Privacy Policy

1.Data controller and contact

The controller of the personal data collected on the Mediarun.com website is HEX-NET spółka z ograniczoną odpowiedzialnością, with its registered office in Warsaw, ul. Franciszka Klimczaka 1 (Royal Wilanów), 02-797 Warszawa, Poland, KRS 0001191786, NIP 9512628812, REGON 542599939 (the “Controller”).

Data relating to orders in the Shop — the Shop customer account, billing details, and order and payment history — are processed by a separate controller, the Seller: HEXAGON NETWORK INT LTD, 85 Uxbridge Road, London W5 5TH, United Kingdom, company number 16085570.

For matters concerning personal data, write to [email protected], call +48 505 460 020 or write by post to the address of the Controller’s registered office. The Controller has not appointed a data protection officer.

2.Key points at a glance

• Without your consent, we do not carry out analytics or personalisation — in that case we store only what is strictly necessary for the features you use to work.
• With your consent, we collect data on your use of the Service and build a profile of your interests. You can change your consent at any time using the “Cookie settings” button in section 5 — the “Cookies” link in the footer of every page leads there — and, when logged in, also in your Account settings, on the “Privacy” tab.
• We record conversations with the AI assistant, and their content is processed by language model providers — including providers outside the European Economic Area.
• We build the profiles of companies and people in the directory from public registers and company websites. You can request rectification, object or request erasure.
• We do not sell data.

3.What data we process, for what purposes and on what legal basis

Reader account

E-mail address, password (in hashed form), first name and surname and — if you provide them — telephone number, country, job title, company, industry, interests and profile photo. Purpose: maintaining the Account, logging in and the panel features (tokens, tasks, briefs, calendar). We also record the date and version of the terms and policy you accepted, the source of registration (form or conversation with the assistant) and the date on which your e-mail address was confirmed — to demonstrate what you accepted and to award tokens. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and our legitimate interest in demonstrating consents (Art. 6(1)(f) GDPR).

Newsletter

E-mail address, your first name (if you provide it), the topics you have chosen and information about opens and clicks. We also record the wording, version and time of the consents you have given, so that we can demonstrate them. You confirm your subscription using the link in an e-mail message (on registration — the same link that confirms your account address). Legal basis: consent (Art. 6(1)(a) GDPR), which you can withdraw using the link in every message.

AI assistant (Jasmin, MR Advisor)

The content of your questions and of the assistant’s answers, your first name if you provide it, a browser identifier, the address and title of the page from which you are writing, screen resolution, language and time zone, and the country and device type determined from your IP address. From the conversation, we record the facts you provide (e.g. job title, company, industry, interests) and brief notes on its course. Purpose: answering your question, continuity of the conversation (after you log in, the conversation is transferred to your Account) and tailoring answers — described in the Profiling section.

Legal basis: performance of the service you request (Art. 6(1)(b) GDPR) and, as regards remembering facts, tailoring answers and suggesting services of the Service, the Controller’s legitimate interest (Art. 6(1)(f) GDPR). We record conversations even when you are not logged in. The content of the conversation is processed by the language model provider (section 6). If you talk by voice, your speech is recognised by your browser (in Chrome and Safari, the audio is processed by Google or Apple servers), and the answer is read out by the ElevenLabs speech synthesiser.

Analytics and personalisation — only with consent

Pages visited, clicks, scroll depth, reading time, phrases entered in the search box, traffic source (referring page and campaign parameters, e.g. utm, gclid, fbclid, li_fat_id), device and browser information, your full IP address and the country and internet service provider determined from it, as well as a browser identifier. When you are logged in or arrive via a link in one of our e-mail messages, we link these data to your Account or e-mail address. Purpose: statistics and content tailoring (profiling). Legal basis: consent (Art. 6(1)(a) GDPR; storing and accessing information on your device — Article 399 of the Polish act Prawo komunikacji elektronicznej (Electronic Communications Law)).

Company directory, people profiles, rankings and award winners

First name and surname, position and company, career history, professional photograph, awards and public statements of people associated with companies in the marketing industry, including members of management boards and commercial proxies. Sources: public registers (KRS, CEIDG, the register of VAT taxpayers, VIES), the ALEO service, Wikidata and Wikipedia, company websites (including those retrieved automatically), press releases, materials submitted by companies and publications of the Service. Descriptions (biographical notes) may be prepared with the help of AI on the basis of these sources. Purpose: maintaining a public database of information on the marketing industry, rankings and journalistic activity. Legal basis: the legitimate interest of the Controller and of readers (Art. 6(1)(f) GDPR). You may object at any time or request rectification or erasure of your data.

