Privacy Policy.

§ 1 General provisions.

1. The administrator of personal data of users of the website located at www.grupa-icea.pl is ICEA S.A. with its registered office in Poznań, at ul. Szyperska 14, 61-754 Poznań, entered in the National Register of Entrepreneurs kept by the District Court Poznań – Nowe Miasto i Wilda in Poznań, 8th Commercial Division of the National Court Register under KRS number: 0000986203, NIP: 7811993323, REGON: 382883680, share capital PLN 1,857,048.00 paid in full (hereinafter: „Administrator”).
2. The Administrator can be contacted:
   a. by e-mail: ado@grupa-icea.pl
   b. in writing, at the Administrator’s address: ul. Szyperska 14, 61-754 Poznań.
3. The purpose of the Policy is to define the actions taken with regard to personal data collected through the Administrator’s website and related services and tools used by its users, as well as in the course of concluding and performing contracts in contact outside the website.
4. If necessary, the provisions of this Policy may be amended. The amendment will be communicated to users by announcing the new content of the Policy, and in the case of the database of persons who have consented to the processing of data by e-mail or provided e-mail data when performing contracts, they will also be notified of the amendment by e-mail.

§ 2 Basis for processing, purposes, and storage of personal data.

1. Users’ personal data is processed in accordance with the General Data Protection Regulation, the Personal Data Protection Act, the Personal Data Protection Act of May 10, 2018, and the Act on the Provision of Electronic Services of July 18, 2002.
2. In the case of personal data processing based on an email or complaint sent by the user, such processing is carried out pursuant to Article 6(1)(b) of the General Data Protection Regulation, according to which data processing is necessary to take action at the request of the data subject.
3. If separate consent is obtained from the user, their personal data may also be processed by the controller for marketing purposes, including for the purpose of sending commercial information by electronic means to the email address provided by the user (Article 6(1)(a) of the General Data Protection Regulation).
4. In the event of the Controller concluding and performing a sales contract or service contracts, the other party is required to provide the data necessary to conclude the contract (which is a contractual requirement and, in the case of tax numbers, also a statutory requirement) and for this purpose the Controller processes personal data (Article 6(1)(b) of the General Data Protection Regulation)..
5. In the case of conducting research and analysis to improve the operation of available services (e.g., tracking tools), Article 6(1)(f) of the General Data Protection Regulation is indicated as the basis for data processing.
6. Users’ personal data is stored for no longer than is necessary to achieve the purpose of processing, i.e. until consent is withdrawn if processing is based on such consent, until the Administrator’s and the other party’s claims regarding the performance of concluded contracts expire (in the case of sales contracts/service contracts, 2 years, counting to the end of the year) and until the request sent by e-mail is processed or until the complaint is resolved.
7. To the extent necessary for the proper functioning of the website, its functionality, and the proper execution of payment transactions (if such transactions are carried out via the website), the website uses the User’s metadata. Metadata should be understood as the process of reading and recognizing by the website’s IT system the configuration and components of the computer used by the user in order to adapt the website to its capabilities and establish a secure connection between the user’s computer and the website. Importantly, such metadata cannot lead to the identification of the User, nor is it in any way harmful to the data stored on the computer. Nevertheless, the User has the right to withdraw their consent to the processing of metadata at any time by configuring their browser accordingly or downloading the appropriate plug-in provided by the browser manufacturer. To do this, consult the software manufacturer and follow their recommendations.
8. The Administrator may use profiling for direct marketing purposes, but the decisions made by the Administrator on this basis do not concern the conclusion or refusal to conclude a contract or the possibility of using electronic services. The effect of using profiling may be, for example, granting a discount to a given person, sending them a discount code, reminding them of unfinished purchases, sending a product proposal that may correspond to the interests or preferences of a given person, or offering better conditions compared to the standard offer. Despite profiling, the person is free to decide whether they want to take advantage of the discount or better terms and make a purchase. Profiling consists of the automatic analysis or prediction of a person’s behavior on the Administrator’s website, e.g., by adding a specific product to the shopping cart, viewing a specific product page, or by analyzing the history of activity on the website. The condition for such profiling is that the Administrator has the personal data of the person concerned in order to be able to send them, for example, a discount code.
9. To the extent necessary for the proper functioning of the website and its functionality, the website may collect other information when used by the User, including, but not limited to:
1. IP address;
2. information about the device, hardware, and software, such as hardware identifiers, mobile device identifiers (e.g., Apple Identifier for Advertising [„IDFA”] or Android Advertising ID [„AAID”]),
3. platform type,
4. settings and components,
5. installed software
6. presence of necessary plug-ins;
7. approximate geolocation data (based on IP address or device settings);
8. web browser data, including browser type and preferred language;
10. Taking into account the nature, scope, context, and purposes of processing, as well as the risk of varying likelihood and severity of the rights and freedoms of natural persons, the Administrator implements appropriate technical and organizational measures to ensure that processing is carried out in accordance with the Regulation and to be able to demonstrate this. These measures are reviewed and updated as necessary. The Administrator shall use technical measures to prevent unauthorized persons from obtaining and modifying personal data transmitted electronically.

