Privacy Policy

This translation is provided for information only. The legally binding version is the Polish original: Polityka prywatności (Polish).

This Privacy Policy (hereinafter: the “Policy”) contains information on the processing of your personal data in connection with your use of the “Bazy.biz” website operating at https://www.bazy.biz (hereinafter: the “Website”).

All capitalised terms not defined otherwise in the Policy have the meaning given to them in the Terms of Service, available at: https://www.bazy.biz/regulamin (English translation: https://www.bazy.biz/en/terms).

Data controller

The controller of your personal data is Michał Woźniak, conducting business under the name HEXGRID Michał Woźniak (principal place of business: ul. Bagienna 36C, 70-772 Szczecin, Poland), entered in the Polish Central Register and Information on Economic Activity (CEIDG), tax identification number (NIP): 9552112428, statistical number (REGON): 320190228 (hereinafter: the “Controller”).

Contacting the Controller

In all matters relating to the processing of personal data you may contact the Controller:

by e-mail at: biuro@bazy.biz;
by post at: ul. Bagienna 36c, 70-772 Szczecin, Poland;
by phone at: +48 537 357 057.

Personal data protection measures

The Controller applies modern organisational and technical safeguards to ensure the best possible protection of your personal data and guarantees that it processes them in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter: “GDPR”), the Polish Act of 10 May 2018 on the Protection of Personal Data and other data protection laws.

Information on the personal data processed

Using the Website requires the processing of your personal data. Below you will find detailed information on the purposes and legal bases of processing, the retention period, and whether providing the data is mandatory or voluntary.

Purpose of processing	Personal data processed	Legal basis
Conclusion and performance of the Account Service Agreement	first name and surname e-mail address	Article 6(1)(b) GDPR (processing is necessary for the performance of the Account Service Agreement concluded with the data subject, or in order to take steps to conclude it)
Providing the above personal data is a condition of concluding and performing the Account Service Agreement (providing them is voluntary, but the consequence of not providing them will be the inability to conclude and perform the above agreement, including creating an Account). The Controller will process the above personal data until the limitation period for claims arising from the Account Service Agreement expires.
Purpose of processing	Personal data processed	Legal basis
Conclusion and performance of the Website Use Agreement	first name and surname e-mail address telephone number residential/business address (street, building number, unit number, town, postal code, country) optionally – company name and NIP (if the Customer is an Entrepreneur or an Entrepreneur with Consumer Rights)	Article 6(1)(b) GDPR (processing is necessary for the performance of the Website Use Agreement concluded with the data subject, or in order to take steps to conclude it)
Providing the above personal data is a condition of concluding and performing the Website Use Agreement (providing them is voluntary, but the consequence of not providing them will be the inability to conclude and perform the Website Use Agreement). The Controller will process the above personal data until the limitation period for claims arising from the Website Use Agreement expires.
Purpose of processing	Personal data processed	Legal basis
Conclusion and performance of the Newsletter Agreement	e-mail address	Article 6(1)(b) GDPR (processing is necessary for the performance of the Newsletter Agreement concluded with the data subject, or in order to take steps to conclude it) and Article 6(1)(f) GDPR (processing is necessary for the purposes of the legitimate interests pursued by the Controller, in this case informing about news and promotions available on the Website)
Providing the above personal data is voluntary but necessary to receive the Newsletter (the consequence of not providing them will be the inability to receive the Newsletter or digital content). The Controller will process the above personal data until an effective objection is raised or the purpose of processing is achieved, or until the limitation period for claims arising from the Newsletter Agreement expires (whichever occurs first).
Purpose of processing	Personal data processed	Legal basis
Handling complaints	first name and surname e-mail address telephone number	Article 6(1)(c) GDPR (processing is necessary for compliance with a legal obligation to which the Controller is subject, in this case the obligations to: respond to a complaint – Article 7a of the Polish Consumer Rights Act; honour the Customer’s rights under the provisions on the Controller’s liability for non-conformity of the Digital Deliverable with the Agreement concerning it)
Providing the above personal data is a condition of receiving a response to a complaint or of exercising the Customer’s rights under the provisions on the Controller’s liability for non-conformity of the Digital Deliverable with the Agreement concerning it (providing them is voluntary, but the consequence of not providing them will be the inability to receive a response to the complaint and to exercise the above rights). The Controller will process the above personal data for the duration of the complaint procedure and, where the above rights of the Customer are exercised, until the limitation period for them expires.
Purpose of processing	Personal data processed	Legal basis
Handling enquiries submitted by Users	first name e-mail address other data contained in the message to the Controller	Article 6(1)(f) GDPR (processing is necessary for the purposes of the legitimate interests pursued by the Controller, in this case responding to the enquiry received)
Providing the above personal data is voluntary but necessary to receive a response to the enquiry (the consequence of not providing them will be the inability to receive a response). The Controller will process the above personal data until an effective objection is raised or the purpose of processing is achieved (whichever occurs first).
Purpose of processing	Personal data processed	Legal basis
Fulfilling tax obligations (including issuing VAT invoices and keeping accounting records)	first name and surname / company name residential / registered office address NIP	Article 6(1)(c) GDPR (processing is necessary for compliance with a legal obligation to which the Controller is subject, in this case obligations under tax law)
Providing the above personal data is voluntary but necessary for the Controller to fulfil its tax obligations (the consequence of not providing them will be the Controller’s inability to fulfil those obligations). The Controller will process the above personal data for 5 years from the end of the year in which the tax payment deadline for the previous year expired.
Purpose of processing	Personal data processed	Legal basis
Fulfilling obligations related to personal data protection	first name and surname the contact details you provide (e-mail address; correspondence address; telephone number)	Article 6(1)(c) GDPR (processing is necessary for compliance with a legal obligation to which the Controller is subject, in this case obligations under data protection law)
Providing the above personal data is voluntary but necessary for the Controller to properly fulfil its obligations under data protection law, including honouring the rights granted to you by the GDPR (the consequence of not providing them will be the inability to properly honour those rights). The Controller will process the above personal data until the limitation periods for claims arising from breaches of data protection law expire.
Purpose of processing	Personal data processed	Legal basis
Establishing, pursuing or defending against claims	first name and surname / company name e-mail address residential / registered office address PESEL number (Polish personal identification number) NIP	Article 6(1)(f) GDPR (processing is necessary for the purposes of the legitimate interests pursued by the Controller, in this case establishing, pursuing or defending against claims that may arise in connection with the performance of Agreements concluded with the Controller)
Providing the above personal data is voluntary but necessary to establish, pursue or defend against claims that may arise in connection with the performance of Agreements concluded with the Controller (the consequence of not providing them will be the Controller’s inability to take those actions). The Controller will process the above personal data until the limitation periods for claims that may arise in connection with the performance of Agreements concluded with the Controller expire.
Purpose of processing	Personal data processed	Legal basis
Analysis of your activity on the Website	date and time of visit device IP address device operating system type approximate location web browser type time spent on the Website pages visited and other actions taken on the Website	Article 6(1)(f) GDPR (processing is necessary for the purposes of the legitimate interests pursued by the Controller, in this case obtaining information about your activity on the Website)
Providing the above personal data is voluntary but necessary for the Controller to obtain information about your activity on the Website (the consequence of not providing them will be the Controller’s inability to obtain that information). The Controller will process the above personal data until an effective objection is raised or the purpose of processing is achieved.
Purpose of processing	Personal data processed	Legal basis
Administering the Website	IP address server date and time web browser information operating system information The above data is recorded automatically in server logs each time the Website is used (administering it without server logs and automatic recording would not be possible).	Article 6(1)(f) GDPR (processing is necessary for the purposes of the legitimate interests pursued by the Controller, in this case ensuring the proper functioning of the Website)
Providing the above personal data is voluntary but necessary to ensure the proper functioning of the Website (the consequence of not providing them will be the inability to ensure that the Website functions properly). The Controller will process the above personal data until an effective objection is raised or the purpose of processing is achieved.