Company profile — management and removal requests

Account e-mail address, first name and surname, the composition of the company’s management board according to the KRS and the NIP number from the order — to check whether you may manage the profile; a history of changes showing who made them. For a profile removal request: the applicant’s details, their role in the company, the statement or power of attorney submitted and the correspondence. Legal basis: performance of a contract (Art. 6(1)(b) GDPR) and legitimate interest — verifying authority and demonstrating how we handled the request (Art. 6(1)(f) GDPR).

Messages to companies and authors

First name, e-mail address or telephone number and the content of the message, and for logged-in users also the Account identifier. A message sent using the contact form on a company profile goes to that company in its panel, and a “Message the author” message goes to the author and the editorial team. Legal basis: your consent to the data being passed to the company (Art. 6(1)(a) GDPR) and our legitimate interest in responding to the enquiry (Art. 6(1)(f) GDPR).

Comments

The content of the comment and the name from your Account, which we publish with the comment after approval by a moderator (Art. 6(1)(b) GDPR).

Quizzes, tests and surveys

First name, e-mail address, telephone number, company, job title and answers — to send you the result by e-mail or via WhatsApp, if you choose it (Art. 6(1)(b) GDPR). We send marketing information only with your separate consent (Art. 6(1)(a) GDPR).

Tokens, tasks and referrals

The balance and history of your Token wallet, completed tasks and badges, your referral code and — when an invited person creates an Account using your link — their masked e-mail address and the rewards granted (Art. 6(1)(b) GDPR). When you recommend Mediarun using the invitation form, we process the first name and e-mail address of the person you are recommending, to which we send a single invitation (Art. 6(1)(f) GDPR).

Shop and orders

First name and surname, e-mail address, company name, NIP or VAT number (checked against the KRS, the Polish “white list” of VAT taxpayers and VIES), billing address, and order and payment history. The controller of these data is the Seller. Purpose: concluding and performing the contract, settlements and tax obligations, handling complaints and pursuing claims. Legal basis: Art. 6(1)(b), (c) and (f) GDPR. Payment card data are processed exclusively by the payment operator Revolut.

Contact forms and submissions

First name, e-mail address, company, subject and content of the message, as well as data contained in submissions (e.g. a media patronage request or a brief) — to respond and handle the matter (Art. 6(1)(b) and (f) GDPR).

Security of the Service

IP address, date and time, the address of the requested page, the browser and technical data recorded in server logs — to protect the Service against abuse and to detect errors (Art. 6(1)(f) GDPR). On the pages of the HEXX tools shop, we store the IP address only in hashed form.

Competitions and events

The processing of the data of entrants, nominees, Jury members, award winners and participants of the Marketing Director of the Year / CMO of the Year competition and of the CMO Executive Summit event is governed by their rules and policies available at dyrektormarketinguroku.pl and executivesummit.eu.

4.Profiling

Profiling is the automated evaluation of certain personal aspects of an individual — in our case, interests and professional context. We use it in three situations.

1. Analytics and personalisation — only with consent. Based on the pages visited, the topics read, searches and the traffic source, we build a profile of the reader’s interests (topics, industries, companies). On that basis, we select the order of content, recommended articles, newsletter topics and the assistant’s suggestions.
2. AI assistant. We combine the facts you provide in a conversation and notes from conversations with your Account data. For logged-in users, we internally add information from our databases: the company identified from the domain of your business e-mail address, data from the company directory and from our contact database (e.g. company size, previous contacts) and — if you have consented to analytics — the articles read and searches made in the last 30 days. This allows the assistant to answer more accurately and to suggest relevant services of the Service.
3. Company identification. Based on the domain of the e-mail address and public data, we associate a person with a company in the directory — in order to handle an enquiry, verify authority over a company profile and prepare offers for companies.

Profiling does not produce legal effects concerning you or similarly significantly affect you: it determines only the selection and order of content and what the assistant suggests. We do not use it to make decisions on concluding a contract, on prices or on access to services.

Legal basis: for analytics — consent, which you can withdraw in the cookie settings; for the assistant and company identification — the Controller’s legitimate interest (Art. 6(1)(f) GDPR). You may object at any time to profiling carried out on that basis (Article 21 GDPR) by writing to [email protected]. On request, we will provide you with all the data we process about you, including information assigned internally (Article 15 GDPR).

