Limited offer: 50% off your first 3 months with FOUNDING50. Until November 30.
Legal

Privacy Policy

How Bewort sp. z o.o. processes personal data in connection with Stepli, as controller and as processor.

Effective: October 31, 2026 Last updated: October 31, 2026

1. Who We Are

Stepli is operated by Bewort sp. z o.o., ul. Ostrobramska 101, 04-041 Warsaw, Poland, KRS 0001040927, NIP 1133098599 ("Bewort", "we", "us"). Privacy contact: legal@stepli.io.

This Privacy Policy explains how Bewort processes personal data in connection with Stepli and the stepli.io website.

2. Our GDPR Roles

Our role depends on the data and the processing activity.

2.1. Customer accounts and billing. Bewort acts as controller for personal data needed to create and administer Customer accounts, provide subscriptions, manage billing, secure the Service and keep contractual records.

2.2. Business contacts sourced by Stepli. Bewort acts as controller when it independently obtains and maintains professional business contact information, from public professional and business sources and from business data providers. If a Stepli Customer decides to contact a person using this information, that Customer acts as a separate and independent controller for its own outreach. People in this group can read our Notice for Business Contacts.

2.3. Customer-controlled data. For personal data that a Customer uploads, creates or controls within Stepli, such as candidate CVs and profiles, mailbox content and replies, manually added contacts and CRM notes, the Customer acts as controller and Bewort acts as processor under our Data Processing Agreement. Questions about that data should normally be directed to the Customer that controls it.

3. Personal Data We Process as Controller

We may process:

  1. name and business contact information of Customer users;
  2. account information, authentication and account identifiers;
  3. company and professional information;
  4. billing, transaction and subscription information;
  5. IP address, device and browser information;
  6. acceptance records, including document version, timestamp, IP address and user agent;
  7. support requests, messages sent through our contact form and legal communications;
  8. for business contacts: name, employer, role, business email address, professional location, publicly available professional information, and email verification results.

4. Sources of Personal Data

We obtain personal data directly from Customers and users; from public professional and business sources; from public job postings and employer websites; from business data and contact discovery providers; from email verification providers; from sign-in and payment providers; and automatically through use of Stepli and our website.

5. Purposes and Legal Bases

5.1. Accounts and subscriptions. Necessary to enter into and perform our contract with the Customer (Article 6(1)(b) GDPR) and, for users acting on behalf of a Customer, our legitimate interest in operating and administering Stepli (Article 6(1)(f)).

5.2. Billing and accounting. Performance of the contract and compliance with tax and accounting obligations (Article 6(1)(b) and (c)).

5.3. Business contact database. Our legitimate interest in providing a B2B service that helps businesses identify relevant professional contacts at organisations that are hiring (Article 6(1)(f)). We limit this to professional information, keep it only as long as set out in Section 9, and respect objections as described in Section 10.

5.4. Security and abuse prevention. Our legitimate interest in protecting Stepli, our Customers and third parties.

5.5. Legal claims and compliance. Compliance with legal obligations and our legitimate interest in establishing, exercising or defending legal claims. This includes keeping records of Terms acceptance.

5.6. Website. Our website uses cookies and similar technologies that are strictly necessary for it to work and to protect our forms. With your consent, given in our cookie banner, it also uses analytics cookies that help us understand how visitors use the website and which pages are useful, and advertising cookies (the LinkedIn Insight Tag) that measure our advertising on LinkedIn. You can consent to each separately. The legal basis for both is your consent (Article 6(1)(a) GDPR). You can withdraw it at any time through "Cookie settings" at the bottom of the website, without affecting processing that took place before. Details are in our Cookie Policy.

6. Artificial Intelligence

Stepli uses a third-party AI provider through its API to draft email content, classify and summarise replies, and parse CV information into structured profiles. Under the provider's API terms, data sent through the API is not used to train its models. Customers remain responsible for reviewing AI-generated content and decisions based on it.

