Version 2026-09-29.4-draft
Controller
The controller is Artur Nowis, operating Greenably at the address in the legal notice. Privacy contact: [email protected]. Do not send a password or identity-document copy in an initial request.
Shop and security
We process IP address, request time, browser information, essential session identifiers and security events to provide and protect the shop. The bases are performance of the requested service and legitimate interests in security and abuse prevention.
Account and order
We process name, email, protected password hash, billing address, cart, order, price, payment status, accepted terms version and correspondence. Purposes include pre-contract steps, contract performance, legal accounting and defence of claims.
Payment
The selected payment provider receives data required for authorisation, settlement, refunds and fraud prevention. The final text will identify the provider, legal basis, recipients, transfers and retention. Greenably should not store full card details.
Handoff to the CV engine
At the appropriate order status, the shop creates a private job for the signed-in customer. Customer, order, line-item and workflow identifiers and data required for authorised access are transferred. CV documents are not stored in PrestaShop or its contact form.
Documents, OCR and AI
Documents pass through Cloudflare to the engine on the operator’s Mac mini. Extraction, OCR and the optional AI assistant run locally. Content is not sent to an external model, published, sold to employers or used to train models. AI suggestions are not automated decisions producing legal effects.
Data minimisation
Do not upload identity documents, unnecessary health data or third-party data without authority. A CV photograph is optional. Documents may reveal special-category data; scope and legal basis require final assessment before production uploads are enabled.
Recipients and transfers
Cloudflare handles traffic. The application, database and local AI run on the operator’s Mac mini. Portal email may use Resend and contact uses Apple iCloud Mail. The payment and shop-mail providers will be added. Providers may process data outside the EEA using appropriate transfer mechanisms; storage solely in the EU is not claimed.
Retention
Accounts and orders are kept for contract performance, legal obligations and applicable claim periods. Working CV materials are scheduled for deletion within 30 days after a job closes, and verified portal backups have a 30-day limit, subject to technically isolated exceptions. Exact order, invoice, payment and email periods must be approved before publication.
Rights
Subject to the GDPR, rights include access, copy, correction, erasure, restriction, portability, objection and withdrawal of consent where used. The normal response period is one month. Complaints may be made, among others, to the Brandenburg data-protection authority.