For Polish, please scroll down.
PRIVACY POLICY AND COOKIES POLICY
Using the website www.mellowoffice.com and the Service means acceptance of the terms of this Privacy Policy and Cookies Policy.
As a User, please read its provisions. The table of contents below will help you do so. This Policy explains how we take care of Users’ Data, how we process it, to whom we entrust it, and other important matters relating to Personal Data.
TABLE OF CONTENTS
§1 GENERAL PROVISIONS
§2 DEFINITIONS
§3 PERSONAL DATA AND THE RULES FOR ITS PROCESSING
WHO IS THE CONTROLLER OF THE USER’S PERSONAL DATA?
IS PROVIDING DATA VOLUNTARY? WHAT ARE THE CONSEQUENCES OF NOT PROVIDING IT?
FOR WHAT PURPOSES AND ON WHAT LEGAL BASES DOES THE CONTROLLER PROCESS THE USER’S PERSONAL DATA PROVIDED WHEN USING THE WEBSITE?
HOW IS DATA COLLECTED?
WHAT RIGHTS DOES THE USER HAVE?
CAN THE USER WITHDRAW CONSENT?
DOES THE CONTROLLER TRANSFER THE USER’S DATA TO THIRD COUNTRIES?
HOW LONG DOES THE CONTROLLER STORE THE USER’S DATA?
LINKS TO OTHER WEBSITES
SOCIAL MEDIA ACTIVITY – INSTAGRAM
SOCIAL MEDIA ACTIVITY – PINTEREST
SOCIAL MEDIA ACTIVITY – LINKEDIN
DATA SECURITY
WHO MAY BE RECIPIENTS OF PERSONAL DATA?
HAS THE CONTROLLER APPOINTED A DATA PROTECTION OFFICER?
DOES THE CONTROLLER PROFILE THE USER’S DATA?
§4 FORMS
§5 RULES FOR PROCESSING PERSONAL DATA BY ARTIFICIAL INTELLIGENCE SYSTEMS
§6 DISCLAIMER AND COPYRIGHT
§7 TECHNOLOGIES
§8 COOKIES POLICY
§9 CONSENT TO COOKIES
§10 SERVER LOGS
§1 GENERAL PROVISIONS
This Privacy Policy and Cookies Policy sets out the rules for processing and protecting Personal Data provided by Users, Cookies, and other technologies appearing on the Website operating under the name and address: www.mellowoffice.com.
1. The Controller of the Website and of the Personal Data provided through it is Katarzyna Morzewska Services, conducting business activity under the business name Katarzyna Morzewska Services at ul. Św. Marcin 29/8, 61-806 Poznań, Tax Identification Number (NIP): 7632046170, in accordance with the document generated from the Polish Central Register and Information on Economic Activity.
2. The Controller processes Personal Data in accordance with currently applicable law.
3. The Controller exercises particular care to ensure respect for Users’ privacy and protection of their interests, in particular by ensuring that Personal Data collected by the Controller through the Website is processed solely for specified purposes and is not subject to further processing incompatible with those purposes.
4. Users’ Personal Data is collected and processed solely on appropriate legal bases, and the scope of the Data depends on the type of services provided and is limited as far as possible.
5. If you have any doubts concerning the provisions of this Privacy Policy and Cookies Policy, please contact the Controller at: hello@mellowoffice.com.
6. The Controller reserves the right to amend the Privacy Policy and Cookies Policy, and every User of the Website is responsible for being familiar with the current Privacy Policy and Cookies Policy. Changes may result from developments in internet technology, changes in generally applicable law, or development of the Website, for example through the Controller’s use of new tools. The publication date of the current Privacy Policy and Cookies Policy appears at the bottom of the Website.
7. Capitalized terms used in this Privacy Policy and Cookies Policy have the meanings assigned to them in §2 of the Privacy Policy.
8. The legal acts indicated in §2 constitute the basis for the provisions of this document.
§2 DEFINITIONS
1. Controller – Katarzyna Morzewska Services.
2. User – any entity visiting and using the Website.
3. Website – the website available at www.mellowoffice.com.
4. Personal Data or Data – any information relating to an identified or identifiable natural person, such as a first and last name, identification number, location data, online identifier, or one or more specific factors determining the physical, physiological, genetic, mental, economic, cultural or social identity of a natural person.
5. Consent – a freely given, specific, informed and unambiguous indication of the User’s wishes by which the User, by a statement or clear affirmative action, agrees to the processing of Personal Data concerning them.
6. Form or Forms – places on the Website that enable the User to enter Personal Data for the purposes indicated therein, e.g. sending a Newsletter, placing an order, or contacting the User.
7. Service – a set of cooperating IT devices and software enabling the processing and storage, as well as sending and receiving, of data through telecommunications networks by means of terminal equipment appropriate for the relevant type of network (Internet), including the Website or part thereof, applications including mobile applications and other services of the Controller (if applicable), Social Media and the Controller’s channels operating within such Media (if applicable).
8. GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
9. Personal Data Protection Act – the Polish Act of 10 May 2018 on the Protection of Personal Data (Journal of Laws 2019, item 1781, as amended).
10. Act on the Provision of Electronic Services – the Polish Act of 18 July 2002 on the Provision of Electronic Services (Journal of Laws 2020, item 344, as amended).
11. Electronic Communications Law or PKE – the Polish Act of 12 July 2024 – Electronic Communications Law (Journal of Laws 2024, item 1221, as amended).
12. AI ACT – Regulation (EU) 2024/1689 of the European Parliament and of the Council of 13 June 2024 laying down harmonised rules on artificial intelligence and amending the legal acts listed therein (Artificial Intelligence Act).
13. DSA – Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a Single Market For Digital Services and amending Directive 2000/31/EC (Digital Services Act).
14. Copyright Act – the Polish Act of 4 February 1994 on Copyright and Related Rights (Journal of Laws 1994 No. 24, item 83, as amended).
15. Database Protection Act – the Polish Act of 27 July 2001 on the Protection of Databases (Journal of Laws 2001 No. 128, item 1402, as amended).
16. Act on Collective Management of Copyright and Related Rights – the Polish Act of 15 June 2018 on Collective Management of Copyright and Related Rights (Journal of Laws 2018, item 1293, as amended).
§3 PERSONAL DATA AND THE RULES FOR ITS PROCESSING
WHO IS THE CONTROLLER OF THE USER’S PERSONAL DATA?
The Controller of the User’s Personal Data is Katarzyna Morzewska Services.
