Based on: GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (OJ EU L 119, 2016)

Contents of the administrator's privacy policy:

1. The administrator's privacy policy contains information regarding:

1. processing personal data and other information relating to users of the website available at: https://bytheray.com/ (hereinafter referred to as the "Website");

2. processing personal data in connection with the execution of an order in the online store, via the order form, as well as via the registration form in connection with setting up an account in the online store, as well as personalizing the offer and monitoring product safety.

3. processing personal data and other information regarding Facebook users on the fanpage called by the ray ( https://www.facebook.com/bytheray com);

4. processing personal data and other information relating to Instagram users on the administrator's profile under the name bytheraybeauty ( https://www.instagram.com/bytheraybeauty/ );

5. processing of personal data contained in the contact form available on the website;

6. processing of personal data contained in electronic correspondence;

7. processing personal data of newsletter subscribers;

8. The policy also contains all the information that data subjects should receive in accordance with the GDPR.

The administrator's privacy policy contains information on the processing of data obtained through the Website, including the use of cookies or other similar technologies.

Personal data administrator:

- The Controller of personal data is BTR CONCEPT sp. z o. o. with its registered office in Warsaw, ul. Polki 1A/20, 02-826 Warsaw, entered into the Register of Entrepreneurs maintained by the District Court for the capital city of Warsaw in Warsaw, 13th Commercial Division of the National Court Register under the KRS number: 0001068040, NIP: 9512581861, REGON: 526883044. The Controller also acts as the Responsible Person for the BY THE RAY own brand products.

• You can contact the data controller at the following e-mail address: hello@bytheray.com

What are the purposes, legal basis and duration of data processing:

Order fulfillment and customer service

WEBSITE:

Operation of the Site

1. In order to provide the Website service, the service provider processes information about the user's device to ensure the correct operation of the services: the computer's IP address, information contained in cookies or other similar technologies, session data, web browser data, device data, data about activity on the Website, including on individual subpages.

2. This information does not contain data regarding the identity of users, but in combination with other information may constitute personal data and therefore the controller provides it with full protection under the GDPR.

3. On the website, you can leave a comment below the content of a blog post. The comment form contains the following fields to complete: name, email address, and comment text. If an individual submits personal data that allows for their direct or indirect identification, the controller also processes the personal data of that individual in this regard.

4. The Administrator also processes personal data contained in reports regarding illegal content in comments, in connection with the implementation of the procedure referred to in point 15 of the Regulations (DSA COMMENTS).

5. In addition, the administrator processes personal data contained in the order form in the online store and registration in order to create an account in the online store on the terms described in the Regulations, after obtaining the consent of the natural person.

6. These data are processed in accordance with Article 6(1)(b) of the GDPR, for the purpose of providing the Website service, and in accordance with Article 6(1)(a) of the GDPR in connection with consent to the use of certain cookies or other similar technologies, expressed through appropriate browser settings in accordance with the Telecommunications Law, and in accordance with Article 6(1)(b) of the GDPR in connection with the fulfillment of an order in the online store, registration, and maintenance of an account in the online store. The data are processed until the user ends their use of the Website, and in the case of completing the application form to place an order in the online store, for the time necessary to fulfill the order.

7. In the situation referred to in paragraph 3, these data are processed in accordance with Article 6 paragraph 1 letter b of the GDPR, in order to provide the Website's service by enabling users to leave comments and thus use its functionality. The data are processed until the person requests the deletion of their data along with the comment.

8. In the situation referred to in paragraph 4, these data are processed in accordance with Article 6 paragraph 1 letter c of the GDPR:

1. 1. in order for the administrator to fulfill the legal obligation to receive a report of illegal content, consider the report, inform about the decision taken, and inform about the possibility of appealing against the decision;

   2. for the purpose for which, on the basis of proceedings conducted before authorized public administration bodies, including law enforcement bodies, in matters relating to
      the purposes or grounds for processing personal data referred to in point 1, the controller will be obliged to process the indicated personal data.

In the case of point a), the data is stored until the decision is communicated and, in the event of an appeal, until the appeal is resolved. In the case of point b), the data is stored for the duration of such obligation.

Profiling and personalizing the offer

In order to provide Customers with the best-fitting private label products, the Administrator may process data regarding cosmetic preferences, skin type or skin problems (e.g. through quizzes on the website or purchase history).

