PRIVACY AND COOKIES
Privacy policy
Personal data, cookies and your rights. The policy below retains the original document’s effective date of 21 February 2024. Contact us using the form or telephone.
This Privacy Policy describes the rules for processing personal data within this website (the “Platform”).
This Privacy Policy is informative and fulfils the information obligations imposed on the data controller by the GDPR, namely Regulation 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
Everyone using the Platform should read this Privacy Policy. It sets out the rules for processing personal data and using cookies and other tracking technologies employed in connection with the operation of the Platform.
01 Personal data controller
The personal data controller is Exacto Holding sp. z o.o., with its registered office in Warsaw (01-745), ul. Jasnodworskia 3B/271, entered in the register of entrepreneurs of the National Court Register maintained by the District Court for the Capital City of Warsaw in Warsaw, XII Commercial Division of the National Court Register, under KRS number 0000623940, NIP 5222980786 and REGON 143758000, with share capital of PLN 250,000 (hereinafter the “Service Provider”).
Any data subject may contact the Service Provider, as the controller of their personal data, through the contact form on this website: , or by letter sent to the address specified in paragraph 1.1 above.
The Service Provider has appointed a Data Protection Officer, Mr Bartłomiej Serafinowicz. He can be contacted by telephone at +48 664 272 989.
02 How data is processed
The purpose and scope of personal data processing are determined by the scope of consent and the data provided by the data subject before starting to use the Platform. Personal data processed by the Service Provider may include in particular: (i) first name; (ii) surname; (iii) email address; (iv) company name (employer/principal); (v) telephone number; (vi) IP address; and (vii) other data voluntarily provided by the person.
Providing personal data is voluntary, but failure to provide it will prevent contact through the contact form. The nature of the activities undertaken by the Service Provider makes it impossible to provide them anonymously.
Personal data will be processed for the following purposes:
| Purpose of processing | Scope of data | Legal basis for processing | Processing period |
|---|---|---|---|
| Providing access to the Platform | IP address and Cookies necessary to display the Platform | Article 6(1)(f) GDPR — the Service Provider’s legitimate interest, as controller, in enabling the website to be displayed | Until the User’s presence on the Platform ends |
| Contact initiated through the contact form | First name, surname, email address, company name (employer/principal), telephone number and other data voluntarily provided by the data subject | Article 6(1)(f) GDPR — the Service Provider’s legitimate interest, as controller, in handling enquiries and correspondence sent directly by data subjects using Platform functionality | Until correspondence ends or the data subject objects |
| Telephone contact with data subjects | Telephone number, first name and surname, and other data voluntarily provided by the data subject during the call | Article 6(1)(f) GDPR — the Service Provider’s legitimate interest, as controller, in handling enquiries and correspondence sent directly by data subjects | Until the call ends or the data subject objects |
| Studying traffic on the Platform | IP address and Cookies | Article 6(1)(a) GDPR — the data subject’s consent | Until the data ceases to be useful or the data subject withdraws consent |
| Sending the Newsletter | Email address | Article 6(1)(a) GDPR — the data subject’s consent | Until the data ceases to be useful for the processing purpose pursued or the data subject withdraws consent |
If the Service Provider learns that a person is using the Platform in breach of generally applicable law, it may process the User’s personal data to the extent necessary to determine the scope of their liability. This will take place under Article 6(1)(f) GDPR, namely the Service Provider’s legitimate interest in pursuing claims and defending against claims.
The Service Provider will not transfer personal data to third countries outside the EEA. However, should this become necessary, the Service Provider assures that it will: (i) use one of the legal instruments permitted by the GDPR to legitimise the transfer; (ii) verify the recipient and assess the ability of the recipient’s country to protect the rights and freedoms of data subjects; and (iii) before the transfer, inform the persons whose data is to be transferred to a third country and explain their rights relating to the transfer.
03 Data recipients
The Service Provider may entrust the processing of Users’ personal data to third parties. Recipients may include in particular: a hosting provider, an email operator, a programming company, a software supplier, an email delivery service provider and entities providing cloud solutions.
Personal data collected by the Service Provider may also be disclosed to the relevant state authorities or institutions (law enforcement bodies, courts and security services) authorised to access it under the applicable provisions of law, or to other persons and entities in cases provided for by generally applicable law.
Each entity to which the Service Provider entrusts personal data for processing under a personal data processing agreement (the “Processing Agreement”) guarantees an appropriate level of security and confidentiality in the processing of personal data. An entity processing personal data under a Processing Agreement may process it through another entity only with the Service Provider’s prior consent.
