Home » Privacy Policy

Privacy Policy Talent.pl

Effective date: 15.09.2026
Service Provider / Data Controller: Kancelaria Prawnicza dr Wiktor Czeszejko-Sochacki radca prawny, ul. Nowogrodzka 62C lok. 47, 02-002 Warszawa, Tax ID (NIP) 1181598012.
Service: Talent.pl
Contact: contact@talent.pl

1. General provisions

  1. This Privacy Policy sets out the rules for processing the personal data of people using the Talent.pl website, including users, creators, buyers, people contacting the controller, newsletter subscribers and people whose data appears in content, input materials or reports submitted to the Service.
  2. This Policy is a document supplementing the Terms of Service of the Talent.pl Service, and in matters not regulated herein, the provisions of the Terms of Service and the applicable laws shall apply, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter “GDPR” and national provisions on the provision of electronic services, consumer rights and privacy protection.
  3. The Service is a creative and marketplace online platform which enables, in particular, the generation, presentation and licensing of digital works under subscriptions, including content generated or co-generated using AI tools, and the nature of these services determines the scope of data processed by the controller.

2. Controller and contact

  1. The controller of personal data is the entity indicated in the introductory part of the Terms of Service, i.e. Kancelaria Prawnicza dr Wiktor Czeszejko-Sochacki radca prawny.
  2. The controller can be contacted by post at the registered office address and electronically at the e-mail address indicated in the Service and the Terms of Service.
  3. If the controller appoints a data protection officer, the relevant information together with their contact details will be made available in the Service or in this policy by way of an update.

3. Scope of application

  1. This Policy covers personal data processed in connection with the registration and maintenance of the user’s Account, the use of the Service’s features, the generation of AI content, the publication and licensing of content, the handling of payments, settlements and payouts to creators, the handling of complaints, infringement reports, appeals, communication with users, sending the newsletter, security analysis and the fulfilment of legal, tax, accounting and evidentiary obligations.
  2. This Policy covers both data provided directly by the user and data generated while using the Service, including system logs, device identifiers, Account activity history and security-related data.
  3. Where a user enters third-party data into the Service, in particular a person’s image, voice, contact details or other personal data contained in content or input materials, the user is responsible for having an appropriate legal basis for doing so.

4. Categories of persons and data

  1. The controller may process the data of users who create an Account and use the Service, creators who publish content or receive remuneration, buyers who purchase licences, packages or subscriptions, contact persons designated by B2B clients, newsletter subscribers, people submitting complaints and infringement reports, people whose data appears in content or input materials, and visitors to the Service in respect of whom technical data, cookies and security logs are processed.
  2. Depending on the purpose and manner of using the Service, the controller may process identification data, account and login data, billing and tax data, transaction data, communication data, publication and content data, technical and operational data, and data relating to infringements and security.
  3. If the user uses the AI content generation features, the controller may also process input materials, prompts, generation settings, generation results, operation history, information on limits used and data needed to settle a digital service performed immediately.
  4. As a rule, the controller does not require special categories of personal data to be provided, unless the nature of the content or input materials means that the user enters such data themselves.

5. Purposes and legal bases

  1. Creating and maintaining the user’s Account, providing electronic services and ensuring access to the panel and features of the Service are based on Art. 6(1)(b) GDPR as processing necessary for the performance of a contract.
  2. Handling AI content generation, fulfilling orders, granting licences, supplying digital content and settling plans, packages and purchases are based on Art. 6(1)(b) GDPR.
  3. Handling payments, invoices, accounting, tax settlements and reporting obligations is based on Art. 6(1)(c) GDPR in conjunction with the relevant legal provisions.
  4. Verifying creators, paying remuneration, preventing abuse and settling transactions may be based on Art. 6(1)(b) and (f) GDPR.
  5. Handling complaints, notice-and-takedown reports, appeals, disputes and requests from authorities is based on Art. 6(1)(c) and (f) GDPR.
  6. Ensuring the security of the Service, detecting abuse and preventing spam, phishing, malware, scraping, crawling and attempts at unauthorised training of AI models are based on Art. 6(1)(f) GDPR.
  7. Direct marketing of the controller’s own services may be based on Art. 6(1)(f) GDPR and, where required by the laws on electronic communications or the provision of electronic services, also on prior consent.
  8. Sending the newsletter electronically is based on Art. 6(1)(a) GDPR with regard to marketing consent and on Art. 6(1)(f) GDPR with regard to the technical handling of sign-ups, unsubscriptions and proof of consent.