7. Recipients

We disclose personal data only where necessary to operate Stepli, provide requested functionality, process payments, protect the Service or comply with law. Recipients fall into these categories:

  1. cloud hosting and infrastructure providers;
  2. payment processing providers;
  3. authentication providers, including Google where a user chooses to sign in with Google;
  4. AI service providers;
  5. business data, contact discovery and email verification providers;
  6. mailbox providers that a Customer chooses to connect;
  7. security and anti-abuse providers for our website forms;
  8. web analytics providers, where you consent to analytics cookies;
  9. LinkedIn, as an advertising platform, where you consent to advertising cookies;
  10. Stepli Customers, for business contact information made available through the Service;
  11. professional advisers, and public authorities where the law requires.

Customers can request the list of sub-processors that process Customer-controlled data at legal@stepli.io.

8. International Transfers

Our primary application hosting is in the European Union (Frankfurt, Germany). Some service providers may process personal data outside the EEA. Where they do, we rely on safeguards recognised under the GDPR: adequacy decisions, including the EU-US Data Privacy Framework for certified recipients, the European Commission's Standard Contractual Clauses, and supplementary measures where appropriate.

9. Retention

We keep personal data only as long as necessary for the relevant purpose, legal obligation or the establishment, exercise or defence of legal claims:

  1. Customer account data: for the duration of the Customer relationship and up to 12 months after the subscription ends, unless deletion is requested earlier.
  2. Billing and accounting records: 5 years from the end of the calendar year in which the financial year ended, as required by Polish accounting law, or longer where tax law requires.
  3. Business contacts sourced by Stepli: up to 24 months from the last time the record was verified or updated, or until a valid objection or deletion request.
  4. Terms acceptance records: for the duration of the agreement and 6 years after it ends, as evidence for possible claims.
  5. Customer-controlled data (CVs, mailbox content, CRM data): as set out in the Terms and the Data Processing Agreement, that is, up to 12 months after the subscription ends, or 30 days after a deletion request.
  6. Website analytics data: analytics cookies expire after 13 months, and analytics data is kept for up to 14 months.
  7. Website advertising data: the li_fat_id cookie expires after 30 days, and LinkedIn keeps Insight Tag data for up to 180 days.
  8. Backups: automated backups expire within 7 days.
  9. Objection records: where you object, we keep the minimum information needed to make sure your data is not added again, for as long as that is needed.

Retention may be extended where required by law, litigation, regulatory proceedings, security investigations or legal claims.

10. Your Rights

Where we act as controller, you have the right to access your personal data; to correct inaccurate data; to request deletion; to restrict processing; to object to processing based on legitimate interests, including at any time to processing for direct marketing purposes; to receive information about the source of your data; to data portability where applicable; and to lodge a complaint with a supervisory authority.

Send requests to legal@stepli.io. We respond within one month, which may be extended where the law allows. If you object to our business contact processing, we delete your record from the Stepli contact database, so that Stepli Customers can no longer find it through the Service.

Unsubscribe links and replies to an email sent by a Stepli Customer stop further outreach from that Customer. To be removed from Stepli entirely, write to legal@stepli.io.

11. Security

We use technical and organisational measures designed to protect personal data against unauthorised access, disclosure, alteration, loss or destruction, including encryption in transit, encryption at rest of our primary database, access controls and backups. No system can guarantee absolute security.

12. Personal Data Breaches

Where Bewort acts as processor, we notify the affected Customer without undue delay after becoming aware of a personal data breach affecting data processed on its behalf. Where Bewort acts as controller, we notify the competent supervisory authority without undue delay and, where feasible, within 72 hours, when notification is required by Article 33 of the GDPR, and we inform affected individuals where the breach is likely to result in a high risk to them, as required by Article 34.

13. Children

Stepli is a business service and is not directed at children. We do not knowingly collect personal data of children.

14. Complaints

You may contact us first at legal@stepli.io. You also have the right to lodge a complaint with a supervisory authority. In Poland, this is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warsaw.

15. Changes

We may update this Privacy Policy to reflect changes in our Service, processing or legal obligations. The current version is always published on this page, with its effective date. This Privacy Policy is a transparency notice and is not accepted as consent.