Data Protection and Privacy Policy

The purpose of this document is to provide you with information regarding the processing of your personal data by LeanCode Sp. z o.o. with its seat at Wróbla 8A street, 02-736 Warsaw, NIP: 7010616433, company code KRS: 0000638275, organising the Flutter Tech Summit conference and operating the website available at fluttertechsummit.com (hereinafter “Flutter Tech Summit” or the “Website”), acting as the controller of your personal data as described below (hereinafter the “Controller”) in a simple, concise and transparent manner. The set of information provided to you here complies with the requirements of the EU Regulation of the European Parliament and of the Council (EU) 2016/679, known as the general regulation on the protection of personal data (hereinafter the “GDPR”).

In order to guarantee the full protection of your data, as well as free access to the necessary information about the processing of your data and your rights, LeanCode Sp. z o. o. provides you with an e-mail address where you can contact the Controller if you have any questions regarding data protection: iod@leancode.pl.

This document is for information purposes only and does not require any action on your part. The processing of personal data in the FTS Conference App, the Flutter Tech Summit mobile app, is described in its own privacy policy below.

The Controller shall process personal data primarily in order to register you for the Flutter Tech Summit conference and organise your participation in it, to perform the contract between the Controller and you, providing services to you or taking actions necessary to conclude a contract or start the provision of such services (pursuant to the art. 6, paragraph 1(b) of the GDPR).

In addition, the Controller may also process your personal data in order to fulfill the legal obligations incumbent on it as the Controller (art. 6, paragraph 1(c) of the GDPR), e.g. in the scope of answering the request of public authorities. In other cases, the basis for data processing is the consent you have given (art. 6, paragraph 1(a) of the GDPR), e.g. to receive marketing communication, including the newsletter and post-event content. The Controller may process your data on the basis of its legitimate interests (Article 6(1)(f) GDPR), namely: – organisation of the conference and proper performance, conclusion and provision of services to participants and counterparties, – settlement of contracts with counterparties, – for the purpose of marketing its own products, services and events, including inviting you to the conference, – if it applies, for the purposes related to the conduct of disputes by the Controller and proceedings before public authorities’ bodies.

The conference is photographed. Your image captured in photos taken at the conference constitutes personal data, which the Controller processes in order to document and promote the event, including on the Website and on the Controller's social media profiles, on the basis of its legitimate interests (art. 6, paragraph 1(f) of the GDPR). You may object to such processing at any time, as described in the “Your rights” section below.

Where personal data is required to register for the conference, to conclude or perform a contract or to respond to an enquiry, providing the required data is a contractual or pre-contractual requirement; failure to provide it may prevent the Controller from registering you, concluding or performing the contract, providing the requested services, or responding to the enquiry. Where collection is required by law, providing the relevant data is a statutory requirement. The Controller shall process the personal data collected from you only to the extent necessary to achieve the purposes listed here. In the event that your personal data has not been collected directly from you i.e. in particular, the name, surname, company, contact details such as e-mail or telephone number and other only necessary for the performance of the contract or for inviting you to the conference, the source of this data is the Controller's CRM system (HubSpot), previous editions of the Flutter Tech Summit conference, and the Controller's personal and professional contacts. Providing consent for analytics or marketing cookies is voluntary, and refusing consent does not prevent access to the basic Website.

