Privacy Policy

1. Detailed information on the processing of personal data

The controller of your personal data is:

The data controller collects and then processes data for specified purposes that are lawful. The data processing is carried out in accordance with applicable law. Data is collected only to the extent that is relevant, harmonised and necessary in relation to the purposes for which it is processed.

The controller does not process special categories of data. The controller takes measures aimed at protecting data against unauthorised access by third parties, and in particular by unauthorised persons. To this end, it applies organisational and technical security measures at a level appropriate to potential threats.

For hosting the website, the controller uses a certified Data Centre holding ISO 27001 and TIER III. The controller does not disclose data to any entities not authorised to receive it under the mandatory legal provisions applicable in this respect.

On matters relating to:

• the protection of personal data
• exercising the rights available to you regarding the processing of personal data

you can contact the controller at any time:

2. For what purposes is your personal data processed?

Following your prior consent, your data will be processed by the Administrator for the purpose of:

1. providing services by electronic means
2. marketing, including profiling, and for analytical purposes
3. tailoring website content to your preferences and interests
4. statistical measurement and service improvement

3. For how long will your personal data be stored?

Where consent is the basis for processing personal data — that is, voluntary consent — such data will be processed until the User withdraws the consent given.

The personal data of users for whom a service was provided by ICBM Polska Sp. z o.o. will be processed for the period required by law.

4. What are the legal grounds for processing your personal data?

The legal grounds for the processing of personal data by the Administrator are:

1. The consent of the data subject to the processing of their personal data for one or more specific purposes
2. Processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract
3. Processing is necessary for compliance with a legal obligation to which the administrator is subject
4. Processing is necessary for the purposes of the legitimate interests pursued by the administrator or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child

5. Requirement to provide personal data

Only voluntary consent is the basis for using your personal data for analytical or advertising purposes, including profiling. If your browser is configured in a way that prevents cookies from being saved, your data will not be processed.

Certain personal data is required to enter into the relevant contract. The consequence of not providing the personal data required to enter into the relevant contract may be the inability to effectively carry out the actions necessary to conclude the contract.

6. Who will your personal data be disclosed to?

The Administrator will entrust the processing of your personal data solely to entities that have signed a data processing agreement. These include, among others, entities with the following profile:

1. providing IT / CRM services
2. providing e-marketing services
3. providing accounting services
4. providing legal advisory services

The Administrator permits the processing of data by other entities, but only where this is necessary.

7. What are your rights in connection with the processing of personal data?

The Website user has the right to request from the Administrator access to the personal data concerning them. They may also request its rectification, erasure or restriction of processing. The Website user has the right to object to processing, as well as the right to data portability.

Furthermore, in the case of processing based on the user's consent, the user has the right to withdraw their consent at any time without affecting the lawfulness of the processing carried out on the basis of consent before its withdrawal.

On matters relating to:

• the protection of personal data
• exercising the rights available to you regarding the processing of personal data

you can contact the controller at any time:

8. Information on the right to lodge a complaint with a supervisory authority

Every user has the right, at any time, to lodge a complaint with the competent data protection supervisory authority. The complaint procedure and additional information can be found on the website of the relevant data protection authority.

9. Cookies and other technologies

The personal data Administrator informs that the website uses cookie technology. Cookies are IT data (in particular text files) that are stored on the end device of the Website user. Cookies are usually a unique alphanumeric identifier that is added to the Website user's browser in order to identify it. Cookies may additionally contain data such as the IP address, the browser type and language, and the date and time the request was sent.

Types of cookies used

1. essential to the operation of the website – cookies enabling the website to function correctly
2. ensuring security – cookies used for registration/login or the detection of abuse
3. optimising the website's performance – improving the site's performance
4. personalising the website – cookies enabling the website content to be tailored to your settings, personalising the display of the site, remembering viewed products or remembering information about adding specific products to the basket
5. used for personalising ads or analysing traffic – cookies that more effectively match ads to your preferences

Local storage — chat widget and first-party analytics

In addition to cookies, the site uses the browser's local storage. The chat widget stores an identifier in it aiads_chat_vid, used solely to maintain conversation continuity between page views (functional purpose — Art. 6(1)(f) GDPR, legitimate interest). Consent preferences are stored in local storage under the key cookie_consent. Our first-party analytics tool (t.js) runs on the site's domain and respects the choice made in the consent banner — if analytics consent is declined, the session is marked as consent-free. You can delete local storage data in your browser settings (clearing site data).

You can make changes and delete cookies from your browser at any time. To do so, follow the instructions available for your browser:

• Firefox
• Internet Explorer
• Chrome
• Opera
• Safari

Mobile devices:

• Android
• Safari (iOS)
• Windows Phone
• Blackberry

Blocking cookies may affect the correct display of the site. Cookies are placed on your end device and may also be used by advertisers and partners cooperating with the Data Administrator.

Advertising, web analytics and remarketing tags

The Administrator may use analytics tools (e.g. Google Analytics) and remarketing tags (Google AdWords tag, Facebook Ads pixel) that enable the analysis and collection of data about your behaviour on the website. Data is collected in an anonymised manner.

You can block the transfer of this information at any time by using the Google tool available at: Google Analytics Opt-out.

This data may be used to display adverts via Google AdWords, Facebook Ads and DoubleClick. You can adjust the information used by Google at any time by changing your Google account settings or by changing your Facebook profile preference settings.

You can also use the third-party cookie opt-out tool on the Network Advertising Initiative.

Profiling (including analytics)

Profiling is a method of aggregating information about your and other users' behaviour on our websites. Through automated analysis of the content a user views, it is possible to create user profiles (including age, gender and interests). User profiles are used to tailor content, adjust the way adverts are presented, and to find users with characteristics similar to yours.

Detection of artificial traffic in advertising campaigns

To protect against advertising abuse (known as click fraud) and to safeguard advertising budgets, the Administrator processes the IP addresses of users who reach the site from paid advertising campaigns (clicks from Google Ads). These addresses are analysed for characteristics typical of automated, artificial traffic (including the lack of genuine interaction with the site and an unnatural frequency of visits). IP addresses identified as a source of artificial traffic may be excluded from being served adverts.

The basis for this processing is the Administrator's legitimate interest (Article 6(1)(f) GDPR), namely protection against abuse and the effective management of the advertising budget. Full IP addresses are stored for this purpose for no longer than 90 days, after which they are anonymised. This data is used solely to detect artificial traffic and is not used for user profiling or marketing purposes.