6. Data related to AI and service pricing

  1. Due to the nature of the Service, the controller may process input and output data related to AI features, including prompts, generation parameters, the history of generated results, quality ratings, information on technical errors and data needed to maintain and develop the tools.
  2. The current pricing model of the Service includes the Start, Creator and Agency plans, which means that the scope of transaction and billing data processed corresponds to monthly or annual service plans.
  3. The updated price list provides for: the Start plan at PLN 29 per month for 100 HD images, the Creator plan at PLN 69 per month for 300 HD images and the Agency plan at PLN 399 per month for 3,000 HD images.

7. Data recipients

  1. Personal data may be transferred to providers of hosting, cloud infrastructure, CDN, e-mail, monitoring and security.
  2. Data recipients may also include providers of analytics tools, marketing automation, CRM and newsletter services, payment operators, banks, entities handling invoicing and accounting, and providers of tools used to generate AI content or to support the technical functions of the Service.
  3. Data may also be transferred to entities supporting the handling of complaints, infringement reports, debt collection, the pursuit of claims or legal services, as well as to authorised public authorities, courts, law enforcement authorities and regulators, where required by law or a legally effective request.

8. Transfer of data outside the EEA

  1. As a rule, the controller aims to use providers that process data within the European Economic Area.
  2. However, due to the nature of internet services and technology tools, some providers may process data outside the EEA.
  3. If data is transferred outside the EEA, the controller ensures an appropriate mechanism to legitimise the transfer, in particular an adequacy decision, standard contractual clauses or another instrument provided for by the GDPR.

9. Data retention period

  1. Account-related data is stored for as long as the Account is maintained and for the time necessary for settlements, handling claims, defending against claims and fulfilling legal and evidentiary obligations.
  2. Transaction, accounting and tax data is stored for the period required by law.
  3. Marketing data processed on the basis of consent is stored until consent is withdrawn or the marketing purpose ceases to be relevant.
  4. Technical and security logs, IP addresses, device identifiers and Account operation history are stored for the period necessary to ensure security, prevent abuse, detect incidents and defend against claims.

10. Rights of data subjects

  1. The data subject has – in the cases provided for by the GDPR – the right of access to data, rectification of data, erasure of data, restriction of processing, data portability, objection to processing based on legitimate interest, withdrawal of consent and the right to lodge a complaint with the President of the Personal Data Protection Office.
  2. Requests concerning personal data can be sent to the controller’s contact details indicated in the Service.
  3. The controller may verify the identity of the person making a request in order to prevent data from being disclosed to an unauthorised person.

11. Automated decision-making and profiling

  1. The controller may use automated supporting mechanisms for security, abuse detection, spam filtering, traffic analysis, interface personalisation or content recommendations.
  2. As a rule, the controller does not make decisions producing legal effects concerning users based solely on automated processing, unless this is necessary for the performance of a contract, required by law or based on explicit consent, and the user has been provided with appropriate safeguards.

12. Data security

  1. The controller applies appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, modification and other forms of unlawful processing.
  2. These measures may include, in particular, encryption of transmission, access control, accountability of operations, backups, incident monitoring, abuse protection, segmentation of permissions and incident response procedures.
  3. However, no internet system guarantees the complete elimination of risk, which is why users should also take care of the security of their own login details, end devices and working environment.

13. Data of children and third parties

  1. The Service is not generally directed at children, unless a particular offer provides otherwise.
  2. Users should not enter third-party data into the Service, including data of minors, without an appropriate legal basis and without meeting the requirements of the law.
  3. If the controller finds that data has been provided without a legal basis or in breach of the law, it may restrict processing, block the content or request additional explanations.
  4. In accordance with Art. 5 of Regulation (EU) 2024/1689 (EU AI Act), as amended by the Digital Omnibus on AI package, from 2 December 2026 there is an absolute prohibition on using AI systems to generate intimate or sexual content depicting a real person without their consent (non-consensual intimate imagery) and content depicting the sexual abuse of children. The controller implements technical and moderation mechanisms to prevent the processing of personal data (including a person’s image) in a manner that violates this prohibition, and input data and generated content that violate the prohibition may be deleted and the user’s account blocked, regardless of the liability provided for in other regulations.

14. Changes to the privacy policy

  1. The Privacy Policy may be updated in particular in the event of changes to the law, the practice of authorities, the scope of the Service’s features, business models, the tools used or the ways in which data is processed.
  2. The current version of the policy is published in the Service and may be made available in a form that allows it to be downloaded, saved and reproduced, in the same way as the Terms of Service.
  3. In the event of changes that significantly affect users’ rights, the controller will take appropriate steps to inform them.