Privacy Policy

1.: GENERAL PROVISIONS

1.1.: The Controller of your personal data collected via On-line Services is the limited liability company "ATHENASOFT" SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, with its registered office in Warsaw (registered office address and the correspondence address: ul. Leszczynowa 7, 03-197 Warsaw), entered into the Register of Businesses of the National Court Register (KRS) under the KRS number 0000035122, District Court for the capital city of Warsaw, in Warsaw, 13th Commercial Division of the National Court Register; tax identification number (NIP): 1131896687, statistical code (REGON): 012924870, e-mail address: rodo@ath.pl, telephone number: (22) 594 05 66, (22) 614 34 22, hereinafter referred to as "the Data Controller" or "Athensoft".

1.2.: The Data Controller has appointed the data protection officer, attorney Witold Masionek, as a contact person for any questions or doubts regarding their processing of your data. To contact the data protection officer, you can send a message to the e-mail address: rodo@ath.pl or by post to the following address: Athenasoft sp. z o.o., ul. Leszczynowa 7, 03-197 Warsaw, with the “DPO” note.

1.3.: The Data Controller makes every effort to protect the interests of data subjects, and in particular ensures that data collected by them are processed in accordance with the law and obtained for specific, lawful purposes, are not subject to further processing, inconsistent with such purposes, remain correct in substance and adequate to the purposes for which they are processed and kept in a form which permits identification of data subjects, for no longer than is necessary to achieve the purpose of processing. The Data Controller ensures the security of personal data, i.e. their confidentiality, availability, integrity, and the accountability for operations carried out in connection with the processing of personal data.

1.4.: This Privacy Policy takes into account the requirements laid down in Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 2016, p. 1), hereinafter referred to as: "the GDPR" and the provisions of Polish legal acts, including, the Personal Data Protection Act of 10 May 12018 and the Act of 18 July 2002 on the provision of electronic services.

1.5.: This Privacy Policy has been defined for information purposes only, i.e. it is not a source of obligations for service recipients or clients of On-line Services owned by to the Data Controller.

1.7.: All capitalized terms, expressions and acronyms in this Privacy Policy (e.g. Seller, On-line Store, Electronic Service, On-Line Services, Websites) are to be understood as defined in the On-line Services Regulations, available on their relevant Website, or in the General Terms and Conditions of Sale.

1.8.: This document governs the rules for processing your personal data in connection with business relations/processes existing between you and the Data Controller, and under which the Data Controller processes your personal data, in particular as part of the following On-line Services: www.ath.pl, www.intercenbud.pl, www.bzg.pl, www.ekoszt.pl.

1.9.: If, for specific purposes of processing, Athenasoft is the controller jointly with another party, including under the terms of use of Facebook social network where the Data Controller has a profile, as defined in the rules available at: https://www.facebook.com/legal/terms/page_controller_addendum, information regarding such processing will be provided in a separate document.

1.10.: As part of their business, the Data Controller may operate jointly with other entities- parties to a relation where our organization is the data processor; in such a case the personal data controller is be the party on behalf of which we perform such processing. In the case of such cooperation, you will receive information about the processing of your personal data from the party on behalf of which we process your data.

2.: PURPOSE OF THE PROCESSING AND LEGAL BASIS

2.1.: Depending on your relation with the Data Controller, the latter may process personal data for the purposes of specific business processes, in the following scope:

	Purpose of the processing and legal basis	Data storage times	Data obtained otherwise than directly from the data subject – source and category of data
1. Clients and contact persons involved in the performance of the agreement with the Data Controller	1) to perform the agreement with the Client or to take steps before such agreement is concluded, upon the Client’s request, made in any form; 2) for billing, accounting and financial reporting purposes, 3) to comply with obligations set out in the provisions of law; 4) for purposes defined in consents to the processing of personal data – provided that consents have been given. Providing data other than those defined by the Data Controller or data marked as optional constitutes an express action and means that you consent to the processing of personal data for purposes for which they have been provided. 5) in order for the Data Controller to pursue their legitimate interests: (i) to determine, seek and defend claims; (ii) for statistical purposes in order to improve performance and service quality, and to adapt services to their recipients. Legal basis: to perform the agreement with the Client (Article 6, paragraph 1(b) of the GDPR – if you are a Client; Article 6, paragraph 1(f) of the GDPR – if you cooperate with the Data Controller on behalf of the Client); to comply with legal obligations (Article 6, paragraph 1(c) of the GDPR); for legitimate interests of the Data Controller (Article 6, paragraph 1(f) of the GDPR); The data which are not required in the light the legal bases above are processed by the Data Controller based on the consent, provided that such previous consents have been given (Article 6, paragraph 1(a) or Article 9, paragraph 2(a) of the GDPR).	Data are processed for the term of the agreement with the Client. The Data Controller may store data for the time required under the law, in particular under accounting regulations, and, if justified, until the limitations for claims arising from the agreement with the Client have expired, whichever is longer.	The Data Controller obtains personal data from you or from the Client – for the person which cooperates with the Data Controller on behalf of the Client. The Data Controller collects personal data to the extent necessary to establish cooperation and perform the agreement, and in particular: first and last name, postal address, e-mail address, telephone number, order data and invoice data. If the agreement is made in writing, the Data Controller will also process the personal ID number (PESEL) and the tax identification number (NIP). For the processing of on-line transaction the data may include login, password, as well as purchase and activity history.
2. Contracting Parties/ suppliers and persons involved in the performance of the agreement with the Data Controller	1) to perform the agreement with the Contracting Party or to take steps before such agreement is concluded, upon the Contracting Party’s request; 2) for billing, accounting and financial reporting purposes; 3) to comply with obligations set out in the provisions of law; 4) for purposes defined in consents to the processing of personal data – provided that such consents have been given. Providing data other than those indicated by the Data Controller or data marked as optional constitutes an express action and shall mean the consent to the processing of personal data for purposes for which they have been provided. 5) in order for the Data Controller to pursue their legitimate interests: (i) to determine, seek and defend claims, (ii) for statistical purposes in order to improve performance and service quality, and to adapt services to their recipients. Legal basis: to perform the agreement with the Contracting Party (Article 6, paragraph 1(b) of the GDPR – if you are the Contracting Party; Article 6, paragraph 1(f) of the GDPR – if you cooperate with the Data Controller on behalf of the Contracting Party); to comply with legal obligations (Article 6, paragraph 1(c) of the GDPR); for legitimate interests of the Data Controller (Article 6, paragraph 1(f) of the GDPR); The data which are not required in the light the legal bases above are processed by the Data Controller based on the consent, provided that such previous consents have been given (Article 6, paragraph 1(a) or Article 9, paragraph 2(a) of the GDPR).	The Data Controller may store data for the time required under the law, in particular under accounting regulations, and, if justified, until the limitations for claims arising from the agreement with the Contracting Party have expired, whichever is longer.	The Data Controller obtains personal data from you or from the Client – for the person which cooperates with the Data Controller on behalf of the Client. The Data Controller collects personal data to the extent necessary to establish cooperation and perform the agreement, and in particular: first and last name, postal address, e-mail address, telephone number, order data and invoice data. If the agreement is made in writing, the Data Controller will also process the personal ID number (PESEL) and the tax identification number (NIP). For the processing of on-line transaction the data may include login, password, as well as purchase and activity history.
3. Prospective Clients, recipients of the newsletter and targets of marketing activities	1) to pursue the Data Controller’s legitimate interest (Article 6, paragraph 1(f) of the GDPR), i.e. to conduct marketing activities concerning their own products and services, and in the case of the express consent – also the products and services of companies cooperating with the Data Controller (Article 6, paragraph 1(a) of the GDPR), with the following forms of communication: (i) mailing of trade information (e-mail messages) /newsletter; (ii) voice calls (phone marketing); (iii) mailing of trade information (text messages); (iv) promotion materials sent by traditional snail mail. 2) for purposes defined in consents to the processing of personal data – provided that such consents have been given (Article 6, paragraph 1(a) of the GDPR). 3) to comply with obligations set out in the provisions of law (Article 6, paragraph 1(c) of the GDPR), 4) for legitimate interests of the Data Controller (Article 6, paragraph 1(f) of the GDPR): (i) to determine, seek and defend claims; (ii) for statistical purposes in order to improve performance and service quality, and to adapt services to their recipients.	Data are processed until the consent is withdrawn or an objection is made. After the consent has been withdrawn or an objection has been made, personal data may be stored for the purpose of demonstrating that the Data Controller has duly complied with their respective legal obligations, and for determining any related claims.	If the data have not been obtained directly from the data subject they are sourced from the party-holder of the data subject’s consent to making the data available to the Data Controller, or under another valid legal basis. Such personal data include any items required to conduct specific types of marketing activities (including first and last name, e-mail address, telephone number and/or correspondence address).
