1. This Privacy Policy sets out the rules for the processing of personal data obtained via the compassandpartners.pl website (hereinafter referred to as the “Website”).
2. The data controller of the Users of this Website is Compass&Partners Sp. z o.o. (hereinafter referred to as C&P) with its registered office in Warsaw, ul. Grochowska 217/15, 04-077 Warsaw, entered into the National Court Register kept by the District Court for the Capital City of Warsaw in Warsaw, 12th Commercial Division, under KRS number 0000579365, NIP 7010512892.

§2 Type of data processed, purposes and legal basis

1. C&P collects information about website Users, i.e. natural persons conducting business or professional activity in their own name and natural persons representing legal persons or organizational units that are not legal persons to which the law grants legal capacity, as well as persons conducting business or professional activity in their own name.
2. Users’ personal data are processed in the following situations and on the following grounds:
   1. placing an order on the Website with the aim of executing a sales contract (Article 6(1)(b) of the GDPR),
   2. using the contact form service on the Website with the aim of executing a contract for the provision of the electronic form service (Article 6(1)(b) of the GDPR),
   3. compliance by C&P with obligations arising from national and EU law (Article 6(1)(c) of the GDPR)
   4. defence of possible claims made by Users against the Administrator, in order to implement the legitimate interest of the Administrator consisting in defending against possible claims (Article 6(1)(f) of the GDPR),
   5. providing the User with marketing information in order to pursue the legitimate interest of C&P consisting in direct marketing of its own services (Article 6(1)(f) of the GDPR),
   6. conducting analyses and statistics regarding the use of the Website’s functionalities by Users, including information about links and references that Users decided to click, in order to implement the legitimate interest of the Administrator consisting in the possibility of conducting analyses and statistics, facilitating the use of services provided electronically and improving the functioning of these services (Article 6(1)(f) of the GDPR).
3. When placing an order on the Website, the User provides the following data:
   1. e-mail address
   2. address details: postal code and city, street with house/apartment number.
   3. first name and last name
   4. contact telephone number
4. When placing an order in which the payer is a company, the scope of data is extended to include:
   1. full company name
   2. NIP
   3. REGON number
5. If you use the contact form service, the User provides the following data:
   1. e-mail address
   2. first name and last name
   3. phone number
   4. and company name if the User represents a Company.
6. When using the Website, additional information may be processed, in particular: the IP address assigned to the User’s computer or the external IP address of the Internet provider, domain name, browser type, access time, operating system type.
7. The provision of personal data to C&P is voluntary, but failure to provide the data specified in the forms will prevent the User from placing and processing an order, as well as using the website’s functionalities.
8. The User has the right to access their data, request their rectification, deletion, limit processing, object to their processing (in the case of data processing based on the legitimate interest of C&P) and transfer these data to another Administrator. The User has the right to lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw).

§3 Information about who the data is shared or entrusted with and how long it is stored

1. The User’s personal data is transferred to service providers used by C&P to operate the Website. C&P service providers can perform various roles, including:
   1. may act as processors – in this case, suppliers process personal data only on the instructions of C&P. These include, among others: suppliers providing hosting services, accounting services, marketing systems, systems for analysing traffic on the Website, systems for analysing the effectiveness of marketing campaigns
   2. who may act as independent administrators – these entities independently determine the purposes and methods of using personal data.
2. Users’ personal data are stored:
   1. if the basis for the processing of personal data is the User’s consent – until the consent is withdrawn, and after its withdrawal – for a period corresponding to the period of limitation of claims that may be raised by C&P and which may be raised against it. Unless a specific provision provides otherwise, the limitation period is six years, and for claims for periodic benefits and claims related to running a business – three years;
   2. if the basis for data processing is the execution of a contract – the User’s personal data are processed by C&P for as long as it is necessary to execute the contract, and after that time for a period corresponding to the limitation period for claims. Unless a specific provision provides otherwise, the limitation period is six years, and for claims for periodic benefits and claims related to running a business – three years.
3. Navigation data may be processed in order to provide Users with better service, analyse statistical data and adapt the Website to Users’ preferences, as well as administer the Website.

§4 Cookie mechanism, IP address

1. The website uses cookies, i.e. small text information. They are saved on the end device of the person visiting the Website (e.g. computer, smartphone, tablet), if the web browser allows it. Cookies can be read by the IT system of the Operator or other entities.
2. C&P stores cookies on the User’s end device and then gains access to the information contained therein for statistical and marketing purposes and to ensure the proper operation of the Website.
3. C&P informs Users that it is possible to configure the web browser in such a way that it prevents the storage of cookies on the User’s end device.
4. C&P indicates that cookies may be deleted by the User after they have been saved by C&P, through appropriate functions of the web browser, programs used for this purpose or by using appropriate tools available within the operating system used by the User.
5. C&P informs Users that changing the configuration of the web browser that prevents or limits the storage of cookies on the User’s end device may result in limitations in the functionality of the Services. Deleting cookies during the provision of the Service may lead to similar effects.
6. C&P may collect Users’ IP addresses. An IP address is a number assigned to the computer of a person visiting the Website by the Internet service provider. The IP number allows you to access the Internet. In most cases, it is assigned to your computer dynamically, which means it changes each time you connect to the Internet. The IP address is used by C&P when diagnosing technical problems with the server, creating statistical analyses (e.g. determining from which regions visits to the Website come from), as information useful in administering and improving the Website, as well as for security purposes and possible identification of problems that burden the server, undesirable automatic programs for viewing the content of the Website.
7. The Website contains links and references to other websites. C&P is not responsible for the privacy policies applicable to them.

§5 Security management

C&P provides Users with a safe and encrypted connection when sending personal data. C&P uses an SSL certificate issued by a company specializing in the security and encryption of data transmitted via the Internet.

§6 Changes to the Privacy Policy

1. The Privacy Policy may change, about which C&P will inform Users 7 days in advance.
2. Please send questions related to the Privacy Policy and the processing of personal data to: [email protected]
3. Date last modified 2021/10/07

Privacy Policy 001 2021/10/07