• Legal basis: Article 6(1)(a) GDPR (consent) or Article 6(1)(f) GDPR. In the case of the provision of health data (e.g. allergies), the basis is Article 9(2)(a) GDPR (explicit consent).

• Processing period: Until consent is withdrawn or an objection is raised.

Product safety monitoring (Cosmetovigilance)

As the Manufacturer and Responsible Person, the Administrator has a legal obligation to monitor adverse reactions caused by cosmetic products.

• Legal basis: Article 6(1)(c) of the GDPR (legal obligation resulting from Regulation 1223/2009).

• Data scope: Name, surname, contact information, description of the allergic/adverse reaction, information on skin condition to the extent necessary to assess the safety of the product.

• Processing time: For the period necessary to perform the safety analysis and the period of archiving the PIF (Product Information File) documentation in accordance with the regulations (usually 10 years from the introduction of the last batch to the market).

Product Safety (GPSR)

In connection with Regulation 2023/988 (GPSR), the Controller processes data for the purpose of informing about possible product withdrawals from the market or safety warnings.

• Legal basis: Article 6(1)(c) of the GDPR.

Comments and Opinions (DSA & Omnibus)

The Administrator processes data (name, e-mail, content) in order to publish reviews of own-brand products and verify their authenticity.

• Legal basis: Article 6(1)(f) of the GDPR (legitimate interest – building brand credibility and fulfilling the obligations under the Omnibus Directive).

Complaints

 To process complaints, the service provider processes the personal data of users submitting complaints, in particular their email address, first name, last name, complaint content, circumstances of the event giving rise to the complaint, and information obtained during the complaint process, including explanations of the event that caused it. In the course of processing a complaint, the service provider may process a variety of other information, including the user's first name and last name, information about the user's use of the services, cookies or other similar technologies, and device information.

These data are processed in accordance with Article 6(1)(b) of the GDPR for the purpose of providing services and are processed for the time necessary to process the complaint and for no longer than 3 months after the end of the complaint procedure for archiving purposes in the event of the need to defend against any claims against the service provider in accordance with the information provided below.

 

Marketing and PR activities of the administrator

The controller may post marketing information about its products or services on the Website. The controller displays this content in accordance with Article 6(1)(f) of the GDPR, in accordance with the controller's legitimate interest in publishing content related to the services provided and promotional content for campaigns in which the controller is involved. At the same time, this activity does not violate the rights and freedoms of users; users expect to receive similar content, and sometimes even expect it, or it is their direct purpose in visiting the Website.

 

Cookies

The website uses its own and third-party cookies .

Own cookies

1. Cookies are small pieces of text information in the form of text files, sent by the server and saved on the website visitor's side (e.g. on the hard drive of a computer, laptop, or smartphone's memory card - depending on the device used by the website visitor).

2. The Administrator may process data contained in cookies when visitors use the Website for the following purposes:

1. 1. remembering data from completed forms available on the Website, including order forms available on the Website, as well as registration forms for the purpose of creating an account in the online store;

   2. adapting the content of the Website to the individual preferences of the Service User (e.g. regarding colors, font size, page layout) and optimizing the use of the Website;

   3. remembering products that have been added to the shopping cart to place a product order;

   4. keeping anonymous statistics showing how the Website is used.

3. By default, most web browsers accept cookies by default . Everyone can specify the terms of cookie use through their own web browser settings. This means, for example, that you can partially restrict (e.g., temporarily) or completely disable the ability to save cookies – in the latter case, this may affect some of the Website's functionalities.

4. Your web browser's cookie settings are important for consenting to the use of cookies by the Website. In accordance with the regulations, such consent may also be expressed through your web browser settings. If you do not consent, you must change your web browser's cookie settings accordingly .

5. Detailed information on how to change cookie settings and how to delete them yourself in the most popular web browsers is available on the following websites (just click on the link):

1. in Chrome

2. in Firefox

3. in the Opera browser

4. in Safari browser

5. in Microsoft Edge browser .

 

Third-party cookies

The Administrator uses external tools that use cookies, such as :

Google Analytics (Google Analytics 4), Google Ads, Hotjar, Meta Pixel, Mailchimp, and from the website you may be redirected to social networking sites: Facebook, Instagram.

