Privacy Policy

1. Introduction

This Privacy Policy explains how Tallium Digital spółka z ograniczoną odpowiedzialnością, trading as "Generation AI" ("we", "us", "the Company"), collects, uses, discloses, and protects personal data of visitors to our website, clients, course participants, and individuals whose image, likeness, or voice appears in materials submitted to us for AI video and photo production. This Policy is provided in accordance with Regulation (EU) 2016/679 ("GDPR") and applicable Polish data protection law.

2. Who We Are — Data Controller

The data controller responsible for your personal data is:

• Company: Tallium Digital spółka z ograniczoną odpowiedzialnością (Tallium Digital sp. z o.o.)
• Registered address: Porąbki 277, 35-317 Rzeszów, Poland
• NIP (Tax ID): 5170417196
• Trading brand: Generation AI (generationai.digital, generationai.team)
• Contact e-mail for data protection matters: info@newgeneraition.ai

As Tallium Digital sp. z o.o. is a Polish limited liability company, Polish law requires its KRS (National Court Register) number to appear in this notice and in commercial correspondence; it will be added here as soon as it is available to us.

We have not appointed a formal Data Protection Officer, as our current processing activities do not meet the thresholds under Article 37 GDPR that would require one. All data protection enquiries should be directed to the contact e-mail above. We will reassess this if the scale of biometric-adjacent processing described in Section 5 grows materially.

3. What Personal Data We Collect

• Account & contact data: name, e-mail, phone number, company name, billing address, login credentials.
• Communication data: messages sent via contact forms, chat, or e-mail correspondence.
• Project materials: for AI video/photo production projects, we may receive photographs, video footage, voice recordings, brand assets, and other materials you or your organization submit. These may include images or voice recordings of you or third parties (e.g., employees, models, actors).
• Course participation data: enrollment records, progress, certificates, and payment history for Educational Services.
• Technical data: IP address, device/browser information, and cookies or similar identifiers (see Section 9).
• Third-party platform data: if you sign in via Google, Facebook, or a similar service, we may receive your name, profile photo, e-mail address, and other public data made available by that platform.
• Payment data: processed by our payment providers; we do not store full card numbers on our own systems.

4. Purposes and Legal Bases for Processing

We only process personal data where we have a valid legal basis under Article 6 GDPR:

• Providing AI video/photo production services and fulfilling client contracts — Art. 6(1)(b), performance of a contract.
• Providing access to online courses and corporate training — Art. 6(1)(b), performance of a contract.
• Producing AI-generated content using materials you submit — Art. 6(1)(b); Art. 6(1)(a) explicit consent where special category / biometric data is involved (see Section 5).
• Account administration and customer support — Art. 6(1)(b).
• Invoicing, bookkeeping, and tax compliance — Art. 6(1)(c), legal obligation.
• Marketing communications and newsletters — Art. 6(1)(a), consent.
• Website analytics and advertising (e.g., Meta Pixel, Google Ads) — Art. 6(1)(a), consent, given via our cookie settings tool.
• Improving and personalizing our services — Art. 6(1)(f), legitimate interest.
• Preventing fraud, enforcing our Terms, and handling legal claims — Art. 6(1)(f) legitimate interest / Art. 6(1)(c) legal obligation.

5. Facial Images, Voice, and Special Category Data

Our AI video/photo production process may involve analysing facial images or voice recordings to generate content or to maintain visual or vocal consistency across a project. Where this processing is used to uniquely identify a natural person, it may constitute processing of biometric data — a special category of data under Article 9 GDPR.

Where this applies, we obtain your explicit, freely given consent before such processing begins, and you may withdraw that consent at any time by contacting us; withdrawal does not affect the lawfulness of processing carried out before withdrawal, but may prevent us from completing an already-started project. We do not use facial or voice data for any purpose beyond the agreed production task and do not share it with unrelated third parties.

If you submit images, footage, or voice recordings of third parties (e.g., models, employees, actors) for a production project, you confirm that you have obtained their informed consent to that use and have made them aware of the relevant privacy information.

6. Who We Share Your Data With

We may share personal data with the following categories of recipients, always under appropriate contractual safeguards:

• Cloud hosting and content-delivery providers (e.g., AWS S3/CloudFront) used to store and deliver video and photo assets;
• AI model and generative production providers used to create content on our behalf; your materials and instructions may be processed by these providers under their own data processing terms;
• Payment processors and accounting/bookkeeping providers;
• E-mail, CRM, and marketing automation tools;
• Analytics and advertising platforms (e.g., Meta, Google), only where you have given cookie consent;
• Professional advisers (legal, accounting) where necessary;
• Public authorities, where disclosure is required by law.

We do not sell personal data to third parties.

7. International Data Transfers

Some of our service providers (for example, US-based cloud, AI, or analytics providers) may process personal data outside the European Economic Area. Where this occurs, we rely on the European Commission's Standard Contractual Clauses, an applicable adequacy decision, or another transfer mechanism recognized under Chapter V GDPR. You may request further details of the relevant safeguard by contacting us.

8. How Long We Keep Your Data

• Contract and invoicing data: for the duration of the business relationship, plus the statutory retention period required under Polish tax and accounting law (generally 5 years from the end of the calendar year in which the tax obligation arose).
• Project materials (photos/video submitted for production): for the duration of the project and a reasonable period afterward for delivery and support purposes, unless you request earlier deletion, or a longer period is separately agreed (e.g., for portfolio use, with your consent).
• Marketing consent data: until you withdraw consent.
• Website analytics/cookie data: as indicated in our cookie settings tool.

9. Cookies and Similar Technologies

Our website uses cookies and similar technologies (including tracking pixels such as Meta Pixel) for essential website functionality, analytics, and marketing purposes, in accordance with Article 173 of the Polish Telecommunications Law and applicable ePrivacy rules. Non-essential cookies are set only with your consent, which you may give or withdraw at any time via our cookie settings tool. Further details of the specific cookies we use, their purpose, and their duration are available in our Cookie Policy.

10. Data Security

We apply appropriate technical and organizational measures — including access controls, encryption in transit, and restricted internal access to project materials — to protect personal data against unauthorized access, loss, or disclosure. No method of transmission or storage over the internet is completely secure, and we cannot guarantee absolute security.

11. Your Rights

Under the GDPR, you have the right to:

• access your personal data (Art. 15);
• rectify inaccurate data (Art. 16);
• request erasure of your data ("right to be forgotten") (Art. 17);
• request restriction of processing (Art. 18);
• receive your data in a portable format (Art. 20);
• object to processing based on legitimate interest or carried out for direct marketing (Art. 21);
• withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal;
• not be subject to a decision based solely on automated processing, including profiling, that produces legal or similarly significant effects (Art. 22) — we do not currently use such automated decision-making.

To exercise these rights, contact us at the e-mail address in Section 2. You also have the right to lodge a complaint with the Polish supervisory authority: Prezes Urzędu Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warszawa, Poland — https://uodo.gov.pl

12. Children

Our Services are not directed at individuals under 16 years of age. If we become aware that we have collected personal data from a child without appropriate parental or guardian consent, we will delete it.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting a notice on our website or, where appropriate, contacting you directly, before the changes take effect.

14. Contact Us

If you have questions about this Privacy Policy or our data practices, please contact: Tallium Digital sp. z o.o., Porąbki 277, 35-317 Rzeszów, Poland, NIP: 5170417196. E-mail: info@newgeneraition.ai