Privacy and cookies

This document sets out the rules for processing personal data (also referred to as “data”) and cookies on the website centrum-kopert.ploperated at the following URL: centrum-kopert.pland referred to below as the “Website”.

§1. CONTACTING THE DATA CONTROLLER

The controller of personal data processed through the Website is:

NOWANO sp. z o.o.
Ożarów 6A, 98-345 Mokrsko
Tax ID (NIP): 8322102495, REGON: 543729634, KRS: 0001216933

Contact the service provider by phone: 669 481 139 or by email: poczta@centrum-kopert.pl.

§2. THE LEGAL BASES FOR PROCESSING YOUR DATA

When collecting personal data, we inform you of the legal basis for processing. These bases are provided by GDPR, Regulation (EU) 2016/679 on the protection and free movement of personal data. References below mean:

• Article 6(1)(a) GDPR — we process personal data on the basis of your consent;
• Article 6(1)(b) GDPR — processing is necessary to perform a contract or take steps at your request before entering into a contract;
• Article 6(1)(c) GDPR — we process personal data to fulfil a legal obligation;
• Article 6(1)(f) GDPR — we process personal data for our legitimate interests.

§3. DATA PROCESSING FOR CONTRACTS AND LEGAL CLAIMS

1. We may process the personal data needed to perform our contract with you. Before a contract is concluded, we may also process data needed to take steps at your request. This processing is based on Article 6(1)(b) GDPR.
2. For paid services, we may process your data to meet accounting and tax obligations. This processing is based on Article 6(1)(c) GDPR.
3. During and after a contract, we process the contracting party's data to handle or pursue claims. For example, our legitimate interest includes responding to complaints as required by civil law. Processing to defend against or pursue claims is based on Article 6(1)(f) GDPR.
4. We retain this data for as long as necessary for these purposes, no longer than the applicable limitation period for claims.
5. You have rights of access, rectification, erasure, restriction and portability, and may complain to the supervisory authority. For the processing described in point 3, you may also object.
6. Providing this data is voluntary, but without it we cannot enter into or perform the contract.
7. Recipients include our hosting, email, IT, telecommunications, accounting, invoicing software, banking, electronic payment, legal, advisory and debt collection providers, and other service providers used for the stated purpose.

§4. DATA PROCESSING FOR DIRECT MARKETING

1. We may process your personal data for direct marketing, for example when replying to your message with details of our offer.
2. This processing is based on Article 6(1)(f) GDPR.
3. We retain your data for as long as necessary for the purpose.
4. You have rights of access, rectification, erasure, restriction, portability and objection, and may complain to the supervisory authority.
5. Providing this data is voluntary; without it we cannot carry out direct marketing activities.
6. Recipients include our hosting, IT, email, telecommunications and advertising service providers.

§5. DATA PROCESSING FOR SECURITY

1. When you open our Website, we process the following data to keep our services secure:
   • the public IP address of the device making the request;
   • browser type and language;
   • request date and time;
   • the number of bytes sent by the server;
   • the referring page's URL, if you followed a link from that page;
   • information about errors occurring while handling the request.
   Our legitimate interest is keeping server logs and protecting the Website against hacking and other misuse, including identifying the IP address of a person attempting to bypass security, publish prohibited content or misuse our servers. This processing is based on Article 6(1)(f) GDPR.
2. We retain this data for as long as necessary for these purposes, no longer than the applicable limitation period for claims.
3. You have rights of access, rectification, erasure, restriction and objection, and may complain to the supervisory authority.
4. Providing this data is a condition of using the Website. Without it, the Website cannot be used.
5. Recipients are our hosting, IT and telecommunications service providers.

§6. DATA RECIPIENTS

We use external services when processing personal data, so third parties may receive your data.

We identify recipients when collecting data, using concise categories for readability. The categories refer to the following providers:

• IT service provider.
• Email service provider.
• Telecommunications service provider.
• Advertising service provider.
• Accounting service provider.
• Invoicing software provider.
• Legal, advisory or debt collection providers — appointed individually when required.
• Banking service provider.
• Electronic payment service provider.

§7. TRANSFERS TO THIRD COUNTRIES

1. Because we use other service providers, your personal data may be transferred outside the European Economic Area to the United States of America (USA).
2. The European Commission has determined that certain countries outside the EEA provide adequate protection for personal data.
3. As the country to which we transfer data has not been recognised as safe, transfers are based on a contract containing standard data protection clauses adopted by the European Commission.

§8. UNCONDITIONAL DATA SUBJECT RIGHTS

References to your data-processing rights include the rights described below. They may be exercised regardless of the legal basis for processing.

Right of access

You may ask us to confirm whether we process your personal data. If we do, you may access it and receive additional information about:

• the purposes of processing;
• the categories of data;
• the recipients or categories of recipients to whom data has been or will be disclosed, particularly those in third countries or international organisations;
• the planned retention period, where possible, or the criteria used to determine it;
• the rights to request rectification, erasure or restriction, to object to processing, and to complain to the supervisory authority;
• the source of data not collected from you;
• automated decision-making, including profiling, its logic, significance and expected consequences for you.

