1. GENERAL PROVISIONS

1.1. The controller of personal data collected via the website infinitycode.pl is Michał Rogalski, conducting business activity under the business name Infinity Code Michał Rogalski, registered office address: Komedy 3/37, 52-234 Wrocław, address for service: Komedy 3/37, 52-234 Wrocław, Tax ID: PL501-005-57-32, Business ID: 380761871, entered in the Central Registration and Information on Business, e-mail address: michal@rogalski.pro, hereinafter the “Controller”, who is also the Service Provider, place of business: Komedy 3/37, 52-234 Wrocław, address for service: Komedy 3/37, 52-234 Wrocław, Tax ID: PL501-005-57-32, Business ID: 380761871, e-mail address: michal@rogalski.pro, hereinafter referred to as the “Controller”.

1.2. Personal data collected by the Controller via the website are processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter referred to as GDPR, and with the Personal Data Protection Act of 10 May 2018.

2. TYPE OF PERSONAL DATA PROCESSED, PURPOSE AND SCOPE OF DATA COLLECTION

2.1. PURPOSE OF PROCESSING AND LEGAL BASIS. The Controller processes personal data via the website infinitycode.pl in the event of: the user using the contact form. Personal data are processed on the basis of Art. 6(1)(f) GDPR as the Controller's legitimate interest. the user subscribing to the Newsletter in order to receive commercial information by electronic means. Personal data are processed after separate consent has been given, on the basis of Art. 6(1)(a) GDPR.

2.2. PERSONAL DATA RETENTION PERIOD. Users' personal data are stored by the Controller:

2.2.1. where the basis for processing is the performance of a contract, for as long as is necessary to perform the contract, and thereafter for a period corresponding to the limitation period for claims. Unless a specific provision provides otherwise, the limitation period is six years, and for claims for periodic performance and claims related to running a business - three years.

2.2.2. where the basis for processing is consent, until the consent is withdrawn, and after the consent is withdrawn, for a period corresponding to the limitation period for claims that the Controller may raise and that may be raised against the Controller. Unless a specific provision provides otherwise, the limitation period is six years, and for claims for periodic performance and claims related to running a business - three years.

2.3. While using the website, additional information may be collected, in particular: the IP address assigned to the user's computer or the external IP address of the Internet provider, domain name, browser type, access time, operating system type.

2.4. Navigation data may also be collected from users, including information about links and references they choose to click or other actions taken on the website. The legal basis for such activities is the Controller's legitimate interest (Art. 6(1)(f) GDPR), consisting in facilitating the use of services provided electronically and improving the functionality of those services.

2.5. Providing personal data by the user is voluntary.

2.6. Personal data will also be processed by automated means in the form of profiling, provided that the user consents to it on the basis of Art. 6(1)(a) GDPR. The consequence of profiling will be assigning a profile to the person in order to make decisions concerning them or to analyse or predict their preferences, behaviour and attitudes.

2.7. The Controller takes particular care to protect the interests of data subjects, and in particular ensures that the data it collects are:

2.7.1. processed lawfully,

2.7.2. collected for specified, lawful purposes and not further processed in a manner incompatible with those purposes,

2.7.3. substantively correct and adequate in relation to the purposes for which they are processed, and stored in a form that permits identification of data subjects for no longer than is necessary to achieve the purpose of processing.

3. DISCLOSURE OF PERSONAL DATA

3.1. Users' personal data are transferred to service providers used by the Controller in running the website. Service providers to whom personal data are transferred, depending on contractual arrangements and circumstances, either follow the Controller's instructions as to the purposes and means of processing such data (processors) or determine the purposes and means of their processing themselves (controllers).

3.2. Users' personal data are stored exclusively within the European Economic Area (EEA).

4. RIGHT TO CONTROL, ACCESS TO THE CONTENT OF ONE'S OWN DATA AND THEIR RECTIFICATION

4.1. The data subject has the right of access to the content of their personal data and the right to rectification, erasure, restriction of processing, the right to data portability, the right to object, and the right to withdraw consent at any time without affecting the lawfulness of processing based on consent before its withdrawal.

4.2. Legal basis for the user's request:

4.2.1. Access to data – Art. 15 GDPR

4.2.2. Rectification of data – Art. 16 GDPR.

4.2.3. Erasure of data (the so-called right to be forgotten) – Art. 17 GDPR.

4.2.4. Restriction of processing – Art. 18 GDPR.

4.2.5. Data portability – Art. 20 GDPR.

4.2.6. Objection – Art. 21 GDPR.

4.2.7. Withdrawal of consent – Art. 7(3) GDPR.

4.3. In order to exercise the rights referred to in point 2, an appropriate e-mail message may be sent to: michal@rogalski.pro.

4.4. Where the user exercises a right arising from the above rights, the Controller fulfils the request or refuses to fulfil it without undue delay, but no later than within one month of receiving it. If, however, due to the complexity of the request or the number of requests, the Controller is unable to fulfil the request within one month, it will fulfil it within the following two months, informing the user in advance, within one month of receiving the request, of the intended extension and the reasons for it.

4.5. If it is found that the processing of personal data infringes the provisions of GDPR, the data subject has the right to lodge a complaint with the President of the Personal Data Protection Office.

5. “COOKIES”

5.1. The Controller's website uses “cookies”.

5.2. Installing “cookies” is necessary for the proper provision of services on the website. “Cookies” contain information necessary for the proper functioning of the website, and they also make it possible to compile general statistics of visits to the website.

5.3. The following types of “cookies” are used on the website: session and persistent

5.3.1. “Session” “cookies” are temporary files that are stored on the user's end device until logging out (leaving the website).

5.3.2. “Persistent” “cookies” are stored on the user's end device for the time specified in the “cookies” parameters or until they are deleted by the user.

5.4. The Controller uses its own cookies to better understand how the user interacts with the content of the website. The files collect information about how the user uses the website, the type of website from which the user was redirected, and the number of visits and the duration of the user's visit to the website. This information does not record specific personal data of the user, but is used to compile statistics on the use of the website.

5.5. The user has the right to decide on the access of “cookies” to their computer by selecting this in advance in their browser window. Detailed information on the possibilities and methods of handling “cookies” is available in the software (web browser) settings.

6. FINAL PROVISIONS

6.1. The Controller applies technical and organisational measures ensuring protection of the personal data processed appropriate to the threats and the categories of data protected, and in particular protects the data against disclosure to unauthorised persons, taking by an unauthorised person, processing in breach of applicable law, and alteration, loss, damage or destruction.

6.2. The Controller provides appropriate technical measures preventing unauthorised persons from obtaining and modifying personal data sent electronically.

In matters not regulated by this Privacy Policy, the provisions of GDPR and other relevant provisions of Polish law shall apply accordingly.