Profiling

In order to create your profile for marketing purposes and to direct to you direct marketing tailored to your preferences, the Controller will process your personal data in an automated manner, including by profiling them – this will not, however, produce any legal effects concerning you or similarly significantly affect your situation.

The scope of profiled personal data corresponds to the scope indicated above in relation to the analysis of your activity on the Website and the data you save in your Account.

The legal basis for processing personal data for the above purpose is Article 6(1)(f) GDPR, under which the Controller may process personal data for the purposes of its legitimate interests, in this case conducting marketing activities tailored to the preferences of recipients. Providing the above personal data is voluntary but necessary to achieve the above purpose (the consequence of not providing them will be the Controller’s inability to conduct marketing activities tailored to the preferences of recipients).

The Controller will process personal data for profiling purposes until an effective objection is raised or the purpose of processing is achieved.

Recipients of personal data

The recipients of personal data will be the following external entities cooperating with the Controller:

the hosting company;
online payment system providers;
the newsletter service provider;
the company providing IT/technical services for the Website;
companies providing tools for analysing activity on the Website and directing direct marketing to its users (including Google Analytics, Facebook, LinkedIn, TikTok);
the company providing accounting services;
the company providing legal services.

In addition, personal data may also be transferred to public or private entities if such an obligation arises from generally applicable law, a final court judgment or a final administrative decision.

Transfer of personal data to third countries

In connection with the Controller’s use of services provided by Google LLC, your personal data may be transferred to the following third countries: the United Kingdom, Canada, the USA, Chile, Brazil, Israel, Saudi Arabia, Qatar, India, China, South Korea, Japan, Singapore, Taiwan (Republic of China), Indonesia and Australia. The bases for transferring data to the above third countries are:

for the United Kingdom, Canada, Israel and Japan – European Commission decisions finding an adequate level of personal data protection in each of those third countries;
for the USA, Chile, Brazil, Saudi Arabia, Qatar, India, China, South Korea, Singapore, Taiwan (Republic of China), Indonesia and Australia – contractual clauses ensuring an adequate level of protection, in line with the standard contractual clauses set out in Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council.

