Privacy policy

and Cookies Policy of the Architype website

This document sets out the Privacy and Cookies Policy of the ARCHITYPE website, available at https://architype.pl/ (the “Website”). The Website is managed by:

ARCHITYPE Spółka z ograniczoną odpowiedzialnością, with its registered office in Warsaw at ul. Grójecka 43/1A, 02-031 Warszawa, entered in the register of entrepreneurs of the National Court Register kept by the District Court for the Capital City of Warsaw in Warsaw, 12th Commercial Division of the National Court Register, under KRS number 0000864024, NIP (tax ID): 7010999871, REGON: 387277517 (the “Company”).

§ 1

Introduction

The ARCHITYPE website makes every effort to respect privacy and protect the personal information provided while using the website, and takes all necessary measures to this end.

Using the services provided by the Company requires the processing of personal data, which is why we take security and privacy protection particularly seriously.

This document has been prepared to help you understand how your privacy is protected, what personal data is collected, for what purpose and how it is used. It also explains how you can exercise your rights under Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC. Data of entrepreneurs processed solely in the Central Register and Information on Economic Activity (CEIDG), kept by the Minister of Development, does not constitute personal data.

The document also lists the technologies used that involve the processing of personal data, such as browser storage, geolocation and pixel tags.

With regard to the cookies policy, information is provided on the conditions for storing information, or gaining access to information already stored, in the telecommunications terminal equipment of end users. An end user is a natural person or entity that uses or requests a publicly available telecommunications service to meet their own needs.

§2

Declaration

In pursuing its overriding objective of respecting Customers’ privacy, the Controller strives to exercise all due diligence. To meet this commitment, it applies the standards and rules arising from generally applicable law, in particular: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC; the Act of 18 July 2002 on the provision of electronic services (Journal of Laws of 2016, item 1030, as amended); and the Act of 16 July 2004 Telecommunications Law (Journal of Laws of 2016, item 1489, as amended).

In particular, due care is taken to ensure that Customers’ personal data is:

• processed lawfully,
• collected for the lawful purposes specified in this document,
• not further processed in a manner incompatible with those purposes,
• accurate and adequate in relation to the purposes for which it is processed,
• adequately protected against unauthorised access, destruction, disclosure and unlawful use,
• kept in a form that permits identification of the data subjects for no longer than is necessary for the purposes of the processing.

§ 3

Controller of personal data

The controller of personal data processed through the website is the Company, ARCHITYPE Sp. z o.o., with its registered office in Warsaw at ul. Jana Dantyszka 18, 02-054 Warszawa. The Controller can be contacted by phone at +48 728 895 084, by e-mail at [email protected] or by post at the Controller’s registered office.

§ 4

Data provided by Customers

Data provided by Customers includes their name (e.g. first name and surname) and e-mail address, as well as any other data the Customer includes in a message sent via the contact form on the website. This data is collected in order to carry out an initial analysis of the enquiry and to contact the Customer to share the findings and, with the Customer’s consent, to provide commercial information.

If the Customer has given consent (by subscribing to the newsletter), the e-mail address provided may be used for the Controller’s marketing purposes. In this case, the legal basis for processing is Article 6(1)(a) GDPR (the data subject has consented to the processing of personal data) and Article 6(1)(f) GDPR (the Controller’s legitimate interest in sending the Customer information about promotions, discounts, products and services provided by the Controller).

Data collected via the form is collected in line with the statutory principle of data minimisation, i.e. it is adequate, relevant and limited to what is necessary for the purposes for which it is processed.

§ 5

Legal basis for processing personal data

The Controller may process personal data only if and to the extent that at least one of the following conditions is met: the data subject has given consent to the processing of their personal data for one or more specific purposes; processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract; processing is necessary for compliance with a legal obligation to which the Controller is subject; or processing is necessary for the purposes of the legitimate interests pursued by the Controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Each processing of personal data by the Controller requires at least one of the legal bases indicated in § 6 of the Privacy and Cookies Policy, which sets out the scope of data processed by the Controller.