In the regular course of business, the Controller may transfer your personal data to external recipients (complying with all requirements to ensure the security thereof resulting from the provisions on the protection of personal data), when it turns out to be necessary in business processes, ensuring high-quality services, as well as meeting legal obligations. The above includes the following categories of data recipients: – contractors, customers, suppliers of the Controller, – public authorities, – entities supporting the Controller in running a business, – providers of legal, advisory, consulting, auditing, accounting and IT services, Controller's contractors, – providers of website hosting services, in particular Netlify, Inc., which hosts the Website, and GitHub, Inc., which stores the Website's content, including personal invitation pages, – providers of website analytics, tag-management, online-advertising and cookie-consent services used on the Website — in particular Google LLC (Google Tag Manager, Google Analytics 4 and, where used, Google Ads), LinkedIn Corporation / LinkedIn Ireland Unlimited Company (LinkedIn Insight Tag, where used) and the provider of the CookieScript cookie-consent tool — to the extent that you have consented to the relevant cookies; see the “Cookies & other technologies” section below for details, including on the transfer of data outside the EEA, – HubSpot, Inc. — the CRM (customer relationship management) tool the Controller uses to record and manage registrations for the conference and enquiries you submit through the Website's forms, and to send e-mails about the conference, the newsletter and post-event content.

HubSpot, Inc., Netlify, Inc. and GitHub, Inc. are based in the United States and may process the data you submit through the Website outside the European Economic Area. Such transfers are based on appropriate safeguards, in particular the European Commission's Standard Contractual Clauses and, where applicable, the provider's certification under the EU-U.S. Data Privacy Framework.

Website technical data is retained for the period configured by the Controller and reasonably necessary to operate and secure the Website, and longer only where needed to investigate an incident or pursue a claim. Registration, contact-form and CRM data is retained until the registration or enquiry is handled and the conference has taken place, for the duration of any resulting business relationship, and afterwards until applicable statutory and legal-claim limitation periods expire. Data processed on the basis of your consent is retained until you withdraw it. Contract-related data is retained for the duration of the relationship and until applicable accounting, tax and legal-claim limitation periods expire. Cookies and related analytics or advertising data are retained for the periods shown in the cookie-settings tool and the Controller's configured provider settings. Records of consent may be retained for as long as necessary to demonstrate compliance.

The Controller has appointed a Data Protection Officer (DPO), who performs the tasks set out in Articles 38 and 39 GDPR independently and acts as a contact point for data-protection matters.

Your data may be subject to profiling, in accordance with the provisions of the GDPR. In particular, we use website-analytics and, where used, advertising cookies and tags (e.g. Google Analytics 4, Google Ads, LinkedIn Insight Tag) to build a profile of your browsing behaviour and interests, in order to improve the Website, to personalise the advertisements shown to you and to measure their effectiveness. If you have consented to the relevant cookies and submit a form on the Website, HubSpot links your earlier visits to the Website to your contact record in the Controller's CRM. This profiling does not produce legal effects concerning you or similarly significantly affect you. It is only carried out to the extent you have given the relevant cookie consent, and you can object to it or withdraw your consent at any time using the cookie-settings tool described in the “Cookies & other technologies” section below.

In conjunction with the protection of your personal data, you have a number of rights under the provisions of the GDPR. These include: 1. The right to rectify your data, 2. The right to access your data, including obtaining a copy of it and information about processing processes, 3. The right to request personal data erasure, 4. The right to restrict data processing, 5. The right to transfer data, 6. The right to object to the processing of your data, 7. The right to withdraw your consent, 8. The right to lodge a complaint with a competent supervisory authority.

If you exercise one of your rights, the Controller shall make every effort and take the necessary steps to implement them. We hope that the information provided has helped you become familiar with and understand the processing of personal data by the Controller. We make every effort to ensure its compliance with the law and the best standards that guarantee the protection of your privacy, rights and freedom. Should you have any queries regarding your data, please contact our Data Protection Officer at the e-mail address iod@leancode.pl, or by letter to the address of the registered office of the Controller.

When you visit our website (fluttertechsummit.com), we collect information about how you use it. Examples of such information include the Internet Protocol address automatically assigned to your computer each time you browse the Internet, the date and time of your visit, the pages you access and the amount of time you spend on each page, the type of Internet browser you use, your device’s operating system and the URL of the website visited immediately before our Website (the referring URL). This information, including your IP address, may itself constitute personal data under the GDPR even though it does not directly reveal your name, and we treat and protect it accordingly. We may also keep records of the type of device being used.

