Introduction

Protecting your personal information is important to us. We are committed to processing it with the highest standards. Below you will find information about how we process your personal information when you use our website available at https://smarthubgroup.eu and https://smarthubgroup.pl (hereinafter: 'Website').

1. Who is the administrator of your data?

The administrator of your personal information within the meaning of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter: 'GDPR') is PGBC – PROCREATOR PIOTR KUGLARZ, ul. Zamknięta 10, loc. 1.5, 30-554 Kraków, NIP: 6772290786, REGON: 386064310 (hereinafter: 'Administrator', 'we').

You can contact the Administrator by email at: [email protected] or in writing at the address given above.

If your inquiry concerns legal services or is directed to a lawyer cooperating with the SmartHub group, your data may be transferred to the Law Office of Maciej Moryc located in Warsaw, ul. Senatorska 2, 00-075 Warsaw, NIP 7122308205, REGON 385756314. In this scope, the Law Office processes your data as a separate administrator, in particular for the purpose of handling your inquiry, providing legal assistance, and fulfilling obligations arising from applicable law and the rules of the legal profession.

2. What personal information do we process?

The personal information we process may include in particular:

  • first and last name
  • email address
  • phone number
  • mailing address – if provided in correspondence or needed to process your inquiry
  • name, address, and identification numbers (NIP, REGON, KRS) of a sole proprietorship or company you represent
  • position or role if you contact us on behalf of a third party
  • content of your inquiry and attachments – if the form or correspondence allows such submission
  • PESEL number – only when necessary for performing a specific service or for concluding and executing a contract
  • IP address, timestamp, and other technical data automatically recorded by the server (see point 3.3)

We do not request special category data as defined in Article 9 of the GDPR. If you provide us with such data on your own initiative, we process it only to the extent necessary to handle your message or we delete it when processing is no longer necessary to fulfill the purpose of contact.

3. For what purposes, on what legal basis, and how long do we process your data?

3.1. Handling correspondence and inquiries

Data entered in a contact form or sent in an email message is processed to respond to your inquiry and maintain current communication with you.

Legal basis: our legitimate interest (Article 6(1)(f) GDPR) in communicating with persons interested in our services and maintaining business relationships.

Retention period: until the correspondence is completed, then no longer than 3 years from the last contact, unless longer retention is necessary to establish, pursue, or defend claims, or until you lodge an effective objection to processing.

3.2. Actions towards conclusion and performance of a contract

If your inquiry concerns an offer from the SmartHub group, establishing cooperation, implementing an investment project, or providing consulting or legal services within the group, we process your data to take actions upon your request before concluding a contract, and if concluded, to perform it.

Legal basis: Article 6(1)(b) GDPR – if you are a party to the contract as a natural person, including a sole proprietor, and Article 6(1)(f) GDPR – if you contact us on behalf of a company or other organization; the legitimate interest being establishing and maintaining business relationships with the entity you represent.

Retention period: for the period necessary to take pre-contractual actions, and if a contract is concluded, for its duration, then for the period required by tax and accounting regulations and until the expiry of claims limitation periods.

3.3. Server logs (technical matters)

Using the Website involves sending requests to the server. Each request is recorded in server logs, including IP address, date and time of the request, information about the browser and operating system. Logs are used solely for operational and technical purposes related to administering the Website and ensuring its security.

Legal basis: our legitimate interest (Article 6(1)(f) GDPR) in ensuring proper operation and security of the Website.

Retention period: logs are kept no longer than 12 months from their recording, unless longer retention is necessary to clarify a security incident or pursue claims.

3.4. Establishing, pursuing, and defending claims

We may process your data to establish, pursue, or defend against claims related to your use of the Website or correspondence conducted.

Legal basis: our legitimate interest (Article 6(1)(f) GDPR).

Retention period: until the expiry of the claims limitation period under the Civil Code.

4. To whom may we share your data?

Recipients of your personal information may be the following categories of entities:

  • hosting service providers and IT infrastructure maintenance providers, including cloud service providers and email service providers, acting on the basis of a data processing agreement concluded with the Administrator,
  • contact form management tool providers, Website statistics and analytics providers to the extent specified in point 6,
  • law firms, tax firms, accounting offices, and other professional advisors providing services to the Administrator, to the extent necessary for service provision,
  • entities from the SmartHub group and operational partners of the Administrator – only to the extent necessary to achieve the purposes referred to in point 3.2,
  • postal operators and courier companies – in case of traditional correspondence,
  • public bodies and courts – if the obligation to disclose data results from applicable law.