§ 3 Data sharing.

1. The administrator ensures that all personal data collected is used to fulfill obligations towards users. This information will not be disclosed to third parties except in situations where:
• the persons concerned have given their prior explicit consent to such action, or
• the obligation to transfer this data results or will result from applicable law, e.g., to law enforcement authorities.
2. In addition, the personal data of service users and customers may be transferred to the following recipients or categories of recipients:
• service providers supplying the Administrator with technical, IT, and organizational solutions enabling the Administrator to conduct business activities, including the website and electronic services provided through it (in particular, computer software providers, marketing agencies, e-mail and hosting providers, providers of business management software and technical support to the Administrator and the product delivery operator) – the Administrator makes the collected personal data of the Customer available to a selected provider acting on its behalf only in the case and to the extent necessary to achieve a given purpose of data processing in accordance with this privacy policy.
• accounting, legal, and consulting service providers providing the Administrator with accounting, legal, or consulting support (in particular, an accounting office, law firm, or debt collection company) – The Administrator shall disclose the collected personal data of the Customer to a selected provider acting on its behalf only in the case and to the extent necessary to achieve the specific purpose of data processing in accordance with this privacy policy.
3. The Administrator may share anonymized data (i.e., data that does not identify specific Users) with external service providers in order to better understand the attractiveness of advertisements and services to users, and in this regard, due to the location of software providers, data may be transferred – in compliance with data protection rules to third countries that ensure the standard contractual clauses approved by the European Commission for the processing of personal data or that have the appropriate authority to do so on the basis of bilateral data processing agreements between the European Union and a given third country that is not a member of the European Economic Area. In the case of the Administrator, these entities are:
• Google LLC. (headquarters: 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) for Google Analytics tools used to analyze website statistics, Google Tag Manager: used to manage scripts by easily adding code snippets to a website or application and tracking user activity on a website, Google Ads used to display sponsored links in Google search results and on websites participating in the Google AdSense program,
• Facebook Inc. (registered office: Facebook Inc., 1601 S. California Ave. Palo Alto, CA 94304, USA) for Facebook pixel used to track conversions from Facebook ads, optimize them based on collected data and statistics, and build a list of recipients targeted for future ads.
4. Third-party analytics technologies integrated with the Administrator’s services (including SDK [Software Development Kit] and API [Application Program Interfaces]) may combine data collected in connection with the user’s use of the Administrator’s website with information that has been collected separately over time and/or across different platforms. Many of these companies collect and use information based on their own data protection policies, which can be found on their websites. The Administrator encourages you to familiarize yourself with these policies.
5. The Administrator’s website may use Google Analytics, a web analytics service provided by Google, LLC. („Google”). Google Analytics uses cookies to help website operators analyze how visitors use the site. The information generated by the cookie about visitors’ use of the website is usually transmitted to and stored by Google on servers in the United States. In accordance with current IT standards, the IP addresses of users visiting the Administrator’s website are shortened. Only in exceptional cases is the complete IP address sent to a Google server in the United States and shortened there. On behalf of the Administrator, Google will use this information to evaluate the website for its users, compile reports on website traffic, and provide other services related to website traffic and internet usage for website operators. Google will not associate the IP address transmitted within the scope of Google Analytics with any other data held by Google. For more information on how Google Analytics collects and uses data, please visit the official Google website at: www.google.com/policies/privacy/partners. In addition, each User may prevent Google from collecting and processing data relating to their use of the website by downloading and installing a browser plug-in from the following link: http://tools.google.com/dlpage/gaoptout.
6. When sharing data with third parties, the Administrator makes every effort to ensure that this is only done with entities certified under the (former) EU-US and Swiss-US Privacy Shield programs, which are available at www.privacyshield.gov. When using information originating from the European Economic Area (EEA), such entities will do so in accordance with the Privacy Shield program’s „Accountability for Onward Transfer” principle. Where appropriate, the Controller will rely on EU standard contractual clauses and other safeguards to enable transfers outside the EEA. In accordance with the decision of the Court of Justice of the European Union of July 16, 2020, regarding the EU-US Privacy Shield and the guidelines of the European Data Protection Board, the Administrator continues to assess the legal systems of the countries to which data is transferred and, where necessary, updates measures to ensure adequate levels of protection.

