1. Who We Are
The controller of your personal data is HOME OF THE BRAVE limited liability company with its registered office in Wroclaw, Poland, entered in the Register of Entrepreneurs of the National Court Register under KRS number 0001030618, NIP 8992957655 (“USBASED”, “we”). We operate the website usbased.com, the US Entry Protocol, Council Sessions, and related services.
Contact for privacy matters: hello@usbased.com or by post to the address above.
2. Who This Policy Covers
This policy applies to:
- visitors of usbased.com;
- people who contact us or complete our intake, application or order forms;
- founders and team members of companies that submit materials to us (including pitch decks);
- personnel of our clients, including participants in recorded sessions;
- Experts and Expert applicants;
- contacts at partner service providers.
3. What Data We Collect
Website usage. IP address, device and browser information, pages visited, and cookie data (see Section 12).
Contact, applications and orders. Name, email, role, company, country, your objectives, budget indication, the content of your messages, and data submitted through electronic order forms.
Pitch and business materials. Decks, metrics, plans and other materials you submit — for example through the intake form or the “We invest in projects” route. These may include personal data of your team members; you are responsible for ensuring you may lawfully share such data with us.
Engagement data. Contract, billing and payment data, correspondence, scheduling data, and session participation records.
Session recordings. Audio, video and transcripts of Tribunal, Council and working sessions, which include the voice, image and statements of participants (see Section 5).
Expert data. Professional history, expertise, bio, contact details, payment and tax details (including tax residence documentation), conflict-check confirmations, and engagement performance notes.
We do not intentionally collect special categories of data. Please do not include health, patient or other sensitive data in materials you submit or statements you make in sessions.
4. Why We Use Your Data and Legal Bases (Art. 6(1) GDPR)
- Responding to inquiries, applications and orders — steps prior to entering a contract (Art. 6(1)(b)) and our legitimate interest in developing our business (Art. 6(1)(f)).
- Delivering our services and performing contracts, including matching Experts to engagements and sharing Expert bios with clients — Art. 6(1)(b) and (f).
- Recording sessions and producing the Tribunal Archives — performance of the contract (Art. 6(1)(b)) and our legitimate interests in quality control, documenting our services and defending claims (Art. 6(1)(f)); where the law requires, consent (Art. 6(1)(a)).
- Creating and commercializing Anonymized Materials (Section 5) — our legitimate interest in developing educational, training, research, benchmarking and insight products from our engagements (Art. 6(1)(f)), implemented through the contractual consents, withdrawal rights and anonymization standard described in Section 5.
- Reviewing investment submissions — our legitimate interest in evaluating opportunities (Art. 6(1)(f)).
- Invoicing, accounting and tax compliance — legal obligation (Art. 6(1)(c)).
- Marketing communications — consent (Art. 6(1)(a)) or, for existing business contacts, our legitimate interest (Art. 6(1)(f)), always with the option to opt out.
- Security, abuse prevention, and establishing or defending legal claims — legitimate interest (Art. 6(1)(f)).
Providing data is voluntary, but without it we may be unable to respond to you or deliver services.
5. Session Recordings and Anonymized Materials
Recording. Tribunal, Council and working sessions may be recorded and transcribed. Participants are informed before recording begins. If you participate in a session on behalf of a client, your organization is contractually required to inform you of the recording and of the uses described below before you take part; this Section provides that information.
Uses. Recordings and transcripts are used to: (a) produce the Tribunal Archives delivered to the relevant client; (b) perform internal quality control and Expert evaluation; (c) document the engagement and defend legal claims; and (d) create Anonymized Materials — versions from which names, brands, logos, product names, personnel names and any other information reasonably identifying the client or its personnel have been removed, redacted or bleeped, and in which Expert identities are not disclosed without the Expert’s separate consent. We may include Anonymized Materials in educational, training, research, benchmarking and insight products.
What we do not do. We do not publish identifiable recordings and do not use them in marketing without the separate written consent of the persons and organizations concerned.
Withdrawal. Clients may withdraw the anonymized-use consent for a given session before its recording begins, on the terms set out in their agreement with us (this withdrawal right does not apply where a Consent Discount has been agreed). Individuals may object to processing based on our legitimate interests as described in Section 9.
Anonymization standard. Until material has been anonymized to the standard that neither the client nor any individual can reasonably be identified from it, we treat it as personal data and protect it under this policy. Once that standard is met, the material no longer constitutes personal data.
6. Who We Share Data With
- Experts — receive client materials and participate in recorded sessions, under contractual confidentiality obligations.
- Clients — receive the names, bios and session feedback (including recordings and transcripts) of the Experts involved in their engagement.
- Recipients of insight products — receive Anonymized Materials only; no personal data.
- Service providers (processors) — hosting and cloud infrastructure (including productivity and database tools such as Google Workspace and Airtable), video conferencing, e-signature, CRM and email tools, analytics, payment and banking providers, and accounting support, acting on our documented instructions.
- Directory partners — we pass your contact details to third-party service providers from our directory only at your request.
- Professional advisors and authorities — where necessary for legal compliance or to protect our rights.
- Corporate transactions — a prospective buyer or successor of our business, under confidentiality.
We do not sell personal data. (Anonymized Materials sold as part of insight products are not personal data, see Section 5.)
7. International Transfers
Some recipients — in particular US-based Experts and certain IT providers — are located outside the European Economic Area. Where we transfer personal data to such recipients, we rely on an adequacy decision (including the EU–US Data Privacy Framework where the recipient is certified) or the European Commission’s Standard Contractual Clauses, together with supplementary measures where appropriate. You can request a copy of the relevant safeguards using the contact details in Section 1.
8. How Long We Keep Data
- Inquiries and applications that do not lead to a contract: up to 24 months.
- Contract and engagement records: for the term of the contract and until the expiry of limitation periods for claims (as a rule, up to 6 years for business claims under Polish law).
- Accounting and tax records: 5 years from the end of the relevant tax year.
- Identifiable session recordings and transcripts: for the duration of the engagement plus 3 years, unless longer retention is needed for legal claims.
- Anonymized Materials: once the anonymization standard in Section 5 is met, the materials are no longer personal data and may be retained and used without time limit.
- Expert profiles and engagement records: for the duration of the relationship and until the expiry of limitation periods.
- Marketing data: until you opt out or withdraw consent.
9. Your Rights
You have the right to access your data, rectify it, request erasure, restrict processing, receive your data in a portable format, object to processing based on legitimate interests (including the creation of Anonymized Materials from sessions in which you participated, and to direct marketing at any time), and withdraw consent (without affecting processing before withdrawal).
To exercise your rights, contact us at privacy@usbased.com. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes UODO), ul. Stawki 2, 00-193 Warsaw, Poland, or with the supervisory authority in your country of residence.
10. Security
We apply appropriate technical and organizational measures — including access controls, encryption in transit and confidentiality commitments — to protect your data. No method of transmission or storage is completely secure.
11. Automated Decision-Making
We do not make decisions based solely on automated processing that produce legal effects concerning you.
12. Cookies
We use essential cookies to run the website and, with your consent, analytics and marketing cookies. You can manage your choices at any time via the Cookie Settings link on our website and through your browser settings.
13. Third-Party Websites
Our website may link to third-party sites (including directory partners). Their privacy practices are their own; this policy does not cover them.
14. Children
Our website and services are directed at businesses and professionals, not at children.
15. Changes to This Policy
We may update this policy from time to time. The current version, with its effective date, is always available at usbased.com/privacy.
16. Contact
HOME OF THE BRAVE sp. z o.o., hello@usbased.com