Personal data will not be processed after the Customer has stopped using the service, except for data that is:

• necessary to settle the service and pursue claims for payment for its use,
• necessary for advertising, market research and research into Customers’ behaviour and preferences, with the results used to improve the quality of the Controller’s services, subject to the Customer’s consent,
• necessary to clarify the circumstances of unauthorised use of the service,
• permitted to be processed under separate laws or an agreement.

Data obtained in this way is processed on the basis of Article 6 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.

The data controller does not use “profiling”, i.e. any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that person’s personal preferences and interests. The Controller does not make automated decisions in individual cases based on profiling, nor any decision based solely on automated processing, including profiling, that would significantly affect the data subject.

Separately, personal data may be processed where this is necessary for the purposes of legitimate interests pursued by us or by data recipients, and the processing does not infringe the rights and freedoms of the data subject. Legitimate interests include, in particular, direct marketing of our products or services and the pursuit of claims arising from our business activity. Data obtained in this way is processed on the basis of Article 6

of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.

In other cases, the Controller asks for voluntary consent to the processing of personal data. Consent is given, in particular, by ticking a checkbox next to the consent statement. Data obtained in this way is processed on the basis of Article 6 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, or Article 18(4) of the Act of 18 July 2002 on the provision of electronic services (Journal of Laws of 2016, item 1030, as amended).

§ 6

Data sets, their scope and purposes of processing personal data

§ 7

Entrusting and sharing personal data

The Controller may entrust Customers’ personal data to other entities, such as a hosting provider, accounting or legal service providers, a payment operator or another entity we work with to provide our services properly. Personal data is always entrusted on the basis of a written data processing agreement. An up-to-date list of entities to which we entrust data processing is available to all Customers at all times. To obtain it, simply send a request to the Controller, for example by e-mail. The legal basis for entrusting personal data is Article 28 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.

The Controller may transfer processed data outside the European Economic Area. Data protection laws in those countries may provide a lower level of protection than the laws of the Republic of Poland. Therefore, if such data is transferred, the Controller takes particular care to ensure compliance with the processing conditions set out in this document. One of the ways it does so is by using standard contractual clauses approved by the European Commission, including those compliant with the EU-US Privacy Shield.

The Controller does not disclose collected data to third parties, except where required by generally applicable law, i.e. at the request of an authority or court entitled to do so.

§ 8

Customer rights

Persons whose personal data is processed have certain rights in connection with that processing. Whether a given right can be exercised depends on the legal basis for processing:

1. Article 15 GDPR, right of access to personal data: the data subject has the right to obtain confirmation from us as to whether personal data concerning them is being processed. Where this is the case, they have the right to access that data and to receive additional information (including purposes, categories, recipients, retention, rights and source).
   
   
2. Article 16 GDPR, right to rectification: the data subject has the right to obtain from us without undue delay the rectification of inaccurate personal data concerning them. Taking into account the purposes of processing, they have the right to have incomplete personal data completed, including by means of a supplementary statement.
   
   
3. Article 17 GDPR, right to erasure (“right to be forgotten”):
   the data subject has the right to obtain from us the erasure of personal data concerning them without undue delay. We are then obliged to erase the personal data without undue delay where one of the following applies:
   - consent to processing has been withdrawn and there is no other legal ground for processing; the data subject has successfully objected to processing;
   - the personal data has been unlawfully processed;
   - the personal data has to be erased for compliance with a legal obligation;
   - the data has been collected in relation to the offer of information society services.
   
   
4. Article 18 GDPR, right to request that the Controller restrict the processing of personal data, subject to the cases referred to in Article 18(2) GDPR:
   the data subject has the right to obtain from us restriction of processing where:
   - the data subject contests the accuracy of the personal data, for a period enabling us to verify its accuracy;
   - the processing is unlawful and the data subject opposes erasure and requests restriction of use instead;
   - we no longer need the personal data for the purposes of processing, but the data subject requires it for the establishment, exercise or defence of legal claims; 
   - the data subject has objected to processing under Article 21(1) GDPR, pending verification of whether the Controller’s legitimate grounds override those of the data subject.
   