§ 4 User Rights.

1. A User whose personal data is processed has the right to:
1. access, rectification, restriction, erasure, or transfer – the data subject has the right to request from the Administrator access to their personal data, rectification, erasure („right to be forgotten”) or restriction of processing, and has the right to object to processing, as well as the right to transfer their data. The detailed conditions for exercising the above rights are set out in Articles 15-21 of the GDPR.
2. withdraw consent at any time – a person whose data is processed by the Administrator on the basis of consent (pursuant to Article 6(1)(a) or Article 9(2)(a) of the GDPR), has the right to withdraw consent at any time without affecting the lawfulness of the processing that was carried out on the basis of consent before its withdrawal.
3. lodging a complaint with a supervisory authority – a person whose data is processed by the Controller has the right to lodge a complaint with a supervisory authority in the manner and procedure specified in the provisions of the GDPR and Polish law, in particular the Personal Data Protection Act. The supervisory authority in Poland is the President of the Personal Data Protection Office in Warsaw.
4. objection – the data subject has the right to object at any time, on grounds relating to their particular situation, to the processing of their personal data based on Article 6(1)(e) (public interest or public tasks) or (f) (legitimate interests of the controller), including profiling based on those provisions. In such a case, the controller may no longer process such personal data unless it demonstrates compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject or for the establishment, exercise, or defense of legal claims.
5. objection to direct marketing – if personal data are processed for direct marketing purposes (based on the legitimate interest of the controller, not on the consent of the data subject), the data subject has the right to object at any time to the processing of personal data concerning him or her for such marketing, including profiling, to the extent that the processing is related to such direct marketing.
2. The above rights are exercised on the basis of a request sent by the user to the e-mail address biuro@grupa-icea.pl. Such a request should include the user’s first and last name.
3. The user ensures that the data provided or published by them on the website is correct.

§ 5 Cookies.