Google Analytics (Google Analytics 4)

Google Analytics is a third-party analytics tool provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Google Analytics allows website and application owners to understand how users use their websites and applications.

The tool may use a set of cookies to collect information and generate reports with statistics about site usage. The data collected does not identify individual users. The main type of cookie used by Google Analytics is "_ga."

In addition to reporting website usage statistics, the data collected by Google Analytics may also, in conjunction with some of the cookies described above, help display more relevant ads on Google services (e.g., Google Search) and across the web.

The information indicated above comes from the website:

https://policies.google.com/technologies/types?hl=pl

The retention period for user and event data associated with cookies, user IDs, or advertising IDs is 12 months.

Thereafter, after the retention period ends, the data will be automatically deleted once a month.

Google has achieved ISO 27001 certification covering the systems, applications, people, technologies, processes, and data centers that support various Google services, including Google Analytics.

All other information related to privacy and data security can be found at:

 https://support.google.com/analytics/topic/2919631?hl=pl&ref_topic=1008008  

 

Google Analytics 4 (GA4), the new version of Analytics:

• collects website and app data to better understand the customer journey;

• uses event-based data, not session-based;

• includes privacy settings, such as cookieless measurement, and behavior and conversion modeling;

• includes predictive features that suggest recommended actions without the use of complex models;

• integrates directly with media platforms to help drive user action on your website or app.

Standard Universal Analytics services will stop processing data on July 1, 2023. Universal Analytics reports will continue to be available for a period of time after July 1, 2023. However, new data will only be delivered to Google Analytics 4 services.

Full information about the GA4 service is available on the website at: https://support.google.com/analytics/answer/10089681?hl=pl .

 

Google Ads

Google Ads is a third-party advertising tool designed to promote products and services on Google search, YouTube, and other websites. It is operated by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

When using this tool for advertising purposes, the administrator relies on his legitimate interest, i.e. the marketing of his own products.

Google Ads displays ads when users search for your products online. Using intelligent technology, Google Ads makes it easy to reach potential customers when they're ready to take action.

 

Google Ads features like remarketing and Customer Match allow you to create and upload audience lists that are used to target ads on Google media and third-party sites.

 

Using Google Ads does not lead to the collection of user data that would allow for their identification. However, it should be noted that Google may combine data in a way that results in it being classified as personal data. However, this is beyond the controller's responsibility and results from the implementation of these activities by Google (agreement concluded with the Google user).

 

Ad settings can be managed directly on the Google website if a person does not wish to receive personalized advertising: https://adssettings.google.com/authenticated .

 

For any other information about controlling the information Google collects across sites and apps, please visit:

https://policies.google.com/technologies/partner-sites .

 

Hotjar

Hotjar is a tool provided by Hotjar Limited, Dragonara Business Centre, 5th Floor, Dragonara Road, Paceville St Julian's STJ 3141, Malta. The tool aims to understand user needs and optimise the website based on their experience while using the website.

 

What information does the administrator obtain using Hotjar?

This includes information about the user's web browser, the subpages visited, the time spent by the user on the website and individual subpages.

 

All relevant information regarding cookies and Hotjar Ltd's privacy policy can be found at:

• https://www.hotjar.com/legal/policies/privacy/

• https://help.hotjar.com/hc/en-us/articles/115011789248-Cookies-on-hotjar-com .

  

Meta Pixel (Facebook and Instagram)

Meta Pixel is a marketing tool provided by Meta Platforms Inc. , One Hacker Way, Menlo Park, CA 94025 USA. In Europe, Meta Platforms Ireland Limited operates 4 GRAND CANAL SQUARE, GRAND CANAL HARBOUR, 462129 Dublin, IRELAND.

The Meta Pixel tool helps you measure the effectiveness of your ads by analyzing the actions users take on your website.

What is the purpose of the above-mentioned tool?

1. Broadcasting advertisements to the right audience.

2. Increased sales.

3. Measuring advertising results.

The website has been configured with a Meta Pixel, so this tool will trigger whenever someone takes an action on the administrator's website. Examples of actions include visiting subsequent subpages. The pixel collects these actions (also known as events). This allows you to see the actions taken by website users and provide options to re-engage them with future advertising.

