Privacy & Cookie Policy

1. Who is responsible

The controller is Krzysztof Grabowski, the individual running the FORMSEMBLE project. FORMSEMBLE is a project name, not a separate company.

Privacy and general enquiries: hello@formsemble.com.
Service support and complaints: support@formsemble.com.

This notice covers browsing the landing, requesting and receiving waitlist messages, and contacting us. It does not cover application accounts, uploaded artwork, model generation, file licences or paid services. Those activities will have separate information before they become available.

2. Data, purposes and legal bases

Your signup request and confirmation

The form requires your email address. We also process the request date, form source and applicable wording/document version, subscription identifier and status, the confirmation event and available signup or confirmation IP records. You request the described emails by submitting the clearly labelled form and then confirming your address; there is no separate agreement checkbox. A pending request is stored before you confirm. We use it to send the confirmation message and process the free service you requested, under Article 6(1)(b) GDPR. The active subscription starts only when confirmation is recorded.

Waitlist emails

With your consent under Article 6(1)(a) GDPR, we send project progress, beta-testing information and invitations, and launch updates. Records include your address, confirmed status, relevant dates and delivery events. Providing your address is voluntary but necessary to receive the service. There are no partner offers or unrelated advertisements, and this consent does not automatically become permission for an ongoing newsletter after the waitlist. Browsing does not require subscribing.

Correspondence and complaints

If you contact us, we receive your address, message, headers, any name or attachments you supply and our replies. General enquiries are handled under Article 6(1)(f), our legitimate interest in answering correspondence. Service requests and complaints necessary to perform the waitlist agreement use Article 6(1)(b); statutory complaint duties use Article 6(1)(c). Please do not include unnecessary sensitive information.

Website operation and security

Delivering the website involves your IP address, request time and resource, response status and browser information transmitted with the request. Necessary access and error logs support reliable operation and fault diagnosis under Article 6(1)(f). Relevant technical and delivery records are also used to investigate abuse, prevent unauthorised access and protect the service under Article 6(1)(f). These records are not used for audience measurement.

Rights and minimal records after leaving

We handle privacy requests and keep necessary evidence of consent and withdrawal under Article 6(1)(c), including GDPR Articles 5(2), 7 and 12–22. Minimal suppression records prevent accidental unwanted sending under Article 6(1)(f). Evidence for a specific claim uses Article 6(1)(f). None of these records may be reused to resume marketing without valid permission.

3. Providers and other recipients

Signup requests are sent directly from your browser to Sender, which handles email confirmation, waitlist subscriptions, messages and unsubscribe requests. We do not operate a separate newsletter database on this website. Removing an earlier integration does not itself erase records held by the earlier provider.

• Sender (UAB Sender.lt) processes your email address, signup source, subscription status and related confirmation and delivery records to provide the waitlist email service. See its Privacy Policy.
• MailerLite Limited, Ireland was used for earlier signup requests, confirmations and subscriptions. Existing records and unsubscribe requests remain subject to its processing until migration or erasure is completed. No new signup requests are sent from this landing to that provider. Its Data Processing Addendum describes its processing and subprocessors.
• Google Workspace handles messages to and from our contact addresses. Google's published terms identify Google Cloud Poland Sp. z o.o. as the contracting entity for Polish Workspace customers. Google processes mailbox content under its Cloud Data Processing Addendum.
• Cloudflare, Inc. provides the domain's DNS infrastructure and hosts the static landing page. Serving the website involves technical request data such as your IP address, requested resource and browser information. Signup email addresses are submitted directly to Sender, rather than to a newsletter backend hosted by us on Cloudflare. See its Privacy Policy.

Providers may use authorised subprocessors. For some account, billing, security or legal-compliance activities, providers determine their own purposes under their privacy notices rather than acting solely on our instructions. Data may also be disclosed to a competent authority when legally required, or to an adviser when necessary for a specific claim. We do not sell the waitlist or disclose it for partners' advertising.

International processing

European contracting entities do not guarantee that all processing stays in the EEA. Google and Cloudflare operate internationally, including in the United States. MailerLite's current subprocessor annex identifies hosting for its new platform in the Netherlands; that is not a guarantee against all overseas support or onward processing.

