Privacy Policy

This website collects personal data in nine forms — you will find an overview of them below. Each one sends the enquiry by e-mail to the National Office’s inbox: we do not save it in any database and do not place it in logs. A separate matter is the Member and Chapter search tool — it shows data from the public BNI Connect directory, which we neither collect nor copy ourselves; we describe this in the section on the directory. The website does not measure traffic and does not build profiles of visitors. Cookies and browser storage are described in a separate document: the Cookie Policy.

The controller of personal data is BNI Poland Sp. z o.o. with its registered office in Warsaw, ul. Chłodna 51, 00-867 Warszawa, entered in the register of entrepreneurs of the National Court Register under number KRS 0000475787, NIP 1132868575, REGON 146851390.

In all matters concerning personal data — including in order to exercise your rights — write to rodo@bnipolska.pl or to the registered office address.

Personal data collected in the systems of the entire BNI organisation — above all in BNI Connect, used by Chapter Members — is controlled jointly with us by BNI Worldwide Development Ltd, Ballinrobe Road, Castlebar, Co. Mayo, F23 FT28, Ireland, tel. +353 94 902 1553, e-mail legal@bni.com. You can notify that company’s data protection officer at dpo@bni.com.

The division of roles is simple: we are responsible for data from this website — for the forms, for replies to your requests and for contact with you, and data from the forms goes exclusively to the National Office’s inbox and is not transferred to Ireland. The Irish company is responsible for BNI’s global systems and for the processing rules for them described in the BNI privacy policy. Regardless of this division, you may exercise your rights against either of us — as provided in Article 26(3) GDPR. The simplest way is to write to rodo@bnipolska.pl; if the matter concerns the global systems, we will pass it on.

The forms differ in their fields and purpose, but they work the same way: the content goes by e-mail to the National Office’s inbox and nowhere else. There is no database of enquiries and no user accounts. The only login on the website is the access code for Members before the people search tool and the materials order — we describe it in the section on the directory. Franchise enquiries are handled by a separate website, franczyzabni.pl — there is no franchise form on this site. Below is a summary, and beneath it each form separately.

What data we collect: the subject of the enquiry from a list, full name, e-mail address, telephone number and the content of the message. Regardless of the subject, you may also indicate a region and a Chapter. Depending on the subject chosen, the form additionally asks about the industry, editorial office or NIP number or document number. The region, the Chapter and these additional fields are optional.

What for: to answer your question and contact you about the matter you raise.

On what basis:

• replying to the enquiry and conducting correspondence — our legitimate interest in handling enquiries addressed to us (Article 6(1)(f) GDPR);
• telephone and e-mail contact for communication purposes — your consent (Article 6(1)(a) GDPR), which you tick when sending and may withdraw at any time;
• if the enquiry concerns joining BNI — also taking steps at your request prior to entering into a contract (Article 6(1)(b) GDPR).

Below the fields there is a second, voluntary checkbox — information about events and training. We describe it separately, in the section Information about events and training. You can send the enquiry without it.

What data we collect: full name, editorial office or title, e-mail address, the subject from a list (a visit to a Chapter Meeting, taking part in an event, an interview or an expert comment, press materials) and the content — what you are working on; optionally a telephone number, city and the deadline by which you need a reply. The form is on the Press page.

What for: to reply to the editorial team — to arrange a visit to a meeting, accreditation for an event or an interview with an expert, and to send press materials.

On what basis:

• replying to the enquiry and conducting correspondence — our legitimate interest in handling enquiries addressed to us and in contact with the media (Article 6(1)(f) GDPR);
• contact by telephone and e-mail for communication purposes — your consent (Article 6(1)(a) GDPR), which you tick when sending and may withdraw at any time.

What data we collect: full name, e-mail address and telephone number, and optionally city and the content of the message. If you arrive here via a link from the Chapter search tool, the name of the chosen Chapter from the page address goes with the enquiry too — you see it above the fields.