The Controller jointly controls Data with the providers of social media platforms, namely:
Squarespace Ireland Limited, Ship Street Great, Dublin 8, D08 N2NT, Ireland [Squarespace];
Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland [Google Workspace];
Pinterest Europe Ltd., Waterloo Exchange, 3rd Floor, Waterloo Road, Dublin 4, Ireland [Pinterest];
Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, D02X525, Ireland [Instagram];
LinkedIn Ireland Unlimited Company, Legal Dept. (Privacy Policy and User Agreement), Wilton Place, Dublin 2, Ireland [LinkedIn].
The above applies, as described in this document, to the Data of persons using social media, following the Controller’s profile on a given social media platform and interacting with the Controller. The Controller uses social media plugins linking to individual platforms, through which the User may proceed to use a given platform. The rules of joint controllership are set out below for each social media platform on which the Controller has a profile and processes Personal Data.
IS PROVIDING DATA VOLUNTARY? WHAT ARE THE CONSEQUENCES OF NOT PROVIDING IT?
Providing Data is voluntary; however, failure to provide certain information, generally marked as mandatory on the Controller’s pages, will result in the inability to perform a given service, achieve a specified purpose, or take specified actions.
Where the User provides Data that is not mandatory or provides excess Data that the Controller does not need to process, this occurs on the User’s own initiative and processing then takes place on the basis of Article 6(1)(a) GDPR (consent). The User gives Consent to the processing of such Data and to the anonymisation of Data that the Controller does not require and does not wish to process but which the User nevertheless provided.
FOR WHAT PURPOSES AND ON WHAT LEGAL BASES DOES THE CONTROLLER PROCESS THE USER’S PERSONAL DATA PROVIDED WHEN USING THE WEBSITE?
The User’s Personal Data on the Controller’s Website may be processed for the following purposes and on the following legal bases:
Number: 1
Purpose of processing: performance of a service or concluded agreement; sending an offer (e.g. advertising offer) at the User’s request
Legal basis for processing: Article 6(1)(b) GDPR (necessary for entering into and/or performance of a contract or taking action at the request of the data subject)
Processing period: for the duration of the agreement / time necessary to send the offer and receive the User’s response, and thereafter until expiry of the limitation period for claims – 2 or 6 years from performance of the agreement depending on whether the User is an entrepreneur
Number: 2
Purpose of processing: issuing an invoice or bill and fulfilling other obligations arising from tax law where products or services are ordered
Legal basis for processing: Article 6(1)(c) GDPR (legal obligation)
Processing period: 5 years from the end of the tax year in which the taxable event occurred
Number: 3
Purpose of processing: granting a discount or informing about promotions and interesting offers of the Controller or entities recommended by the Controller
Legal basis for processing: Article 6(1)(a) GDPR (consent); Article 6(1)(f) GDPR (legitimate interest of the Controller)
Processing period: until Consent is withdrawn; thereafter for 2 years in the case of persons who withdrew Consent, or after 6 months of no activity by the recipient in the case of Newsletter distribution
Number: 4
Purpose of processing: issuing invoices and fulfilling tax and accounting obligations, including sending structured invoices to the National e-Invoice System (KSeF)
Legal basis for processing: Article 6(1)(c) GDPR (legal obligation imposed on the Controller in connection with VAT legislation)
Processing period: 5 years from the end of the calendar year in which the tax payment deadline expired; structured invoices are additionally stored in KSeF for 10 years by the Minister of Finance in accordance with the applicable provisions
Number: 5
Purpose of processing: establishing, pursuing or defending claims
Legal basis for processing: Article 6(1)(f) GDPR (legitimate interest of the Controller)
Processing period: until the basis for processing ceases or until expiry of the limitation period for claims – 2 or 6 years from performance of the agreement depending on whether the User is an entrepreneur
Number: 6
Purpose of processing: telephone/teleconference contact concerning performance of a service or agreement
Legal basis for processing: Article 6(1)(b) GDPR (necessary for entering into and/or performance of a contract)
Processing period: for the duration of the agreement / time necessary to send an offer and receive the User’s response, and thereafter until expiry of the limitation period for claims – 2 or 6 years from performance of the agreement depending on whether the User is an entrepreneur
Number: 7
Purpose of processing: telephone/teleconference contact for presenting an offer and direct marketing
Legal basis for processing: Article 6(1)(a) GDPR (consent)
Processing period: until Consent is withdrawn
Number: 8
Purpose of processing: creating records connected with GDPR and other legal provisions
Legal basis for processing: Article 6(1)(c) GDPR (legal obligation) and Article 6(1)(f) GDPR (legitimate interest of the Controller)
Processing period: until the basis for processing ceases or the Data is no longer useful to the Controller
Number: 9
Purpose of processing: archiving for the purpose of safeguarding information that may serve as evidence of facts
Legal basis for processing: Article 6(1)(f) GDPR (legitimate interest of the Controller)
Processing period: until an objection is raised or the Data is no longer useful to the Controller, or until expiry of the limitation period for claims – 2 or 6 years from performance of the agreement depending on whether the User is an entrepreneur
Number: 10
Purpose of processing: analytics, including analysis of Data collected automatically when using the Website, including cookies such as Google Analytics cookies or Meta Pixel
Legal basis for processing: Article 6(1)(f) GDPR (legitimate interest of the Controller)
Processing period: until cookies are deleted from the User’s browser
Number: 11
Purpose of processing: use of cookies on the Website and its subpages
Legal basis for processing: Article 6(1)(a) GDPR (consent)
Processing period: until cookies are deleted from the User’s browser
Number: 12
Purpose of processing: management of the Website and the Controller’s pages on other platforms
Legal basis for processing: Article 6(1)(f) GDPR (legitimate interest of the Controller)
Processing period: until an objection is raised or the Data is no longer useful to the Controller
Number: 13
Purpose of processing: surveying satisfaction with the services offered
Legal basis for processing: Article 6(1)(f) GDPR (legitimate interest of the Controller)
Processing period: until an objection is raised or the Data is no longer useful to the Controller
Number: 14
Purpose of processing: posting by the User of an opinion concerning services provided by the Controller
Legal basis for processing: Article 6(1)(a) GDPR (consent)
Processing period: until Consent is withdrawn or the Data is no longer useful to the Controller, unless Consent is withdrawn earlier
Number: 15
Purpose of processing: the Controller’s internal administrative purposes connected with managing contact with the User
Legal basis for processing: Article 6(1)(f) GDPR (legitimate interest of the Controller)
Processing period: until the basis for processing ceases or until expiry of the limitation period for claims – 2 or 6 years from performance of the agreement depending on whether the User is an entrepreneur
Number: 16
Purpose of processing: adapting content displayed on the Controller’s pages to individual needs and continuously improving the quality of services offered
Legal basis for processing: Article 6(1)(f) GDPR (legitimate interest of the Controller)
Processing period: until an objection is raised or the Data is no longer useful to the Controller
Number: 17
Purpose of processing: direct marketing to the User of products or Services or recommended third parties
