This Privacy Policy sets out the rules governing the storage of and access to data on Users’ Devices when they use the Website for the purpose of providing electronic services by the Controller. It also explains the rules governing the collection and processing of Users’ personal data voluntarily provided by them through the tools available on the Website.
This Privacy Policy forms an integral part of the Website Terms and Conditions, which define the rules, rights and obligations of Users accessing and using the Website.
1. Definitions
- Website – the “Smart Choice” website available at https://smartchoice.pl.
- External Website – websites operated by partners, service providers or service recipients cooperating with the Controller.
- Website / Data Controller – the controller of the Website and personal data (hereinafter referred to as the “Controller”) is Atlantis Hero Sp. z o.o., with its registered office at ul. Obrzeżna 5, 02-691 Warsaw, Poland, Tax Identification Number (NIP): 5214134887, National Court Register (KRS) number: 0001196771. The company provides electronic services through the Website.
- User – a natural person to whom the Controller provides electronic services through the Website.
- Device – an electronic device, together with its software, through which the User accesses the Website.
- Cookies – text data stored in files placed on the User’s Device.
- GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
- Personal Data – information relating to an identified or identifiable natural person (“data subject”). An identifiable natural person is someone who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier or one or more factors specific to that person’s physical, physiological, genetic, mental, economic, cultural or social identity.
- Processing – any operation or set of operations performed on Personal Data or sets of Personal Data, whether by automated means or otherwise, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
- Restriction of Processing – the marking of stored Personal Data with the aim of limiting its future processing.
- Profiling – any form of automated processing of Personal Data consisting of the use of Personal Data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.
- Consent – a freely given, specific, informed and unambiguous indication of the data subject’s wishes by which they, through a statement or a clear affirmative action, signify agreement to the processing of Personal Data relating to them.
- Personal Data Breach – a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, Personal Data transmitted, stored or otherwise processed.
- Pseudonymisation – the processing of Personal Data in such a manner that it can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the Personal Data is not attributed to an identified or identifiable natural person.
- Anonymisation – an irreversible process that destroys or overwrites Personal Data in such a way that an individual can no longer be identified or a record linked to a specific User or natural person.
2. Data Protection Officer
Pursuant to Article 37 of the GDPR, the Controller has not appointed a Data Protection Officer (DPO).
For matters relating to the processing of data, including Personal Data, please contact the Controller directly.
3. Types of Cookies
- First-party Cookies – files placed on and read from the User’s Device by the Website’s IT system.
- Third-party Cookies – files placed on and read from the User’s Device by the IT systems of External Websites. Scripts from External Websites that may place Cookies on the User’s Device have been deliberately integrated into the Website through scripts and services made available and installed on the Website.
- Session Cookies – files placed on and read from the User’s Device by the Website during a single session. These files are deleted from the Device when the session ends.
- Persistent Cookies – files placed on and read from the User’s Device by the Website until they are manually deleted. They are not automatically removed when the session ends, unless the User’s Device is configured to delete Cookies at the end of each session.
4. Data Storage Security
- Cookie storage and retrieval mechanisms – the mechanisms used to store, read and exchange data between Cookies saved on the User’s Device and the Website operate through built-in web browser functions. They do not allow the Website to retrieve other data from the User’s Device or information from other websites visited by the User, including Personal Data or confidential information. Transferring viruses, Trojan horses or other worms to the User’s Device through these mechanisms is also practically impossible.
- First-party Cookies – the Cookies used by the Controller are safe for Users’ Devices and do not contain scripts, content or information that could compromise the security of Personal Data or the Device used to access the Website.
- Third-party Cookies – the Controller takes reasonable steps to verify and select Website partners with regard to User security. The Controller works with established, reputable partners with a global reputation. However, it does not have full control over the content of Cookies provided by external partners. To the extent permitted by law, the Controller is not responsible for the security or content of Cookies originating from External Websites, or for their use by scripts installed on the Website in accordance with the relevant licences. A list of partners is provided later in this Privacy Policy.
- Managing Cookies
- Users may change the settings governing the storage, deletion and access to Cookies used by individual websites at any time.
- Instructions on disabling Cookies in popular desktop browsers are available from the following providers:
- Users may delete all previously stored Cookies at any time using the tools available on the Device through which they access the Website.