What for: to point you to a Chapter, arrange a date and invite you to a meeting as a Visitor.

On what basis: your consent (Article 6(1)(a) GDPR), which you tick when sending and may withdraw at any time.

What data we collect: full name, e-mail address, the company’s NIP number and city. The company name and address are filled in from the register based on the NIP number. If you open the form from a link next to a specific Chapter — for example from the Find a Chapter search tool — the name of that Chapter from the page address goes with the application too. You see it above the fields.

What for: to check which Chapter has a vacancy in your specialisation and invite you to a meeting as a Visitor.

On what basis:

• contact and invitation to a Chapter Meeting — your consent (Article 6(1)(a) GDPR), which you tick when sending and may withdraw at any time;
• taking steps at your request prior to entering into a membership agreement (Article 6(1)(b) GDPR).

What we do with the NIP number. You start the query to the register yourself: after entering the number you click the “Fetch company details” button next to the field (or press Enter). We then look the company up in the REGON register kept by Statistics Poland (GUS) and retrieve from there the company name and its registered office address from the register — street and number, postal code and town. Not just the city: you see both values under the NIP field and both go to the Office’s inbox together with the application. If you do not click, the number does not go to the register and the application goes through with the NIP alone — without the company name and address from the register. The number goes to the GUS service as an ordinary query to a public register; until the National Office obtains a key to the GUS service, we direct the same query to the Register of VAT Taxpayers kept by the Ministry of Finance — also a public register, from which we retrieve the same public data: the company name and address. We use only public data that anyone will see in that register. If you run a sole proprietorship, your NIP is personal data — we check it in our legitimate interest in shortening the form and making sure the application concerns an operating business (Article 6(1)(f) GDPR). We do not save the result of the query anywhere other than in the content of the application being sent. The number itself, like the address of every sub-page, remains in the server’s technical log — we describe this in the section Technical server data. The NIP field in the enquiry to a Chapter, in the “Become a Director” form and in the materials order works the same way.

What data we collect: full name, e-mail address, telephone number, the company’s NIP number and city; optionally the industry and the content of a message. When you request a visit we ask whether you have already been to a BNI Chapter Meeting; when you apply — which Chapter you visited. The name of the Chapter next to which you opened the form goes with the enquiry — on the Find a Chapter page or on the BNI Worldwide map. The company name and address are filled in from the register based on the NIP number, as with the membership application.

What for: to invite you to a meeting of the chosen Chapter as a Visitor or to pass your application to that Chapter’s Director — and to contact you about it.

On what basis:

• contact and an invitation to a Chapter Meeting — your consent (Article 6(1)(a) GDPR), which you tick when sending and may withdraw at any time;
• when you apply — also taking steps at your request prior to entering into a membership agreement (Article 6(1)(b) GDPR).

What data we collect: full name, telephone number, e-mail address, the company’s NIP number, company name, position and industry, information on years in business and city or area of operation. The company name and address are filled in from the register based on the NIP number — as with the membership application; if the register does not respond, you enter the name yourself.

What for: to consider your application in our ongoing recruitment for BNI Director and contact you about it.

On what basis: your consent (Article 6(1)(a) GDPR), which you tick when sending and may withdraw at any time.

This is ongoing recruitment, not a call for a specific position — your application stays with us for the period indicated below, unless you withdraw your consent earlier.

What data we collect: full name, e-mail address and the content of the application — whatever you write about yourself; optionally a telephone number and the team indicated (Support Team, Marketing Team or Sales Team). You may attach up to five files — a CV, a cover letter, a portfolio — in PDF, DOC, DOCX, ODT, RTF, JPG or PNG format, up to 4 MB in total. The attachments travel together with the application by e-mail to the Office’s inbox and are not saved anywhere beyond it.

What for: to consider your application in recruitment to the National Office team and contact you.

On what basis: your consent (Article 6(1)(a) GDPR), which you tick when sending and may withdraw at any time. If in the content of the application you provide data we do not ask for, we also process it on the basis of this consent.

