Privacy notice

For the English pages of szopalabs.com (NIS2 Supplier Compass) · Last updated: 20 October 2026

1. Who is responsible for your data

The controller of your personal data is Michał Szopa, a natural person (SzopaLabs), ul. Wejherowska 17C/1, 42-202 Częstochowa, Poland. E-mail: michal.szopa@szopalabs.com.

This notice covers the English pages of szopalabs.com, the demo request form on them and the cookie banner shown there. The rest of szopalabs.com is in Polish and is covered by the Polish privacy policy (polityka prywatności).

2. Demo requests

• What we collect: your work e-mail address and the name of your organisation; optionally, the approximate number of suppliers and your sector chosen from a list; the language of the page you sent the request from. If you tick the separate consent box, we also store your consent together with its wording and the time it was given. The form has no free-text field. Your IP address is not stored with your request — the form uses it only to limit the number of requests, in the server's memory.
• Why and on what legal basis: to answer your demo request and correspond with you about it, including one automatic confirmation that we received the request (at most once every 30 days for the same address). Legal basis: our legitimate interest in replying to an enquiry made on behalf of an organisation (Art. 6(1)(f) GDPR). You can object at any time by writing to the address above. Providing the data is voluntary, but without an e-mail address and an organisation name we cannot answer the request.
• E-mails about the paid version (optional): only if you tick the separate box in the form — on the basis of your consent (Art. 6(1)(a) GDPR and Art. 398 of the Polish Electronic Communications Law). The demo does not depend on it. You can withdraw your consent at any time by writing to michal.szopa@szopalabs.com; withdrawal does not affect anything done before it.
• Who receives the data: Google (hosting of the site and the Firestore database, in a European Union region; the e-mail infrastructure we send messages through). A copy of your request is delivered by e-mail to the controller's mailbox.
• How long we keep it: 12 months from our last contact; a new request from the same address extends this period. Messages in the controller's mailbox about your request are kept no longer than 12 months from the last contact.

3. Supplier lists in a pilot

• Supplier lists are not needed for the demo — please do not send them through the form or by e-mail.
• We accept a supplier list only in a pilot and only after a data processing agreement under Art. 28 GDPR has been signed. We then process the list on behalf of your organisation, as a processor, under that agreement.
• Supplier lists from a pilot are processed in the EU. The language model we use runs locally — the lists are not sent to external AI APIs.
• To look suppliers up, we send their identifiers — the NIP (Polish tax identification number) and, depending on the registry, the KRS number, the company name or the LEI — as search queries to the public registries we query: the VAT white list (Polish Ministry of Finance), the National Court Register (KRS), the REGON register (Statistics Poland), GLEIF (Global Legal Entity Identifier Foundation, based in Switzerland, a country the European Commission recognises as providing an adequate level of data protection), EU sanctions lists and Polish insolvency and restructuring registers — just as when someone searches those registries by hand.

4. Public registry data in the product

The supplier risk map in the demo is built from public registries and from published contract award notices of public institutions. Where it contains personal data (for example data of a supplier who is a sole trader, or the functions of people representing a company that are disclosed in the public KRS register), we process it as the controller, on the basis of our legitimate interest in preparing analyses for the business needs of our customers — here, a free demo (Art. 6(1)(f) GDPR). Because this data comes from public registries whose disclosure is laid down by law, and not from the people it concerns, the exemption in Art. 14(5)(c) GDPR applies. The people concerned have the rights listed in section 7.

In a pilot on your own supplier list we act as your processor (section 3): the map is prepared on behalf of your organisation, under the data processing agreement.

5. Cookies and statistics (Consent Mode)

1. Necessary: the site stores in your browser only what it needs to work — including your choice in the cookie banner (localStorage). This is not used for tracking.
2. Analytics (Google Analytics via Google Tag Manager): they run in Consent Mode v2. Until you consent, Google Analytics sends signals without cookies (for example about a page view, a button click or a submitted form, with no identifiers stored on your device) — so that we know how many people visit the site. Legal basis: our legitimate interest in measuring traffic and improving the site (Art. 6(1)(f) GDPR); you can object by writing to us, or block Google scripts in your browser. Analytics cookies (such as _ga) are set only after you consent in the banner (Art. 6(1)(a) GDPR).
3. Marketing (Meta pixel, Google Ads conversion tag): they start only after you give marketing consent in the banner (Art. 6(1)(a) GDPR). Until then the Meta script is not downloaded at all — no request is sent to Meta.
4. You can change or withdraw your consent at any time — with the button in section 8 or by clearing this site's data in your browser.

6. Transfers outside the European Economic Area

Because we use Google and Meta services, data may be transferred to third countries, such as the United States. Data goes to Meta only if you give marketing consent. We use only providers that ensure an adequate level of protection — on the basis of the European Commission's adequacy decision (EU–US Data Privacy Framework) or Standard Contractual Clauses. Supplier look-ups in GLEIF go to Switzerland (section 3).

7. Your rights

You have the right to access your data, to have it rectified or erased, to restrict its processing, to data portability, to object to processing based on our legitimate interest, and to withdraw consent at any time. You also have the right to lodge a complaint with the President of the Personal Data Protection Office in Poland (Prezes Urzędu Ochrony Danych Osobowych, UODO) or with the supervisory authority in the EU or EEA member state where you live, where you work or where the alleged infringement took place. Requests: michal.szopa@szopalabs.com.

8. Changing or withdrawing cookie consent

Withdrawing consent is as easy as giving it. The button below deletes your saved choice and takes you to the NIS2 Supplier Compass page, where the banner asks again. The page has to reload: scripts started on the basis of your earlier consent stop only after a refresh.

Change or withdraw cookie consent