The information indicated above comes from the website: https://pl-pl.facebook.com/business/help/742478679120153?id=1205376682832142

This information (including information about websites visited and advertisements viewed) may be used to help advertisers and other partners measure the effectiveness and distribution of their advertising and services, and to understand the types of people who use their services and how users visit their websites, use their applications, and services. If the website wishes to link this data with other information about the portal user, we inform you that, as a controller of personal data solely for our fan page, we have no actual control over these activities.

All information in this regard is available at: https://www.facebook.com/policy/cookies/

MailChimp

 To automate mailing within the newsletter service, the Administrator uses tools provided by MailChimp, which is owned and operated by The Rocket Science Group LLC with its registered office in Georgia, 675 Ponce De Leon Ave NE, Suite 5000, Atlanta, Georgia 30308, USA.

 

Regarding the newsletter service, information related to the processing of newsletter subscribers' personal data can be found further in this Policy. Here, the administrator presents information related to cookies in the context of integration with MailChimp, which is available at:

 

• Full information regarding privacy and data security is available at:

https://mailchimp.com/legal/privacy/

 

• Information about the cookies used is available at:

https://mailchimp.com/legal/cookies/ 

 

Social tools

On the website, after the user clicks on the appropriate social media icon, they may be redirected to Facebook and Instagram, which means that a connection to that service will be established in the user's browser. The information the service obtains when the user is not logged in or does not have an account includes: the website display in their browser and their IP address. This information is transmitted and stored on the server of the owner of the service. If they log in to the respective service, personal data is collected and processed according to the principles described in the privacy policies of those services.

Issues related to privacy protection are regulated on individual social networking sites:

• Facebook: https://pl-pl.facebook.com/privacy/explanation

• Instagram: https://www.facebook.com/help/instagram/155833707900388 

FACEBOOK FANPAGE:

Running a fanpage

 

The Administrator processes users' personal data to enable them to use the fanpage. The Administrator has information about:

liking the fanpage,

activity on the fanpage,

the content of comments and posts posted by users.

1. These data are processed in accordance with Article 6(1)(b) of the GDPR for the purpose of providing services.

 

Marketing and PR activities of the administrator

1. On the fanpage, the administrator may post marketing information about his products, services or events that he organizes or in which he participates.

2. The display of this content is carried out by the controller in accordance with Article 6(1)(f) of the GDPR, in accordance with the controller's legitimate interest in its own marketing activities. At the same time, this action does not violate the rights and freedoms of users who expect and sometimes even expect to receive similar content, particularly given the nature of Facebook's operations.

 

COMPANY PROFILE ON INSTAGRAM: 

Maintaining a profile 

The Administrator processes users' personal data to enable them to use its company profile on Instagram. The Administrator has information about:

people following his profile,

likes,

views on Instagram stories,

user activity,

content of comments posted by users.

1. These data are processed in accordance with Article 6(1)(b) of the GDPR for the purpose of providing services.

 

Implementing contact with users

In order to enable the Administrator to contact the User, the Administrator processes information about individuals who contact the Administrator via messages sent by Instagram, in particular the name and surname or Instagram username, and the content of the correspondence (messages, threads). The Administrator does not store these messages anywhere other than Instagram.

The data is processed in accordance with Article 6(1)(f) of the GDPR, in the legitimate interest of the controller and users, consisting in the need to ensure contact between users and the controller, and the processing of this data does not violate the rights and freedoms of users.

The content of correspondence and contact information is processed for the time necessary to resolve the user's request and for no longer than three months after the request is resolved for archiving purposes in the event of defending against potential claims against the controller. After this time, they are deleted from the controller's profile, and the controller will no longer be able to access this data.

  

Marketing and PR activities of the administrator

1. On the Instagram profile, the administrator may post marketing information about his products, services or events that he organizes or in which he participates.

2. The controller displays this content in accordance with Article 6(1)(f) of the GDPR, in accordance with the controller's legitimate interest in its own marketing activities. At the same time, this action does not violate the rights and freedoms of users who expect and sometimes even expect to receive similar content, particularly given the nature of Instagram's operation.

ONLINE CONTACT FORM:

1. Personal data such as name, e-mail address and message content are processed for the time necessary to resolve the user's matter, including sending marketing information about selected services, and for no longer than 3 months after resolving the matter for archiving purposes in the event of the need to defend against possible claims against the controller.

2. These data will then be processed for the purpose of providing the online contact form service electronically (Article 6, paragraph 1, letter b of the GDPR).