4. Correspondence Party	1) to manage correspondence and to ensure document flows and archiving, which is the Data Controller’s legitimate interest (Article 6, paragraph 1(f) of the GDPR).	In general, the storage period of data included in the correspondence will depend on the purpose of data processing covered by a specific piece of correspondence. As a rule, specific data from the correspondence are kept for storage times defined in the provisions of law, and if no storage times have been defined for specific documents, they are kept for the time compatible with the Data Controller’s legitimate interest, i.e. the time available to seek claims, if any.	In general, the Data Controller will process data provided directly by the data subject.
5. Social Media Users	We process data in order to manage social media accounts, in particular to receive notifications, communicate with users of promotions concerning the Data Controller’s brand and their products, to moderate fora, comply with legal obligations, determine claims and keep statistics.	Data are processed until the consent is withdrawn or an objection is made. After the consent has been withdrawn or an objection has been made, personal data may be stored for the purpose of demonstrating that the Data Controller has duly complied with their respective legal obligations, and for determining any related claims, or if justified, until the limitations for claims have expired, whichever is longer.	If personal data have been obtained from persons other than the data subject, such data are sourced from the person who provided them in the notification. The Data Controller collects data to the extent necessary to process the notification, and in particular: first and last name, e-mail address, telephone number, correspondence address, circumstances covered by the notification, bank account number (for reimbursements, if any).
6. Persons who file complaints/ requests and queries, and their representatives	1) to examine any grievance, request or complaint (Article 6, paragraph 1(f) of the GDPR); 2) to perform the agreement connected with the notification (Article 6, paragraph 1(b) of the GDPR – if those who file a request, a complaint or an query are the party to the agreement with the Data Controller, or Article 6, paragraph 1(f) of the GDPR – if the notifying party cooperates with the Data Controller in the name and on behalf of the Data Controller’s Client or their Contracting Party); 3) if applicable – for billing, accounting and financial reporting purposes (Article 6, paragraph 1(c) and (f) of the GDPR); 4) to comply with other obligations set out in the provisions of law (Article 6, paragraph 1(c) of the GDPR); 5) for purposes specified in the consents to the processing of personal data – provided that such consents have been given (Article 6, paragraph 1(a) of the GDPR); if the notification includes data of specific category, such data are processed based on your consent considered as your express action, i.e. data are considered as provided on your initiative in order to process the notification (Article 9, paragraph 2(a) of the GDPR)’ 6) for legitimate interests pursued by the Data Controller (Article 6, paragraph 1(f) of the GDPR): (i) to determine, seek and defend claims, if the notification includes data of specific category, such data are processed to determine, seek and defend claims (Article 9, paragraph 2(f) of the GDPR); (ii) for statistical purposes in order to improve performance and service quality, and to adapt services to their recipients.	Personal data will be stored for 2 years from the expiry of the warranty period or the complaint settlement deadline, and if they are processed to determine, seek or defend claims – until the expiry of their limitation period or the definitive closure of court or enforcement proceedings.	If personal data have been obtained from persons other than the data subject, such data are sourced from the person who provided them in the notification. The Data Controller collects personal data to the extent necessary to process the notification, and in particular: first and last name, e-mail address, telephone number, correspondence address, circumstances covered by the notification, bank account number (for reimbursements, if any).
7. Website visitors and users	1) as far as needed to enable the functionalities and the use of the Data Controller’s Websites (Article 6, paragraph 1(b) and (f) of the GDPR); 2) if applicable – for billing, accounting and financial reporting purposes (Article 6, paragraph 1(c) and (f) of the GDPR); 3) to perform agreements with customers of the Data Controller’s on-line store/ provide electronic services (Article 6, paragraph 1(b) of the GDPR)’ 4) to comply with obligations set out in the provisions of law (Article 6, paragraph 1(c) of the GDPR); 5) to pursue the Data Controller’s legitimate interest, to conduct marketing activities concerning their own products and services (Article 6, paragraph 1(f) of the GDPR), and if the consent has been given – also the products and services of companies cooperating with the Data Controller (Article 6, paragraph 1(a) of the GDPR), with the following forms of communication: (i) mailing of trade information (e-mail messages) /newsletter; (ii) voice calls (phone marketing); (iii) promotion materials sent by snail mail. 6) for purposes specified in the consents to the processing of personal data – provided that such consents have been given (Article 6, paragraph 1(a) of the GDPR). 7) for legitimate interests pursued by the Data Controller under Article 6, paragraph 1(f) of the GDPR: (i) to determine, seek and defend claims; (ii) for statistical purposes in order to improve performance and service quality, and to adapt services to their recipients.	Personal data are processed until the consent is withdrawn or the objection is made; after the consent has been withdrawn or the objection has been made, personal data may be stored for the purpose of demonstrating that the Data Controller has duly complied with their respective obligations and related claims, or, if justified, until the expiry of the limitation period for claims , whichever is longer. With regard to the processing of personal data based on the agreement concluded with the Data Controller, personal data will be stored for the term of the agreement or until the claims under the agreement made with the Data Controller have expired.	If personal data have been obtained from persons other than the data subject, such data are sourced from the person who had a relevant legal basis, including the consent to making the data available to the Data Controller. The Data Controller collects personal data to the extent necessary to manage a specific marketing communication channel, and in particular: first and last name, , e-mail address, telephone number, correspondence address.
