NTAX updates

PRIVACY POLICY

I. DEFINITIONS

  1. GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
  2. Personal data – all information about a natural person identified or identifiable by one or more specific factors determining physical, physiological, genetic, mental, economic, cultural or social identity, including device IP, location data, internet identifier and information collected for via cookies and other similar technology.
  3. Personal data administrator, Administrator – NTAX Biuro Rachunkowe sp. z o.o. with its registered office in Cracow, Zbożowa 2B/5, 30-002 Cracow entered into the Register of Entrepreneurs of the National Court Register maintained by the Sąd Rejonowy dla Krakowa-Śródmieścia w Krakowie Wydział XI Gospodarczy KRS under the number: 0000730956, tax number (NIP): 6751645976;
  4. Policy – this privacy policy.
  5. Website – website run by the Administrator at www.ntax.com.pl;
  6. User – any natural person visiting the Website or using one or several services or functionalities described in the Policy.

II. PERSONAL DATA PROCESSING IN CONNECTION WITH THE USE OF THE WEBSITE

In connection with the User’s use of the Website, the Administrator collects data to the extent necessary to provide the services offered, as well as information about the User’s activity in the Website. Detailed rules and purposes for processing personal data collected while using the Website by the User are described below.

III. OBJECTIVES AND LEGAL BASIS FOR DATA PROCESSING

1. USE OF THE WEBSITE

  1. Personal data of all persons using the Website (including the IP address or other identifiers and information collected via cookies or other similar technologies) are processed by the Administrator:
    1. in order to provide services electronically in the scope of making content collected in the Website available to Users, providing contact forms – then the legal basis for processing is the necessity of processing to perform the contract (art. 6 paragraph 1 letter b of the GDPR);
    2. to handle complaints – then the legal basis for processing is the necessity of processing to perform the contract (art. 6 paragraph 1 letter b of the GDPR);
    3. for analytical and statistical purposes – then the legal basis for processing is the justified interest of the Administrator (art. 6 paragraph 1 letter f of the GDPR) consisting in conducting analyzes of Users’ activity as well as their preferences in order to improve the functionalities and services provided;
    4. in order to possibly determine and assert claims or defend against them – the legal basis for processing is the justified interest of the Administrator (art. 6 paragraph 1 letter f of the GDPR) consisting in the protection of his rights;
    5. for Administrator’s marketing purposes

2. CONTACT FORMS

  1. Administrator provides the possibility of contacting him using electronic contact forms as well as via e-mail address or other forms of communication indicated on the Website’s website. Using the form or making contact via e-mail address or other forms of communication indicated on the Website’s website requires providing personal data necessary to contact the User and answer the inquiry. The User may also provide other data to facilitate contact or service the inquiry. Providing data marked as mandatory is required in order to accept and handle the inquiry, and failure to do so results in the inability to handle. Providing other data is voluntary.
  2. Personal data is processed:
    1. to identify the sender and handle his inquiry sent via the provided form – the legal basis for processing is the necessity of processing to perform the service contract (art. 6 paragraph 1 letter b of the GDPR);
    2. for analytical and statistical purposes – the legal basis for processing is the legitimate interest of the Administrator (art. 6 paragraph 1 letter f GDPR) consisting in keeping statistics of inquiries submitted by Users via the Website in order to improve its functionality. 