Following such a request, we must provide a copy of the personal data being processed. If the request is electronic and you do not ask otherwise, we also respond electronically.

Right to rectification

You may request prompt correction of inaccurate personal data. Taking the processing purposes into account, you may also have incomplete data completed, including by providing an additional statement.

Right to erasure (right to be forgotten)

You may request prompt deletion of your personal data. We must erase it without undue delay if any of the following applies:

• you withdraw consent and we have no other basis for processing;
• you make a valid objection to processing;
• your data has been processed unlawfully;
• your data must be erased to comply with a legal obligation;
• your data was collected in connection with offering information society services.

Right to restriction of processing

You may request restriction of processing in the following cases:

• you dispute the accuracy of data, for a period allowing us to verify it;
• processing is unlawful, but you oppose erasure and request restriction instead;
• we no longer need the data for processing, but you need it to establish, exercise or defend legal claims;
• you have objected to processing, pending verification of whether our legitimate grounds override your objection.

Automated decisions, including profiling

You may refuse to be subject to a decision based solely on automated processing, including profiling, that has legal or similarly significant effects on you.

This right does not apply if the decision:

• is necessary for entering into or performing a contract between you and us;
• is authorised by EU or Polish law providing appropriate safeguards for your rights, freedoms and legitimate interests; or
• is based on your explicit consent.

Right to complain

You may complain about the processing of your personal data to the supervisory authority: President of the Polish Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warszawa; phone +48 22 531 03 00; fax +48 22 531 03 01; email kancelaria@uodo.gov.pl.

§9. CONDITIONAL DATA SUBJECT RIGHTS

References to your data-processing rights also include those described below. Their availability depends on the legal basis for processing.

Right to withdraw consent

If we process your data on the basis of consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing before it was withdrawn.

Right to data portability

You may receive the personal data you provided in a structured, commonly used, machine-readable format and transfer it to another controller without obstruction if processing:

• is based on consent or a contract; and
• is carried out by automated means.

You may ask us to send the data directly to another controller where technically feasible. This right must not adversely affect others' rights and freedoms.

Right to object

If we process data under Article 6(1)(f) GDPR, you may object on grounds relating to your particular situation.

We must then stop processing unless we demonstrate:

• compelling legitimate grounds overriding your interests, rights and freedoms; or
• grounds for establishing, exercising or defending legal claims.

If you object to direct marketing processing, we may no longer process your data for that purpose.

§10. INTRODUCTION TO COOKIES

The Website uses cookies: small files containing text that are sent to and stored on the device you use to visit, such as a computer, tablet or smartphone. The browser stores them and sends them back on later visits. We classify cookies in three ways.

By purpose, we distinguish three categories:

• Necessary cookies — enable the Website and its functions to work, for example authentication and security cookies. Without storing them, the Website cannot be used.
• Functional cookies — remember your settings and adapt the Website to your preferences, such as language, font size and appearance. They help improve functionality and performance. Some functions are limited without them.
• Business cookies — include advertising cookies. Some Website functions may be limited without them.

By lifetime, there are two categories:

• session cookies — expire at the end of the session;
• persistent cookies — remain after the session ends.

By the entity managing cookies, we distinguish:

• our own cookies;
• third-party cookies.

§11. THE CONTROLLER'S COOKIES

Our cookies support:

• authentication;
• protection against hacking.

This helps make Website functions easier and more convenient to use.

§12. THIRD-PARTY COOKIES

We use cookies managed by Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043, USA, for:

• Google Ads — running and assessing Google Ads campaigns;
• Google Analytics — assessing Google Ads campaigns, studying user behaviour and traffic, and producing traffic statistics.

Data collected by Google Inc. is anonymous and aggregated and does not contain identifying characteristics understood as personal data of Website users. When using these services, we collect traffic sources, on-site behaviour, device and browser information, IP addresses, domains, demographics (age and gender), interests and geographical data.

§13. COOKIE CONSENT AND MANAGEMENT

Consent to cookies is voluntary and may be withdrawn at any time. Refusing some cookies may limit Website functions or prevent their use.

Cookie consent may be provided:

• through settings in software installed on your device;
• by using a button declaring consent to cookies or confirming that you have read their terms.

Browsers commonly allow cookies and other information on your device by default. If you do not agree, change your browser settings. You can block storage for all websites or a particular website, and delete stored cookies. The method depends on your software.

Find current cookie-management instructions in your browser settings or here: https://www.e-regulaminy.pl/biuletyn/polityka-cookies-obsluga/.

§14. CACHE

When you use the Website, we may automatically use your device's cache. Local storage can retain data between visits to speed up use and avoid repeatedly downloading the same information over your connection. The cache may also store information such as a sign-in password.

§15. LINKS TO OTHER WEBSITES OR SOFTWARE

The Website may link to other websites or software. We are not responsible for their privacy or cookie practices. Read their policies when visiting them or before installing software.

§16. CHANGES TO THE PRIVACY AND COOKIE POLICY

1. This policy takes effect when published on the Website.
2. Changes are made by publishing an updated policy on the Website.
3. We announce changes on the Website at least three days before the new wording takes effect.