Privacy policy

1. Data controller

The controller of personal data collected in the ChimeTable service is Bigawerk sp. z o.o., registered in Poland (“we”). For any privacy matters, contact us at privacy@bigawerk.com

2. What data we process

• Account data — email address, name and role in the organization, provided during sign-up and team management.
• Data entered by the school — data about students, guardians, teachers and classes (including phone numbers used for notifications). For this data the school is the controller and we act as a processor on its behalf (Art. 28 GDPR).
• Contact requests — name, email, phone, school name and the message sent through the form on this site.
• Technical and diagnostic data — server logs, error information, browser and device type, and the addresses of views you visit. In the authenticated part of the Service, we also process performance data and interactions with the interface. Selected sessions may be recorded as replays in which text, form fields, and media are masked or blocked. Our configuration disables automatic collection of cookies, headers, request and response bodies.

3. Purposes and legal bases

• providing the ChimeTable service — Art. 6(1)(b) GDPR (performance of a contract),
• responding to contact form requests — Art. 6(1)(f) GDPR (legitimate interest),
• billing and accounting obligations — Art. 6(1)(c) GDPR (legal obligation),
• security and service improvement — Art. 6(1)(f) GDPR.

4. Recipients

We use service providers that process data on our behalf:

• Supabase — database hosting (servers located in the European Union),
• Vercel — application hosting,
• Cloudflare — protection of forms against automated spam,
• Postmark — delivery of contact request notifications,
• Sentry — error monitoring and, in the authenticated part of the Service, performance monitoring and masked replays of selected sessions (the project uses Sentry's European data region),
• SMSAPI — SMS delivery to recipients indicated by the school.

We do not sell personal data or share it with third parties for marketing purposes.

5. Retention

Account data and data entered by the school are kept for the duration of the contract and, after it ends, until claims are time-barred or legal obligations expire. Contact requests are kept for up to 12 months after the correspondence ends. Diagnostic data and session replays are deleted automatically after the retention period configured in Sentry; we limit that period to the time needed to diagnose errors, evaluate performance, and improve the Service.

6. Your rights

You have the right to access, rectify, erase and port your data, to restrict processing and to object to it. You can also lodge a complaint with the President of the Polish Personal Data Protection Office (PUODO). To exercise these rights, write to privacy@bigawerk.com

7. Cookies

We only use cookies that are necessary for the service to work: the login session and the selected language. We do not use advertising or tracking cookies.

8. Changes

We will announce material changes to this policy in the service or by email. The current version is always available at this address.