request may lead to earlier deletion than the maximum periods above. We assess lawful exceptions individually.

9. SECURITY

9.1. We apply organisational and technical controls proportionate to the risks of the processing, including authenticated access, user permissions, confidentiality obligations, protected communications and safeguards for relevant service providers.

9.2. Users and organisation administrators should secure the email and WhatsApp accounts they connect, protect credentials, use available multi-factor authentication and promptly remove access that is no longer required.

9.3. No online service can eliminate all risks. If you suspect unauthorised access to an account or personal data, contact valeriya@berrini.farm.

10. YOUR RIGHTS

10.1. Where the GDPR applies and we are the controller, you may have the right to:

obtain access to personal data and a copy of it;
request correction of inaccurate or incomplete information;
request erasure in the circumstances provided by law;
ask for restriction of processing;
object to processing based on our legitimate interests, including the right to object at any time to direct marketing;
receive personal data in a portable format where the GDPR conditions are met;
withdraw consent at any time, without affecting processing carried out lawfully before withdrawal; and
lodge a complaint with a competent supervisory authority, including the President of the Polish Personal Data Protection Office (UODO).

10.2. If you object to processing based on Article 6(1)(f) for reasons relating to your particular situation, we will stop unless we demonstrate compelling legitimate grounds overriding your interests, rights and freedoms, or the data is necessary for legal claims. An objection to direct marketing does not require you to give special reasons.

10.3. Send requests to valeriya@berrini.farm. We may ask for information reasonably necessary to verify your identity. We answer within the time limits required by applicable law.

10.4. If a request concerns messages or files controlled by a Broker.farm customer, that customer is generally responsible for determining the response. You should contact the organisation concerned; we will assist it as required by the DPA.

11. AI AND AUTOMATED DECISION-MAKING

11.1. Broker.farm uses AI-assisted tools to classify and organise customer-connected correspondence, extract business information, identify relevant products and commercial terms, and prepare structured records and summaries. Certain extracted results may be automatically accepted into the customer's internal business records where configured processing criteria are met, while other results may be referred to an authorised User for review.

For these activities, the customer normally determines the purposes of processing, and we act on its behalf under the DPA. The internal acceptance of an AI-generated result does not, by itself, constitute a commercial commitment or a decision producing legal or similarly significant effects on an individual.

11.2. For our own controller-side activities described in this Policy, we do not make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects on individuals within the meaning of Article 22 GDPR.

11.3. AI-generated information may contain errors, omissions or outdated information, including when a result has been automatically accepted into an internal record. Customers and their authorised Users are responsible for applying appropriate oversight and checking material business information before relying on it or making commercial commitments, as further explained in the Terms of Service.

12. COOKIES AND SIMILAR TECHNOLOGIES

12.1. Our website and Service use technical mechanisms necessary to deliver pages, authenticate Users, maintain secure sessions and protect against misuse. Depending on the relevant function, these may include session cookies, browser storage and comparable technologies.

12.2. Where enabled, Vercel Web Analytics is used to understand aggregate website traffic and performance. According to the provider's documentation, this service is designed to operate without cookies and uses limited page-view, referral and technical information for website statistics. The precise data processed depends on the configuration and functions enabled.

12.3. We assess cookies and comparable technologies under the GDPR and applicable electronic-communications law, including Article 399 of the Polish Electronic Communications Law. Where storing information on, or accessing information from, a user's device requires prior consent, we obtain that consent before the relevant operation takes place, unless a statutory exception applies.

12.4. Where optional analytics, advertising, personalisation or other technologies require consent, we provide appropriate information and a choice before enabling them. Users may refuse or withdraw optional consent through the available website controls. Refusing optional technologies does not prevent access to essential website functions, although disabling strictly necessary authentication or security technologies may affect some Service functions.

12.5. Information about the particular technologies used, their purposes, providers and applicable storage periods is provided through the relevant cookie information or consent interface where required. We review this information when technologies or configurations change.

12.6. Consent to optional cookies or similar technologies is separate from consent to receive marketing communications by email, telephone or other electronic channels.

13. MARKETING AND BUSINESS REFERENCES

13.1. We may send messages necessary for account registration, onboarding, payment confirmation, security and customer support without treating them as marketing subscriptions.

13.2. We send marketing through email, phone or other electronic channels only where permitted by applicable GDPR and electronic-communications requirements. Where prior consent is required, we obtain it before sending the communication.

13.3. Submitting the website's Request a call or Book a meeting form means that the person requests contact from our team concerning Broker.farm and, where applicable, the arrangement of a business meeting. We use the submitted contact details to respond to that request and provide related scheduling information.

Submitting the form does not, by itself, constitute consent to recurring marketing messages, promotional mailing lists or unrelated marketing calls. Any separate marketing communications are subject to the applicable legal requirements and preferences described in this Section.

13.4. You may withdraw a marketing consent or object to direct marketing using the method provided in a message or by contacting valeriya@berrini.farm.

13.5. We do not publish a customer's name, logo or case study as a business reference without a separate approval. Refusing approval does not prevent registration or use of the Service.

14. CHILDREN AND PERSONAL USE

Broker.farm is intended for businesses and professionals. It is not designed for children's accounts or private household use. We do not knowingly market the Service to children.

15. CHANGES TO THIS POLICY

We may update this Policy to reflect changes in processing, technology or legal requirements. We publish the updated version with its effective date. Where a change requires individual notice, another legal basis or renewed consent, we take the steps required by applicable law before applying it.

16. CONTACT

Wojciech Oksiński — IT Wojciech Oksiński / Broker.farm
ul. Sienna 72a/203, 00-833 Warsaw, Poland
Privacy contact: valeriya@berrini.farm
Website: https://www.broker.farm/

If your request concerns personal data contained in a customer's connected messages or workspace, contact the relevant customer organisation in the first instance. We assist that organisation under the DPA.

Broker.farm Privacy Policy — version 1.0.