Legal basis for processing: Article 6(1)(f) GDPR (legitimate interest of the Controller)
Processing period: until an objection is raised or the Data is no longer useful to the Controller
Number: 18
Purpose of processing: operating the Instagram profile and interacting with Users
Legal basis for processing: Article 6(1)(f) GDPR (legitimate interest of the Controller) and Article 6(1)(a) GDPR (consent)
Processing period: until Consent is withdrawn, an objection is raised, or the Data is no longer useful to the Controller
Number: 19
Purpose of processing: operating the LinkedIn profile and interacting with Users
Legal basis for processing: Article 6(1)(f) GDPR (legitimate interest of the Controller) and Article 6(1)(a) GDPR (consent)
Processing period: until Consent is withdrawn, an objection is raised, or the Data is no longer useful to the Controller
Number: 20
Purpose of processing: operating the Pinterest profile and interacting with Users
Legal basis for processing: Article 6(1)(f) GDPR (legitimate interest of the Controller) and Article 6(1)(a) GDPR (consent)
Processing period: until Consent is withdrawn, an objection is raised, or the Data is no longer useful to the Controller
Number: 21
Purpose of processing: directing advertising in social media and on websites, such as advertisements created using Facebook Ads Manager, and conducting remarketing
Legal basis for processing: Article 6(1)(a) GDPR (consent) and Article 6(1)(f) GDPR (legitimate interest of the Controller consisting in promotion and advertising of the Controller’s services through remarketing directed to persons subscribed to the mailing list or visiting a given website)
Processing period: until Consent is withdrawn, an objection is raised, or the Data is no longer useful to the Controller
Number: 22
Purpose of processing: contact with the Controller using a chatbot
Legal basis for processing: Article 6(1)(a) GDPR (consent) or Article 6(1)(b) GDPR (contract/service at the User’s request) for responding to the Website User’s question; Article 6(1)(f) GDPR (legitimate interest of the Controller) consisting in ensuring efficient User service and developing Website functionality. The User has the right to human intervention in the case of a decision made entirely by automated means.
Processing period: until Consent is withdrawn, an objection is raised, or the Data is no longer useful to the Controller
Number: 23
Purpose of processing: posting comments by the User
Legal basis for processing: Article 6(1)(a) GDPR (consent)
Processing period: until Consent is withdrawn or the Data is no longer useful to the Controller
Number: 24
Purpose of processing: posting opinions by the User
Legal basis for processing: Article 6(1)(a) GDPR (consent)
Processing period: until Consent is withdrawn or the Data is no longer useful to the Controller
Number: 25
Purpose of processing: creating the Controller’s own databases of Users’ Data
Legal basis for processing: Article 6(1)(f) GDPR (legitimate interest of the Controller)
Processing period: until Consent is withdrawn or the Data is no longer useful to the Controller
Number: 26
Purpose of processing: fulfilling obligations arising from the Digital Services Act (DSA), including handling reports concerning illegal content
Legal basis for processing: Article 6(1)(c) GDPR (legal obligation)
Processing period: for the time necessary to handle the report and for the limitation period applicable to claims connected with content moderation
Where the User provides Data that is not mandatory or excess Data that the Controller does not need to process, this occurs on the User’s own initiative and processing then takes place on the basis of Article 6(1)(a) GDPR (consent). The User gives Consent to the processing of such Data and to the anonymisation of Data that the Controller does not require and does not wish to process but which the User nevertheless provided.
HOW IS DATA COLLECTED?
Only Data provided by the User is collected and processed (except, in certain situations, Data collected automatically by means of cookies and log-in data, as described below).
During a visit to the Website, Data concerning the visit itself is collected automatically, e.g. the User’s IP address, domain name, browser type, operating system type, etc. (log data). Data collected automatically may be used to analyse Users’ behaviour on the Website, collect demographic data about Users, or personalise Website content in order to improve it. Such Data is processed solely for Website administration, ensuring efficient hosting, or directing marketing content and is not associated with Data of individual Users. As a rule, such Data is anonymous and serves the proper use of the Website. More information about cookies appears later in this Policy.
Data may also be collected for the purpose of completing Forms available on the Website, as described later in the Privacy Policy.
Information society services
The Controller does not collect children’s Data. A User should be at least 16 years old in order to independently give Consent to the processing of Personal Data for the provision of information society services within the Website, including for marketing purposes, or obtain the Consent of a legal guardian (e.g. a parent).
A User under 16 years of age should not use the Website or the Service.
The Controller is entitled to make reasonable efforts to verify whether the User meets the age requirement referred to above or whether a person exercising parental responsibility or guardianship over a User under 16 has given or approved Consent.
WHAT RIGHTS DOES THE USER HAVE?
The User has, at any time, the rights provided for in Articles 15–21 GDPR, namely:
the right of access to their Data;
the right to Data portability;
the right to correct Data;
the right to rectification of Data;
the right to erasure of Data where there is no basis for processing;
the right to restriction of processing where processing has been carried out incorrectly or without a legal basis;
the right to object to processing based on the Controller’s legitimate interest;
the right to lodge a complaint with the supervisory authority – the President of the Personal Data Protection Office – if the User considers that the processing of their Data is contrary to currently applicable personal-data-protection law;
the right to be forgotten where further processing is not provided for by currently applicable law.
The Controller points out that these rights are not absolute and do not apply to every processing activity involving the User’s Personal Data. This applies, for example, to the right to obtain a copy of Data. That right may not adversely affect the rights and freedoms of others, such as copyright or professional secrecy. For limitations applicable to Users’ rights, please refer to the GDPR.
The User always has the right to lodge a complaint with the supervisory authority – President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, tel. 22 531-03-00, e-mail: kancelaria@uodo.gov.pl – if they consider that the processing of Personal Data infringes the GDPR or other applicable provisions concerning the processing of Personal Data.
To exercise their rights, the User may contact the Controller at hello@mellowoffice.com, indicating the scope of the request. A response will be provided no later than 30 days from receipt of the request and its justification, unless extension of that period is justified under the GDPR.
CAN THE USER WITHDRAW CONSENT?
If the User has given Consent to a specific activity, such Consent may be withdrawn at any time. This will result in removal of the e-mail address from the Controller’s mailing list and cessation of the indicated activities (where subscription is based on Consent). The User may withdraw Consent by clicking the “unsubscribe” link or a similar link in the Newsletter and confirming withdrawal on the page to which the User is redirected. The User may also withdraw Consent by sending a statement to the Controller’s e-mail address or to the address of the place where the Controller conducts business, if that address is provided in this Privacy Policy. Withdrawal of Consent does not affect the lawfulness of processing carried out on the basis of Consent before its withdrawal.
