Privacy Policy

§ 1. General Provisions

The Controller ensures that the processing of Personal Data takes place with the greatest respect for the privacy and with the utmost care for the security of the Personal Data processed, and in particular the Controller ensures that it has taken appropriate measures provided for by law to ensure security of Personal Data.

The Controller has taken technical and organisational measures to ensure the protection of the processed Personal Data appropriate to the threats and categories of protected data, in particular, protects the data against unauthorised access, removal by an unauthorised person, processing in non-compliance with the law and change, loss, damage or destruction.

§ 2. Definitions

For the purpose of this Privacy Policy:

• Controller - Grinn Sp. z o.o. with its registered office in Wrocław, address: 54-429 Wrocław, ul. Strzegomska 140A, entered into the Register of Entrepreneurs of the National Court Register (KRS) kept by the District Court for Wrocław-Fabryczna in Wrocław, 6th Commercial Division of the National Court Register, under KRS number 0000230049, with share capital of PLN 125.000, Tax Id Number (NIP): 8992730302, REGON 020047322, website: https://grinn-global.com/, e-mail address: office@grinn-global.com. The Controller should also be understood as the data controller within the meaning of art. 4(7) of the GDPR;

• Personal Data - any information relating to an identified or identifiable natural person (‘User’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

• Software - web browsers that may be used by the User in order to use the Website;

• Cookies - text files with small pieces of data, used to identify the Device, which are stored on the User's Device and are intended for the use of the Website;

• Website – website operating at: https://grinn-global.com/;

• Device - an electronic device through which the User gains access to the Website, in particular: PCs, laptops, tablets, smartphones, etc.;

• User - a person who uses the Website.

§ 3. Processing of Personal Data

Users' Personal Data will be processed in order to perform the contract (if it is concluded), contact the User, for statistical purposes and for marketing purposes. The legal basis for the processing of Personal Data may be, respectively:

• the necessity to perform the contract;

• the necessity to fulfil the legal obligation to which the Controller is the subject;

• the necessity for the purposes of the legitimate interests pursued by the Controller - in relation to the processing of Personal Data for marketing purposes during the legal relationship between the User and the Controller, for statistical purposes related to market and internet traffic research on the Website, to assess interest in services and content posted on the Website, improving its content and services provided on the Website framework, as well as the processing of Personal Data after the performance of the contract for the period in which the User may submit any claims related to its performance against the Controller;

• User's consent - in the case of data processing for marketing purposes based on the User's consent.

Providing Personal Data by the user is voluntary.

The User may also express a separate consent to receive commercial, advertising and marketing information from the Controller. The user may at any time opt out of receiving them.

The Controller processes or may process the following Personal Data of the User, which the User provides voluntarily when using the Website:

• name and surname;

• electronic addresses;

• phone number;

• social media profiles;

• other data provided voluntarily by the User.

The Controller stores Personal Data in the Users database in order to facilitate potential contacts with Users in the future.

The recipients of Personal Data are persons authorised by the Controller to process data as part of their official duties, entities to which the Controller entrusts IT, accounting, HR, legal and tax services to the Controller, in particular on the basis of contracts for entrusting the processing of Personal Data.

The Controller has the right to share the User's data and information as part of the proceedings with an authorised body, e.g. the prosecutor's office or a court.

The Controller declares that as part of the processing of Personal Data for statistical purposes, he may use tools designed to analyse traffic on the Website, such as Google Analytics and other similar.

The Controller processes the User's Personal Data for the time in which the User may submit any claims related to the performance of the contract against the Controller, but not longer than for a period of six years. If the processing is based on the User's consent, the Controller will process their data until the consent is withdrawn.

The Controller adheres to the following rules while processing of Personal Data:

• records collected Personal Data only on information carriers protected against access by third parties;

• supervises the security of Personal Data throughout the entire period of their possession in a manner ensuring, in particular, protection against unauthorised access, damage, destruction or loss;

• maintains the confidentiality of Personal Data.

The Controller takes into account the state of the art, the cost of implementation and the nature, scope, context and purposes of processing as well as the risks of varying likelihood and severity for rights and freedoms of natural persons posed by the processing, implement appropriate technical and organisational measures, to ensure a level of security appropriate to the risk, including inter alia as appropriate:

• the pseudonymisation and encryption of Personal Data;

• the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services;

• the ability to restore the availability and access to Personal Data in a timely manner in the event of a physical or technical incident.