   
5. Article 20 GDPR, right to data portability:
   the data subject has the right to receive the personal data concerning them, which they have provided to the Controller, in a structured, commonly used and machine-readable format, and the right to transmit that data to another controller without hindrance from the controller to which the personal data has been provided, where:
   - the processing is based on consent pursuant to Article 6(1)(a) or Article 9(2)(a), or on a contract pursuant to Article 6(1)(b);
   - and the processing is carried out by automated means.
   
   In exercising the right to data portability, the data subject has the right to have the personal data transmitted directly from one controller to another, where technically feasible.
   
   
6. Article 21 GDPR, right to object to the processing of personal data: 
   the data subject has the right to object at any time, on grounds relating to their particular situation, to the processing of personal data concerning them based on Article 6(1)(f) (the Controller’s legitimate interest). We may then no longer process that personal data unless we demonstrate compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject, or for the establishment, exercise or defence of legal claims. 

In addition, persons whose personal data is processed have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych) if they consider that the processing of their personal data infringes the GDPR or other generally applicable laws.

The Controller may provide system functions that allow these rights to be exercised. If you wish to exercise any of these rights, please contact us as described in § 21 of this Privacy and Cookies Policy.

§ 9

Server logs

Server logs are the website server’s internal event logs, which automatically record page requests sent when Customers use the website. System logs contain the page request sent by the Customer, IP address, browser type, browser language, date and time of the request, and one or more cookies that may uniquely identify the Customer’s browser.

Data collected in system logs is used by us for an indefinite period, solely for the purpose of administering the website. It is not transferred to third parties, except in the circumstances described in this document.

§ 10

Cache

When providing services to Customers, the Controller may automatically use the cache of the Customer’s browser, application or device. This involves storing data in the browser memory installed on the Customer’s device. Local storage makes it possible to keep data between sessions, i.e. between the Customer’s consecutive sessions. The purpose of using the cache is to make the website faster by avoiding situations in which the same data is downloaded from the website repeatedly, putting extra load on the Customer’s internet connection.

§ 11

Geolocation

The Controller, or third parties through the cookies they administer, may use geolocation functions, which involve collecting and processing information about the Customer’s location. For this purpose, the following data may be processed: IP address, GPS sensor data, Wi-Fi access point data or mobile network base station data.

§ 12

Pixel tags

The Controller, or third parties through the cookies they administer, may use pixel tags. These are elements embedded in digital content that make it possible to record information, for example about the Customer’s activity on the Shop’s website.

§ 13

Cookies: introduction

When providing services to Customers, the Controller uses professional technologies to collect and store information, such as cookies. Cookies contain information necessary for the proper use of the website. They are common small files containing a string of characters, sent to and stored on the end device (e.g. computer, laptop, tablet, smartphone) used by the Customer when visiting the website. This information is sent to the storage of the browser in use, which sends it back on subsequent visits to the website. Cookies most often contain the name of the website they come from, the length of time they are stored on the end device and a unique number. External entities listed in § 17 of this Privacy and Cookies Policy may also have access to data from cookies.

§ 14

Legal basis for processing cookies

Cookies are processed on the basis of Article 173 of the Act of 16 July 2004 Telecommunications Law (Journal of Laws of 2016, item 1489, as amended).

The Controller asks Customers using services provided electronically via the website for voluntary consent to the processing of cookies, i.e. to storing information or gaining access to information already stored in their telecommunications terminal equipment.

Consent to the processing of cookies is given, in particular, by clicking a button containing a statement of consent to the processing of cookies or confirming that its terms have been read. This consent may be withdrawn at any time, free of charge, in the manner described in the section on managing cookies.

§ 15

Cookies used by the Controller

Cookies are common small files containing a string of characters, sent to and stored on the end device (e.g. computer, laptop, tablet, smartphone) used when visiting a website. This information is sent to the memory of the browser in use, which sends it back on subsequent visits to the website. The Controller may categorise cookies in three ways.

By purpose, we distinguish the following categories of cookies:

• strictly necessary cookies: these enable the website and its functions to work properly, e.g. authentication or security cookies.
  
• functional cookies: these remember the settings selected by the Customer and adapt the website to their needs and preferences, e.g. language, font size or website layout.
  