3. In the scope of sending commercial information by electronic means or direct marketing via telephone terminal equipment, data will be processed on the basis of consent expressed by clear confirmatory actions (Article 6 paragraph 1 letter a in connection with Article 4 point 11 of the GDPR), consisting in completing the appropriate field for entering the e-mail address.

 

Claims settlement

If it is necessary for the controller or other users or entities to pursue claims, or to defend against claims of users or other entities, the controller may process the personal data of specific users contained in the online contact form until the end of the ongoing proceedings and until the expiry of the limitation period for the controller's claims against the user, which is usually 3 years in accordance with Article 118 of the Civil Code, but may be longer in specific cases provided for by law.

These data will then be processed in accordance with Article 6(1)(f) of the GDPR, i.e., in the legitimate interest of the controller in pursuing claims against the user or defending against them. The legitimate interest of the controller will then override the rights and freedoms of the service recipient.

 

Service usage statistics

1. In order to improve the quality of its services, the administrator processes statistical information regarding the use of the online contact form and for this purpose uses statistical information provided by cookies or other similar technologies.

2. These data are processed in accordance with Article 6(1)(f) of the GDPR in the legitimate interest of the controller consisting in facilitating the use of services, improving the quality and functionality of the services provided, and the processing of these data does not violate the rights and freedoms of users.

3. This data is processed as part of the administrator's ongoing activities, but no longer than 60 days from receipt of the information. After this time, the administrator may continue to process general statistical data, which will be devoid of any information about individual users.

ELECTRONIC CORRESPONDENCE (E-MAIL):

1. The Administrator processes contact information about senders and recipients of e-mail correspondence, contained in the content of such correspondence, for the purpose of:

1. enabling e-mail contact with the administrator and contacting the recipients;

2. documenting arrangements made with persons contacted by e-mail;

3. receiving letters, notifications and applications in electronic form;

4. protection against claims and the pursuit of possible claims.

1. We store correspondence for one year, unless the messages contain content relevant to the pursuit of claims or defense against claims, in which case we will store selected messages for up to 3 years, i.e. until the expiry of the limitation period for claims, in accordance with the Civil Code.

2. The legal basis for processing data contained in e-mail correspondence is:

1. the legitimate interest of the data controller and the senders of electronic messages (Article 6(1)(f) of the GDPR) – in relation to incidental correspondence, consisting in enabling electronic contact with the controller;

2. voluntarily expressed consent through a clear affirmative action – if the sender of a message requests information about services or products, the response given to the sender will contain the information requested by the sender, and sending the inquiry will constitute consent to the administrator sending commercial information to the sender at the e-mail address provided by the sender to the extent necessary to provide a response (Article 10 of the Act on Providing Services by Electronic Means); the expressed consent may be withdrawn at any time without giving any reason, but commercial information sent after the inquiry has been sent and before the withdrawal of consent will be sent in accordance with the law; withdrawal of consent may prevent a full answer to the inquiry;

3. the legitimate interest of the controller in pursuing claims or defending against claims, in accordance with generally applicable legal provisions, in particular the Civil Code (Article 6 paragraph 1 letter f of the GDPR).

 

NEWSLETTER:

1. The Administrator processes the email addresses of newsletter subscribers for the purpose of providing the requested newsletter service, which is provided electronically. The Administrator processes the following data:

1. name,

2. provided email address,

3. date of subscription,

4. information about sending newsletters.

1. Furthermore, the administrator processes e-mail addresses provided for the provision of the newsletter service also for the purpose of providing the service in accordance with this Privacy Policy.

2. Data are processed in accordance with Article 6(1)(b) of the GDPR for the purpose of providing the newsletter service. Consent to receiving messages for the purpose of providing the newsletter service and to be informed about promotions and offers is expressed on the basis of Article 10(2) in conjunction with Article 1 of the Act on the Provision of Electronic Services and Article 172(1) of the Telecommunications Law.

Complaints

1. To process complaints, the service provider processes the personal data of subscribers submitting complaints, in particular: email address, name and surname, content of the complaint, circumstances of the event giving rise to the complaint, information obtained during the complaint processing, including explanations of the event causing it. In the course of processing a complaint, the service provider may process a variety of other information, including the user's name and surname, information about subscribers' use of the newsletter service, cookies or other similar technologies, and device information.

