Legal

Last updated: July 14, 2026

1. Data Controller

CrystalByteLabs, operating from ul. Plac 20 Pazdziernika 3, 63-100 Srem, Poland (hereinafter "the Company", "we", "us", or "our"), is the data controller responsible for the processing of personal data collected through our website and service platforms, in accordance with Regulation (EU) 2016/679 (General Data Protection Regulation — GDPR).

2. Categories of Personal Data Collected

We may collect and process the following categories of personal data:

• • Contact Data: Full name, email address, telephone number — collected via contact forms and direct communications.
• • Technical Data: IP address, browser type and version, operating system, device identifiers, and usage analytics — collected automatically through server logs and analytics tools.
• • Communication Data: Content of correspondence, service inquiries, and project specifications submitted through our platforms.
• • Transaction Data: Payment information and billing details — processed exclusively through our PCI-DSS compliant payment processor (Stripe).

3. Legal Basis for Processing

We process personal data under the following legal bases as defined in Article 6(1) GDPR:

• • Consent (Art. 6(1)(a)): When you voluntarily submit information through contact forms or subscribe to communications.
• • Contract Performance (Art. 6(1)(b)): When processing is necessary for the performance of a contract to which you are party, or to take steps at your request prior to entering into a contract.
• • Legitimate Interest (Art. 6(1)(f)): When processing is necessary for our legitimate interests — including website security, fraud prevention, and service improvement — provided such interests are not overridden by your fundamental rights.
• • Legal Obligation (Art. 6(1)(c)): When we are legally required to retain certain data for tax, accounting, or regulatory compliance purposes.

4. Purpose of Data Processing

Your personal data is processed for the following specific purposes:

• • To respond to inquiries and provide requested services through CrystalByteLabs.
• • To execute and manage contractual obligations for digital studio services.
• • To maintain accurate billing and financial records in compliance with Polish tax regulations.
• • To ensure the security, integrity, and performance of our web platforms.
• • To comply with applicable legal and regulatory obligations under EU and Polish law.

5. Data Retention

Personal data is retained only for as long as necessary to fulfill the purposes for which it was collected. Contract-related data is retained for the duration of the contractual relationship plus 6 years in accordance with Polish commercial and tax legislation. Contact inquiry data is retained for a maximum of 12 months from the date of the last communication, unless an ongoing business relationship has been established.

6. Data Sharing and Transfers

CrystalByteLabs does not sell, rent, or trade personal data. Data may be shared with the following categories of processors solely for the purposes outlined in this policy:

• • Infrastructure Providers: Vercel, Cloudflare, and hosting partners — for website delivery and security.
• • Payment Processors: Stripe — for PCI-DSS compliant payment handling.
• • Communication Tools: Email service providers — for correspondence management.

All data processors are bound by Data Processing Agreements (DPAs) ensuring GDPR compliance. Where personal data is transferred outside the European Economic Area (EEA), we ensure appropriate safeguards are in place, including Standard Contractual Clauses (SCCs) as approved by the European Commission.

7. Your Rights Under GDPR

Under the General Data Protection Regulation, you have the following rights:

• • Right of Access (Art. 15): The right to obtain confirmation of whether your data is being processed and to access a copy of such data.
• • Right to Rectification (Art. 16): The right to request correction of inaccurate or incomplete personal data.
• • Right to Erasure (Art. 17): The right to request deletion of your personal data where there is no compelling legal reason for continued processing.
• • Right to Restriction (Art. 18): The right to request restriction of processing in certain circumstances.
• • Right to Data Portability (Art. 20): The right to receive your data in a structured, commonly used, machine-readable format.
• • Right to Object (Art. 21): The right to object to processing based on legitimate interests, including for direct marketing purposes.

To exercise any of these rights, please contact us at [email protected]. We will respond to your request within 30 days in accordance with GDPR requirements.

8. Supervisory Authority

If you believe that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the competent supervisory authority. In Poland, this is the Urząd Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warsaw, Poland.

Last updated: July 14, 2026

1. General Policy

CrystalByteLabs operates on a milestone-based project delivery model. All services are provided as digital services under EU consumer protection law. This refund policy outlines the conditions under which refunds may be issued for services rendered by CrystalByteLabs, operating from ul. Plac 20 Pazdziernika 3, 63-100 Srem, Poland.

2. Eligibility for Refund

• • Pre-commencement Cancellation: If a project has been agreed upon but no work has commenced, a full refund of any advance payment will be issued within 14 business days.
• • Milestone-Based Refund: For projects in progress, refund eligibility is calculated based on completed and invoiced milestones. Work that has been delivered and approved is non-refundable. Uninvoiced, uncompleted work may be eligible for a proportional refund.
• • Deliverable Non-Conformance: If delivered work materially deviates from the agreed specification and CrystalByteLabs is unable to remedy the non-conformance within a reasonable timeframe, a refund proportional to the non-conforming deliverable will be issued.

3. Non-Refundable Items

• • Services that have been fully delivered, accepted, and signed off by the client.
• • Third-party costs incurred on behalf of the client (domain registrations, hosting fees, stock assets, licensed software).
• • Work abandoned by the client after project initiation without providing required feedback, content, or access for a period exceeding 30 days.
• • Rush delivery premiums and expedited processing fees.

4. Refund Process

To request a refund, contact CrystalByteLabs at [email protected] with the project identifier and a description of the refund request. Refund requests will be evaluated within 10 business days. Approved refunds will be processed using the original payment method within 14 business days of approval.

5. Dispute Resolution

In the event of a dispute regarding refund eligibility, both parties agree to attempt resolution through good-faith negotiation before pursuing any formal legal proceedings. This policy is governed by the laws of the Republic of Poland and applicable EU consumer protection directives.