IV. SOCIAL MEDIA

  1. Administrator processes the personal data of Users visiting the Administrator’s profiles in social media (Facebook, LinkedIn). These data are processed only in connection with keeping the profile, including to inform Users about the Administrator’s activity and to promote various types of events, services and products, as well as to communicate with users through the functionalities available on social media. The legal basis for the processing of personal data by the Administrator for this purpose is its legitimate interest (Article 6 paragraph 1 letter f of the GDPR) consisting in promoting its own brand and building and maintaining a brand-related community.
  2. There are integrated social media plugins on the Website’s website. This means that if the User clicks on one of these buttons, certain information will be shared with the providers of these social media channels. If the User is logged in to a given social account at the same time, the social network service provider may connect this information with the User’s account on the social channel and make the activities on the User’s profile public in such a way that they will be shared with other network users.
  3. Plug-ins, the so-called plug-ins of social networks, incl. Facebook, Pinterest, Instagram, YouTube and others may be on the Website’s website. The related services are provided respectively by:
    1. Facebook are operated by Meta Ireland Limited, 4 Grand Canal Square, Grand Canal Harbor, Dublin 2 and Meta Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA Facebook;
    2. LinkedIn is operated by LinkedIn Ireland Unlimited Company Wilton Place, Dublin 2, Ireland;
  4. The plug provides its supplier only with information about the time when the User had access to the Website. If, while viewing the Website’s website or staying on it, the User is logged in to his account located, for example, on Facebook, the provider is able to combine the User’s interests, information preferences, and other data obtained, for example, by clicking the “Like” button or leaving comment, or enter the profile name in the searched ones. Such information will also be transmitted directly to the provider via the browser. To avoid recording a visit to the selected User account of a given provider of the social media portal on the Website’s website, log out of the account before browsing the Website.
  5. Website’s website also contains links to websites administered by entities independent of the Administrator, i.e. Facebook, LinkedIn. They may have separate clauses or privacy policy. Administrator encourages you to read their content, as the Administrator has no influence on the collected data and data processing processes, as well as the knowledge of the full scope of their acquisition, the purpose of their processing and the duration of their storage. Administrator also has no information on the deletion of the data collected by the plug-in providers.
  6. Addresses of plug-in providers and URLs to their privacy policy:
    1. Facebook: http://www.facebook.com/policy.php ; further information on personal data collection: http://www.facebook.com/help/186325668085084  http://www.facebook.com/about/privacy/your-info-on-other#applications and http://www.facebook.com/about/privacy/your-info#everyoneinfo. Facebook has joined the “Privacy Shield” agreement between the EU and the US, https://www.privacyshield.gov/EU-US-Framework;
    2. LinkedIn: https://pl.linkedin.com/legal/privacy-policy?

V. COOKIES AND SIMILAR TECHNOLOGY

Cookies are small text files installed on the device of the User browsing the Website. Cookies collect information that facilitates the use of the website – e.g. by remembering User’s visits to the Website and activities performed by him.

1. “SERVICE” COOKIES

  1. The Administrator uses the so-called service cookies primarily to provide the User with services provided electronically and to improve the quality of these services. Therefore, the Administrator and other entities providing analytical and statistical services to him use cookies, storing information or gaining access to information already stored in the User’s telecommunications terminal device (computer, telephone, tablet, etc.). Cookies used for this purpose include:
    1. cookies with data entered by the User (session ID) for the duration of the session (user input cookies);
    2. authentication cookies used for services that require authentication for the duration of the session (authentication cookies);
    3. cookies used to ensure security, e.g. used to detect fraud in the field of authentication (user centric security cookies);
    4. session cookies of multimedia players (e.g. flash player cookies), for the duration of the session (multimedia player session cookies);
    5. persistent cookies used to personalize the User interface for the duration of the session or a little longer (user interface customization cookies),
    6. cookies used to remember the contents of the basket for the duration of the session (shopping cart cookies);
  2. To collect statistics, Administrator uses the Google Analytics product, thus the data of the User visiting the Website will be obtained by Google, 1600 Amphitheater Parkway Mountain View, CA 94043 United States. Google is certified under the Privacy Shield program. As part of the agreement between the US and the European Commission, the latter has established an adequate level of data protection in the case of companies certified by the Privacy Shield. It is possible to block Google Analytics access to the User’s data after the user installs the plugin in the browser at the link: https://tools.google.com/dlpage/gaoptout/. If you are interested in the details related to data processing as part of Google Analytics, we encourage you to read the explanations prepared by Google: https://policies.google.com/privacy?hl=pl.

2. “MARKETING” COOKIES

The Administrator also uses cookies for marketing purposes, including in connection with targeting behavioral advertising to Users. For this purpose, the Administrator Websites information or gains access to information already stored in the User’s telecommunications terminal device (computer, telephone, tablet, etc.). The use of cookies and personal data collected through them for marketing purposes requires the consent of the User. This consent may be expressed through the appropriate configuration of the browser, and may also be withdrawn at any time, in particular by clearing the cookie history and disabling cookies in the browser settings.