2. Data are processed in accordance with Article 6(1)(c) of the GDPR in order to fulfill the obligation arising from the provisions of law regarding the obligation to consider complaints, in accordance with the Act on the provision of electronic services, for the time necessary to consider the complaint and for no longer than one year after the end of the complaint procedure for archiving purposes in accordance with the Accounting Act in the event of the need to defend against possible claims against the service provider in accordance with the information provided below.

 

Investigation proceedings, pursuing claims

1. In the event of initiating an investigation into a possible violation of the provisions of this Policy or legal provisions, principles of social coexistence or good manners, the controller may process the personal data of specific subscribers until the end of the ongoing proceedings and until the expiry of the limitation period for the controller's claims against the subscriber, which is usually 3 years, but may be longer in specific cases provided for by law.

2. These data will then be processed, including shared, in accordance with Article 6(1)(f) of the GDPR, i.e., for the legitimate interest of the controller in pursuing claims against the user. The legitimate interest of the controller will then override the rights and freedoms of the subscriber.

Recipients of user data 

1. The Administrator discloses users' personal data only to processors under concluded personal data processing agreements for the purpose of providing services to the Administrator, e.g. hosting and maintenance of the Website, IT services, e-mail services, accounting, advisory and legal services.

2. Regarding the fan page, due to the specific nature of Facebook, information about fan page followers, likes, as well as the content of comments, posts, and other information provided by users is public. However, the administrator does not disclose other information to other entities.

3. Due to the nature of the Instagram profile, information about followers, likes, story views, comment content, and other information provided by users is public. However, the administrator does not disclose any other information to third parties.

 

Transfer of personal data to third countries

Personal data will be processed in third countries only to the extent necessary for the provision of the Controller’s services and this will be done in compliance with specific measures (i.e. on the basis of a decision confirming the adequacy of the level of protection issued by the EU Commission or on the basis of appropriate guarantees, Article 44 et seq. of the GDPR).

 

Rights of persons whose personal data is concerned

Every data subject has the right to:

to information on data processing – the controller provides the person submitting the request with information on the processing of personal data, including in particular the purposes and legal basis of processing, the scope of personal data held, the entities to which they are disclosed and the planned date of deletion of personal data (after the end of the storage period);

the right to obtain a copy of the data – the controller provides the person making the request with a copy of the personal data concerning him/her;

the right to rectify data – the administrator removes any inconsistencies or errors in the processed personal data upon request and supplements them if they are incomplete;

the right to delete data – the controller, upon request, deletes or anonymizes personal data whose processing is no longer necessary to achieve any of the purposes for which they were collected;

the right to limit data processing – the administrator, upon request, ceases to perform operations on personal data – with the exception of operations to which the person whose data is processed has given consent – and their storage, in accordance with the adopted period of personal data storage or until the reasons for limiting the processing of personal data cease to exist;

the right to data portability – to the extent that personal data are processed by automated means, the controller shall, upon request, issue the personal data provided by the data subject in a format that allows the personal data to be read by a computer;

the right to object (including for marketing purposes) – the person whose personal data is processed may at any time object to the processing of personal data which is carried out on the basis of the legitimate interest of the controller;

The right to withdraw consent at any time and without providing a reason, but the processing of personal data carried out prior to the withdrawal of consent will continue to be lawful. Withdrawal of consent will result in the controller no longer processing personal data for the purpose for which consent was given.

1. In order to exercise the aforementioned rights, the data subject must contact the controller using the contact details provided and inform him/her which right he/she wishes to exercise and to what extent.

President of the Personal Data Protection Office

The data subject has the right to lodge a complaint with the supervisory authority, which in Poland is the President of the Personal Data Protection Office with its registered office in Warsaw at ul. Stawki 2, who can be contacted as follows:

1. by post: ul. Stawki 2, 00-193 Warsaw,

2. via the electronic mailbox available at: https://www.uodo.gov.pl/pl/p/kontakt ;

3. by phone: (22) 531 03 00.

 

Changes to privacy policy

1. The privacy policy may be supplemented or updated according to the administrator's current needs in order to provide users with current and reliable information regarding their personal data and information about them. Users will be notified of any changes to the privacy policy on the administrator's website.

2. This privacy policy is effective from the date it is posted on the website.

3. Publication date: 23/02/2026