- Risks on the User’s Side
The Controller uses reasonable technical measures to protect data stored in Cookies. However, the security of such data also depends on the actions taken by the User. The Controller is not responsible for the interception of data, impersonation of a User’s session or deletion of data resulting from the User’s deliberate or inadvertent actions, or from viruses, Trojan horses or other spyware that may have infected the User’s Device. Users should follow safe internet practices to protect themselves against such risks. - Storage of Personal Data
The Controller makes every effort to ensure that Personal Data voluntarily provided by Users is kept secure, that access to it is restricted and that it is processed in accordance with its intended purpose. The Controller also makes every effort to protect the data it holds against loss through appropriate physical and organisational safeguards.
5. The Website may use Cookies and related technologies to support the following purposes:
- Improving and facilitating access to the Website.
- Personalising the Website for Users.
- Marketing and remarketing on External Websites.
- Compiling statistics, including the number of Users and visits, types of Devices and internet connection details.
- Providing multimedia services.
6. Purposes of Personal Data Processing
Personal Data voluntarily provided by Users is processed for one or more of the following purposes:
- Providing electronic services.
- Enabling the Controller to communicate with Users about matters relating to the Website and data protection.
- Pursuing the Controller’s legitimate interests.
Data about Users collected anonymously and automatically is processed for one or more of the following purposes:
- Compiling statistics.
- Remarketing.
- Pursuing the Controller’s legitimate interests.
7. Cookies Used by External Websites
The Controller uses JavaScript scripts and web components provided by partners who may place their own Cookies on the User’s Device.
Users can control which Cookies are permitted through their browser settings. The following partners or services integrated into the Website may place Cookies:
- Multimedia services:
- Analytics:
- Other services:
Services provided by third parties are outside the Controller’s control. These providers may change their terms of service, privacy policies, data processing purposes and methods of using Cookies at any time.
8. Types of Data Collected
The Website collects information about Users. Some information is collected automatically and anonymously, while other information consists of Personal Data voluntarily provided by Users when signing up for individual services offered through the Website.
Anonymous data collected automatically
- IP address.
- Browser type.
- Screen resolution.
- Approximate location.
- Website pages visited.
- Time spent on individual pages.
- Operating system.
- Address of the previously visited page.
- Referring website address.
- Browser language.
- Internet connection speed.
- Internet service provider.
- Demographic data, such as age and gender.
Data collected during registration
- First name, last name or username.
- Email address.
- Telephone number.
- IP address (collected automatically).
Data collected when subscribing to the newsletter
- Email address.
Some data that does not identify individuals may be stored in Cookies. Some non-identifying data may also be shared with analytics service providers.
9. Access to Personal Data by Third Parties
As a general rule, the Controller is the sole recipient of Personal Data provided by Users. Data collected in connection with the services provided is not transferred or sold to third parties.
Access to data may be granted, usually under a data processing agreement, to entities responsible for maintaining the infrastructure and services necessary to operate the Website, including:
- Hosting companies providing hosting or related services to the Controller.
Processing of Personal Data by Hosting, VPS and Dedicated Server Providers
To operate the Website, the Controller uses an external provider of hosting, VPS or dedicated server services: LH.pl Sp. z o.o. All data collected and processed through the Website is stored and processed within the service provider’s infrastructure located within the European Union. The provider’s personnel may access the data when carrying out maintenance work. Such access is governed by the agreement between the Controller and the service provider.
10. Methods of Personal Data Processing
Personal Data voluntarily provided by Users
- Personal Data will not be transferred outside the European Union unless it has been made publicly available as a result of an individual action by the User, such as posting a comment or entry, in which case it may be accessible to anyone visiting the Website.
- Personal Data will not be used for automated decision-making, including profiling.
- Personal Data will not be resold to third parties.
Anonymous data collected automatically (excluding Personal Data)
- Anonymous data may be transferred outside the European Union.
- Anonymous data may be used for automated decision-making, including profiling.
- Profiling based on anonymous data does not produce legal effects or similarly significantly affect the individuals concerned.
- Anonymous data will not be resold to third parties.
