Privacy Policy

1. Data Controller

The Data Controller for the Compabase platform is Content Writer Sp. z o.o., headquartered at ul. Strzelecka 29A/39, 61-846 Poznań, Poland.

KRS (National Court Register): 0001088645

NIP (Tax ID): 7792567297

Data Protection Contact: [email protected]

The Controller has not appointed a Data Protection Officer. For GDPR-related matters, please contact us at the address above.

Compabase services are provided under the Compabase brand (compabase.com). Information notices under Article 14 of the GDPR may be sent from the compabase-legal.com domain—both domains are operated by the same Controller (Content Writer Sp. z o.o.).

2. Scope of this Policy

This Privacy Policy describes:

• how we process data of users with an account on the Compabase portal,
• how we process data of users purchasing datasets,
• how we process and publish data from public business registers (KRS, CEIDG),
• how we fulfill the information obligation under Article 14 of the GDPR,
• how we enable self-service updating and correction of data on an entity's profile (including without creating an account) — see § 14,
• how the artificial intelligence (AI) assistant available on the platform operates — see § 15,
• how we protect technical and transactional data related to platform usage.

Compabase is a B2B platform for analyzing economic data and is intended exclusively for professional use. Access to company profiles and data exports are subject to this policy.

3. Categories of Processed Data

3.1. Portal User Account Data

When registering and using an account, we may process:

• email address associated with the account,
• user identifier in the authentication system,
• data provided during onboarding (e.g., represented company, contact person, settings),
• content of queries to the platform assistant (if used),
• list of observed entities (watchlist).

3.2. Transactional and Billing Data

We collect only the data necessary to execute contracts, deliver ordered services (including platform exports), and issue invoices, including:

• email address,
• company name,
• tax identification number (NIP/VAT),
• invoice details.

3.3. Payment Data

Payments are processed by external payment service providers (e.g., Stripe). We do not store payment card numbers or bank account access credentials.

3.4. Technical Data

Basic technical logs may include:

• IP address,
• query metadata,
• timestamps.

This data is used solely to ensure security, system stability, and to prevent abuse and fraud.

3.5. Public Data from Business Registers

Compabase processes and structures data from publicly available official registers and documents, in particular:

• the National Court Register (KRS) and financial statements filed with public repositories,
• the Central Register and Information on Economic Activity (CEIDG),
• the Central Register of Beneficial Owners (CRBR),
• the Repository of Registration Files (RAR) — shareholder lists and selected provisions of articles of association,
• the National Debtors Register (KRZ) and the Court and Commercial Gazette (MSiG),
• the VAT taxpayer list (the "white list") maintained by the Minister of Finance — VAT status and business bank accounts,
• public procurement and contract registers: the Public Procurement Bulletin (BZP), the EU TED, the Central Register of Contracts of the Ministry of Finance and contracts of the National Health Fund (NFZ),
• other official registers: trademarks of the Polish Patent Office, public aid (SUDOP), Energy Regulatory Office licences, BDO, registers and the public warning list of the Polish Financial Supervision Authority (KNF), and Warsaw Stock Exchange quotations,
• sanctions lists (including those of the Polish Ministry of the Interior, the European Union, the United Kingdom, OFAC SDN, the BIS Entity List and the World Bank).

In addition, we collect publicly available information from entities' websites: business description, website address, email address, telephone number and the entity's social media profiles. A website is assigned to an entity only when it contains the entity's NIP, KRS number, REGON or registered address. Email addresses are verified technically against the mail server; non-existent and disposable addresses are not made available in exports or via MCP.

The platform covers companies and other entities registered in KRS and sole proprietorships (CEIDG). Profiles may present, among others: entity name, KRS, NIP, REGON, legal form, address, status, registration dates, financial data and algorithmically calculated indicators (including an estimated valuation), business descriptions, VAT status and business bank accounts, restructuring and insolvency proceedings, announcements, public procurement, contracts and public aid, trademarks, licences and register entries, information on sanctions listings, contact details, relationships between entities and — to the extent described in § 3.6 — personal data of individuals.