You may obtain from the Controller a copy of the data transferred to a third country.

In connection with the Controller’s use of services provided by Meta Platforms Ireland Limited (the operator of Facebook), your personal data may be transferred to the USA and Singapore.

The basis for transferring data to the above third countries are contractual clauses ensuring an adequate level of protection, in line with the standard contractual clauses set out in Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council.

You may obtain from the Controller a copy of the data transferred to a third country.

Your rights

In connection with the processing of personal data, you have the following rights:

the right to be informed which of your personal data is processed by the Controller and to receive a copy of that data (the right of access). The first copy of the data is free of charge; the Controller may charge a fee for subsequent copies;
if the processed data becomes outdated or incomplete (or otherwise incorrect), you have the right to request its rectification;
in certain situations you may ask the Controller to erase your personal data, for example when:
1. the data is no longer needed by the Controller for the purposes it informed you of;
2. you effectively withdraw your consent to processing – provided the Controller has no right to process the data on another legal basis;
3. the processing is unlawful;
4. the need to erase the data arises from a legal obligation to which the Controller is subject;
where personal data is processed by the Controller on the basis of your consent or in order to perform an Agreement concluded with it, you have the right to transfer your data to another controller;
where personal data is processed by the Controller on the basis of your consent, you have the right to withdraw that consent at any time (withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal);
if you consider that the processed personal data is inaccurate, that its processing is unlawful, or that the Controller no longer needs certain data, you may request that, for a specified, necessary period (e.g. to verify the accuracy of the data or to pursue claims), the Controller does not perform any operations on the data other than storing it;
you have the right to object to the processing of personal data where the basis for processing is the Controller’s legitimate interest. If the objection is effective, the Controller will stop processing the personal data for the above purpose;
you have the right to lodge a complaint with the President of the Polish Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych) if you consider that the processing of personal data infringes the GDPR.

Cookies

The Controller informs that the Website uses “cookies” installed on your end device. These are small text files that can be read by the Controller’s system and by systems belonging to other entities whose services the Controller uses (e.g. Facebook, Google).
The Controller uses cookies for the following purposes:
1. ensuring the proper functioning of the Website – thanks to cookies, the Website works smoothly, its functions can be used and it is easy to move between its pages;
2. improving the comfort of using the Website – thanks to cookies, errors on certain pages can be detected and the pages continuously improved;
3. generating statistics – cookies are used to analyse how users use the Website. This makes it possible to continuously improve the Website and adapt its operation to users’ preferences;
4. conducting marketing activities – thanks to cookies, the Controller can direct advertisements tailored to users’ preferences.
The Controller may place both persistent and temporary (session) cookies on your device. Session cookies are usually deleted when the browser is closed, whereas closing the browser does not delete persistent cookies.
Information about the cookies used by the Controller is displayed in the panel located at the bottom of the web page / in the Website’s footer. Depending on your decision, you can enable or disable cookies of individual categories (except for necessary cookies) and change these settings at any time.
The data collected by means of cookies does not allow the Controller to identify you.
The Controller uses the following cookies or tools that make use of them:

TOOL	PROVIDER	FUNCTIONS AND SCOPE OF DATA COLLECTED	DURATION
Necessary cookies	Controller	These cookies are necessary for the proper functioning of the Website / its web pages, so you cannot disable them. Thanks to these cookies (which collect, among other things, your device’s IP address), it is possible, for example, to inform you about the cookies operating on the Website.	Most necessary cookies are session cookies, but some remain on your end device for 1 month or until deleted.
Google Analytics	Google	This tool makes it possible to collect statistical data on how Users use the Website, including the number of visits, visit duration, search engine used and location. The collected data helps to improve the Website and make it more user-friendly.	up to 2 years or until deleted (whichever occurs first)
Facebook Pixel	Facebook	This tool makes it possible to establish that you have opened the Website, to direct to you advertisements displayed on the Facebook and Instagram social networks, and to measure their effectiveness.	up to 3 months or until deleted (whichever occurs first)
LinkedIn Pixel	LinkedIn	This tool makes it possible to establish that you have opened the Website, to direct to you advertisements displayed on the LinkedIn social network, and to measure their effectiveness.	until deleted

Using most commonly used browsers, you can check whether cookies have been installed on your end device, delete installed cookies, and block the Website from installing them in the future. Disabling or restricting cookies may, however, cause considerable difficulties in using the Website, such as having to log in on every page, longer loading times or limitations in the use of certain functionalities.

Final provisions

Matters not regulated by the Policy are governed by generally applicable data protection law.

The Policy applies from 2 April 2024.