• business cookies: this category includes, for example, advertising cookies. They make it possible to tailor advertisements displayed on or outside the website to the Customer’s preferences.
  

By validity period, we distinguish two categories of cookies:

• session cookies: these exist until the end of the Customer’s session,
  
• persistent cookies: these remain after the Customer’s session has ended.
  

By the entity administering the cookies, we distinguish:

• the Controller’s cookies,
  
• third-party cookies.
  

§ 16

The Controller’s cookies

The Controller’s cookies make it possible to recognise the Customer’s device and display the Company’s website tailored to the Customer’s individual expectations, making the website easier and more pleasant to use. Storing these files on the Customer’s device makes it possible, for example, to remember login details, keep the session active after logging in, remember selected goods or services, or adapt the website to the Customer’s preferences, such as content layout, language or colour.

§ 17

Third-party cookies

The Controller may use cookies of Google Inc., 1600 Amphitheatre Pkwy, Mountain View, CA 94043, United States, as part of the following services:

• Google Adwords: these cookies make it possible to run advertising campaigns via the Google Adwords service and to assess their quality,
  
• Google Analytics: these cookies make it possible to assess the quality of advertising campaigns run via the Google Adwords service, to study Customers’ behaviour and traffic, and to compile traffic statistics,
  
• Google Maps: these cookies store information about the Customer that enables the use of map functions available in the Google Maps service. Google Inc. may track the Customer’s location,
  
• YouTube: these cookies store information about the Customer that enables the use of YouTube functions. Google Inc. may track the Customer’s video playback.
  

The Controller may use cookies of Facebook Inc., 1 Hacker Way, Menlo Park, CA 94025, United States. These cookies may be used to link a user’s account on the external social network Facebook with their account on the website, if the Controller provides this function. They may also be used to process, on Facebook, the Customer’s actions performed with the “Share” or “Like” buttons. The processing of these actions may be public.

The use of third-party cookies is subject to the privacy and cookies policies of those entities. We encourage you to read the personal data processing rules and privacy policies of the entities that process our data most often and most extensively:

• Google Privacy Policy
• Facebook Cookies Policy
• Pinterest Privacy Policy
• Instagram Privacy Policy
• Twitter Cookies Policy
  

§ 18

Managing cookies and other information

Browser settings usually allow cookies and other information to be placed on the end device by default. If the Customer does not agree to these files being stored, the web browser settings must be changed accordingly. It is possible to disable storage for all connections from a given browser or for a specific website, and to delete cookies. How cookies are managed depends on the software used. Current rules for managing cookies can be found in the settings of the web browser in use.

To manage cookie settings, select your web browser or system from the list below and follow the instructions:

1. Internet Explorer
2. Edge
3. Chrome
4. Safari
5. Firefox
6. Opera
7. Android
8. Safari (iOS)

Current rules for managing cookies in browsers not listed above can be found in the settings of the web browser in use.

With regard to information about user preferences collected by the Google advertising network, users can view and edit information derived from cookies using the Google Ads Preferences tool. Information on managing cookies on a mobile phone can be found in the user manual of the phone in question.

Consent to the processing of cookies is voluntary. Please note, however, that restricting their use may make some website functions difficult or impossible to use.

§ 19

Links to other websites or software

The website may contain links to other websites or software. The Controller is not responsible for the privacy and cookie rules applicable on those websites or in that software. We recommend reading the privacy and cookies policies of those websites or software after visiting them or before installing them.

§ 20

Changes to the Privacy and Cookies Policy

The Controller reserves the right to amend this Privacy and Cookies Policy. If the privacy policy changes, the Controller will publish the updated version at this location.

§ 21

Contact and reports

The Controller makes every effort to process Customers’ personal data and cookies to the highest standards. If you identify any threat to or breach of these standards, please contact us immediately using the details below:

[email protected]

+48 22 602 20 22

ARCHITYPE Sp. z o.o. ul. Jana Dantyszka 18

02-054 Warszawa

We welcome any feedback. If you have any questions, requests or concerns about the processing of personal data or cookies, please get in touch.