Controller – Refericon Spółka z ograniczoną odpowiedzialnością (a limited liability company) with its registered office at ul. Głogowska 31/33, 60-702 Poznań, Poland, entered in the Register of Entrepreneurs of the National Court Register (KRS) kept by the District Court Poznań – Nowe Miasto i Wilda in Poznań, 8th Commercial Division of the National Court Register, under KRS number: 0000668107, NIP (tax ID): 7831755621, REGON: 366778428, share capital: PLN 5,000.00 (fully paid up).

Respecting your rights as data subjects (the persons to whom the data relate) and complying with applicable law, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter the GDPR, the Polish Personal Data Protection Act (hereinafter the Act) and other applicable personal data protection laws, we undertake to maintain the security and confidentiality of the personal data we obtain from you.

All employees have been properly trained in the processing of personal data, and our company, as the Personal Data Controller, has implemented appropriate safeguards and technical and organizational measures to ensure the highest level of personal data protection. We have implemented personal data protection procedures and policies compliant with the GDPR, which ensure the lawfulness and reliability of data processing and the enforceability of all rights you have as data subjects.

In addition, where necessary, we cooperate with the supervisory authority in the Republic of Poland, i.e. the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, hereinafter PUODO).

Contact

Any inquiries, requests and complaints concerning the processing of personal data by our company (the Personal Data Controller), hereinafter Requests, should be sent to the following e-mail address: pawel@studio201.io or in writing to the Personal Data Controller's correspondence address, i.e. ul. Głogowska 31/33, 60-702 Poznań, Poland.

The Request should clearly state:

the details of the person or persons the Request concerns,
the event giving rise to the Request,
your demands and the legal basis for those demands,
the expected way of resolving the matter.

Personal data we collect

On our Website we collect the following personal data:

first name, last name and correspondence address – to use the Services of our Website you will be asked to provide your first and last name and correspondence address, so that we can provide the services and are able to contact you,
phone number – we sometimes call you in the event of unexpected events, at the same time proposing the most favorable solution,
e-mail address – we use your e-mail address to send you confirmations of the services you use on the Website and to contact you when needed in connection with a concluded agreement or the services provided. If you have subscribed to our newsletter, we will also send you commercial information,
NIP – we collect the Tax Identification Number (NIP) from businesses and from persons who request an invoice and have a NIP number,
device IP address – information resulting from the general rules of Internet connections, such as the IP address (and other information contained in system logs), is used by the Website administrator for technical purposes. IP addresses may also be used for statistical purposes, in particular to collect general demographic information (e.g. about the region from which the connection is made),
Cookies – our Website uses Cookies to adapt its operation to your individual needs. Accordingly, you may agree that the data and information you enter be remembered, so that you can use them on your next visit to our Website without having to enter them again.

Purpose of processing

Your personal data are processed by our company as the Personal Data Controller in order to provide the services offered on the Website to you (i.e. the data subjects). In line with the data minimization principle, we process only those categories of personal data that are necessary to achieve the purposes referred to in the previous sentence.

We process personal data for as long as necessary to achieve the purposes listed in the previous paragraph. Personal data may be processed for longer than indicated in the previous sentence where such a right or obligation of the Personal Data Controller arises from specific provisions of law, or where the service we provide is continuous (e.g. a newsletter subscription).

Data transfers

As a rule, your personal data are not transferred to a third country within the meaning of the GDPR. The exceptions are the analytics and marketing tools and the management of our social media profiles, described later in this Privacy policy – their providers may process data in the United States on the basis of the European Commission's implementing decision on the EU-US Data Privacy Framework.

Apart from the providers of the tools described in the sections “Cookies, analytics and marketing tools” and “Planova – managing our social media profiles”, we do not share any personal data with third parties without the explicit consent of the data subject. Without the data subject's consent, personal data may be disclosed only to public law entities, i.e. government and administrative authorities (e.g. tax authorities, law enforcement authorities and other entities authorized under generally applicable law).

Processors

As the Personal Data Controller, we entrust the processing of personal data to the following entities:

providing hosting services for the website – HITME.PL Marek Bajerski with its principal place of business at ul. Franciszka Mamuszki 17A, 80-178 Gdańsk, NIP: 8792487067, REGON: 340405340,
Biuro Rachunkowe HANNA GRZEŚKOWIAK „EKONOMIK" with its principal place of business at ul. Przemysłowa 46A/6U, 61-541 Poznań, NIP: 782-11-03-578, REGON: 301465625,
User.com Sp. z o.o. with its principal place of business at ul. Grzybowska 87, 00-844 Warsaw, NIP: 5272791969,
IFIRMA SA, with its registered office in Wrocław, at ul. Grabiszyńska 241G, 53-234 Wrocław, KRS: 0000281947, NIP: 8981647572,
Vercom S.A., with its registered office in Poznań, at ul. Roosevelta 22, 60-829 Poznań, NIP: 781-17-65-125,
Sendinblue, a société anonyme registered in the Paris Trade and Companies Register under number 498 019 298, with its registered office at 106 boulevard Haussmann, 75008 Paris.