11. Legal Bases for Processing Personal Data
The Website collects and processes Users’ data on the basis of:
Regulation (EU) 2016/679 (General Data Protection Regulation — GDPR)
Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of Personal Data and on the free movement of such data, and repealing Directive 95/46/EC, in particular:
- Article 6(1)(a): the data subject has given consent to the processing of their Personal Data for one or more specific purposes.
- Article 6(1)(b): processing is necessary for the performance of a contract to which the data subject is a party, or to take steps at the request of the data subject prior to entering into a contract.
- Article 6(1)(d): processing is necessary to protect the vital interests of the data subject or of another natural person.
- Article 6(1)(f): processing is necessary for the purposes of the legitimate interests pursued by the Controller or a third party.
Other legal acts listed in the original policy:
- The Polish Act of 10 May 2018 on the Protection of Personal Data (Journal of Laws of 2018, item 1000).
- The Polish Telecommunications Law of 16 July 2004 (Journal of Laws of 2004, No. 171, item 1800).
- The Polish Act of 4 February 1994 on Copyright and Related Rights (Journal of Laws of 1994, No. 24, item 83).
12. Retention Periods for Personal Data
Personal Data voluntarily provided by Users
As a general rule, Personal Data is stored only for as long as the Controller provides the relevant service through the Website. It is deleted or anonymised within 30 days of the service ending, for example, when a registered User account is deleted or a User unsubscribes from the newsletter.
An exception may apply where continued processing is necessary to protect the Controller’s legitimate interests. In such cases, the Controller may retain the data for up to three years from the date on which the User requests its deletion, where the User has breached or is suspected of breaching the Website Terms and Conditions.
Anonymous data collected automatically
Anonymous statistical data that does not constitute Personal Data is retained by the Controller for website analytics for an indefinite period.
13. Users’ Rights in Relation to Personal Data Processing
- Right of access
Users have the right to obtain access to their Personal Data by submitting a request to the Controller. - Right to rectification
Users have the right to request that the Controller promptly rectify inaccurate Personal Data or complete incomplete Personal Data. - Right to erasure
Users have the right to request that the Controller promptly erase their Personal Data. For User accounts, erasure involves anonymising data that could identify the User. The Controller reserves the right to suspend the fulfilment of an erasure request where necessary to protect its legitimate interests, for example, where the User has breached the Terms and Conditions or the data was obtained through correspondence. For the newsletter service, Users can remove their Personal Data themselves by using the link included in each email. - Right to restriction of processing
Users have the right to request restriction of processing in the circumstances specified in Article 18 of the GDPR, including where they contest the accuracy of their Personal Data. - Right to data portability
Users have the right to receive their Personal Data from the Controller in a structured, commonly used and machine-readable format. - Right to object
Users have the right to object to the processing of their Personal Data in the circumstances specified in Article 21 of the GDPR. - Right to lodge a complaint
Users have the right to lodge a complaint with the supervisory authority responsible for personal data protection.
14. Contacting the Controller
The Controller can be contacted using any of the following methods:
- Postal address: Atlantis Hero Sp. z o.o., ul. Obrzeżna 5, 02-691 Warsaw, Poland.
- Email: kontakt@smartchoice.pl
- Telephone: +48 573 588 392
- Contact form: available at https://smartchoice.pl/en/contact/.
15. Website Requirements
- Restricting the storage of or access to Cookies on the User’s Device may cause certain Website functions to operate incorrectly.
- The Controller accepts no responsibility for Website functions that do not operate correctly where the User has restricted the ability to store or read Cookies.
16. External Links
The Website may contain links to external websites in articles, posts, entries or User comments. The owners of those websites may not cooperate with the Website owner.
Such links, and the websites or files they lead to, may pose a risk to the User’s Device or data security. The Controller is not responsible for content available outside the Website.
17. Changes to the Privacy Policy
- The Controller reserves the right to amend this Privacy Policy at any time, without notifying Users, insofar as the changes concern the use and processing of anonymous data or the use of Cookies.
- The Controller also reserves the right to amend this Privacy Policy in relation to the processing of Personal Data. Users who have accounts or are subscribed to the newsletter will be notified by email within seven days of the changes being made. Continued use of the services constitutes acknowledgement and acceptance of the amended Privacy Policy.
- If a User does not agree with the changes, they must delete their Website account or unsubscribe from the newsletter.
- Changes to the Privacy Policy will be published on this page of the Website.
- Changes take effect upon publication.