3. GOOGLE ADS, FACEBOOK PIXEL

  1. Website’s website uses the Google Ads program.
  2. Google Ads is a program of Google Inc., 1600 Amphitheater Parkway, Mountain View, CA 94043, United States (“Google”). As part of Google Ads, the Administrator uses the so-called conversion tracking. When you click on an ad served by Google, a conversion tracking cookie is set. Cookies are small text files that are saved in the internet browser on the user’s computer. These cookies lose their validity after 30 days and are not used to identify you personally. If the user visits certain pages of this website and the cookie has not yet expired, Google and the website of the Website are informed that the user has been redirected to this page after clicking on the ad.
  3. Each Google Ads customer receives a different cookie. Cookies cannot be tracked through the websites of Ads customers. The information collected using the conversion cookie is used to compile conversion statistics for Ads customers who have opted for conversion tracking. Customers are told the total number of users who clicked on their ad and were redirected to a page with a conversion tracking tag. However, they do not receive any information that could be used to identify the user. If you do not want to participate in conversion tracking, you can object to the use of this feature. For this, it is sufficient to deactivate the Google conversion tracking cookie in your internet browser. You will then not be included in the conversion tracking statistics.
  4. Conversion cookies are stored based on art. 6 paragraph 1 letter f  of the GDPR. The website operator has a legitimate interest in analyzing user behavior to optimize both its website and its advertising.
  5. For more information on Google Ads and Google Conversion Tracking, see Google’s privacy policy at: https://www.google.plpolicies/privacy/.
  6. You can set your browser so that you are informed about the generation of cookies and allow them only on a case-by-case basis, not to accept cookies on a case-by-case basis or in general, and to activate the automatic deletion of cookies when closing the browser. Disabling cookies may limit the functionality of this website.
  7. In order to conduct effective marketing campaigns and promotions of Goods sold by Administrator through the Online Website, Administrator uses the “Facebook Pixel” option, which is provided by the Facebook social network operated by Facebook Inc., 1601 S. California Ave., Palo Alto, CA 94304 , USA or, for EU residents, Facebook Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbor, Dublin 2, Ireland (“Facebook”). Facebook Pixel is a code fragment placed on the Online Website. It allows Facebook to identify people visiting the Administrator’s web content as a target group to display ads on Facebook on their social profiles (e.g. as part of sponsored ads), which we understand as our legitimate interest (art. 6 paragraph 1 letter f of the GDPR). As part of the Facebook Pixel function, it is therefore possible to display the Administrator’s published ads on Facebook only to Facebook users who have shown interest in our services or who have certain common factors (such as interests in certain topics or products determined on the basis of the visited tabs on our website, viewed products) that we pass on to Facebook (this results from the operation of Pixel installed on our website). The Facebook Pixel function also helps the Administrator understand the effectiveness of Facebook ads for statistical and market research purposes, showing whether users have been redirected to our services after clicking on an ad on Facebook (the so-called conversion, allowing to determine on which devices the user performs the activity), in order to create the so-called similar audiences or statistical twins (i.e. serving advertisements to target groups similar to existing customers) and obtaining comprehensive statistics on site usage. During your visit to our website, the Facebook Pixel function establishes a direct connection to Facebook’s servers. Thus, the Facebook server is notified that the User has visited our website, and Facebook assigns this information to the personal Facebook user account. 
  8. Further information on the collection and use of data by Facebook and your privacy rights and options can be found in the data protection policy of Facebook at https://www.facebook.com/about/privacy/update. Specific information and details about Facebook Pixel’s features and how it works are available in the Facebook help section at https://www.facebook.com/business/help/651294705016616. This feature can be disabled as shown at https://de-de.facebook.com/business/help/1415256572060999?helpref=uf_permalink or at https://www.facebook.com/settings?tab=ads. To do this, you must log in to Facebook.
  9. You can object to our use of Facebook Pixel using your personal data as follows: Users who have a Facebook account by clicking on the following link: https://www.facebook.com/ads/preferences.
  10. Please note that when the cookie blocking is removed, the data will be collected again by Facebook Pixel.

    VI. PERIOD OF PROCESSING OF THE PERSONAL DATA

    We will process personal data for the duration of the contract and the time necessary to demonstrate performance of the contract, i.e. for the duration of the limitation period for claims.