What data we collect: full name, e-mail address and the company’s NIP number, and optionally a telephone number, Chapter and the list of items ordered. The company name and address are filled in from the register based on the NIP number, as with the membership application. The form is available after logging in with the access code for Members — the code creates no account and collects no data; we describe it in the section on the directory.

What for: to pass the order to the National Office and get back to you about it. This form is not a sale — payment, shipping and invoices are handled by the BNI Polska shop at biznesprzezrekomendacje.pl, outside this website. There is no basket or payment data here.

On what basis: your consent (Article 6(1)(a) GDPR) and taking steps at your request prior to entering into a contract (Article 6(1)(b) GDPR).

What data we collect: e-mail address, and optionally the title of the material chosen from the list. Nothing more. The form is on the Learning page, in the “Books and e-books” section.

What for: to send you that material to the address provided.

On what basis: your consent (Article 6(1)(a) GDPR), which you tick when sending and may withdraw at any time. Leaving your address for the material is not a newsletter subscription — we do not run one and do not add you to any mailing list.

Next to the contact form there is a second, separate checkbox: “I would like to receive information about BNI Polska events and training at the e-mail address provided”. It is voluntary and independent of the consent to handling the enquiry — we will reply to the message without it too. It is the only place on the website where we ask for consent to marketing messages.

What data we collect: nothing beyond the data from the contact form. Only the information whether the checkbox was ticked goes to the Office.

What for: to send you invitations to BNI Polska open meetings, training and conferences and information about the organisation’s activities — as individual messages from the National Office, irregularly, a few times a year. Through which channel: exclusively by e-mail, to the address provided in the form. We do not call with offers and do not send text messages; the consent covers one channel and only that channel is used.

On what basis: your consent — Article 6(1)(a) GDPR for the processing of data and Article 398 of the Electronic Communications Law for the sending of the marketing message itself by electronic means. The latter provision has been in force since 10 November 2024 and requires separate consent for each channel — which is why the checkbox refers expressly to the e-mail address.

How long: until consent is withdrawn. The record of the consent itself — the enquiry with the date of sending and the ticked checkbox — we additionally keep for the limitation period for claims, so as to be able to demonstrate that it was given. The wording of the checkbox on the day of the enquiry follows from the version of this policy and of the form in force on that day. How to withdraw: one sentence to rodo@bnipolska.pl or to biuro@bnipolska.pl. Withdrawal takes effect for the future and does not affect the lawfulness of messages sent before withdrawal or of the reply to the enquiry we sent earlier.

The website has no newsletter subscription and does not maintain a list of addresses: the checkbox concerns messages sent manually from the Office’s inbox. If you do not tick it, nothing happens — we reply to the enquiry in the same way, and you simply do not receive messages about events.

The Find a Member and Find a Chapter sub-pages show data we do not collect from you — it comes from the public BNI Connect directory (bnipl.pl). Below is the information required by Article 14 GDPR, that is, for data not obtained from the data subject.

• Where we get this data from: from the publicly available BNI Connect directory, operated by the BNI organisation. The entry is created in BNI Connect, not on this website.
• What data we show: the Member’s full name, company name, industry category, Chapter, city and region and a link to the profile in BNI Connect. Exactly as much as the directory publishes — nothing more.
• What for: so that a person looking for a trusted contractor or a specific Chapter can find them and arrange contact through the Chapter or through the profile in BNI Connect.
• On what basis: our legitimate interest in showing on the organisation’s website what that organisation publishes about itself in its own directory (Article 6(1)(f) GDPR).
• Who we share it with: what you type in the Member search tool — surname, company, phrase, first name, city, region or Chapter name — our server sends to the BNI Connect directory (bnipl.pl) to obtain the results. It sends one, the narrowest, criterion and narrows the response with the others itself. The directory is run by BNI Global, LLC (United States) and jointly controlled by BNI Worldwide Development Ltd described above. The server connects on its own, so your IP address does not go there. Before it reaches your screen, the directory’s response passes through our server and sits in its buffer — and the server is maintained for us by Cloudflare, Inc. under a data processing agreement (Article 28 GDPR; described in the section Who we share data with). Nobody else receives this data from us, and it goes nowhere further from your browser. In the worldwide Chapter search — the place you enter goes to the OpenStreetMap Foundation, and the coordinates to bni.com (described below).