8. Participants of events organized at the request of/by the Data Controller	1) to organize the event, and namely to process participants’ applications (Article 6, paragraph 1(f) of the GDPR); 2) to comply with the provisions of the Event Regulations (Article 6, paragraph 1(b) of the GDPR); 3) for the purpose of accounting and financial reporting (Article 6, paragraph 1(c) and (f) of the GDPR); 4) in order for the Data Controller to perform their other obligations under the generally applicable law (Article 6, paragraph 1(f) and Article 9, paragraph 2(i) of the GDPR); 5) for purposes specified in the consents to the processing of personal data – provided that such consents have been given (Article 6, paragraph 1(a) of the GDPR); 6) for other legitimate interests pursued by the Data Controller (Article 6, paragraph 1(f) of the GDPR): (i) to conduct the promotion and marketing of the event; (ii) in order for the Data Controller to be able to exercise their copyright related to the event (e.g. to enforce the authorization to disseminate the image of event participants or the image of persons constituting the detail of a larger whole); (iii) to determine, seek and defend claims; (iv) for statistical purposes in order to improve performance and service quality, and to adapt services to their recipients.	The Data Controller will process personal data for the time necessary to achieve the purpose for which such data have been collected, to enable the organization of the event, and until event-related claims, if any, have expired.	The Data Controller will process data provided by event participants.
9. Users of loyalty programs	1) to comply with the provisions of the Loyalty Program Regulations (Article 6, paragraph 1(b) of the GDPR); 2) for accounting and reporting purposes (Article 6, paragraph 1(c) and (f) of the GDPR); 3) in order for the Data Controller to perform their other obligations under the generally applicable law (Article 6, paragraph 1(c) of the GDPR); 4) for purposes specified in the consents to the processing of personal data – provided that such consents have been given (Article 6, paragraph 1(a) of the GDPR); 5) for other legitimate interests pursued by the Data Controller (Article 6, paragraph 1(f) of the GDPR): (i) to conduct marketing activities related to the loyalty program (and for the communication with program participants, only subject to the participant’s prior consent, consent to contact in a relevant communication channel); (ii) to process notifications and claims about the loyalty program; (iii) to determine, seek and defend claims, (iv) for statistical purposes in order to improve performance and service quality, and to adapt services to their recipients.	The Data Controller will process data for the time necessary to achieve the purpose for which such data have been collected, to enable the participation in the loyalty program, and until related claims, if any, have expired.	The Data Controller will process data provided by users of loyalty programs.
10. Competition participants	1) to perform the organizer’s obligations concerning the organization of the competition, collect competitors’ applications, select competition winners, and send awards, based on the Data Controller’s legitimate interest (Article 6, paragraph 1(f) of the GDPR); 2) for billing, accounting and financial reporting purposes (Article 6, paragraph 1(c) and (f) of the GDPR); 3) to comply with obligations set out in legislative provisions (Article 6, paragraph 1(c) of the GDPR); 4) for purposes specified in the consents to the processing of personal data – provided that such consents have been given (Article 6, paragraph 1(a) of the GDPR); 5) for legitimate interests pursued by the Data Controller (Article 6, paragraph 1 (f) of the GDPR): (i) to determine, seek and defend claims; (ii) for statistical purposes in order to improve performance and service quality, and to adapt services to their recipients.	The Data Controller will process data for the period necessary to achieve the purpose for which they have been collected, i.e. to organize the competition, and until the expiry of the of limitation period for competition-related claims, if any.	The Data Controller will process data provided by competition participants.
11. Competition participants	1) to promote the Data Controller, and if any legal basis exists, also to promote parties which cooperate with Data Controller in this respect (Article 6, paragraph 1(f) of the GDPR); 2) to comply with the provisions of the agreement concluded between the Data Controller and the data subject, provided that such agreement has been made (Article 6, paragraph 1(b) of the GDPR); 3) if applicable – for accounting and financial reporting purposes (Article 6, paragraph 1(c) and (f) of the GDPR); 4) in order for the Data Controller to perform their other obligations under the generally applicable law (Article 6, paragraph 1(c) of the GDPR); 5) for purposes specified in the consents to the processing of personal data – provided that such consents have been given (Article 6, paragraph 1(a) of the GDPR); 6) for the Data Controller to be able to pursue their other legitimate interests (Article 6, paragraph 1 (f) of the GDPR): (i) Data Controller’s promotion and marketing of the event; (ii) in order for the Data Controller to be able to exercise their copyright (e.g. to enforce the authorization to disseminate the image of the data subject or the image of persons constituting the detail of a larger whole); (iii) to determine, seek and defend claims.	Personal data will be stored for the time of the legal basis under which the image is disseminated, and if an agreement has been made between the Data Controller and the relevant party, until the expiry of the limitation period for claims arising under such agreement between the Data Controller and that party.	If the data subject has not provided the data directly to the Data Controller, the Data Controller will source them from the author of the promotional material or the party entitled because of the material production. In most cases such personal data relate to the image.
12. The image of persons recorded with the Data Controller’s CCTV	1) to ensure the safety of persons who stay in the Data Controller’s premises, including access control and property protection, and to determine, seek and defend claims (Article 6, paragraph 1(f) of the GDPR).	The CCTV personal data will be stored from the date of their recording by means of the CCTV system or until you make a reasoned objection. After you have made the objection, the Data Controller may process your personal data to determine, seek or defend claims, in particular when recordings constitute evidence in court or administrative proceedings, and in the latter case your data may be processed until the definitive closure of such proceedings.	In general, the Data Controller will process data which you have provided. If you have not provided your data to the Data Controller, they are sourced from the person who reported your visit to the Data Controller.