5.Cookies and browser storage

The Service stores cookies and data in browser storage (localStorage, sessionStorage) on your device. Without your consent, we use only those that are strictly necessary for the features you use — logging in, the cart, conversations with the assistant, remembering your language and your choice in the banner. Analytics and personalisation are activated only after you click “Accept”.

You can change or withdraw your consent at any time using the “Cookie settings” button below — the “Cookies” link in the footer of every page leads to this section — and, when logged in, also in your Account settings, on the “Privacy” tab. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

Cookie settings

Strictly necessary — used without consent

Functional — remember your choices

Analytics — only with consent

We remove the token from a link in our e-mail message (the mr_o parameter) from the page address immediately and — only if you have consented to analytics — use it to link the visit to your e-mail address. Without your consent, we do not store it on your device.

External resources

Video thumbnails are loaded from YouTube servers (i.ytimg.com), and the player in youtube-nocookie.com mode is loaded only after you click. Job offer pages may display an OpenStreetMap map. At checkout, the payment form is provided by Revolut. When these elements are displayed, their providers receive the IP address of your device.

6.Recipients of data

We entrust data to entities that provide services to us, and only to the extent necessary:

• hosting, e-mail and newsletter delivery — OVH (server in Poland);
• protection and acceleration of traffic for the domains that use it — Cloudflare;
• payments — Revolut;
• language models for the AI assistant and HEXX tools — depending on the configuration: DeepSeek, Moonshot AI (Kimi), Google (Gemini) or a model run on our own server; speech synthesis — ElevenLabs;
• sending results via WhatsApp, if you choose it — Meta Platforms (WhatsApp);
• automated retrieval of company websites for the directory — Firecrawl;
• accounting and legal services — an accounting firm and a law firm, to the extent necessary for settlements and the pursuit of claims;
• the Seller, HEXAGON NETWORK INT LTD — with regard to orders in the Shop.

Data are also received by: a company in the directory — the message you send to it using the contact form on its profile; the author of a text — a “Message the author” message; public authorities — where required by law.

7.Transfers of data outside the European Economic Area

• United Kingdom — the Seller and the payment operator. The European Commission has found that the United Kingdom ensures an adequate level of data protection.
• United States — Google, Cloudflare, ElevenLabs, Meta, Firecrawl. Transfers take place on the basis of the EU–U.S. Data Privacy Framework (for recipients covered by it) or standard contractual clauses adopted by the European Commission.
• China — DeepSeek and Moonshot AI (the content of conversations with the assistant and of texts sent to HEXX tools). There is no adequacy decision for China; transfers take place on the basis of standard contractual clauses.

You can obtain a copy of the safeguards by writing to [email protected].

8.How long we keep data

• Account — until the Account is deleted; after deletion, up to 30 days in backup copies.
• Newsletter — until consent is withdrawn.
• Conversations with the AI assistant — in the Account, until the conversation or the Account is deleted; conversations of guests who are not logged in — for as long as they are needed to operate and develop the assistant; at least once a year we check whether they are still needed.
• Analytics (with consent), including IP addresses — for as long as the data are needed for statistics and for the security of the Service; at least once a year we check whether they are still needed. IP addresses are not disclosed outside the Publisher and the entities that process them on its behalf.
• Messages, enquiries and form submissions — for the time needed to handle the matter and for further contact, but no longer than until the limitation period for claims expires.
• Company and people directory — for as long as the information is current and relevant to the market, or until an objection is upheld.
• Company profile removal requests and their handling — 3 years from the decision.
• Comments — until the comment or the Account is deleted.
• Orders and invoices — 5 years from the end of the tax year in which the tax obligation arose; data needed to pursue claims — until the limitation period for those claims expires.
• Technical logs — up to 12 months.

9.Your rights

You have the right of access to your data, the right to rectification, erasure, restriction of processing and data portability, the right to object to processing based on legitimate interest — including profiling and direct marketing — and the right to withdraw consent at any time.

Send your request to [email protected]. We respond without undue delay and in any event within one month. You also have the right to lodge a complaint with the President of the Urząd Ochrony Danych Osobowych (Polish Personal Data Protection Office) (uodo.gov.pl).

10.Do you have to provide your data?

Providing data is voluntary, but you cannot create an Account without an e-mail address or place an order without billing details. You provide profile data (job title, company, interests) if you want content to be tailored to you.

11.Automated decision-making

We do not make decisions about you based solely on automated processing that would produce legal effects concerning you or similarly significantly affect you. The profiling described in section 4 is used solely to select content.

12.Changes to this Policy

We announce material changes in the Service and notify Account holders by e-mail. This Policy is in force from 7 October 2026; the previous version was in force from 8 September 2026.