We do not maintain our own database of Members and do not create a copy of the directory. We retrieve Chapter and Member data live from BNI Connect, and the server keeps the response in a buffer so as not to ask the same thing over and over. We replace the buffer entry with a new one as soon as BNI Connect responds again (we refresh a Member search result after ten minutes, the list of Chapters after an hour); if it does not respond for a longer time, the last correct response remains in it — we then show it with the date it was retrieved. It is a buffer, not a database: we do not search it, do not link it to any person and nothing remains of it once the entry has been replaced.

The phrase you enter is the key to this buffer — otherwise the server would not recognise that you are asking about the same thing — so it sits there together with the response until it is refreshed. Beyond the buffer we do not save it anywhere: there is no database of queries, we do not build a search history and we do not link phrases to the person who entered them. The technical record of the connection itself is described in the section Technical server data.

The worldwide Chapter search on the BNI Worldwide page works differently. The place you enter — a city, postal code or address — our server sends to the Nominatim geocoding service (OpenStreetMap Foundation, United Kingdom) to convert it into coordinates, and the coordinates of the recognised place to the Chapter directory at bni.com (BNI Global, LLC, United States). The server connects to these services on its own, so your IP address does not go there. We keep the geocoder’s response in the server’s memory for up to a day under a key made from the phrase entered, and the bni.com result for up to an hour under a key made from the coordinates; we do not link them with the person who asked. If you do not want to pass on your home address, enter just the city — that is enough to find Chapters nearby.

The Member search tool is available after logging in. The access code is issued to Members by the National Office; we do not create accounts and do not ask for any data. After you log in, we save in your browser one technical cookie that confirms the session and has an expiry date — it expires after a day or when you log out. It contains no first name, surname or e-mail address. The same code opens the materials order form. The Chapter search tool is open to everyone, without logging in.

If you are a Member and want to change or delete your entry, do so in BNI Connect — that is where it is created. You can also write to rodo@bnipolska.pl, and if the matter concerns the directory itself, we will pass it on to the joint controller described above. Objecting to your entry being shown on this website (Article 21 GDPR) takes one message to that address.

The server on which the website runs records the technical data of each connection: IP address, date and time, the address of the sub-page visited and the browser type. We also use the IP address ourselves — as a brake against abuse. The website counts how many times from one address in a short time a form was sent (five per minute), a NIP was checked (twenty per minute), a query was put to the Member search tool (one hundred and twenty per ten minutes) and a login with a Member’s code failed (five per quarter of an hour); once the limit is exceeded, we reply with a request to wait. These counters work exclusively in the server’s working memory: they take into account only events from the last few minutes, save nothing to disk or to a database and disappear at the latest when the server instance shuts down. All of this serves security and fault diagnosis only. The basis is our legitimate interest in maintaining and securing the website (Article 6(1)(f) GDPR). We do not link this data with data from the forms and do not use it for traffic analysis. One exception we must name plainly: when you click Fetch company details, the NIP number goes to our server in the address of the query, so it will appear in the hosting provider’s log next to the IP address — like any other sub-page address. We do not read those logs in order to find it and do not link it with you; the basis and retention period are the same as for the rest of the technical data (Article 6(1)(f) GDPR).

The connection to the website is encrypted (HTTPS). This applies to everything you send: the Member’s access code, the content of the forms and the attachments. The server passes an enquiry from a form to the e-mail provider over an encrypted connection as well.