3.: INFORMATION ON DATA PROCESSED ON THE DATA CONTROLLER’S WEBSITES

3.1.

Websites will automatically collect solely the information from cookies. The Data Controller hereby informs that cookie files (so-called “cookies”) are to be understood as IT data, in particular text files, which are stored in the terminal device of the Website User. Cookies usually contain the name of their source Website, the information about their storage time on the terminal device and a unique number.

Cookies are used to:

adapt the contents of the Data Controller’s Websites to the user's preferences and to streamline the Website use; in particular, cookies help recognize the device of the Website User and to display the Website in a proper manner, tailored to the User’s individual needs;
to produce statistics in order to better understand how Website Users navigate through Websites, with a view of improving their structure and content;
to manage the Website User’s session.

3.2.

The Data Controller’s Websites use the following cookie types:

"essential" cookies, to enable the use of Services available on Websites, e.g. authentication cookies used for Services which require authentication on Websites, security cookies, used for instance to detect abuses of authentication on such Websites;
"statistical" cookies, to enable the collection of information on how the Data Controller’s Websites are used;
"preferential" cookies, to enable the Website settings selected by the User to be remembered and to personalize the User’s Website interface, e.g. selected language or region of the User’s origin, font size, Website layout, etc.;
"marketing" cookies, to enable the provision of advertising content more tailored to the interests of Website Users.

3.3.: Internet browsers (Website User’s software) enable by default cookies which are stored on the terminal device, and the Website User will always have an option to change the Internet browser settings for cookie use. Restrictions to the use of cookies may affect Website functionalities. Cookies stored on the Website User’s terminal device may also be used by advertisers and partners of the Data Controller. The Website Administrator hereby informs that the Data Controller is responsible for introducing cookies on the Website User’s terminal device and therefore has access to such files. The Data Controller hereby informs that information on how to handle cookies is available in the software (Internet browser) settings. For more information about cookies, pleace check “Help” section in the Internet browser menu.

3.4.: Each Website User who does not consent to the use of cookies needs to change their Internet browser settings by themselves and according to their own preferences. If your Internet browser settings allow to use cookies you consent that the Data Controller stores information collected by means of cookies, in accordance with Article 173, paragraph 2 of the Telecommunications Law Act of 16 July 2004 (Journal of Laws No. 171, item 1800, as amended).

3.5.

You can change the conditions for storing or receiving cookies by changing the settings in any of your Internet browser:

1): Internet Explorer browser

2): Mozilla Firefox browser

3): Chrome browser

4): Safari browser

5): Opera browser

3.6.

In terms of the data storage times, cookies may be categorized into session and permanent cookies.

a): Session cookies are stored on the user’s device until they log out of the Website or turn off the Internet browser;

b): Permanent cookies are stored for a pre-defined period, determined by the parameter included in a specific cookie. Typically, they may be stored for a period from 1 day to 2 years; however, some cookies may retain settings until the User has deleted their search history. Depending on the options provided by the Internet browser or any related tools, the User may delete all or individual cookies by themselves, in accordance with their preferences.

3.7.

Google Analytics, Google Optimize and Google Tag Manager

Websites use Google Analytics, an on-line analytics service provided by Google Ireland Limited (“Google”). Google Analytics uses cookies. Information on how you use the Website, as generated by cookies, is usually sent to a Google server in the U.S for further storage. However, due to the activation of IP anonymization on such Websites, beforehand Google will shorten the User’s IP address in the European Union Member States or in other countries-parties to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be sent to a Google server in the U.S. to be shortened there. On behalf of the Website Administrator, Google will use these details to assess how the User navigates through the Website, to produce reports on the Website traffic rates and to provide other services in connection with Website traffic and Internet use for the Data Controller. The IP address made available by Google Analytics will not be combined with other data in Google’s possession.