Sanctions lists are matched to entities only by an unambiguous identifier (KRS, NIP or REGON) given in the list entry; we do not assign entries to individuals based on name alone. For sole proprietorships, data from the above sources is presented only under the rules described in § 3.6.

3.6. Publication of Personal Data from Registers

The principles for publishing and sharing personal data of individuals obtained from public registers vary depending on the source register:

Entities registered in KRS (commercial companies, associations, foundations and other entities):

• we publish personal data of members of management and supervisory bodies, commercial proxies, liquidators, shareholders and stockholders based on Art. 6(1)(f) GDPR (legitimate interest — counterparty verification and transparency of business dealings); we fulfil the information obligation as described in § 6;
• we present the first and last name, the function and the period in which it was held, the number and value of shares and the approximate age;
• where a shareholder list filed with the Repository of Registration Files covers the company's entire share capital, we use it to complete the ownership structure — including shareholders not shown in the KRS extract (e.g. holding less than 10% of the capital); we present only the name and the shares, and the files themselves are not made available;
• personal data is presented in the representation, ownership and relationships modules, only on entity profiles — we do not maintain separate pages about individuals.

Beneficial owners (CRBR). The name, approximate age, citizenship, country of residence and nature of control of a beneficial owner are made available only to logged-in users of the platform and to API and MCP clients using an access key. This data is not available to non-logged-in users or to search engines. Every view or download of this data is logged (user or API key, channel, entity, time, IP address), which makes it possible to establish to whom the data was disclosed. We do not build relationships between individuals based on CRBR data.

Entities registered in CEIDG (sole proprietorships):

• because CEIDG discloses the business address, the profile of a sole proprietorship — including the owner's name — is published only after an Art. 14 GDPR notice has been sent to an active email address disclosed in the register;
• if the register contains no email address or the address is inactive, the profile is not published or presented on the platform (including search, API, MCP, exports and the AI assistant);
• once the owner's objection is upheld, the profile is hidden and its data deleted from the platform; we keep only the NIP together with a note of the objection so that the data is not collected from the register again.

Links between sole proprietorships and individuals in KRS. Because CEIDG does not disclose the PESEL number, we establish a link between the owner of a sole proprietorship and an individual appearing in KRS based on matching first and last names, their frequency in Poland (Statistics Poland data), location and shared contact details (email, telephone, domain, white-list bank account, address). We present only links with a high probability, labelled with the level of confidence ("Probably the same person" or "Same person (high confidence)"), and only for businesses in respect of which we have fulfilled the Art. 14 GDPR obligation. An incorrect link can be reported to [email protected] — after verification we exclude it permanently.

Family-structure label. If shareholders who are individuals share the same surname, the ownership card states that the shareholding structure indicates family control. The label concerns the entity, is based solely on surnames visible on the profile and is an indication rather than a statement of fact. An incorrect label can be reported to [email protected].

Proceedings, announcements and sanctions. KRZ information reflects the current state of the register — an entry removed from KRZ disappears from the profile at the next data refresh. MSiG announcements are presented as published in the official gazette. Information on a sanctions listing is updated together with the source list.

Data minimization principle (Article 5(1)(c) GDPR). To limit the scope of personal data presented to the necessary minimum, with respect to individuals:

• we do not present the PESEL number or the full date of birth; to distinguish individuals with identical names we present only the approximate age, calculated from the year of birth in KRS or the date of birth in CRBR (e.g. "47 yrs"). The full date of birth and the PESEL number are not made available in the platform interface, via API or MCP, in exports or in the AI assistant;
• we limit personal data to information arising from the role held in the entity; we do not collect home addresses, private telephone numbers or data from individuals' private social media profiles;
• following a justified objection, we may hide a specific person's approximate age or CRBR entry, and withdraw an email address or telephone number from the profile.

