Privacy Policy

This Privacy Policy sets out the rules for storing and accessing data on the Devices of Users who use the Website for the purposes of the provision of services by electronic means by the Controller, and the rules for collecting and processing Users’ personal data that they have personally and voluntarily provided through the tools available on the Website.

This Privacy Policy forms an integral part of the Terms of Service, which set out the rules, rights and obligations of Users using the Website.

§1 Definitions

Website - the “payticon.com” website operating at https://payticon.com
External Website - websites of partners, service providers or service recipients cooperating with the Controller
Website Administrator / Data Controller - the Website Administrator and Data Controller (hereinafter the Controller) is the company “Payticon Sp. z o.o.”, conducting business at: Rynek Główny 28, with tax identification number (NIP): 9452224702, providing services by electronic means through the Website
User - a natural person to whom the Controller provides services by electronic means through the Website.
Device - an electronic device together with software through which the User accesses the Website
Cookies - text data collected in the form of files placed on the User’s Device
GDPR - Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)
Personal data - means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person
Processing - means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction;
Restriction of processing - means the marking of stored personal data with the aim of limiting their processing in the future
Profiling - means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements
Consent - consent of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which they, by a statement or by a clear affirmative action, signify agreement to the processing of personal data relating to them
Personal data breach - means a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed
Pseudonymisation - means the processing of personal data in such a manner that the personal data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and is subject to technical and organisational measures to ensure that the personal data are not attributed to an identified or identifiable natural person
Anonymisation - data anonymisation is an irreversible process of operations on data that destroys / overwrites “personal data”, making it impossible to identify or associate a given record with a specific user or natural person.

§2 Data Protection Officer

The Controller has appointed a Data Protection Officer, who is Łukasz Kafel.

The Officer can be contacted by e-mail at: lukasz@payticon.com, by telephone at +48 663 366 883 or in writing at ul. Rynek Główny 28, 31-010 Kraków.

The Data Protection Officer may be contacted on all matters concerning the processing of personal data.

§3 Types of Cookies

First-party Cookies - files placed on and read from the User’s Device by the Website’s ICT system
Third-party Cookies - files placed on and read from the User’s Device by the ICT systems of External Websites. Scripts of External Websites that may place Cookies on Users’ Devices have been deliberately placed on the Website through scripts and services made available and installed on the Website
Session Cookies - files placed on and read from the User’s Device by the Website during a single session of that Device. After the session ends, the files are deleted from the User’s Device.
Persistent Cookies - files placed on and read from the User’s Device by the Website until they are manually deleted. The files are not automatically deleted after the Device’s session ends, unless the User’s Device is configured to delete Cookies after the Device’s session ends.

§4 Security of data storage

Mechanisms for storing and reading Cookies - the mechanisms for storing, reading and exchanging data between Cookies saved on the User’s Device and the Website are implemented through built-in web browser mechanisms and do not allow the retrieval of other data from the User’s Device or data from other websites visited by the User, including personal data or confidential information. Transferring viruses, trojans and other worms to the User’s Device is also practically impossible.
First-party Cookies - the Cookies used by the Controller are safe for Users’ Devices and do not contain scripts, content or information that could threaten the security of personal data or the security of the Device used by the User.
Third-party Cookies - the Controller takes all possible steps to verify and select the Website’s partners with regard to Users’ security. The Controller selects well-known, large partners that enjoy public trust worldwide. However, the Controller does not have full control over the content of Cookies originating from external partners. To the extent permitted by law, the Controller is not liable for the security or content of Cookies originating from External Websites, or for their use in accordance with the licence by the Scripts installed on the Website. A list of partners is provided later in this Privacy Policy.
Control of Cookies
The User may independently change the settings concerning the storage and deletion of Cookies and access by each website to the data in stored Cookies at any time
Information on how to disable Cookies in the most popular computer browsers is available at: how to disable cookies or from one of the following providers:
Managing cookies in Chrome
Managing cookies in Opera
Managing cookies in Firefox
Managing cookies in Edge
Managing cookies in Safari
Managing cookies in Internet Explorer 11
The User may delete all Cookies stored to date at any time using the tools of the User’s Device through which the User accesses the Website’s services.
Risks on the User’s side - the Controller applies all possible technical measures to ensure the security of data placed in Cookies. However, it should be borne in mind that ensuring the security of this data depends on both parties, including the User’s actions. The Controller accepts no responsibility for the interception or deletion of this data or the hijacking of the User’s session as a result of the User’s deliberate or unintentional actions, viruses, trojans or other spyware with which the User’s Device may be or may have been infected. To protect themselves against these risks, Users should follow the rules for safe use of the Internet.
Storage of personal data - the Controller assures Users that it makes every effort to ensure that the personal data voluntarily entered by Users and processed is secure, that access to it is restricted and that such access is in accordance with its intended use and the purposes of processing. The Controller also assures Users that it makes every effort to protect the data it holds against loss by applying appropriate physical and organisational safeguards.
Storage of passwords - the Controller declares that passwords are stored in encrypted form, using the latest standards and guidelines in this area. Decryption of the account access passwords entered on the Website is practically impossible.

