Pompi
Contact

Legal

Privacy Policy

In this document, the Controller explains the rules under which it processes Users' personal data.

Polska wersja

1. Definitions

Capitalized terms should be understood in accordance with the definitions below:

  1. "Controller" means Cloudtech Consulting Sp. z o.o., address: Marynarska 13, 02-674 Warsaw, NIP: 5213964457, entered in the National Court Register under KRS number 0000965893.
  2. "Application" means software operating on mobile devices that enables use of the Services, available at https://pompi.app/ and its subdomains.
  3. "Personal data" means information that makes it possible to identify the User directly or indirectly.
  4. "Policy" means this document containing information on the rules for processing personal data by the Controller.
  5. "GDPR" means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
  6. "Website" means the website available at: https://pompi.shop, https://pompi.pl/, https://pompi.com.pl/, https://pompi.link/, https://pompi.app/ and their subdomains.
  7. "Service" means a service provided electronically within the meaning of the Act of 18 July 2002 on the provision of electronic services.
  8. "User" means a natural person who uses the Services.

2. General provisions

  1. The Policy applies to all Users using the Services provided by the Controller, as well as all persons visiting the Website and using the Application.
  2. Before starting to use the Services, the User should read this Policy.
  3. The Controller is not responsible for links enabling Users to go directly to websites managed by other entities.
  4. If the User uses a link to websites or services of other entities, the User should read the privacy protection rules introduced by those entities.

3. Personal data controller

  1. The controller of the User's personal data is Cloudtech Consulting Sp. z o.o., address: Marynarska 13, 02-674 Warsaw, NIP: 5213964457, entered in the National Court Register under KRS number 0000965893.
  2. Questions, requests concerning the exercise of rights and comments regarding the Policy and the processing of personal data by the Controller should be sent in writing to the correspondence address: Cloudtech Consulting Sp. z o.o., Marynarska 13, 02-674 Warsaw, or by email to contact@cloudtech.consulting.

4. Data collected by the Controller

Users' personal data is processed on the basis of at least one of the legal bases indicated below:

4.1. Consent

The legal basis for processing personal data is Article 6(1)(a) GDPR - the User's consent.

The User may be asked to consent to the processing of their personal data, or may independently and voluntarily provide the Controller with their personal data (for example by completing optional form fields).

Giving consent is always voluntary. The User may withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

The User's consent is collected for the purpose of making available by the Controller electronic data collected automatically through cookies. Processing of this data by the Controller for profiling and displaying personalized advertisements may take place in connection with the Controller's legitimate interest.

4.2. Performance of a contract

The legal basis for processing personal data is Article 6(1)(b) GDPR - taking steps to conclude a contract and performing a contract.

The Controller may process the User's personal data due to the ongoing process of concluding contracts and then performing contracts, including contracts concerning use of the Services.

If the User represents an entity with which the Controller has concluded a contract, the User's data is processed for the purpose of pursuing the Controller's legitimate interest (Article 6(1)(f) GDPR), namely concluding and performing a contract with the represented entity.

4.3. Legal obligation

The legal basis for processing personal data is Article 6(1)(c) GDPR - compliance with a legal obligation imposed on the Controller under specific provisions of law.

The Controller may process Users' personal data due to the need to fulfil legal obligations. This includes situations in which data resulting, for example, from issued invoices must be stored for accounting and tax reasons.

4.4. Protection of the vital interests of the User or another person

The legal basis for processing personal data is Article 6(1)(d) GDPR. The Controller may process personal data to protect, for example, property interests, health or life, where failure to process the data could lead to a threat to or violation of a person's vital interests.

4.5. Legitimate interest

The legal basis for processing personal data is Article 6(1)(f) GDPR - pursuit of the Controller's legitimate interests.

On the basis of legitimate interest, the Controller may process Users' personal data for the following purposes:

  1. conducting direct marketing of products and services through communication channels to which the User has consented;
  2. adapting marketing content to Users' interests;
  3. informing about new functionalities of the Website and Application through communication channels to which the User has consented;
  4. analysing the use of the Services;
  5. improving the Services;
  6. pursuing claims and defending against claims;
  7. archiving;
  8. accepting submissions and answering questions;
  9. measuring advertising effectiveness;
  10. ensuring the security of the provided Services and IT systems, session security and abuse detection; on the basis of legitimate interest, data concerning the User, in particular system logs, may also be processed.

When using the Services, information necessary to provide technical access to the Services is collected. Such information includes:

  1. IP address;
  2. date and time of the request;
  3. content of the request (Website domain);
  4. domain of the website from which the request originates;
  5. type, language and version of the browser;
  6. type and version of the operating system;
  7. technical data of the end device (for example a computer or phone).