The website saves five things on your device and none of them is personal data: your choice of light or dark theme (local storage, key “bni-theme”), a marker that the home page intro has already been shown (session storage, key “bni-intro”), your choice from the consent bar (local storage, key “bni-zgody”), after a Member logs in the session cookie “bni-czlonek” with an expiry date, and — only in the preview version before publication — the access cookie “bni-preview”. We do not set analytics or advertising cookies; we count visits without saving anything on your device (section Visit statistics). The full details are described in the Cookie Policy.

We count visits with Cloudflare Web Analytics to know which content is read, how visitors reach it and whether the website loads quickly — and to improve it on that basis. When a page loads, your browser sends Cloudflare the page address, the address of the page you came from, the browser and device type and the load time; Cloudflare determines the country from the connection’s IP address, but does not store the IP address for the statistics. The script uses no cookies or browser storage, assigns no identifier and does not make it possible to recognise you on your next visit; we see only aggregate data. We do not combine it with form data and do not build profiles.

The legal basis is our legitimate interest in understanding how you use the website and improving it (Article 6(1)(f) GDPR). Cloudflare, Inc. runs the statistics for us as a processor under a data processing agreement (section Who we share data with). You can object (Article 21 GDPR) by writing to rodo@bnipolska.pl; any ad-blocking extension also switches the measurement off.

Recordings embedded on the website do not load on their own — until you click, you see a still frame and the browser does not connect to Google’s servers. Clicking the play button starts the YouTube player in privacy-enhanced mode and passes to Google Ireland Limited your IP address and the technical information needed to play the recording. From that moment Google’s rules apply: Google Privacy Policy ↗.

The preview of Instagram posts on the Events page works the same way: a post opens in a large window only after you click. The browser then connects to Instagram’s servers and passes to Meta Platforms Ireland Limited your IP address and the technical information needed to show the post; Instagram may also save its own cookies. From that moment Meta’s rules apply: Meta Privacy Policy ↗. If in the consent bar you chose “Essential only”, the video frame and the post window ask for confirmation before anything connects.

You do not have to start the videos or open the posts — all of the website’s content is available without them.

We do not sell data and do not share it with other companies for marketing purposes. We do, however, use providers who process data on our behalf, under data processing agreements (Article 28 GDPR):

• transactional e-mail provider — Resend, Inc. (United States), through which enquiries from the forms are sent to the Office’s inbox;
• hosting and visit statistics provider — Cloudflare, Inc. (United States), which maintains the website’s server: it processes standard technical connection data in order to maintain and secure the website, keeps in the server’s buffer the BNI Connect directory responses described in the section on the directory and runs the aggregate statistics described in the section Visit statistics;
• e-mail and office tools provider — Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), in whose Google Workspace service the National Office’s inbox is run; every enquiry from a form goes to that inbox;
• other providers of IT tools used by the Office;
• law firm and accounting office — when a matter requires it.

Separately: the NIP number entered in the forms with a NIP field is sent to the REGON register kept by Statistics Poland (GUS) in order to retrieve public company data. This is a query to a public register, not an entrustment of data — GUS does not process it on our behalf. Until a GUS key is obtained, the query goes to the Ministry of Finance’s Register of VAT Taxpayers — on the same terms: a public register, public data, no entrustment.

Separately: the criterion entered in the Member search tool is sent by the server to the BNI Connect directory (bnipl.pl, BNI Global, LLC), the place entered in the worldwide Chapter search — to the Nominatim service (OpenStreetMap Foundation), and the coordinates of that place to the Chapter directory at bni.com (BNI Global, LLC) — these are queries to external services, not an entrustment of data; details in the section on the directory.

We may also transfer data to public authorities if the obligation arises from provisions of law.

