Legal
Privacy Policy
1. Who we are
MetaCoach is a product of Immersion sp. z o.o., ul. Jana Ciszewskiego 15, 2nd floor, 02-777 Warsaw, Poland, KRS 0000518914, NIP 9512382050, REGON 147357722. MetaCoach and Immersion Labs are trading names of the same company.
For the data described in this policy, we are the data controller under Regulation (EU) 2016/679 (GDPR), except as stated in section 3. You can reach us about anything in this policy at office@immersionlabs.us.
This policy covers metacoach.ai. Our other website, immersionlabs.us, has its own.
2. What this policy covers
It covers personal data we handle when you visit metacoach.ai, submit a form on it, subscribe to our newsletter, or meet us at an event and give us your details.
3. What it does not cover
If you use the MetaCoach platform because an organisation gave you access to it, please note the following roles:
- The organisation giving you access is the data controller for your training data. This includes simulation transcripts, performance results, and your voice audio (processed transiently only for real-time transcription, we do not create or keep voice recordings).
- We (MetaCoach) act only as a data processor, acting on that organisation’s instructions under a data processing agreement (whether the platform was supplied by us directly or through a partner).
Please send any privacy requests about your training data directly to the organisation you use the platform through. Details are in our Trust Statement and the applicable data processing agreement, available on request.
4. What we collect, why, and for how long
4.1 Forms
Data: name, business email, phone number if you give it, company, and your message.
Purpose: to answer you, arrange a demo, or assess a partnership.
Legal basis: steps taken at your request before a contract (Art. 6(1)(b) GDPR) and our legitimate interest in handling business enquiries (Art. 6(1)(f) GDPR).
Filling in a form is voluntary. Name and business email are needed for us to reply; without them we cannot.
Retention: 24 months from our last contact. If you become a customer, for the duration of the relationship and then for the statutory limitation and accounting periods, which for accounting records is five years from the end of the financial year.
4.2 Newsletter and marketing email
Data: email address, first name, and your company, role or interests if you give them. We record whether our emails were delivered, opened, and clicked.
Purpose: to send you news about MetaCoach and to follow up on interest you have shown.
Legal basis: your consent, given by ticking a separate optional box (Art. 6(1)(a) GDPR), or, where we are following up on your enquiry or a conversation at an event, our legitimate interest in business development (Art. 6(1)(f) GDPR). You can withdraw consent or object at any time using the unsubscribe link in every email or by writing to us. A completed contact form is not consent to marketing.
Retention: until you unsubscribe or object. We then keep your address on a suppression list, so that you are not added again by mistake, for as long as we run the list.
4.3 Cookies and analytics
Purpose: to measure traffic and improve the site.
Legal basis: your consent, given through our cookie banner, for everything other than strictly necessary cookies (Art. 6(1)(a) GDPR). Strictly necessary cookies rely on our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR).
We use Google Analytics 4 with Consent Mode v2, so nothing is set before you consent, and Consent Pro to collect and record your choice. You can change or withdraw it at any time at cookie settings. We use two categories of cookies, strictly necessary and analytics. We do not use advertising or personalisation cookies, and video on this site is served from the site itself, so no third party sets a cookie when it plays. The individual cookies are listed in section 13.
Retention: 12 months in Google Analytics, which is the maximum for our property type. Records of your cookie choice are kept for 12 months after that choice expires or is withdrawn.
4.4 Server logs
Data: IP address, timestamps, request details, user agent. Purpose: availability, fault diagnosis, and abuse detection. Legal basis: our legitimate interest in the security of our systems (Art. 6(1)(f) GDPR).
Retention: 30 days
4.5 Events
Data: the details on a badge you let us scan or a card you give us, and notes from our conversation. Purpose: to follow up. Legal basis: our legitimate interest in business development (Art. 6(1)(f) GDPR), and your consent where the event operator requires it for badge scanning.
Retention: 24 months, or under section 4.1 if the conversation becomes an active opportunity.
4.6 Our social media profiles
We maintain profiles on LinkedIn, Instagram and X. When you interact with them, the platform operator processes your data under its own privacy policy and sets its own cookies, over which we have no control.
For the aggregated audience statistics we receive about our LinkedIn and Instagram profiles we are joint controllers with the platform operator (Art. 26 GDPR). The essence of that arrangement, and the operator's own information about the processing, is set out here:
- Page Insights Joint Controller Addendum: https://legal.linkedin.com/pages-joint-controller-addendum
- Privacy Policy: https://www.linkedin.com/legal/privacy-policy
You can exercise your rights against the operator directly or against us. Our legal basis is our legitimate interest in maintaining a presence on these platforms (Art. 6(1)(f) GDPR).
5. Who we share it with
We do not sell personal data. We share it with service providers acting on our instructions, each under a data processing agreement and only for the purposes we set:
- Webflow, Inc., 398 11th Street, Floor 2, San Francisco, CA 94103, United States — website and video hosting
- Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, D04 E5W5, Ireland — analytics
- Finsweet Inc., United States — cookie banner and consent records (Consent Pro)
- Pipedrive OÜ, Mustamäe tee 3a, 10615 Tallinn, Estonia — customer relationship management (CRM)
We also share data with our accountants and lawyers where necessary and under a duty of confidentiality, and with public authorities where we are legally required to.
6. Transfers outside the EEA
Our own infrastructure sits in the European Union. Some of the providers (and their sub-processors) above are established in the United States or other third countries. For those transfers we rely on the European Commission’s adequacy decision for the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on Standard Contractual Clauses adopted by the European Commission. Where we rely on Standard Contractual Clauses, we assess whether additional safeguards are needed and apply them where relevant. You can ask us for a copy of the safeguards that apply.
7. Security
Immersion sp. z o.o. holds ISO/IEC 27001 and ISO/IEC 27701 certification at company level. Our measures include encryption in transit and at rest, role-based access control, logging, staff training, and review of our sub-processors. No system is completely secure, and we report incidents in line with our legal duties.
8. Your rights
You have the right to access your data and get a copy, to have it corrected, to have it erased where Art. 17 GDPR applies, to restrict processing, to receive it in a portable format where processing is based on consent or contract and is automated, to object to processing based on legitimate interest, to withdraw consent at any time, and not to be subject to a decision based solely on automated processing that has legal effects for you.
Write to office@immersionlabs.us. We reply within one month, and may extend that by up to two further months for complex or multiple requests, telling you within the first month if we do. Withdrawing consent does not affect processing carried out before it.
You can also complain to the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland, or to the supervisory authority where you live.
9. If you are in the United States
Depending on your state, you may have the right to know what personal information we collect, to request its deletion or correction, and to opt out of the sale or sharing of personal information for targeted advertising. We do not sell personal information and we do not share it for cross-context behavioural advertising. Write to office@immersionlabs.us. We will not discriminate against you for exercising these rights.
10. Automated decision-making
We do not make decisions about you on this website based solely on automated processing, including profiling, that produces legal effects for you or otherwise significantly affects you. The MetaCoach platform produces performance feedback and scores which may involve processing; where you use the platform through an organisation, that organisation decides how those results are used and is the controller for them. See section 3.
11. Changes
We may update this policy. The version and date at the top tell you which version applies. If a change is significant we will flag it on the website or, where we have your address, by email.
12. Contact
Immersion sp. z o.o., ul. Jana Ciszewskiego 15, 2nd floor, 02-777 Warsaw, Poland. office@immersionlabs.us
13. Cookies we use
Each cookie, who sets it, what it does, and how long it lasts: Cookie Policy