The providers' data-processing terms set out transfer safeguards, including European Commission Standard Contractual Clauses where applicable. An applicable adequacy decision may also support a transfer. You can request information about the relevant safeguards and a copy, subject to necessary redactions, at hello@formsemble.com. Google's subprocessor information and Cloudflare's DPA provide further details.

4. Retention and erasure

These are organisational limits, not statutory GDPR retention periods.

• Active participation: ends at the earliest of withdrawal, closure of the waitlist or project, or 24 months from confirmation. Repeated submissions do not extend it. Ending participation removes eligibility for campaigns and automated waitlist messages.
• Pending requests: after 30 days without confirmation, we initiate erasure through a daily review. This is the start of the erasure process, not a claim that every provider copy disappears that day.
• Routine server access and error logs: a rolling maximum of seven days for availability and fault diagnosis. Relevant records can be isolated for a documented security incident, with a review every 30 days while the investigation continues. Only evidence needed for a specific unresolved claim or legal duty is retained beyond that investigation.
• Local exports and working copies: no routine local copy of the mailing list is maintained. An exceptional export for a rights request or a defined maintenance task is limited to the required data and erased within seven days after that task closes. Copies retained as necessary case evidence follow the separate criteria below.
• Consent and suppression evidence: retain only the address, relevant permission/version, confirmation and withdrawal details needed to demonstrate lawful processing or prevent accidental re-import. Review necessity when participation ends and at least annually, and erase records once the accountability need or realistic risk of unwanted sending ends.
• Correspondence: retain while answering the matter and its agreed follow-up; review closed matters monthly and remove correspondence with no remaining purpose. Retain relevant evidence longer only for an identified duty or specific claim, for its applicable legal period or ongoing proceedings.

Ending mailing permission, removing an active record and completing provider erasure are different steps. We initiate erasure where required; MailerLite documents a processing period of up to 30 days for its erasure procedure. Backup copies follow providers' documented deletion cycles and remain restricted from ordinary use. We follow up incomplete erasure and respond to rights requests within the applicable legal deadlines. A retained backup or proof of consent never authorises renewed marketing.

5. Your choices and rights

You can withdraw consent at any time using the unsubscribe link in a waitlist email or by writing to hello@formsemble.com. Withdrawal does not affect the lawfulness of processing before it. You do not need to give a reason.

Subject to the conditions in the GDPR, you may request access, correction, erasure or restriction of your data. You may object to processing based on legitimate interests and to direct marketing. Where processing is automated and based on consent or contract, you may request portability of data you provided. These rights do not always require erasure of information we must lawfully retain for another specified purpose.

Send requests to hello@formsemble.com or our postal address. We may ask for proportionate information to verify identity where reasonably necessary. We respond without undue delay, normally within one month. If a lawful extension is needed because of complexity or the number of requests, we will explain it within that month. Routine requests are free; statutory exceptions apply.

You may complain to a competent supervisory authority, including in the country of your habitual residence, workplace or the alleged infringement. In Poland this is the President of the Personal Data Protection Office (Prezes UODO): uodo.gov.pl. You do not have to contact us first.

6. Cookies, browser storage and email delivery

The landing uses locally served fonts, artwork and 3D assets. We do not use advertising cookies, session recording or website audience analytics. Normal browser caching helps load files. Technologies necessary to deliver the form or protect it against abuse may process technical request information.

Sender processes delivery information and may route email links through its redirect service and record email interactions. We do not use Google Analytics or e-commerce tracking in these messages, or segment subscribers or trigger follow-up messages based on opens or content-link clicks.

Confirmation and unsubscribe links can contain an individual identifier needed to carry out your request. Subscription, delivery, bounce and unsubscribe events are processed for their operational purposes and minimal consent evidence, rather than audience measurement. External destinations have their own technologies and notices.

7. Security and automated processing

We restrict access to personal data and use appropriate safeguards for the services involved. No internet service can guarantee absolute security. Any notification required by law following a personal-data breach will be made accordingly.

Sending confirmation or waitlist emails automatically is not a decision producing legal or similarly significant effects. We do not make such decisions about you solely by automated processing under this landing and waitlist service.

8. Changes to this notice

We will update the version and date when this notice changes. Material changes will be explained on the landing and, where relevant, to active subscribers by email. A notice update does not extend your consent or restart its retention period.