    VII. USER’S ENTITLEMENTS

    1. Data subjects have the following rights:
      1. The right to information on the processing of personal data – the Administrator provides information on the processing of personal data, including primarily the purposes and legal grounds for processing, the scope of data held, entities to whom personal data is disclosed and the planned date of their removal;
      2. The right to obtain a copy of the data – the Administrator provides a copy of the processed data regarding the person making the request;
      3. Right to rectification – the Administrator removes any incompatibilities or errors regarding personal data being processed, and supplements or updates them if they are incomplete or have changed;
      4. The right to delete data (the so-called right to forget) – is the basis for requesting the deletion of data whose processing is no longer necessary to achieve any of the purposes for which it was collected;
      5. The right to limit processing – the Administrator ceases to carry out operations on personal data, with the exception of operations to which the data subject has consented and their storage, in accordance with the adopted retention rules, or until the reasons for limiting data processing cease (e.g. a decision will be issued supervisory authority authorizing further processing of data);
      6. The right to transfer data – to the extent that data is processed in connection with the concluded contract or expressed consent, the Administrator issues data provided by the person to whom they relate, in a format that can be read by a computer. It is also possible to request that the data be sent to another entity – provided that both the Administrator and another entity to which the data are sent have appropriate technical conditions enabling such transmission;
      7. The right to object to the processing of data for marketing purposes – the data subject may at any time object to the processing of personal data for marketing purposes, without the need to justify such an objection;
      8. The right to object to other purposes of data processing – the data subject may at any time object to the processing of personal data on the basis of the justified interest of the Administrator (e.g. for analytical or statistical purposes or for reasons related to the protection of property). An objection in this respect should contain a justification and is subject to the Administrator’s assessment;
      9. The right to withdraw consent – if the data are processed on the basis of consent, the data subject has the right to withdraw it at any time, which, however, does not affect the lawfulness of the processing carried out before the withdrawal of this consent;
      10. Right to complain – if it is considered that the processing of personal data violates the provisions of the GDPR or other provisions regarding the protection of personal data, the data subject may submit a complaint to the President of the Office for Personal Data Protection.
    2. An application regarding the exercise of the rights of data subjects, together with an indication of which request we make, can be submitted:
      1. in writing to the address of the seat of NTAX Biuro Rachunkowe sp. z o.o. with its registered office in Cracow, Zbożowa 2B/5, 30-002 Cracow;
      2. by Administrator’s email: office@ntax.com.pl;
    3. If the Administrator will not be able to determine the content of the request or identify the person submitting the application based on the application, he will ask the applicant for additional information.
    4. Answers to applications will be given within one month of receipt. If it is necessary to extend this period, the Administrator will inform the applicant about the reasons for such extension.
    5. The answer will be given to the e-mail address from which the application was sent, and in the case of applications sent by letter, by ordinary letter to the address indicated by the applicant, unless the content of the letter indicates the desire to receive feedback to the e-mail address (in this case you must provide an email address).

    VIII. DATA RECIPIENTS

    1. In connection with the provision of services, personal data will be disclosed to external entities, including in particular suppliers responsible for the operation of IT systems, entities providing accounting, legal, auditing, consulting services.
    2. Administrator reserves the right to disclose selected information about the User to the competent authorities or third parties who submit a request for such information, based on an appropriate legal basis and in accordance with the provisions of applicable law.

    IX. TRANSFER OF PERSONAL DATA OUTSIDE EEA

    Administrator will not transfer the personal data of Website Users to a third country (outside the European Economic Area) or an international organization, except for situations and entities clearly indicated in this privacy policy (such as: Facebook, LinkedIn) or in connection with the necessity to perform the contract, i.e. transfer the data to the courier entity or payment operators.

    X. SECURITY OF THE PERSONAL DATA

    1. Administrator conducts a risk analysis on an ongoing basis to ensure that personal data is processed by him in a safe manner – ensuring, above all, that only authorized persons have access to the data and only to the extent that it is necessary due to the not the job. The administrator makes sure that all operations on personal data are recorded and performed only by authorized employees and colleagues.
    2. Administrator shall take all necessary steps to ensure that its subcontractors and other cooperating entities guarantee the application of appropriate security measures in each case when they process personal data on behalf of the Administrator. 

    XI. CONTACT DETAILS

    Contact with the Administrator is possible in writing to the address of the seat of Administrator at: NTAX Biuro Rachunkowe sp. z o.o. with its registered office in Cracow, Zbożowa 2B/5, 30-002 Cracow or by Administrator’s email: office@ntax.com.pl;

    XII. CHANGES TO THE PRIVACY POLICY

    The policy is reviewed on an ongoing basis and updated as necessary.