In some cases, Data may not be completely erased and may be retained for the purpose of defending against potential claims for the period permitted by the Civil Code or, for example, for compliance with legal obligations imposed on the Controller.
In each case, the Controller will respond to the User’s request and appropriately justify further actions arising from legal obligations.
DOES THE CONTROLLER TRANSFER THE USER’S DATA TO THIRD COUNTRIES?
The User’s Data may, to a certain extent, be transferred outside the European Union to third countries.
Because the Controller uses external providers of various services, e.g. Meta Platforms Ireland Limited [Instagram], LinkedIn Ireland Unlimited Company [LinkedIn], Google Ireland Limited [Google Workspace], Pinterest Europe Ltd. [Pinterest], Squarespace Ireland Limited [Squarespace], etc., the User’s Data may be transferred to the United States of America (USA) in connection with storage on US servers, in whole or in part. In the case of Meta Platforms and Google, transfers to the USA take place on the basis of:
the European Commission adequacy decision of 10 July 2023 concerning the EU-U.S. Data Privacy Framework, issued pursuant to Regulation (EU) 2016/679;
Standard Contractual Clauses (SCCs) approved by the European Commission;
additional safeguards used by service providers (e.g. encryption, anonymisation).
In other cases, Users’ Personal Data will be transferred only to recipients that guarantee a high level of Data protection and security, including through cooperation with processors in countries covered by an appropriate European Commission decision, use of Standard Contractual Clauses issued by the European Commission, use of binding corporate rules approved by the competent supervisory authority, or where the User has given Consent to the transfer.
Detailed information is available in each provider’s privacy policy, including:
Google Ireland Limited: https://policies.google.com/privacy?hl=pl
Meta Platforms Ireland Limited: https://www.facebook.com/privacy/explanation
Squarespace Ireland Limited: https://support.squarespace.com/hc/en-us/articles/360000851908-GDPR-and-Squarespace
HOW LONG DOES THE CONTROLLER STORE THE USER’S DATA?
The User’s Data will be stored by the Controller for the duration of individual services / achievement of the purposes indicated in the table above, and:
for the duration of the service and cooperation, and for the limitation period for claims under applicable law – with respect to Data provided by contractors, clients or Users;
for the period of discussions and negotiations preceding conclusion of an agreement or performance of a service – with respect to Data provided in a request for an offer;
for the period required by law, including tax law – with respect to Personal Data connected with compliance with obligations arising from applicable provisions;
until an effective objection under Article 21 GDPR – with respect to Personal Data processed on the basis of the Controller’s legitimate interest, including direct marketing;
until Consent is withdrawn or the processing/business purpose is achieved – with respect to Personal Data processed on the basis of Consent. After withdrawal of Consent, Data may still be processed for the purpose of defending against potential claims in accordance with the limitation period for such claims or a shorter period communicated to the User;
until the Data becomes outdated or no longer useful – with respect to Personal Data processed mainly for analytical and statistical purposes, use of cookies and administration of the Controller’s pages;
for up to 2 years in the case of persons who unsubscribed from the Newsletter, for the purpose of defending against potential claims (e.g. information about subscription and unsubscribe dates, number of Newsletters received, and activities connected with received messages), or after 6 months of no activity by a given subscriber, e.g. failure to open any message from the Controller.
Data-retention periods stated in years are calculated to the end of each year in which processing began. This is intended to streamline Data processing and management.
Detailed Personal Data processing periods for individual processing activities are set out in the Controller’s record of processing activities.
LINKS TO OTHER WEBSITES
The Website may contain links to other websites. They will open in a new browser window or in the same window. The Controller is not responsible for content provided by those websites. The User is required to read the privacy policy or terms and conditions of those websites.
SOCIAL MEDIA ACTIVITY – INSTAGRAM
The Controller administers the User’s Data on the profile named Mellow Office, available at: https://www.instagram.com/mellowoffice, on Instagram (hereinafter: the Profile).
The Controller jointly controls Data with the provider of the Instagram social media platform, in particular with regard to Data of persons using Instagram and the Controller’s Profile, following the Profile and interacting with the Controller. The scope of Data is described below and also follows from the provider’s privacy policy.
Personal Data provided by the User on the Profile will be processed for the purposes of administering and managing the Profile, communicating and interacting with the User, directing marketing content to the User, and building the Profile community.
The legal basis is the User’s Consent and the Controller’s legitimate interest consisting in interacting with Users and followers of the Profile. The User voluntarily decides to like/follow the Profile.
The rules applicable on the Profile are determined by the Controller, while the rules governing use of the Instagram social network follow from Instagram’s terms and conditions.
The User may stop following the Profile at any time. The Controller will then no longer display to the User content originating from the Controller and connected with the Profile.
The Controller can see the User’s Personal Data, such as first name, surname and general information that the User makes public on their profile. Other Personal Data is processed by the social media platform under its terms and privacy rules.
The User’s Personal Data will be processed for the period during which the Profile is operated/exists, on the basis of Consent expressed by liking/clicking “Follow” or otherwise interacting, e.g. leaving a comment or sending a message, and for the purposes of the Controller’s legitimate interests, i.e. marketing its own products or services or defending against claims.
The User’s Personal Data may be made available to other Data recipients, such as cooperating advertising agencies or other subcontractors supporting the Controller’s Profile, IT service providers, or a virtual assistant if contact occurs outside the platform.
The User’s Data may be transferred to the USA in connection with storage on US servers, in whole or in part. For Meta Platforms, transfers to the USA take place on the basis of the EU-U.S. Data Privacy Framework adequacy decision, Standard Contractual Clauses approved by the European Commission, and additional safeguards used by service providers (e.g. encryption, anonymisation).
Such Data may also be profiled, which helps better personalise advertising directed to the User. It will not, however, be processed by automated means within the meaning of the GDPR in a way that has a negative effect on the User’s rights and freedoms.
The User’s remaining rights are described in this Privacy Policy.
Instagram privacy policy: https://help.instagram.com/519522125107875
SOCIAL MEDIA ACTIVITY – PINTEREST
The Controller administers the User’s Data on the profile named Mellow Office, available at: https://pl.pinterest.com/mellowoffice/, on Pinterest (hereinafter: the Profile).
The Controller jointly controls Data with the provider of the Pinterest social media platform, in particular with regard to Data of persons using Pinterest and the Controller’s Profile, following the Profile and interacting with the Controller. The scope of Data is described below and also follows from the provider’s privacy policy.
Personal Data provided by the User on the Profile will be processed for the purposes of administering and managing the Profile, communicating and interacting with the User, directing marketing content to the User, and building the Profile community.
The legal basis is the User’s Consent and the Controller’s legitimate interest consisting in interacting with Users and followers of the Profile. The User voluntarily decides to like/follow the Profile.