Data processing is entrusted to processors on the basis of a data processing agreement meeting the requirements of Article 28 GDPR. Employees and collaborators of the Administrator are not data recipients within the meaning of GDPR – they act as persons authorized by the Administrator and process data solely on its instruction.

5. Do we transfer data outside the European Economic Area?

Due to the use of technology provider services, in particular Cloudflare, Inc. (Cloudflare Pages hosting) and Google LLC (Google Analytics, Google Tag Manager), your data may be transferred outside the European Economic Area (hereinafter: "EEA"), including to the United States of America. Transfer takes place only when there is a legal basis provided for in the GDPR, in particular a European Commission decision establishing an adequate level of protection (Article 45 GDPR), standard contractual clauses adopted by the European Commission (Article 46(2)(c) GDPR), or other appropriate transfer mechanism.

In the case of US providers using the EU-US data protection framework, transfer may take place on the basis of the European Commission's implementing decision (EU) 2023/1795 of 10.07.2023, provided that the provider is currently certified in this program. For non-certified providers, transfer takes place on the basis of standard contractual clauses adopted by the European Commission's implementing decision (EU) 2021/914 of 04.06.2021.

You can obtain a copy of the security measures applied or information on where they are made available by contacting the Administrator.

6. Does our website use cookies?

Yes. The website uses cookies and similar technologies stored on your end device (e.g., computer, tablet, smartphone). Cookies are small text files that can be read by our IT system.

We use cookies based on Article 399 of the law of 12.07.2024 – Regulation on Electronic Communications (Journal of Laws 2024, item 1221), and to the extent that personal data is processed in cookies – also on the basis of the GDPR.

The website uses both necessary and analytical cookies for its proper operation, ensuring security, handling the contact form, and remembering basic user settings. These files are necessary to provide the electronic service requested by the user and do not require separate consent. The basis for data processing is Article 6(1)(f) GDPR – our legitimate interest in ensuring the proper operation of the Website. Analytical cookies from Google LLC (Google Analytics, Google Tag Manager) are used only with your consent expressed through the cookie banner available on the Website; the basis for data processing in this regard is Article 6(1)(a) GDPR in connection with Article 399(1) of the Electronic Communications Act.

If in the future we implement analytical, marketing, or other cookies not required for the Website to function, we will use them only with your consent. In such case, consent will be expressed through a visible banner, and the Website will be equipped with a panel allowing you to change or withdraw it. Withdrawing consent does not affect the lawfulness of processing carried out on its basis before withdrawal.

You can also manage cookies yourself from your internet browser settings, including blocking or deleting them. Limiting the use of cookies may affect the Website's functionality.

7. What rights do you have under GDPR?

Under the GDPR, you have the following rights regarding the processing of your personal information:

  • right of access to data and obtaining a copy (Article 15 GDPR),
  • right to rectification (Article 16 GDPR),
  • right to erasure if the conditions in Article 17 GDPR are met,
  • right to restrict processing (Article 18 GDPR),
  • right to data portability if processing is based on consent or contract and is automated (Article 20 GDPR),
  • right to object to processing if the basis is Article 6(1)(f) GDPR – on grounds relating to your particular situation, and in case of direct marketing – at any time without justification (Article 21 GDPR),
  • right to withdraw consent at any time if processing is based on consent (Article 7(3) GDPR); withdrawal does not affect the lawfulness of processing before withdrawal,
  • right not to be subject to a decision based solely on automated processing, including profiling (Article 22 GDPR),
  • right to lodge a complaint with the supervisory authority, in Poland the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw).

The above rights are not absolute. GDPR provisions and special provisions – including the law of 29.09.1994 on accounting, the law of 29.08.1997 – Tax Code, and the law of 06.07.1982 on lawyers – provide for situations where the exercise of some rights may be limited, in particular when further processing is necessary to comply with a legal obligation, to establish, pursue, or defend claims, or to protect professional secrecy. We analyze each of your requests individually and respond without undue delay, no later than one month from receipt (Article 12(3) GDPR).

8. Is providing data voluntary?

Providing personal information is voluntary, but necessary to respond to your inquiry, establish business contact, or take actions towards concluding a contract. Failure to provide data will make it impossible to fulfill these purposes.

9. Do we make decisions about you in an automated way?

We do not make decisions about you based solely on automated processing of data, and we do not profile you within the meaning of Article 22 GDPR.

10. Changes to the privacy policy

The privacy policy may be updated periodically, in particular in the event of changes to applicable law, technology providers, or the Website's operation. The current version of the policy is published on the Website with the effective date indicated at the beginning of the document.