Three of our providers have a connection with the United States: Resend, Inc. (form e-mail) and Cloudflare, Inc. (hosting and visit statistics) are based there, and the National Office’s inbox runs in Google Workspace — the agreement is with Google Ireland Limited, but data may also be processed by Google LLC in the United States. Your data therefore goes outside the European Economic Area. Resend, Inc., Cloudflare, Inc. and Google LLC are certified under the EU–US Data Privacy Framework — a programme run by the United States Department of Commerce, for which the European Commission found an adequate level of protection on 10 July 2023 (Article 45 GDPR). Independently of this, the data processing agreements with all three providers contain the European Commission’s standard contractual clauses (Article 46(2)(c) GDPR), so the transfer has a basis even if the certification were to lapse. You can obtain a copy of the safeguards by writing to rodo@bnipolska.pl.

If you start an embedded video, your IP address goes to Google — under the rules described in Google’s privacy policy; if you open an Instagram post — to Meta, under the rules described in Meta’s privacy policy. Google LLC and Meta Platforms, Inc. are certified under the same EU–US Data Privacy Framework referred to above.

The place entered in the worldwide Chapter search goes to the OpenStreetMap Foundation in the United Kingdom — a country for which the European Commission found an adequate level of protection by its decision of 28 June 2021 (Article 45 GDPR) — and the coordinates of the recognised place to BNI Global, LLC in the United States, a company certified under the EU–US Data Privacy Framework. In both cases it is a query from the server, without your IP address. Likewise, the criterion entered in the Member search tool goes to the BNI Connect directory run by BNI Global, LLC in the United States — on the same basis (Article 45 GDPR, EU–US Data Privacy Framework) and also without your IP address.

After these periods expire, we delete the data — and we will delete any enquiry earlier at your request sent to rodo@bnipolska.pl. Withdrawal of consent ends processing for the future — it does not invalidate what we lawfully did earlier. This table does not cover Members’ data from the BNI Connect directory: we do not store it, and an entry lasts as long as it lasts in the directory itself.

You have the right to:

• access your data and obtain a copy of it (Article 15 GDPR);
• rectification of inaccurate data and completion of incomplete data (Article 16);
• erasure of data (Article 17);
• restriction of processing (Article 18);
• portability of data to another controller (Article 20);
• object to processing based on our legitimate interest — on grounds relating to your particular situation (Article 21);
• withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal (Article 7(3)).

You can deal with all of these matters with one message to rodo@bnipolska.pl — withdrawing consent is exactly as easy as giving it. We reply within a month; in complex matters we may extend this period, of which we will inform you.

If you consider that we are processing your data unlawfully, you have the right to lodge a complaint with the supervisory authority: the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warszawa.

No. We do not make decisions about you based solely on automated processing and we do not profile visitors. This also applies to the tools described in the next section.

When handling enquiries and correspondence we use office and e-mail tools in which artificial intelligence features operate — they organise the inbox, summarise long messages and suggest a draft reply. The content of your enquiry may therefore pass through such a tool. We say so here, before you fill in the form, because you are entitled to this information.

• A human decides. The tool determines nothing. The reply, the invitation to a meeting and the next steps are decided by a person from the National Office or the regional Director. We do not make decisions about you based solely on automated processing within the meaning of Article 22 GDPR.
• Only what you yourself write. The tool receives the content of the enquiry and the correspondence connected with it. We do not combine your data with other data sets, do not build a profile and do not train any model on it.
• The tool providers are processors. They act under data processing agreements — Article 28 GDPR — with settings that exclude training models on the entrusted data. The same rule applies to every further tool.
• The website has no AI assistant. There is no chat or bot on the site. You are not talking to a machine here and you leave no data in any chat window.

If you would prefer your enquiry not to pass through such a tool, write to rodo@bnipolska.pl or call — +48 792 092 002. We will handle the matter without their involvement.

Providing data is voluntary, but without it we will not reply to the enquiry or consider the application — the form cannot work without an address to which we can reply.

This document describes the state as at the date of publication. We will change it if the way the website works changes — and we will describe the change openly, not quietly.

Questions about personal data: rodo@bnipolska.pl
BNI Poland Sp. z o.o., ul. Chłodna 51, 00-867 Warszawa