Privacy Policy
Controller and contact
The data controller is BOMEGA SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, 2B Długa Street, 56-416 Twardogóra, Poland. Privacy contact: biuro@bomega.pl. No separate DPO contact channel is published for xHumanDesign; data-protection matters may be sent directly to the controller.
Data categories and sources
Depending on features used, data can include account/contact identifiers, sessions/security activity, preferences, birth date/time/location, derived Human Design chart data, linked Telegram identity, consent/legal evidence, privacy requests, support, entitlement/billing lifecycle and audit/security records. Data can come from the user, platform activity and approved integrations.
Purposes and legal bases
Data is processed to provide requested account, chart, history and report functions, maintain security, handle support and comply with legal duties. The applicable basis is respectively GDPR Article 6(1)(b), Article 6(1)(f), Article 6(1)(c), or Article 6(1)(a) for optional functions where consent is the appropriate basis.
Recipients and processors
Data may be entrusted to hosting/infrastructure and technical service providers, the transactional email provider/relay and, when the user voluntarily uses the integration, Telegram to the extent required by that function. Authorized support and administration personnel may access data. No payment processor, external analytics provider or advertising provider is currently active.
International transfers
Where a technical or communications provider processes data outside the EEA, the transfer may occur only using an applicable GDPR Chapter V mechanism, including an adequacy decision, Standard Contractual Clauses or another permitted legal basis.
Retention and erasure
Account and Human Design data is kept while the service is used and, after an effective deletion request, is erased or anonymized under policy privacy-retention-free-v1. Minimal consent, legal-acceptance and audit evidence may remain in pseudonymous form to the extent required for compliance, security or defence of claims. Technical data is removed according to its function and applicable legal or limitation periods.
Data-subject rights
Subject to applicable conditions and exceptions, rights can include access, rectification, erasure, restriction, portability, objection and consent withdrawal. The platform already has technical request/export/correction/deletion mechanisms.
Automated processing
xHumanDesign does not make solely automated decisions about a user that produce legal or similarly significant effects. Chart calculation and interpretive content are product functions for self-reflection, not legal, medical, financial or employment decisions.
Children and age policy
A minor may use the service only to the extent permitted by law; where consent or action by a legal representative is required, it must be obtained. xHumanDesign is not designed as a service directed to children.
Complaints and authority
President of the Personal Data Protection Office (Prezes UODO) in Poland. A data subject may lodge a complaint with the President of UODO if they consider that processing infringes the GDPR. Privacy questions may also be sent to biuro@bomega.pl.
Changes and effective date
Material changes to this privacy information are communicated in a manner appropriate to their significance. This policy is effective from 29 September 2026.