Entity contact details. The entity's email address and telephone number — taken from the register or the entity's website — are not visible to non-logged-in users or to search engines; we make them available only to logged-in users, via API and in exports. This is an additional security measure (Art. 32 GDPR) that limits automated harvesting of addresses and misuse. Contact details are made available for business-to-business contact with entities, including counterparty verification and customer acquisition. Compabase does not send messages on behalf of users. A user who uses this data to make contact acts as a separate controller and is solely responsible for the legal basis of the contact, including obtaining consent to commercial communications by electronic means and to telephone marketing where required by the Polish Electronic Communications Law. On request, we withdraw an email address or telephone number from the profile, in particular an address containing an individual's name.

4. Data Sources

Data from the registers, financial statements, lists and directories listed in § 3.5 originates from publicly available official sources and is not collected directly from individuals. Business descriptions, contact details and social media profiles of entities originate from those entities' publicly available websites.

User account data and transactional data come directly from the user or are generated through service usage.

In addition, data presented on an entity profile may come directly from a person authorized to represent or associated with the entity who has used the self-service profile update and correction feature (see § 14). Such data is stored as a separate layer of supplementary information and does not modify the content of official public registers.

5. Purposes and Legal Bases for Processing

We process data on the following legal bases:

5.1. Performance of a contract (Article 6(1)(b) GDPR)
For the purpose of:

• maintaining the portal account and providing platform services,
• performing contracts and delivering ordered services (including exports of information from the platform),
• confirming payments.

5.2. Legal obligation (Article 6(1)(c) GDPR)
For the purpose of:

• issuing VAT invoices,
• keeping accounting records.

5.3. Legitimate interest (Article 6(1)(f) GDPR)
For the purpose of:

• providing structured access to public business information from official registers for counterparty verification and the security of business dealings (including due diligence, KYC/AML procedures, credit risk assessment and market analysis),
• enabling business-to-business contact with entities using their contact details (within the limits of § 3.6),
• building and presenting relationships between entities and individuals and ownership-structure labels (within the limits of § 3.6),
• keeping a record of access to beneficial ownership data (accountability, Art. 5(2) GDPR),
• ensuring platform security and preventing abuse,
• establishing, exercising or defending legal claims,
• maintaining the technical integrity of data processing systems.

Non-personal data from registers (entity data, financials, addresses, PKD codes, etc.) is processed under Art. 6(1)(f) GDPR to provide structured access to public business information.

Personal data (first and last name, function, shares held by an individual, approximate age, beneficial owner status, owner of a sole proprietorship) is processed under Art. 6(1)(f) GDPR on the terms and to the extent described in § 3.6.

The controller has carried out, and regularly updates, a Legitimate Interest Assessment — most recently in October 2026. We present its outcome to data subjects on request.

6. Information Obligation (Article 14 GDPR)

Where personal data is not obtained directly from individuals, we fulfil the Art. 14 GDPR obligation as follows:

• Entities registered in KRS: because the source register contains no contact details of individuals and obtaining them individually would involve a disproportionate effort (Art. 14(5)(b) GDPR), the information obligation is fulfilled by making this Privacy Policy publicly available on the website. In addition, where the register discloses the entity's email address, we send an information notice to it (from the compabase-legal.com domain);
• Entities registered in CEIDG: before a profile is published, we send an information notice to an active email address disclosed in the register (from the compabase-legal.com domain), referring to this Policy; without such a notice the profile is not published;
• for individuals who contact us directly — we process the data contained in the correspondence and fulfil the information obligation by making this Policy available.

Art. 14 information notices are not marketing communications and serve only to fulfil legal obligations.

7. Automated Processing and Data Transformation

Compabase performs automated collection, normalization and analysis of publicly available data.

Financial indicators (e.g. EBITDA, growth and stability ratios) and the estimated valuation may be derived, calculated, estimated or interpreted algorithmically and constitute an analytical representation of the entity's public financial data.

The platform may generate business descriptions based on publicly available information, build a graph of relationships between entities and individuals and determine ownership-structure labels (within the limits of § 3.6). Links between sole proprietorships and individuals in KRS are determined probabilistically and labelled with a confidence level.