The rules applicable on the Profile are determined by the Controller, while the rules governing use of the Pinterest social network follow from Pinterest’s terms and conditions.
The User may stop following the Profile at any time. The Controller will then no longer display to the User content originating from the Controller and connected with the Profile.
The Controller can see the User’s Personal Data, such as first name, surname and general information that the User makes public on their profile. Other Personal Data is processed by the social media platform under its terms and privacy rules.
The User’s Personal Data will be processed for the period during which the Profile is operated/exists, on the basis of Consent expressed by liking/clicking “Follow” or otherwise interacting, e.g. leaving a comment or sending a message, and for the purposes of the Controller’s legitimate interests, i.e. marketing its own products or services or defending against claims.
The User’s Personal Data may be made available to other Data recipients, such as cooperating advertising agencies or other subcontractors supporting the Controller’s Profile, IT service providers, or a virtual assistant if contact occurs outside the platform.
The User’s Data may be transferred to the USA in connection with storage on US servers, in whole or in part. For Pinterest, transfers to the USA take place on the basis of the EU-U.S. Data Privacy Framework adequacy decision, Standard Contractual Clauses approved by the European Commission, and additional safeguards used by service providers (e.g. encryption, anonymisation).
Such Data may also be profiled, which helps better personalise advertising directed to the User. It will not, however, be processed by automated means within the meaning of the GDPR in a way that has a negative effect on the User’s rights and freedoms.
The User’s remaining rights are described in this Privacy Policy.
Pinterest privacy policy: https://policy.pinterest.com/pl/privacy-policy
SOCIAL MEDIA ACTIVITY – LINKEDIN
The Controller administers the User’s Data on the profile named Katarzyna Morzewska, available at: https://www.linkedin.com/in/katarzyna-morzewska, on LinkedIn (hereinafter: the Profile).
The Controller jointly controls Data with the provider of the LinkedIn social media platform, in particular with regard to Data of persons using LinkedIn and the Controller’s Profile, following the Profile and interacting with the Controller. The scope of Data is described below and also follows from the provider’s privacy policy.
Personal Data provided by the User on the Profile will be processed for the purposes of administering and managing the Profile, communicating and interacting with the User, directing marketing content to the User, and building the Profile community.
The legal basis is the User’s Consent and the Controller’s legitimate interest consisting in interacting with Users and followers of the Profile. The User voluntarily decides to like/follow the Profile.
The rules applicable on the Profile are determined by the Controller, while the rules governing use of the LinkedIn social network follow from LinkedIn’s terms and conditions.
The User may stop following the Profile at any time. The Controller will then no longer display to the User content originating from the Controller and connected with the Profile.
The Controller can see the User’s Personal Data, such as first name, surname and general information that the User makes public on their profile. Other Personal Data is processed by the social media platform under its terms and privacy rules.
The User’s Personal Data will be processed for the period during which the Profile is operated/exists, on the basis of Consent expressed by liking/clicking “Follow” or otherwise interacting, e.g. leaving a comment or sending a message, and for the purposes of the Controller’s legitimate interests, i.e. marketing its own products or services or defending against claims.
The User’s Personal Data may be made available to other Data recipients, such as cooperating advertising agencies or other subcontractors supporting the Controller’s Profile, IT service providers, or a virtual assistant if contact occurs outside the platform.
The User’s remaining rights are described in this Privacy Policy.
The User’s Data may be transferred to third countries in accordance with LinkedIn’s terms.
Such Data may also be profiled, which helps better personalise advertising directed to the User. It will not, however, be processed by automated means within the meaning of the GDPR in a way that has a negative effect on the User’s rights and freedoms.
LinkedIn privacy policy: https://pl.linkedin.com/legal/privacy-policy
DATA SECURITY
The User’s Personal Data is stored and protected with due care, in accordance with the Controller’s implemented internal procedures. The Controller processes information about the User using appropriate technical and organisational measures meeting the requirements of generally applicable law, in particular the Personal Data Protection Act and the GDPR. These measures are intended primarily to protect Users’ Personal Data against access by unauthorised persons.
In particular, access to Users’ Personal Data is limited to authorised persons who are required to keep such Data confidential, or entities to which processing of Personal Data has been entrusted under a separate data-processing agreement.
At the same time, the User should exercise care in protecting Personal Data transmitted over the Internet, in particular by not disclosing login credentials to third parties, using antivirus protection and keeping software up to date.
WHO MAY BE RECIPIENTS OF PERSONAL DATA?
The Controller uses services of external entities. Entities to which the Controller entrusts processing of Personal Data (such as courier companies, electronic payment intermediaries, accounting service providers and newsletter providers) guarantee the use of appropriate Personal Data protection and security measures required by law, in particular by the GDPR.
The Controller informs the User that it entrusts processing of Personal Data, among others, to the following entities:
Google Workspace – for use of Google services, including e-mail, and for storing Personal Data on a server;
Squarespace – for creating landing pages and collecting leads;
Portal Dokumentów – for processing accounting documents;
Stripe – for operating the payment system and electronic transactions;
Squarespace and Google Workspace – for domain and mail-server services;
The Ministry competent for Public Finance – as the entity operating the National e-Invoice System (KSeF);
other contractors or subcontractors involved in technical or administrative support or providing legal assistance to the Controller and its clients, e.g. accounting, HR, IT, graphic-design and copywriting support, debt-collection companies, lawyers, etc.
Personal Data may also be disclosed to other recipients, including public authorities such as the tax office, for the purpose of fulfilling legal and tax obligations connected with settlements and accounting.
Entities that process Personal Data, like the Controller, ensure compliance with European Personal Data protection standards, including standards arising from legal acts and European Commission decisions, and use compliance mechanisms when Data is transferred outside the EEA (European Economic Area), including Standard Contractual Clauses adopted by the European Commission.
HAS THE CONTROLLER APPOINTED A DATA PROTECTION OFFICER?
The Personal Data Controller hereby informs that it has not appointed a Data Protection Officer (DPO) and independently performs the obligations connected with processing Personal Data.
The User acknowledges that their Personal Data may be transferred to authorised state authorities in connection with proceedings conducted by those authorities, at their request and after the conditions confirming the necessity of obtaining such Data from the Controller have been met.
DOES THE CONTROLLER PROFILE THE USER’S DATA?
The User’s Personal Data will not be used for automated decision-making having an effect on the User’s rights, obligations or freedoms within the meaning of the GDPR.
Within the Website and tracking technologies, the User’s Data may be profiled, which helps better personalise the company’s offer directed by the Controller to the User, mainly through behavioural advertising. This should not affect the User’s legal situation, in particular the terms of agreements concluded or intended to be concluded. It may only help better adapt content and advertising to the User’s interests. The information used is anonymous and is not associated with Personal Data provided by the User, e.g. during a purchase process. It results from statistical data such as gender, age, interests, approximate location and behaviour on the Website.