The Controller ensures regular testing, assessing and evaluating the effectiveness of technical and organisational measures for assuring the security of the processing.

The User whose Personal Data is processed has the right to request the Controller to access the data, as well as to rectify, delete, limit processing or object to processing, in accordance with § 7 of the Policy.

§ 4. Cookies

The Controller uses Cookies on the Website.

The Website uses two basic types of Cookies:

• session - these are temporary files that are stored on the User's Device until they leave the Website or disable the Software;

• permanent - these are files stored on the User's Device for the time specified in the parameters of Cookie files or until they are deleted by the User.

All or some of the following types of Cookies may be used on the Website:

• necessary - which enable the use of the Website;

• analytical - which enable the collection of information on how to use the Website;

• functional – which allow to keep the settings selected by the User and personalise the User interface, e.g. language, font size, Website appearance;

• marketing - which make it possible to provide the User with advertising content more tailored to their interests.

Cookies listed in par. 2 and 3 of this section are used for the following purpose:

• optimising the use of the Website; in particular, they make it possible to recognize and display the Website on the User's Device in a form adapted to their individual preferences;

• creating statistics that support the observation of the use of the Website by Users, which improves its structure and content.

The Website uses the following Cookies:

The files used on the Website are safe for the Devices and Users using the Website.

§ 5. Data transfer outside the EEA

The User's Personal Data, including the data made available by browsing the Website, in particular the data collected through Cookies, may be made available to trusted third parties, in accordance with the User's preferences, including those expressed through the Cookies settings.

In a situation where the User's Personal Data will be transferred to trusted third parties based outside the European Economic Area (EEA), it will be made only based on the decision of the European Commission (EC) to ensure an adequate level of protection, standard contractual clauses approved by the EC, binding corporate rules or GDPR provisions.

§ 6. Profiling

As part of the use of the Website, a system tracking Users' activity is used based on information, including Cookies, stored on Users' Devices, e-mail addresses, as well as the history of Website Users' activity. Based on this tracking, it is possible to profile Users in order to send individually tailored marketing messages.

The profiling referred to in the above paragraph does not cause any legal effects to the User or, to a similar extent, does not significantly affect their situation.

§ 7. Users' rights

The User has the right to access their Personal Data and the right to correct it at any time.

The User can choose to what extent and time they want to use the Website and share information about themselves. If for some reason the User does not wish to leave their Personal Data in the Users database, the User has the right to demand their removal.

In the case of Personal Data processing for marketing purposes, based on the consent granted, the User has the right to withdraw consent at any time and by a written declaration or by e-mail to the Controller’s address: office@grinn-global.com

The User has the right to correct, complete, update, rectify and request removal of their Personal Data.

The User has the right to object to the processing of Personal Data based on the purposes of legitimate interests, including profiling referred to in §6 of the Privacy Policy, implemented by the Controller or by a third party. If the User objects to the processing of his Personal Data for marketing purposes, it prevents further processing of this information for this purpose.

In order to request correction, completion, updating, rectification, restriction of processing, deletion and objection to the processing of their Personal Data, the User should send a request to the Controller’s e-mail address: office@grinn-global.com or in writing to the following address: Strzegomska 140a, 54-429 Wrocław.

The User has the right to lodge a complaint with the President of the Personal Data Protection Office in a situation where the Controller will not process his Personal Data in accordance with the law.

The User has the option to limit or disable the access of Cookies to his Device. If they use this option, the use of the Website will be possible, excluding some functionalities that require Cookies.

The User may change the Cookie settings at any time. These settings can be changed in particular in such a way as to block the automatic handling of Cookies in the web browser settings, or to inform about their every posting in the User's Device. Detailed information on the possibilities and methods of handling Cookies is available in the Software settings.

The User may at any time delete Cookies using the functions available in the web browser they use.

§ 8. Final Provisions

Links to other websites may appear on the Website. Such websites operate independently of the Controller and are not supervised by the Controller in any way. These websites may have their own privacy policies and regulations. It is recommended for User to read them.

Questions and concerns regarding the Privacy Policy should be reported via a message sent to the e-mail address: office@grinn-global.com.

The Controller reserves the right to change the Privacy Policy.

The User will be informed about any changes to the Privacy Policy on the Website.