The platform may take measures to ensure that data is current and of good quality, including technical verification.

Compabase does not engage in automated decision-making within the meaning of Art. 22 GDPR and produces no legal effects for individuals.

8. Data Sharing and Recipients

We do not sell personal data as separate products. Analytics and advertising tools (Google Analytics, Meta Pixel) are used only with the user's consent. The platform gives users access to publicly available company data (browsing profiles, API, MCP server, file exports and the AI assistant), including personal data disclosed in public registers (in accordance with § 3.6). Beneficial ownership data is made available only to identifiable recipients (logged-in users and API and MCP clients), and every such access is logged.

Personal data of representatives disclosed in registers (e.g. name, function) is a component of the entity's register data and is available to users when browsing profiles, via the API and in data exports as part of that register data (in accordance with § 3.6). Personal data is, however, not a separate commercial product — it is not sold or made available as a separate database of personal data.

Data may be entrusted to or shared with the following categories of recipients (processors acting on our behalf or cooperating entities):

• payment service providers (e.g. Stripe),
• the hosting provider — Hetzner Online GmbH (servers in Germany and Finland), on whose infrastructure we run the application and the database,
• providers of tools for sending Art. 14 GDPR information notices,
• providers of AI models and services supporting the AI assistant (including OpenAI Ireland Ltd; see § 15), acting as processors on our behalf and without the right to use the content provided to train models,
• providers of analytics and advertising tools (Google Analytics, Meta Pixel) — only with the user's consent,
• accounting and tax service providers,
• entities supporting the security, maintenance and development of the platform.

All processors act under data processing agreements (Art. 28 GDPR) where required.

9. Data Transfers Outside the EEA

Due to the global nature of some infrastructure providers (e.g., payments), data may be processed outside the European Economic Area. In such cases, appropriate safeguards are applied, including EU Standard Contractual Clauses or equivalent legal mechanisms. The primary platform infrastructure and databases are hosted in the EU.

10. Data Retention Period

Accounting and billing records: for the period required by tax law.

Portal user account data: for as long as the account is active and, after its deletion, until the general limitation periods for civil-law claims expire (usually 3 or 6 years under the Polish Civil Code).

Email address related to a transaction: only as long as necessary for delivery and resolving technical issues.

Technical logs: for a limited period necessary for system security and integrity.

Log of access to beneficial ownership data: 3 years from the date of access.

Public register data (non-personal): for as long as it remains in official public registers or is necessary for the continuity of business information.

Personal data from registers: for as long as it is disclosed in the relevant public register, unless grounds for ceasing publication arise earlier (e.g. an upheld objection by the data subject). Functions that have ended are presented as historical, as in the register. Data from CRBR, KRZ and sanctions lists reflects the current state of the source and is removed from the platform when it is removed at the source. After removal from the platform, data may be archived only for the duration of limitation periods for claims.

Entity contact details: for as long as they are active and assigned to the entity; details withdrawn on request are not published again.

Relationships and labels determined by the platform: recalculated on an ongoing basis; they disappear together with the data from which they were derived.

Record of an upheld objection (identifier of the entity or person and the date): without time limit, as it is necessary to prevent the data from being collected and published again.

11. Data Subject Rights

All individuals whose personal data we process (both platform users and individuals disclosed in business profiles) have the right to:

• access their data (Article 15 GDPR),
• request rectification (Article 16 GDPR),
• request erasure (Article 17 GDPR) — within legal limits, in particular when the data remains in a public register,
• request restriction of processing (Article 18 GDPR),
• data portability (Article 20 GDPR) — for data processed by automated means on the basis of a contract,
• object to processing based on Article 6(1)(f) GDPR (Article 21 GDPR).

Each request and objection is assessed individually. We respond without undue delay and no later than one month from receipt (Article 12(3) GDPR), subject to the cases provided for in the GDPR. If an objection or request is justified, processing may be restricted or modified or — to the extent technically possible — personal data may be removed from presentation on the platform (while the entity's non-personal register data remains).