The Data Controller processes data in order to assess how Websites are used, and to produce reports on Website traffic types. Based on your use of Websites and the Internet, you will be provided with other related services. The processing is based on the legitimate interest of the Website Administrator.

Google Analytics collects data on IP addresses, network location, date of visit, operating system and browser type. You can prevent the storage of cookies by using the appropriate settings in your Internet browser software; please note, however, that if you decide to do so, you may not be able to use Website functions in full and to their widest possible extent.

In addition, you can prevent Google from collecting any data generated by cookies and data on the Website use (including IP addresses), and from processing such data, by downloading and installing the browser plugin available at the link: Browser Add On, which will disable Google Analytics. In addition to or as an alternative to the browser add-on, you can prevent Google Analytics from Website tracking by clicking this link. An opt-out cookie will be installed on your device, which will prevent Google Analytics from collecting your personal data via Websites and the relevant browser in the future until the cookie file in the browser is uninstalled.

Google Tag Manager may use HTTP request logs. For more information about Google Tag Manager please check the Tag Manager Privacy and Data Security document.

3.8.

Use of Google Ads

Websites use the Google Conversion Tracking tool. If you have been redirected to the Website from an advertisement sent by Google, Google Ads will set a cookie on your device. The tracking cookie will be used when the User clicks on an ad managed by Google. Cookies will expire after 30 days and will not be used for personal identification. If the User visits some of the Data Controller’s Websites and the cookie has not expired, the Data Controller and Google may recognize that the User has clicked on the ad and has been redirected to the relevant Website. Each Google Ads customer will receive a different cookie. Cookies cannot be tracked by Ads advertisers’ Websites. The information collected using the redirect cookies will be used to generate redirect statistics for Ads advertisers who use such functionality. Clients will only be informed of the total number of users who clicked on the ad and were redirected to a relevant Website. However, they will not receive any information item that enables Users’ identification. If you want to stop the Website traffic tacking, please change the settings of your Internet browsers to block cookies from ads.google.com.
You may not use the cookies opt-out option if you want measurements data to be still recorded. If you have deleted the relevant cookie from the Internet browser, in order to be able to use Google Adds you need to reinstall the appropriate cookie.

3.9.

Use of Google reCaptcha

In order to ensure data security during template use, in some cases the Data Controller relies on reCAPTCHA service offered by Google Ireland Limited. This tool is particularly useful to determine whether a relevant entry has been made by a natural person or to identify the automated processing abuse. However, if IP anonymization is activated on the Website, Google will shorten your IP address beforehand in the European Union Member States or in other countries-parties to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be sent to a Google server in the U.S. and shortened there. The service includes sending the IP address and any other data required by Google to reCAPTCHA service. This is due to different privacy policies adopted by Google Ireland Limited.

More information on the Privacy Policy of Google Ireland Limited can be found here.

3.10.

Use of Facebook social plugins

Based on the Data Controller’s legitimate interests (i.e. analysis, streamlining of the Data Controller’s on-line offer within the meaning of Article 6, paragraph 1(f) of the GDPR), the Data Controller uses social plugins (“Plugins”) of the Facebook social network, offered by Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbor, Dublin 2, Ireland (“Facebook”). Plugins may represent elements of interaction or content (e.g. videos, graphics or text inserts) and may be recognizable with one of the Facebook’s logos (a white “f” on a blue tile, the terms “Like”, “Thumbs Up” or “Mark”) or are marked with the note: “Facebook Social Plugin”. For the list and styles of Facebook social plugins see here.

When you use Website functions with a respective plugin, your device will establish a direct connection with Facebook’s servers. Facebook will send the plugin contents directly to your device and integrate it into the on-line offer. In this process, data which are subject to processing may be used to create user profiles. The Data Controller has no influence on the volume of data collected by Facebook with the plugin; however, the Data Controller will provide you with information on how plugins work according to their knowledge.

Thanks to integrated plugins, Facebook will be informed that a given user has accessed a specific Website. If the user is logged in to Facebook, Facebook is able to link their visit to their Facebook account. If users interact with plugins, e.g. by using the “Like” button or the comment function, information about the interaction will be sent from the device directly to Facebook for further storage. If the user is not a Facebook member, Facebook may still be able to obtain their IP address.

The details about the purposes of collection, the scope of data collected by Facebook, and the rules for their further processing and use by Facebook, including the inalienable rights of data subjects related to the above operations, as well as options for setting the safeguards of user’s privacy, can be found in: Facebook’s privacy policy.

If you have a Facebook user profile/account and you do not wish Facebook to collect data from Websites, or to combine them with user data stored on Facebook, before any Website use you need to log out of Facebook and delete cookies. Other settings concerning the use of data for advertising purposes can be changed in Facebook profile settings. Settings are adapted to all devices on which Facebook service is delivered, in particular desktop computers or mobile devices.