§5 Purposes for which Cookies are used

Improving and facilitating access to the Website
Personalising the Website for Users
Enabling login to the Website
Marketing and remarketing on External Websites
Advertising services
Affiliate services
Compiling statistics (Users, number of visits, types of Devices, connections, etc.)
Providing multimedia services
Providing social networking services

§6 Purposes of processing personal data

Personal data voluntarily provided by Users is processed for one of the following purposes:

Providing electronic services:
Registration and maintenance of a User account on the Website and its related functionalities
Newsletter services (including sending advertising content with consent)
Services for commenting on / liking posts on the Website without having to register
Services for sharing information about content published on the Website on social networks or other websites.
Communication between the Controller and Users on matters concerning the Website and data protection
Safeguarding the Controller’s legitimate interest

Data about Users collected anonymously and automatically is processed for one of the following purposes:

Compiling statistics
Remarketing
Serving advertisements tailored to Users’ preferences
Operating affiliate programmes
Safeguarding the Controller’s legitimate interest

§7 Cookies of External Websites

The Controller uses partners’ JavaScript scripts and web components on the Website, and these partners may place their own cookies on the User’s Device. Remember that you can decide in your browser settings which cookies may be used by individual websites. Below is a list of partners or their services implemented on the Website that may place cookies:

Social networking / integrated services: (Registration, login, content sharing, communication, etc.)
Facebook
Google+
Advertising services and affiliate networks:
Google Adsense
Compiling statistics:
Google Analytics

Services provided by third parties are beyond the Controller’s control. These entities may change their terms of service, privacy policies, the purpose of data processing and the manner in which cookies are used at any time.

§8 Types of data collected

The Website collects data about Users. Some data is collected automatically and anonymously, while some is personal data voluntarily provided by Users when signing up for individual services offered by the Website.

Anonymous data collected automatically:

IP address
Browser type
Screen resolution
Approximate location
Website subpages opened
Time spent on the relevant Website subpage
Type of operating system
Address of the previous subpage
Address of the referring website
Browser language
Internet connection speed
Internet service provider

Data collected during registration:

First name / surname / nickname
Login
E-mail address
Residential address
Telephone number
IP address (collected automatically)
Tax identification number (NIP)

Data collected when subscribing to the Newsletter service

First name / surname / nickname
E-mail address
IP address (collected automatically)

Data collected when adding a comment

First name and surname / nickname
E-mail address
Website address
IP address (collected automatically)

Some data (excluding identifying data) may be stored in cookies. Some data (excluding identifying data) may be transferred to a provider of statistical services.

§9 Access to personal data by third parties

As a rule, the Controller is the sole recipient of personal data provided by Users. Data collected as part of the services provided is neither transferred nor resold to third parties.

Access to data (most often under a data processing agreement) may be granted to entities responsible for maintaining the infrastructure and services necessary to operate the Website, namely:

Hosting companies providing hosting or related services to the Controller
Companies through which the Newsletter service is provided
Companies acting as intermediaries in online payments for goods or services offered through the Website (when a purchase transaction is made on the Website)

Entrusting the processing of personal data - Hosting, VPS or Dedicated Server services

In order to operate the Website, the Controller uses the services of an external hosting, VPS or Dedicated Server provider - OVH sp. z o.o.. All data collected and processed on the Website is stored and processed within the service provider’s infrastructure located in Poland. Access to the data may occur as a result of maintenance work carried out by the service provider’s personnel. Access to this data is governed by the agreement concluded between the Controller and the Service Provider.

Data processing in the case of online payments

When online payments are made, all payment data is provided directly by the User to the entity processing the payment - ZEN. Selected data necessary to complete the transaction is then transferred by that entity to the Controller. The transfer of data is governed by the agreement concluded between the Controller and the Service Provider.

§10 How personal data is processed

Personal data voluntarily provided by Users:

Personal data will not be transferred outside the European Union unless it has been published as a result of an individual action by the User (for example, adding a comment or post), which will make the data available to anyone visiting the Website.
Personal data will not be used for automated decision-making (profiling).
Personal data will not be resold to third parties.

Anonymous data (excluding personal data) collected automatically:

Anonymous data (excluding personal data) will be transferred outside the European Union.
Anonymous data (excluding personal data) will not be used for automated decision-making (profiling).
Anonymous data (excluding personal data) will not be resold to third parties.

§11 Legal bases for processing personal data

The Website collects and processes Users’ data on the basis of:

Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)
Article 6(1)(a) the data subject has given consent to the processing of their personal data for one or more specific purposes
Article 6(1)(b) processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract
Article 6(1)(f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party
The Act of 10 May 2018 on the protection of personal data (Journal of Laws of 2018, item 1000)
The Telecommunications Law Act of 16 July 2004 (Journal of Laws of 2004, No. 171, item 1800)
The Act of 4 February 1994 on copyright and related rights (Journal of Laws of 1994, No. 24, item 83)

§12 Period of processing personal data

Personal data voluntarily provided by Users:

As a rule, the personal data in question is stored only for the period during which the Controller provides the Service through the Website. It is deleted or anonymised within 30 days of the end of the provision of services (for example, deletion of a registered user account, unsubscribing from the Newsletter list, etc.).

An exception applies where it is necessary to safeguard legitimate purposes for the Controller’s further processing of this data. In such a situation, in the event of a breach or suspected breach of the Website’s Terms of Service by the User, the Controller will retain the data in question for no longer than 3 years from the User’s request for its deletion.

Anonymous data (excluding personal data) collected automatically:

Anonymous statistical data that does not constitute personal data is stored by the Controller for the purpose of compiling Website statistics for an indefinite period.

§13 Users’ rights in relation to the processing of personal data