In particular: once an objection by the owner of a sole proprietorship is upheld, we hide the profile and delete the data; for individuals disclosed in KRS we may — where a particular situation is shown — hide the approximate age or the CRBR entry; on request we withdraw an email address or telephone number from the profile and exclude an incorrect link. In response to an Art. 15 GDPR request we also indicate the recipients to whom the person's CRBR data was disclosed (based on the access log).

Requests can be submitted to: [email protected] (Subject: "GDPR").

You have the right to lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stanisława Moniuszki 1A, 00-014 Warsaw, Poland, uodo.gov.pl.

12. Cookies

Compabase uses cookies in two categories:

• Essential (always on): session, login, payments, language, currency, and proper site operation.
• Analytics and marketing (consent only): Google Analytics (traffic measurement) and Meta Pixel (performance measurement and communication). We load these scripts and cookies only after you accept in the cookie banner.

Without consent, only cookies required to run the site remain. You can change your choice at any time in the footer (“Cookie settings”).

13. Security Measures

We apply appropriate organizational and technical measures to protect data, including secure infrastructure, access control mechanisms, encryption of data in transit and monitoring to prevent unauthorized access and abuse.

To minimize risk we apply, among others: hiding email addresses and telephone numbers from non-logged-in users (see § 3.6), making CRBR data available only to identifiable recipients with an access log, limiting the personal data presented (no PESEL or full date of birth, only an approximate age) and technical restrictions on data access via the API, MCP server, exports and the AI assistant.

14. Self-Service Update and Correction of Profile Data

We provide a feature enabling persons authorized to represent an entity or connected to it to independently supplement, update, and correct data presented on the entity's profile (e.g., business description, logo, contact details). This feature serves to ensure the accuracy and currency of the data (Article 5(1)(d) GDPR) and facilitates the exercise of the right to rectification (Article 16 GDPR).

The feature can be used in two ways:

• after logging into the portal and confirming authority to manage the profile (verification based on a business email domain matching the entity's register data),
• without creating an account — in one-time edit mode, after confirming control over the business email address (domain verification via a one-time, time-limited link sent to an address in the entity's domain).

Domain verification is intended to ensure that data is modified only by a person controlling the entity. We process data submitted through this feature on the basis of Article 6(1)(f) GDPR (ensuring the currency and quality of economic information). Data entered in this way constitutes a supplementary layer of information and does not change the content of official public registers.

15. AI Assistant (Artificial Intelligence)

The platform offers an assistant based on artificial intelligence (AI) that allows users to ask questions in natural language about the business data available in the service and presents answers, visualizations and files based on that data.

• No model training on user data. We do not train, fine-tune or build our own AI models on user data, query content or platform data. We use models made available by external providers (including OpenAI) acting as processors on our behalf; content sent to the model is not used by the provider to train its models. If a user configures their own AI provider key, queries are sent to the provider chosen by the user under the agreement between the user and that provider.
• Limited, controlled access to data. The assistant accesses data only through tools defined by us (an MCP-type interface), which are predefined, parameterized, read-only database queries. These tools operate on a limited set of data and views that already reflect the personal data restrictions described in this policy (including the Art. 14 GDPR gate, no access to the PESEL number or full date of birth, and CRBR data available only to identifiable users).
• Files generated by the assistant. The assistant can prepare a CSV, Excel or JSON file with data available on the platform. The file contains only data the user can see in the service, with the same personal data restrictions.
• No automated decision-making. The AI assistant is purely informational and supportive. It does not make decisions with legal or similarly significant effects on individuals within the meaning of Art. 22 GDPR. Results generated by the assistant may contain inaccuracies and require independent verification.
• Content of interactions. The content of queries to the assistant, the responses and the related technical metadata (chat history) are recorded and stored to provide the service, ensure its security, quality control, auditing, abuse prevention and documenting any attempts to circumvent or manipulate safeguards (Art. 6(1)(b) and (f) GDPR). Chat history is not used to train AI models; it may, however, serve as evidence in proceedings concerning breaches of the Terms of Service, including attempts to circumvent safeguards.