This website uses cookies. LeanCode uses its own cookies as well as cookies from third parties. The cookies are used to remember your settings, traffic metrics, to present you with targeted ads and to track your use of our website for statistical purposes. You can accept or refuse our cookies. Cookies that are not strictly necessary for the operation of the Website — in particular analytics and marketing cookies — are only used on the basis of your consent (art. 6, paragraph 1(a) of the GDPR and Article 399(1) of the Polish Electronic Communications Law (Prawo komunikacji elektronicznej)), which you can give or withdraw at any time using the cookie-settings tool (CookieScript): the “Cookie Settings” button in the bottom-left corner of every page of the Website. You can change or block them within the settings for your Internet browser. Blocking them may however restrict your use of the features of our website. The Website uses and allows the use of cookies by third parties (e.g. Google Tag Manager and Google Analytics 4 (GA4), used respectively to manage website tags and measure site usage) for statistical purposes. The Website may also use marketing tags (Google Ads and the LinkedIn Insight Tag), used to deliver and measure advertising and for audience-matching purposes; they are only used if you consent to marketing cookies. HubSpot's tracking code (HubSpot, Inc.), loaded through Google Tag Manager, sets the cookies hubspotutk, __hstc, __hssc and __hssrc, used to recognise your browser, count your visits and link them to the details you submit through the Website's forms; they are only used if you consent to the relevant cookies. Videos on the Website are played from our own servers; only if a video cannot be played that way is it loaded from YouTube (youtube-nocookie.com), and only after you press play.

Some of these third-party providers — in particular Google LLC, HubSpot, Inc. and LinkedIn Corporation / LinkedIn Ireland Unlimited Company — may process the data collected through these cookies outside the European Economic Area, including in the United States. Such transfers are based on appropriate safeguards, in particular the European Commission’s Standard Contractual Clauses and, where applicable, the provider’s certification under the EU-U.S. Data Privacy Framework. You can obtain more information about these safeguards from the Controller’s Data Protection Officer at the e-mail address iod@leancode.pl.

The controller of your personal data is: LeanCode Sp. z o.o. Wróbla 8A, 02-736 Warsaw, Poland KRS: 0000638275 NIP: 7010616433 REGON: 365456272 Email: iod@leancode.pl

You can use the App without logging in. However, if you choose to register or log in, we may collect the following personal data: – First name and last name – Email address – Consent to the Terms & Conditions and Privacy Policy

No additional personal or sensitive data is collected.

We collect your data only for the following purposes: – To allow access to features that require registration (e.g. rating conference talks) – To provide core functionality of the App – To send push notifications related to the event (e.g. session reminders)

The App uses Firebase Cloud Messaging (FCM) to send push notifications. These notifications are the same for all users and are not personalized. You can disable notifications at any time in your device settings.

At this time, the App does not use analytics or tracking tools. If this changes in the future (e.g. Firebase Analytics is added), this policy will be updated accordingly.

The App does not collect your precise location. It may access your general location (e.g. for map functionality) only if you grant permission through the operating system. No location data is stored or shared.

We do not share your personal data with third parties, except for services necessary to provide app functionality (e.g. Firebase push notification infrastructure). These services act as data processors under appropriate agreements.

We do not store any data locally on your device other than what is required for temporary app operation. All user data is stored securely on our servers.

You have the right to request access, correction, or deletion of your personal data. To do so, please contact us at: iod@leancode.pl

User data will be removed upon request, and in any case not retained longer than necessary for the duration of the event.

In accordance with the GDPR, you have the right to: – Access your personal data – Correct incorrect or outdated information – Request deletion of your data – Object to certain forms of processing

You also have the right to lodge a complaint with a supervisory authority.

This Privacy Policy may be updated to reflect changes in legal or operational requirements. Any changes will be published in the App or on the conference website.

Last updated: May 26, 2025