1. Cookies are IT data, in particular text files, stored on users’ end devices (usually on a computer hard drive or mobile device) used by the user’s browser to save specific settings and data for the purpose of using websites. These files allow the user’s device to be recognized and the website to be displayed appropriately, ensuring comfort during its use. The storage of cookies therefore enables the website and the offer to be tailored to the user’s preferences – the server recognizes and remembers, among other things, preferences such as visits, clicks, and previous actions.
2. Cookies contain, in particular, the name of the domain of the website from which they originate, the time they are stored on the end device, and a unique number used to identify the browser from which the website is accessed.
3. Cookies are used for the following purposes:
1. adapting the content of websites to user preferences and optimizing the use of websites,
2. create anonymous statistics which, by helping to determine how the user uses websites, enable their structure and content to be improved,
3. provide website users with advertising content tailored to their interests.
4. Cookies are not used to identify users and their identity is not determined on the basis of cookies.
5. Cookies are basically divided into two categories:
1. Essential cookies – these are absolutely necessary for the proper functioning of the website or the functionality that the user wishes to use, as without them we would not be able to provide many of the services we offer. Some of them also ensure the security of the services we provide electronically.
2. Functional cookies – these are important for the functioning of the website because:
1. they serve to enhance the functionality of websites; without them, the website will function correctly, but will not be tailored to the user’s preferences,
2. they ensure a high level of website functionality; without them, the level of website functionality may be reduced, but their absence should not prevent you from using the website completely,
3. they are used for most website functionality; blocking them will cause selected functions to not work properly.
3. Business cookies – enable the implementation of the business model on which the website is based; blocking them will not make the entire functionality unavailable, but may reduce the level of service due to the inability of the website owner to generate revenue to subsidize its operation. This category includes, for example, advertising cookies.
4. Cookies used to configure websites – enable the configuration of functions and services on websites.
5. Cookies used for website security and reliability – they enable the verification of authenticity and optimization of website performance.
6. Cookies used for authentication – enable notification when a user is logged in, allowing the website to display relevant information and functions.
7. Session cookies – these enable the storage of information about how users use the website. They may relate to the most frequently visited pages or any error messages displayed on certain pages. Cookies used to record the so-called „session status” help to improve services and increase the comfort of browsing websites.
8. Cookies that examine processes occurring on the website – enable the efficient operation of the website and the functions available on it.
9. Cookies that support advertising – enable the display of advertisements that are more interesting to users and at the same time more valuable to publishers and advertisers; cookies can also be used to personalize advertising and to display advertisements outside of websites.
10. Location-access cookies – enable the information displayed to be tailored to the user’s location.
11. Cookies that conduct analysis, research, or audience measurement – enable website owners to better understand their users’ preferences and, through analysis, improve and develop their products and services. Typically, the website owner or research company collects anonymous information and processes data on trends without identifying individual users’ personal data.
12. Harmless cookies – these include cookies that are necessary for the proper functioning of the website and are needed to enable the functionality of the website, but their operation has nothing to do with tracking the user.
13. Tracking cookies – used to track users, but do not include information that allows (without other data) the identification of a specific user.
6. The use of cookies to tailor the content of websites to user preferences does not, in principle, involve the collection of any information that allows the user to be identified, although this information may sometimes be personal data, i.e., data that allows certain behaviors to be attributed to a specific user. Personal data collected using cookies may only be collected for the purpose of performing specific functions for the user. Such data is encrypted in a way that prevents unauthorized access.
7. The cookies used by this website are not harmful to the user or the end device used by them, therefore, in order for the website to function properly, it is recommended not to disable them in browsers. In many cases, software used for browsing websites (web browser) allows, by default, the storage of information in the form of cookies and other similar technologies on the user’s end device. The user can change the way cookies are used by the browser at any time. To do this, change your browser settings. The method of changing the settings varies depending on the software (web browser) used. You will find relevant instructions on the subpages, depending on the browser you are using.
8. Cookies are also used to facilitate logging into your user account, including via social media, and to enable you to navigate between subpages on websites without having to log in again on each subpage. At the same time, cookies are used to secure websites, e.g., to prevent unauthorized access.
9. As part of cookie technology, the Administrator may use tracking pixels or clear GIF files to collect information about how you use its services and your response to marketing messages sent by email. A pixel is a piece of software code that allows an object, usually a pixel-sized image, to be embedded on a website, enabling the tracking of user behavior on the websites where it is placed. Once consent has been given, the browser automatically establishes a direct connection to the server storing the pixel, which is why the data collected by the pixel is processed in accordance with the data protection policy of the partner administering the server.
10. The administrator may use web log files (which contain technical data such as the user’s IP address) to monitor traffic within its services, resolve technical issues, detect and prevent fraud, and enforce the provisions of the User Agreement.
11. The administrator informs that the website does not respond to DNT (Do Not Track) signals, but the user can disable certain forms of online tracking, including some analytics and personalized ads, by changing the cookie settings in their browser or using our cookie consent tools (if applicable).
12. Detailed information on changing cookie settings and deleting cookies yourself in the most popular web browsers is available in the help section of your web browser and on the following pages (just click on the link):
    in Chrome
    in Firefox
    in Opera
    in Safari
    in Microsoft Edge
13. Detailed information on managing cookies on your cell phone or other mobile device should be found in the user manual for that mobile device.
14. Third parties place information in the form of cookies and other similar technologies on your end device (e.g., computer, smartphone) and access them on our websites. These are our trusted partners with whom we constantly cooperate in order to tailor the advertisements on our and their websites to your needs and interests, as well as the services provided by us and our trusted partners. Such trusted partners include entities from the Wirtualna Polska capital group. Detailed information on the processing of your data by Wirtualna Polska can be found in the privacy policy of Wirtualna Polska.