The above data, contained in so-called system logs, is used by the Controller to improve the Services, adapt them to Users' needs and more effectively remove detected malfunctions.

In the case of a User using the Services, for settlements and issuing a VAT invoice the Controller may obtain the User's personal data (business activity data appearing in a register or records) from publicly available sources, such as the Central Registration and Information on Business.

5. Data sharing

  1. The Controller may disclose Users' personal data only where it has a legal basis to do so, including at the request of entities authorized under legal provisions or where it is necessary to perform services offered by the Controller (for example to entities providing services to the Controller).
  2. The User's personal data may be made available at the request of public authorities or other entities authorized to access such data under legal provisions, in particular where this is necessary to ensure the security of the Controller's systems or the rights of other Users.
  3. Access to the User's personal data may be obtained by entities that provide services to the Controller (including for the purpose of delivering services to Users), such as IT service providers, service subcontractors, entities providing analytical services and online opinion research, entities carrying out mailing campaigns, advertising agencies, law firms and debt collection firms. In each case, personal data is disclosed to the extent necessary to achieve a specified purpose (for example provision of services by an IT company).
  4. The User's personal data may be transferred to third countries, i.e. countries outside the European Economic Area. In such cases, data is transferred only to countries for which the European Commission has issued a decision confirming an adequate level of personal data protection. If there is no such decision, the Controller and its providers apply additional safeguards, including standard contractual clauses.
  5. Personal data may be made available to entities related to the Controller by capital or personal ties, in particular legal persons in which the Controller is a shareholder. In such a case, the related entity will become a separate controller of the User's personal data, about which the User will be informed.

6. User rights

In connection with the processing of personal data, the User has the rights indicated below:

6.1. Right of access to personal data

At the User's request, the Controller will inform the User what personal data concerning the User it processes and will provide a copy of that data.

6.2. Right to rectify personal data

If the User's personal data is incorrect or incomplete, the User may request that the Controller rectify or supplement it.

6.3. Right to erase personal data

In certain situations, the User may request that the Controller erase personal data processed by the Controller (for example when the data is no longer necessary for the Controller to provide services).

6.4. Right to restrict processing of personal data

The User may request that the Controller temporarily suspend processing of their data (for example not send marketing information to the provided email address) in specific situations. For example, the User may request restriction of processing of their personal data when they object to processing or question the accuracy of the data. Despite restriction of processing, the Controller will still be entitled to store personal data.

6.5. Right to request transfer of personal data

In specific situations (for example in relation to data processed on the basis of consent and processed by automated means), the User has the right to receive personal data processed by the Controller in a structured, commonly used, machine-readable format in order to transmit that data to another controller.

6.6. Right to withdraw consent to the processing of personal data

If the basis for processing personal data is the User's consent, the User may withdraw consent at any time. Withdrawal of consent does not affect the lawfulness of the processing by the Controller of the User's data that was carried out on the basis of consent before its withdrawal.

6.7. Right to object to the processing of personal data

The User may request that the Controller stop processing personal data due to the User's particular situation when:

  1. the Controller processes the User's personal data on the basis of its own legitimate interest or the legitimate interest of a third party, except where those interests prove overriding in relation to the User's interests, rights and freedoms;
  2. the User's personal data is processed for direct marketing purposes;
  3. the processing of personal data includes automated decision-making concerning the User, including profiling.

6.8. Right to lodge a complaint with the President of the Personal Data Protection Office

The User has the right to lodge a complaint with the President of the Personal Data Protection Office (address: ul. Stawki 2, 00-193 Warsaw) in connection with the processing of personal data by the Controller.

7. Data retention period

  1. The Controller stores Users' personal data only for the time necessary to achieve the purposes for which the data was collected and for the time required by law (for example 5 years from the end of the tax year in connection with tax regulations). After that time, the data will be deleted or may be anonymized in such a way that it is not possible to determine the User's identity.
  2. Personal data may be stored longer if such an obligation results from legal provisions or if it is necessary for the Controller to defend against or pursue claims against Users.
  3. If the basis for processing data is the necessity to perform a contract, the data will be processed for the duration of its performance and until the limitation period for claims under that contract expires or until the proceedings end.
  4. Personal data processed solely on the basis of consent is processed until that consent is withdrawn, but no longer than is necessary to achieve the specified purpose.
  5. If the basis for processing personal data is the Controller's legitimate interest, the data is processed until the User submits an effective objection.
  6. The Controller does not use Users' personal data for automated decision-making and does not transfer it to international organizations.

8. Changes to the Privacy Policy

The Controller places a link to the current Policy in the footer of the Website.