3.11.

Facebook Pixel

The Data Controller uses the “user action pixel” (“Facebook Pixel”), i.e. a service provided in Websites by Facebook Inc., 1601 S. California Ave., Palo Alto, CA 94304, USA (“Facebook Inc.”). By means of the Facebook Pixel, the Data Controller is able to track users’ activities once they have viewed or clicked a Facebook ad. This allows the Data Controller to track the performance of the Facebook ad, which in turn helps to improve their methods of achieving statistical goals and market research. Such data are collected as anonymous, i.e. the Data Controller does not process personal data of individual users. However, such data are stored and processed by Facebook, and the Data Controller will inform you about that fact according to their best knowledge. Facebook may link such stored data with your Facebook account, and use them for their own advertising, in accordance with Facebook’s Data Use Policy. You can prevent Facebook and its affiliates from displaying ads on and off Facebook.

3.12.

LinkedIn cookies track how its embedded services are used and are employed to track visitors of several Websites in order to display appropriate ads based on the visitor’s preferences. Some cookies are activated when the Website includes an embedded panel with reference to LinkedIn portal. More information available at: https://www.linkedin.com/legal/privacy-policy

3.13.

YouTube

Cookies will be used if you upload YouTube videos on our Website. With the embedded YouTube videos, such cookies will store the user’s video player preferences.

More information available at: https://policies.google.com/technologies/cookies?hl=en

3.14.

Google Maps

If the Data Controller conducts personal data operations to identify which of their Services or Products are proposed in a specific location, the information on the User’s approximate location may be processed by Websites, based on their IP address.

Websites with available chat function may start to use cookies once they have been opened in order to identify users, manage the chat and monitor users’ activity thereon.

The Data Controller uses the tool to analyze the User’s activities. Cookies help identify the user or match the results of analyses on traffic in the Data Controller’s websites. Based on the outcome of the Data Controller’s analyses, the statistical data will be processed.

3.15.

Polish Post Office, Open Street Map

The location function enables to identify the pick-up point in the approximate vicinity of the user’s location.

3.15.

Disqus comments plug-ins

In their Websites, the Data Controller uses Disqus comment system, i.e. a service provided by Disqus, Inc., 717 Market St San Francisco, CA 94103, USA (“Disqus”). You use Disqus service as its independent user, and the service is provided based on and under the terms set out in the regulations and the privacy policy of Disqus service.

If Websites with embedded Disqus service are displayed, i.e. the comment system, Disqus will send cookies to the User’s device to enable the identification of their Internet browsers, and to ensure an adequate service performance, in particular to enable the User to log in to the comment system and to post comments. In such transferred cookies, Disqus may also collect data on how Websites are used by their visitors in order to determine the actual Website use patterns, including users’ activities, and to personalize any contents displayed under the service, including ads.

If you post comments on our Websites, your personal data will stored and processed by Disqus and the Data Controller will inform you about that fact according to their best knowledge.

You may prevent Disqus and its affiliates from displaying ads on and off Disqus. The details about the purposes of collection, the scope of data collected, and their further processing and use by Disqus, including any related rights and options for setting the safeguards of user’s privacy, can be found in: Disqus’ Data Use Policy, and the detailed terms and conditions of Disqus services have been defined in Disqus Regulations for the Provision of Services.

3.17.

Server Logs

1): While you use Websites queries are sent to the server used for their storage.

2): Each query to the server is recorded in the server log. Logs include e.g. the User’s IP address, server date and time, information about the User’s Internet browser and their operating system.

3): Logs are saved and stored on the server.

4): Data stored in the server logs are not linked to individual Website users and are not used by the Data Controller for the purpose of their identification.

5): Server logs are solely an auxiliary material used for Websites administration, and their contents are not disclosed to anyone except persons authorized to administer the server.

4.: DATA RECIPIENTS

4.1.: The recipients of your personal data may include external entities which provide support to the Data Controller, parties to appropriate data processing agreements. In connection with any activities of the Data Controller which require the processing of your personal data, personal data will be disclosed to external parties, in particular to providers responsible for the operation of IT systems, providers of legal or accounting services, couriers or providers of marketing services.

4.2.

Below we provide the list of possible recipients of your personal data:

a): vendors of software needed to run and maintain Websites;

b): parties-providers of goods;

c): wholesalers and contracting parties of the Data Controller, including distributors;

d): providers of electronic payment solutions and banks;

e): insurance companies and other financial and payment institutions;

f): accounting firms;

g): notaries and law firms or firms of legal advisers;

h): providers of consulting and auditing services;

i): providers of document archiving and destruction services;

j): website hosting providers;

k): parties dealing with Website streamlining;

l): vendors of software intended to facilitate business (e.g. accounting software);

m): providers of technical support to the Data Controller;

n): providers of the mailing system;

o): providers of marketing services;

p): providers of statistical services;

q): relevant public authorities, to the extent that the Data Controller has an obligation to provide data to such public authorities.