Every User has the right to object to profiling if it could negatively affect the User’s rights and obligations.
More information about behavioural advertising: https://www.youronlinechoices.com/pl/o-reklamie-behawioralnej
§4 FORMS
The Controller uses the following types of Forms on the Website:
1. Newsletter subscription form – requires the User to provide their first name and e-mail address in the appropriate fields. These fields are mandatory. To add the User’s e-mail address to the Controller’s subscriber database, the User must then confirm their wish to subscribe. Data obtained in this way is added to the mailing list for the purpose of sending the Newsletter.
Subscription means that the User accepts this Privacy Policy and gives Consent to receive marketing and commercial information by electronic means, e.g. at the e-mail address provided.
By subscribing to the Newsletter, the User also gives Consent to the Controller’s use of the User’s telecommunications terminal equipment (e.g. telephone, tablet, computer) for direct marketing of the Controller’s products and services and for presenting commercial information to the User.
The above Consents are voluntary but necessary in order to use the Newsletter service, including to receive information about services, new blog posts, products, promotions and discounts offered by the Controller or products of third parties recommended by the Controller. Consent may be withdrawn at any time, resulting in cessation of Newsletter distribution in accordance with this Privacy Policy.
The Newsletter is sent for an indefinite period, from activation until Consent is withdrawn. After withdrawal, the User’s Data may remain in the Newsletter database for up to 2 years in order to demonstrate that the User gave Consent to Newsletter communications, the User’s actions (e-mail opens), the time of withdrawal, and any related claims. This constitutes the Controller’s legitimate interest under Article 6(1)(f) GDPR.
Newsletter distribution may be discontinued if the User shows no activity for at least 6 months from commencement of the Newsletter service or from reading the last e-mail. In that case, the Controller will delete the User’s Data from the Newsletter sending system/provider. The User will not be entitled to receive further messages from the Controller unless they subscribe again using the Newsletter form or contact the Controller in another chosen manner.
The mailing system used to send the Newsletter records activity and actions taken by the User in connection with e-mails sent to them, including date and time of opening, clicks on links, and the time of unsubscribing.
The Controller may also conduct remarketing on the basis of Article 6(1)(f) GDPR (the Controller’s legitimate interest consisting in promotion and advertising of services to Newsletter subscribers) by uploading subscriber e-mail addresses to the marketing tool offered by Meta Platforms Ireland Limited, i.e. Ads Manager, and directing advertising created by the Controller or authorised persons through the Controller’s advertising account to those subscribers, provided that they are also Facebook users. Such Data is deleted after each advertising campaign. For each subsequent campaign, an updated subscriber database is uploaded. Information about custom audiences, hashing and Data processing is available in Facebook’s privacy documentation: https://www.facebook.com/legal/terms/customaudience# and https://www.facebook.com/legal/terms/dataprocessing.
2. Contact form – enables a message to be sent to the Controller and electronic contact with the Controller. Personal Data in the form of first name, surname, e-mail address and Data included in the message is processed by the Controller in accordance with this Privacy Policy for the purpose of contacting the User and on the basis of the User’s Consent.
After contact with the User ends, Data may be archived, which constitutes the Controller’s legitimate interest. The Controller cannot determine the exact archiving period and therefore the exact date on which messages will be deleted. However, the maximum period will not exceed the statutory limitation periods for claims unless further contact with the User occurs or processing takes place on another legal basis, e.g. until Consent is withdrawn.
3. Comment form – all Data in the comment form is provided voluntarily by the User if the User wishes to leave a comment. By posting a comment, the User gives Consent to the processing of such Data. This may include first name, surname, e-mail address, website name and IP address. Certain Data marked as mandatory must be entered if the User wishes to use the comment function.
Providing an e-mail address is voluntary but necessary to prevent spam and/or display the User’s avatar. The address is not disclosed to third parties.
The Controller is not responsible for the content of comments posted by readers of the Website and blog. The Controller reserves the right not to publish comments that constitute spam, are offensive, contain vulgar or insulting expressions, contain unlawful content, or contain links to other websites posted without the Controller’s Consent.
The Controller may entrust processing of Personal Data to third parties without separate Consent from the User, on the basis of a data-processing agreement. Data obtained through Forms may not be transferred to third parties. Users should review the privacy policies made available by the providers of those services on their websites.
§5 RULES FOR PROCESSING PERSONAL DATA BY ARTIFICIAL INTELLIGENCE SYSTEMS
Within the Website, we may use artificial-intelligence-based tools (hereinafter AI Systems or AI) for data analysis, automation of customer-service processes, content personalisation and improvement of the services provided. AI is used in accordance with the GDPR and the EU Artificial Intelligence Act (AI ACT).
AI Systems may process Users’ Personal Data for:
analysis of User preferences and adaptation of the offer (e.g. behavioural marketing);
automated handling of User enquiries (e.g. chatbots);
detection of fraud and irregularities in transactions;
statistical analysis for the purpose of improving services.
Data processing by AI takes place only to the extent necessary to achieve the relevant purposes and on appropriate legal bases, such as the User’s Consent (Article 6(1)(a) GDPR) or the Controller’s legitimate interest (Article 6(1)(f) GDPR).
If you have any doubts or questions concerning areas in which the Controller uses AI systems or technologies within the Website, please contact us. Contact details are provided at the beginning of this Policy.
TRANSPARENCY AND AUTOMATED DECISION-MAKING
Where artificial intelligence systems automatically process Users’ Personal Data, we ensure transparency of the process. We inform you that:
we do not use automated decision-making that would significantly affect Users’ rights or freedoms without their explicit Consent;
where profiling is used, e.g. to personalise marketing content, the User has the right to object and to obtain an explanation of the mechanism by which their Data is processed.
If an AI System makes decisions automatically, the User has the right to:
obtain an explanation of the logic used in the AI System;
object to a decision made automatically;
have the decision reviewed by a human.
For this purpose, the User may contact the Controller in any manner indicated at the beginning of this Privacy Policy.
DATA MINIMISATION AND RETENTION PERIOD
The artificial intelligence systems we use are designed in accordance with the principle of data minimisation. This means that:
we process only Data necessary to achieve the specified purpose;
the Data-retention period is adapted to the purpose of processing and does not exceed the necessary period;
after processing ends, Data is anonymised or deleted unless the User consents to further processing or processing is possible on another legal basis.
PROTECTION OF PERSONAL DATA IN AI SYSTEMS
Our AI Systems are designed in accordance with the principles of privacy by design and privacy by default, which means that we implement appropriate technical and organisational measures to protect Personal Data at every stage of processing.