Disclosure of personal data to entities not authorised under this Privacy Policy may take place only with the data subject’s prior written consent.
04 Rights of data subjects
Every data subject has the right to: (a) have personal data collected about them erased from both the Service Provider’s system and the databases of entities with which it cooperates or has cooperated; (b) restrict the processing of personal data; (c) portability of personal data collected about them by the Service Provider, including receipt of it in a structured format; (d) request access to and rectification of their personal data; (e) object to the processing of personal data; (f) withdraw consent given to the Service Provider at any time, without affecting the lawfulness of processing based on consent before its withdrawal; and (g) lodge a complaint against the Service Provider with the supervisory authority, the President of the Polish Personal Data Protection Office.
Data subjects may exercise their rights in particular through the communication channels specified in paragraph 1.2 of this Privacy Policy or by contacting the Data Protection Officer, whose details appear in paragraph 1.3.
A data subject wishing to exercise any of their rights is advised to use the contact form on this website: , or contact the Data Protection Officer directly by telephone at +48 664 272 989. This will enable the Service Provider to take action as quickly as possible.
05 Other data
The Service Provider may store HTTP requests, meaning that server log files may record certain information about Users, including: the IP address of the computer from which the request originated; the User’s workstation name, identified through HTTP; the system date and time of registration in the Application and receipt of the request; the number of bytes sent by the server; the URL of the page previously visited by the User; information about the User’s browser; and information about errors occurring during HTTP transactions. Logs may be collected for the proper administration of the Platform. Only persons authorised to administer the IT system may access the data referred to above. Log files may be analysed to compile statistics on Platform traffic and errors. Summaries of such information do not identify Users.
The Service Provider may use Google Analytics and HotJar analytical tools, through which it has access to anonymised information about Users, including the operating system and web browser used and the time spent on the Platform. This information is not combined with the User’s personal data, does not enable identification and is not personal data within the meaning of the GDPR.
The extent to which the tools referred to in paragraph 5.2 above are used in relation to a User depends on the scope of the consent they have given to the use of Cookies.
06 Security
The Service Provider takes care of the security of Users’ personal data. It has implemented appropriate security and personal data protection measures taking account of the risks associated with processing. In particular, it applies technical and organisational safeguards against disclosure to unauthorised persons, taking by an unauthorised person, alteration, loss, damage or destruction, and processing in breach of the GDPR, including through the use of SSL certificates. Personal data sets collected by the Service Provider are stored on secure servers and are also protected by its internal personal data processing procedures and information security policy.
Regardless of the above, the Service Provider points out that using the Internet and electronically supplied services may carry a risk of malicious software (malware) entering a person’s IT system and device, as well as third parties obtaining access to data, including personal data. To minimise such risks, everyone should use appropriate technical safeguards, such as antivirus software, or safeguards protecting their identity on the Internet.
07 Cookies
To ensure the proper operation of the Platform, the Service Provider uses cookies (“Cookies”). Cookies are text information stored on the User’s device, such as a computer or smartphone, which can be read by the Platform’s IT system or third-party IT systems.
The Service Provider uses two types of Cookies: (a) session Cookies, which are permanently deleted when the browser session ends; and (b) persistent Cookies, which remain on the device after the browser session ends until they are deleted.
Neither session nor persistent Cookies allow identity to be established or identification in any other way. Cookies do not allow any personal data to be retrieved.
Files generated directly by the Service Provider cannot be read by other websites. External Cookies, meaning Cookies placed by entities cooperating with the Service Provider, may be read by an external server.
The User may independently change Cookie settings at any time, specifying the conditions for their storage through the web browser settings.
The User may independently disable the storage of Cookies on their device at any time in accordance with the browser manufacturer’s instructions, but this may make some or all Platform functionality unavailable.
The User may independently delete Cookies stored on their device at any time in accordance with the browser manufacturer’s instructions.
The Service Provider uses its own Cookies to maintain User sessions; configure the Platform; analyse and study its audience, including the number of clicks and Users’ navigation paths in order to improve its appearance and content organisation; measure time spent on the Platform; and determine the number of Users and the frequency of their visits.
The Service Provider uses external Cookies to create anonymous statistics that help optimise the Platform’s usability and to analyse and study Users’ behaviour on the Platform.
Detailed information on managing Cookies is available in the settings of the web browser used by the User.
08 Final provisions
Effective date of this Privacy Policy: 21.02.2024