5.: FREE PROVISION OF DATA AND RIGHTS OF DATA SUBJECTS

5.1.: Your data are given freely, however their provision is necessary when agreements have been made with the Data Controller, for the settlement of their business activities and for their compliance with their obligations under generally applicable law. For other legal bases under which personal data are processed (in particular when the Data Controller processes data for marketing purposes), such data are given freely.

5.2.

You have the right to:

a): withdraw your consent if the Data Controller has obtained such consent to the processing of personal data;

b): request that your personal data be deleted, and based thereon, you may request the deletion of data which do not need to be processed any longer to achieve any of the purposes for which they have been collected;

c): request to limit the processing of your personal data – if such request is made, the Data Controller ceases to perform personal data operations, except for operations to which the data subject has consented, and ceases to store them, in accordance with the retention rules adopted by the Data Controller or until the reasons for restriction of data processing have ceased to exist;

d): access your personal data;

e): make an objection – the data subject may at any time object – for reasons related to their individual circumstances – to the processing of their personal data conducted based on the legitimate interest of the Data Controller (e.g. for analytical or statistical purposes);

f): have your personal data transferred – on such grounds, the Data Controller will hand over the data provided by the data subject in a readable format. You may also request that your data be sent to another party, provided however that both the Data Controller and such party possess relevant technical capabilities;

g): file a complaint to the Office for Personal Data Protection – if it is found that the processing of personal data violates the provisions of the GDPR or other provisions on the protection of personal data, the data subject may file a complaint to the authority responsible for the supervision of personal data processing, with the jurisdiction over the place of the data subject’s habitual residence, their place of work or the place where the alleged infringement has been committed.
In Poland, the supervisory authority is the President of the Office for Personal Data Protection. More information is available at: Complaint to the President of the Office for Personal Data Protection.

5.3.: The Data Controller reviews your requests, demands or objections, in accordance with the applicable provisions on the protection of personal data. Please note however that your rights are not absolute and that the legislation provides for exceptions to their exercise.

5.4.: Should you wish to get further information or exercise any of your rights above, please send an e-mail to: rodo@ath.pl

6.: AUTOMATED DECISION-MAKING

6.1.: As part of the processes which they conduct, the Data Controller will not adjust contents in an automatic manner (including in the form of profiling) so that, as a result of such automated processing, decisions could be made, other legal effects could be produced or a significant influence could be exerted on customers, contracting parties and their staff/associates of the Data Controller.

6.2.: If, as part of the processes conducted by the Data Controller, it is planned to activate an automated decision-making process, you will be informed about such steps either by means of the amendment to this Privacy Policy or in a separate statement.

7.: TRANSFERS OF DATA TO THIRD COUNTRIES OR INTERNATIONAL ORGANIZATIONS

7.1.: Your personal data may be transferred to third countries and international organizations provided that entities based in such countries have implemented appropriate safeguards for personal data which are subject to processing. If personal data are transferred outside the EEA, the Data Controller will conclude agreements with recipients of your personal data, based on standard contractual clauses published by the European Commission in accordance with Article 46, paragraph 2(c) of the GDPR.

7.2.: A copy of standard contractual clauses can be obtained from the Data Controller by contacting them using contact details provided in section 1.1 of this Privacy Policy, with a “Standard Contractual Clauses” note. Safeguards used by the Data Controller for your data are compliant with the rules laid down in Chapter V of the GDPR. You may also request further information about respective safeguards, obtain a copy of such safeguards and information on where they have been made available.

8.: FINAL PROVISIONS

8.1.: Services and functions available on Websites, as well as the Data Controller’s offer may by subject to change, including extensions. This means that the Data Controller may amend this document from time to time.

8.2.: Such changes will be announced by means of a relevant notice of amendment to the Privacy Policy, published on relevant Websites. Upon each and every change, a new version of the Privacy Policy will be displayed with an amended date.

8.3.: The Data Controller uses technical and organizational measures to ensure the protection of personal data which they process, in line with existing threats and categories of protected data, and in particular they protect data against unauthorized access, removal by an unauthorized person, processing in violation of applicable regulations, and their modification, loss, damage or destruction.

8.4.: The current version of this Privacy Policy becomes effective on 4 July 2023.

Kosztorysowanie

Niezbędne

Oferta

Zakupy

Athenasoft

Pobierz

Obsługa klienta

Pomoc i informacje online

Nasze serwisy

Newsletter