We take care to:
ensure full compliance with the GDPR and AI ACT;
use Data encryption and pseudonymisation mechanisms where possible;
limit access to Data to authorised persons and entities only;
carry out regular compliance audits and data protection impact assessments (DPIAs) in relation to AI tools.
§6 DISCLAIMER AND COPYRIGHT
1. Nature of published content
The content presented on the Website does not constitute legal, tax, financial or other specialist advice (e.g. educational advice) and does not relate to any specific factual situation. If the User wishes to obtain assistance in a particular matter, the User should contact a person authorised to provide such advice or the Controller using the contact details provided.
The Controller is not responsible for the use of content contained on the Website or for actions and omissions undertaken on the basis of that content.
2. Protection of copyright and related rights
Content posted on the Website, including texts, graphics, photographs, video recordings, educational materials, source code and all other publications, is protected under copyright and related-rights legislation.
The Controller does not consent to copying, reproducing, distributing or using such content in whole or in part without the Controller’s express prior Consent. Exceptions are situations permitted by law, such as permitted personal use or quotation within the limits provided by law.
When quoting excerpts of content posted on the Website, it is required to:
identify the author or source of the content;
state the Controller’s full name;
include an active, clickable link to the complete source material on the Controller’s Website.
Any breach of the above rules may result in civil and criminal liability in accordance with applicable law. The Controller reserves the right to pursue claims for copyright infringement, including appropriate compensation.
3. Text and data mining (TDM)
Text and data mining (TDM), meaning analysis performed solely through automated techniques used to analyse text and data in digital form in order to generate information including, in particular, patterns, trends and correlations, may be subject to restrictions within the Website and may require the Controller’s consent.
If content available on the Website is used for data mining for commercial purposes, the User is required to obtain the Controller’s prior consent.
Text and data mining may be permitted without the Controller’s consent solely for scientific and research purposes, provided that use of the content does not infringe copyright and the activities are not carried out for direct or indirect financial gain.
4. Liability of the Controller as an internet service provider
The Controller exercises due care to detect and remove user-generated content (e.g. comments, posts) within the Website that infringes third-party copyright. This also applies to User activity on social media described in this Policy.
If the User posts content on the Website of which the User is not the author or to which the User does not hold rights, the User bears full responsibility for any resulting violations of law.
If a copyright infringement is reported, the Controller may:
remove content that infringes the law;
block access to such content;
provide information about the infringement to competent authorities or the copyright holder.
The User has the right to appeal a decision concerning removal of their content under the procedure specified by the Controller.
By commenting and publishing content on the Controller’s profiles on social media platforms, the User grants the Controller a non-exclusive licence to use such content to the extent resulting from the functionality of the relevant platform and for the duration of publication of such content, until it is removed by the User.
The Controller may moderate, hide or remove Users’ comments and content if they breach the social media platform’s terms, contain offensive, vulgar, misleading or unlawful content, constitute advertising or spam, promote illegal activity, or infringe copyright, including by copying the Controller’s content without Consent.
Users who repeatedly breach content-publication rules may be blocked and prevented from commenting and interacting with the Controller’s Website.
The Controller is not responsible for content published by Users on social media profiles, but may remove materials that breach applicable terms and report infringements to the platform provider.
Social media platforms (Meta, YouTube, LinkedIn) are required to comply with copyright-protection rules and remove content infringing the Controller’s copyright.
The Controller may report infringements to platforms and, if there is no response, pursue rights in court or under procedures provided in platform terms.
Users should comply with social media platforms’ copyright rules and should not publish content that may infringe the rights of others.
5. Currency of content
Content posted on the Website is current as of the date on which it is posted, unless otherwise indicated.
§7 TECHNOLOGIES
To use the Controller’s Website, it is necessary to have:
Internet access using a suitable device such as a desktop computer, laptop or other portable device, including equipment enabling communication and completion of necessary Forms within the Service, e.g. a functioning keyboard;
a properly configured and up-to-date web browser supporting, among other things, cookies, e.g. Microsoft Edge, Opera, Mozilla Firefox, Safari or Google Chrome, and enabling websites to be viewed;
an active and properly configured e-mail account. The Controller recommends checking whether e-mails from the Service domain are directed to the “spam”, “offers/promotions” or another folder rather than the primary inbox. The Controller has no influence over this and it depends on the User’s e-mail settings and/or e-mail provider;
software enabling content to be read in the formats presented, e.g. PDF, video, MP3, MP4.
§8 COOKIES POLICY
These fragments of the cookies policy are protected by copyright belonging to IAB Polska and were taken from http://wszystkoociasteczkach.pl/.
Like most websites, the Controller’s Website uses tracking technologies, i.e. cookies, which make it possible to improve the Website in line with the needs of visiting Users.
The Website does not automatically collect any information other than information contained in cookies.
Cookies are IT data, small text files stored on a terminal device such as a computer, tablet or smartphone when the User uses the Website.
They may be first-party cookies originating directly from the Website or third-party cookies originating from websites other than the Website.
Cookies make it possible to adapt Website content to the individual needs of the User and other visiting Users. They also enable creation of statistics showing how Users use and navigate the Website. This allows the Controller to improve the Website, its content, structure and appearance.
The User has the right to manage Consent to cookies and other tracking technologies in accordance with the requirements of the Digital Services Act (DSA) and the AI Act where artificial-intelligence-based tools are used on the Website.
Categories of cookies used by the Controller:
Necessary – required for the Website to function.
Analytics – e.g. Google Analytics.
Marketing – e.g. Meta Pixel.
Personalisation – adapting content to the User.
Details concerning cookies are provided below and in the cookie Consent management tool.
Web push notifications from the browser
For better communication with the User and faster delivery of valuable content or offers, the Controller enables the User to give Consent to receive web push notifications through the User’s browser.
To give Consent to receive web push notifications, the User should select “show notifications” or a similar option in the message displayed by the User’s browser. The wording may vary between browsers.
Consent to receive such notifications may be withdrawn at any time by changing the User’s browser settings. The Controller does not process Personal Data of Users using web push notifications. Users are identified solely on the basis of information stored by their browsers, to which the Controller does not have access.
Social media plugins, e.g. Pinterest, Instagram, LinkedIn
After clicking the icon of a given plugin, the User is redirected to the website of an external provider, in this case the owner of the relevant social network, e.g. Instagram. The User may then click “Like” or “Share”, follow/like the Controller’s profile on Instagram, or directly share its content (post, article, video, etc.).
The Controller recommends reading Instagram’s privacy policy before creating an account on that platform. The Controller has no influence over Data processed by Instagram. From the moment the User clicks a social-media plugin button, Personal Data is processed by the social network, e.g. Instagram, which becomes the controller of such Data and determines the purposes and scope of processing. Cookies placed by the Instagram plugin or other third parties may also be stored on the User’s device after entering the Website and then associated with Data collected on Instagram. By using the Website, the User accepts this fact. The Controller has no influence over third-party processing carried out in this manner.
