Privacy Policy

This page describes how data is processed when using the docs.nav24.pl documentation website, including the AI assistant.

I. Definitions

Controller - Nav24 Spółka z ograniczoną odpowiedzialnością, with its registered office in Bielsko-Biała, ul. Towarowa 2/2200, 43-300 Bielsko-Biała, Poland, entered in the Register of Entrepreneurs of the National Court Register under KRS number 0000481874, NIP 5472148066 and REGON 243394657.

AI Assistant - the chat available on the Website that answers questions about the documentation using artificial intelligence technology.

Personal data - information relating to an identified or identifiable natural person, including online identifiers and information stored on the User's device.

GDPR - Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016.

Website - the documentation website operated by the Controller at https://docs.nav24.pl.

User - any person using the Website.

II. Scope of processed data

When using the Website, the following data may be processed:

  • technical data concerning the device, browser, operating system, IP address, date and time of the visit, and pages viewed;
  • statistical information about how the Website is used;
  • information stored in the browser, described in section V. Cookies and browser storage;
  • the content of questions sent to the AI Assistant, the conversation history sent with the current question, and the context of the page currently being viewed;
  • AI Assistant responses and technical data related to processing the request, such as the request identifier, response time, status, model used, and number of tokens.

The Website does not require an account or the submission of identifying information. However, the User may include personal data in a question sent to the AI Assistant.

Important

Do not enter confidential data or information that is not necessary to obtain an answer about the documentation in the chat.

The Controller processes data for the following purposes:

  • providing the Website, ensuring its security, and diagnosing errors, based on the Controller's legitimate interest in maintaining a secure and functioning website (Article 6(1)(f) GDPR);
  • analysing how the Website is used with Google Analytics and improving its content and operation, based on the User's consent (Article 6(1)(a) GDPR);
  • providing answers through the AI Assistant, based on the Controller's legitimate interest in helping Users use the documentation (Article 6(1)(f) GDPR);
  • monitoring the quality and security of the AI Assistant, accounting for use of the service, and diagnosing errors, based on the Controller's legitimate interest (Article 6(1)(f) GDPR).

Providing content to the AI Assistant is voluntary. The AI Assistant cannot be used without sending a question, but the rest of the Website remains available.

IV. AI Assistant

After a question is sent, the Website transfers the following to the service operating the AI Assistant:

  • the content of the current question;
  • up to the last six conversation turns to preserve context;
  • the documentation section name derived from the current page navigation, when the context has changed since the previous question;
  • a random request identifier and a request for technical processing data.

The history visible in the chat window is stored in the browser's session storage. The Website stores up to 50 recent messages there. The User can delete this history using the clear conversation button. Session storage data is also deleted when the browser session ends.

Application Insights telemetry may record the question, the AI Assistant response, page context, request status and processing time, model name, and number of tokens used. This data is used to monitor the quality, security, and operation of the AI Assistant.

Responses are generated automatically and may contain errors. The AI Assistant does not make decisions producing legal effects for the User.

V. Cookies and browser storage

The storage of information or access to information stored on the User's device requires clear prior information and consent, except where an exception applies under applicable law. In particular, consent is not required when storage or access is necessary to transmit an electronic communication or provide a service requested by the User.

The Website uses Google Analytics to collect statistical data about traffic and use of the documentation. Google Analytics is started only after the Analytics cookie category has been enabled in the cookie settings. The service may store cookies and read information from the User's device.

The Website also uses Microsoft Application Insights to record telemetry data, errors, and events related to the operation of the AI Assistant. The service may use identifiers and cookies to associate events within a session.

The Website stores the following in browser storage:

  • in sessionStorage: chat history, the expanded state of the chat window, the last submitted page context, and the table-of-contents filter text;
  • in localStorage: the position and size of the chat window.

Data in sessionStorage is stored for the duration of the browser session. Data in localStorage remains on the device until deleted by the User; the chat position and size can also be reset from its menu.

The User can enable or disable Google Analytics at any time using the Cookie settings button. Disabling the Analytics category blocks further data transmission to Google Analytics and removes the service's cookies that are accessible to the Website. Cookies and browser storage data can also be restricted or deleted in the browser settings. Restricting necessary browser storage mechanisms may prevent chat settings and history from being preserved.

Information about managing cookies and website data is available in the privacy settings of the browser being used.

VI. Data retention period

Personal data is processed only for the period necessary to achieve the purpose for which it was collected. The applicable periods are as follows:

  • up to 14 months from the User's last activity on the Website, for analytics data processed by Google Analytics (the retention period is renewed with each subsequent visit by the User);
  • 90 days, for telemetry data processed by Application Insights;
  • 90 days, for logs and conversation history involving the AI Assistant;
  • until the session ends or the User deletes cookies, for technical data necessary for the Website to function;
  • until consent is withdrawn, for processing activities based on the User's consent.

VII. Data recipients

Data may be transferred to entities supporting the Controller in maintaining the Website, including:

  • providers of hosting, cloud infrastructure, IT, and security services;
  • the provider of the service operating the AI Assistant;
  • Microsoft in connection with the use of Azure and Application Insights services;
  • Google in connection with the use of Google Analytics;
  • authorised employees and contractors of the Controller;
  • public authorities where disclosure is required by law.

These entities process data under an agreement with the Controller or as separate controllers, in accordance with the rules applicable to the relevant service.

VIII. Transfers outside the EEA

Due to the use of global technology providers, data may be transferred outside the European Economic Area. Such transfers are based on an appropriate legal mechanism, in particular a European Commission adequacy decision, standard contractual clauses, or another safeguard provided for by the GDPR.

IX. User rights

Under the GDPR, the User has the right to:

  • obtain information about the processing of data and access that data;
  • receive a copy of the data;
  • rectify data;
  • erase data;
  • restrict processing;
  • data portability;
  • object to processing based on the Controller's legitimate interest;
  • withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal;
  • lodge a complaint with the President of the Personal Data Protection Office in Poland, in accordance with applicable law.

A request concerning the exercise of rights may be sent to ado@nav24.pl or to the Controller's correspondence address. If necessary to confirm identity or the scope of the request, the Controller may ask for additional information.

X. Contact and policy updates

For matters concerning personal data, contact the Controller:

  • email: ado@nav24.pl;
  • correspondence address: Nav24 Spółka z ograniczoną odpowiedzialnością, ul. Towarowa 2/2200, 43-300 Bielsko-Biała, Poland.

This policy is reviewed regularly and updated when the Website or applicable laws change.