Your rights

Under the GDPR, every person whose personal data we process as the Personal Data Controller has the right to:

access their personal data (Art. 15 GDPR),
correct, complete, update and rectify their personal data (Art. 16 GDPR),
erasure of data (the right to be forgotten) (Art. 17 GDPR),
restriction of processing (Art. 18 GDPR),
data portability (Art. 20 GDPR),
object to the processing of personal data (Art. 21 GDPR),
not be subject to profiling (Art. 22 in conjunction with Art. 4(4) GDPR),
lodge a complaint with the supervisory authority (i.e. the President of the Personal Data Protection Office) (Art. 77 GDPR).

Limits of the right to erasure

Under the GDPR, you may not exercise the right to erasure if:

the processing of your personal data is necessary for exercising the right of freedom of expression and information,
the processing of personal data is necessary for our company to comply with a legal obligation arising from the law,
your data are processed for the establishment, exercise or defense of legal claims.

If you wish to exercise your rights, please send a message by e-mail to: pawel@studio201.io.

Cookies, analytics and marketing tools

On the Website we use tools from third-party providers that store cookies (or similar identifiers) on your device and collect information about how you use the Website. These are:

Google Analytics 4 (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland) – visit statistics: pages viewed, traffic source, approximate location, device and browser type,
Microsoft Clarity (Microsoft Ireland Operations Limited, One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland) – analysis of how the Website is used, including session recordings (cursor movements, clicks, scrolling) to improve usability; content typed into form fields is not recorded,
Meta Pixel (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, D04 X2K5, Ireland) – measuring the effectiveness of ads on Facebook and Instagram and building ad audiences,
LinkedIn Insight Tag (LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland) – measuring the effectiveness of ad campaigns on LinkedIn and demographic statistics of visitors (in aggregate form),
Google reCAPTCHA (Google Ireland Limited) – protecting forms against spam and abuse,
Cloudflare (Cloudflare, Inc.) – delivering the Website, protection against attacks and aggregate performance statistics, without the use of cookies.

We launch the analytics and marketing tools (Google Analytics 4, Microsoft Clarity, Meta Pixel, LinkedIn Insight Tag) only after you give your consent in the banner shown on your first visit. Without consent, they are not loaded. The legal basis for their use is your consent (Art. 6(1)(a) GDPR in conjunction with Art. 399 of the Polish Electronic Communications Law). You can change or withdraw your consent at any time using the “Cookie settings” link in the page footer, without affecting the lawfulness of processing carried out before its withdrawal. The basis for using reCAPTCHA and Cloudflare is our legitimate interest (Art. 6(1)(f) GDPR), i.e. ensuring the security and proper operation of the Website.

The providers of these tools may process data in the United States on the basis of the European Commission's decision on the EU-US Data Privacy Framework. Meta and LinkedIn may combine the information collected with the data of your accounts on their services in accordance with their own privacy policies.

You can delete or block cookies at any time in your web browser settings. You can also use the Google Analytics opt-out browser add-on (tools.google.com/dlpage/gaoptout) and the ad preference settings on Facebook, Instagram and LinkedIn. Restricting the use of cookies does not prevent you from using the Website.

Planova – managing our social media profiles

The Controller uses Planova, an internal tool, to schedule posts, reply to comments and analyze the performance of Studio201's profiles on Facebook, Instagram, LinkedIn and TikTok. For this purpose, we process data made available by these services through their official APIs: the content of posts and of comments under our posts, the identifiers of their authors and aggregate statistics. We use the data solely to manage our profiles. We do not sell, export or combine them with other data. We delete the content of LinkedIn comments after 48 hours, and we do not store the profile data of commenters. The legal basis is our legitimate interest (Art. 6(1)(f) GDPR), i.e. running and developing our communication channels.

Every identified security breach is documented, and in any of the situations specified in the GDPR or the Act, the data subjects and, where applicable, PUODO are notified of such a personal data protection breach.

In matters not governed by this Privacy policy, the relevant provisions of generally applicable law apply accordingly. In the event of any conflict between the provisions of this Privacy policy and those provisions, those provisions prevail.