The above guidance should also be applied to:
the Instagram profile: https://www.instagram.com/mellowoffice
the LinkedIn profile: https://www.linkedin.com/in/katarzyna-morzewska
the Pinterest profile: https://pl.pinterest.com/mellowoffice/
Content from external portals and websites
The Controller may embed on the Website content from portals, services, blogs and other websites of external entities. In particular, this may include videos from YouTube or Vimeo and audio recordings from SoundCloud.
Those third parties may record certain Data concerning playback of content by the User.
If the User does not want this to occur, the User should log out of the relevant portal before visiting the Controller’s Website (if the User has an account and is logged in) or should not play the relevant content on the Website. The User may also change browser settings and block display of specified content from specified portals.
When playing recordings available on SoundCloud, the User uses services provided by SoundCloud, which is an independent entity providing electronic services to the User. Details concerning SoundCloud’s processing of Personal Data are available at https://soundcloud.com/pages/privacy, its cookies policy at https://soundcloud.com/pages/cookies, and its terms at https://soundcloud.com/terms-of-use.
YouTube
YouTube is operated by Google Ireland Limited and enables playback of recordings available on the Controller’s pages. YouTube may store cookies on the User’s device concerning playback of recordings and associate them with the User’s YouTube account if the User is logged in.
When using recordings posted on YouTube, the User uses electronic services provided by Google Ireland Limited. Details concerning YouTube’s processing of Personal Data are available in the privacy policy and terms at https://policies.google.com/privacy and https://www.youtube.com/t/terms.
Affiliate links and partner programmes
The Controller’s Website may contain affiliate links to certain third-party products or services. This is a method of monetising content on the Website that is generally made available free of charge. Clicking a link does not result in any charge to the User. If the User goes to an external entity’s website by clicking an affiliate link and purchases a product, the Controller may receive a commission. By using the Website, the User agrees to the use of cookies for this purpose.
The Website may also display advertising boxes with third-party products as part of Google AdSense. The Controller has no influence over the content or appearance of those advertisements, which is determined by the provider’s algorithm, in this case Google Ireland Limited. The User can modify ad settings and personalisation through the browser at https://adssettings.google.com/authenticated.
Squarespace – cookie management
The Controller’s Website uses tools provided by Squarespace to manage cookies and Users’ consents.
During the first visit to the Website, the User may be shown a cookie banner enabling acceptance or rejection of optional cookies and management of preferences for individual cookie categories.
Necessary cookies may be used independently of the User’s Consent where they are required for the proper and secure functioning of the Website.
Other cookies, in particular analytics and marketing cookies, are used in accordance with the User’s settings and Consents.
The User may change cookie preferences at any time using the cookie settings available on the Website.
Google reCAPTCHA – protection against spam and bots
To protect the Website against automated attacks (bots), spam and abuse of contact forms, Google reCAPTCHA has been implemented on the Controller’s Website. Google reCAPTCHA analyses the User’s behaviour on the Website to determine whether the User is a human or a bot. This mechanism operates in the background and does not require additional action by the User.
Google reCAPTCHA may collect and analyse the following User Data: IP address, operating-system and browser data, time spent on the Website, mouse movements, interactions with Forms, history of visits to websites on which reCAPTCHA operates, and other technical parameters specified by Google. reCAPTCHA is used solely for:
protecting Forms against automated spam;
protecting the Website against unauthorised access attempts;
improving system security and integrity.
Data processing by Google reCAPTCHA is based on Article 6(1)(f) GDPR – the Controller’s legitimate interest consisting in protecting the Website against abuse and ensuring security.
The entity processing Data is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google privacy policy: https://policies.google.com/privacy.
Data collected by reCAPTCHA is stored in accordance with Google’s rules and may be retained for different periods depending on Google’s settings.
Google reCAPTCHA operates automatically and cannot be disabled for an individual User because it is a key element of Website protection. If the User does not want their Data to be analysed by Google reCAPTCHA, the User may:
object, which entails refraining from using contact Forms on the Website;
use alternative methods of contacting the Controller, e.g. e-mail or telephone.
The Controller again recommends reading the privacy policy of each provider of the above services in order to learn about available changes and settings protecting the User’s rights.
The Website uses two types of cookies: session cookies, which are deleted when the browser is closed, the User logs out or leaves the Website, and persistent cookies, which are stored on the User’s terminal device and allow the browser to be recognised on a subsequent visit to the Website for the period specified in the cookie parameters or until deleted by the User.
In many cases, web-browsing software (a web browser) permits cookies to be stored on the User’s terminal device by default. Users of the Service may change cookie settings at any time. In particular, these settings may be changed so as to block automatic handling of cookies in the browser settings or to inform the User each time cookies are placed on the User’s device. Detailed information on the possibility and methods of managing cookies is available in the software/browser settings.
The Controller informs that restrictions on the use of cookies, including disabling or limiting them, may affect certain functions available on the Website and make the Website more difficult to use.
More information about cookies is available at http://wszystkoociasteczkach.pl/ or in the “Help” section of the web browser menu.
Through the web browser settings, the User may delete cookies originating from the Website or the Controller’s providers by changing browser settings at any time. The method of deleting cookies differs depending on the browser used. Information on deleting cookies is available in the “Help” section of the selected browser.
Deleting cookies does not mean that Personal Data obtained by the Controller through cookies is deleted.
§9 CONSENT TO COOKIES
When first entering the Website, the User should determine the scope of Consent to cookies while using the Website or take other available actions indicated in the displayed message in order to continue using the Website content. The User manages Consents through the cookie-management tool. Lack of Consent to cookies other than necessary cookies does not limit the possibility of using the Website, except for functions dependent on such cookies. The User may change browser settings and disable or delete cookies at any time. The necessary information is available in the browser’s “Help” section.
§10 SERVER LOGS
Use of the Website involves sending requests to the server on which the Website is stored.
Each request addressed to the server is recorded in server logs. Logs include, among other things, the User’s IP address, server date and time, and information about the web browser and operating system used by the User.
Logs are recorded and stored on the server.
Server logs are used to administer the Website and their content is not disclosed to anyone other than persons and entities authorised to administer the server.
The Controller does not use server logs in any way to identify the User.
Legal notice
This Privacy Policy was prepared by the #Legalny Biznes Online law firm, legalnybiznesonline.pl. Do not copy it, either in whole or in part, as doing so will infringe copyright and may expose you to claims. Obtain your own lawful licence by contacting the law firm or using the legal shop at legalnybiznesonline.pl.
Publication date of the Privacy Policy: 29.09.2026
