PRIVACY PROTECTION POLICY alfathrust.pl

§ 1 GENERAL PROVISIONS

The administrator of the personal data of users of the website located at the domain www.alfathrust.pl is Alfa Corporations ltd., with its registered office at Pl. Wladyslawa Andersa 3, 11^th floor, entered into the Register of Entrepreneurs of the National Court Register maintained by District Court in Poznan – Nowe Miasto and Wilda in Poznan, 8^thEconomic Department of the National Court Register, under KRS number: 0001115159, holding the Tax Identification Number (NIP): 7831907640 and the National Business Registry Number (REGON): 529113163.. Hereinafter, this entity shall be referred to as the “Administrator.”
The Administrator has established an electronic contact point dedicated to handling correspondence directed by the authorities of the European Union Member States, the European Commission, and the Digital Services Board. Contact can be made via the following e-mail address: contact@alfathrust.pl. This communication channel may also be used by Customers wishing to contact the Administrator directly and promptly.
Additionally, contact with the Administrator may be made via traditional mail sent to the address indicated above, through the contact form available on the website, or by telephone at: +48 572 603 631 during the Administrator’s working hours, i.e., Monday to Friday from 8:00 a.m. to 4:00 p.m. (calls charged according to the applicable tariff of the telecommunication operator used by the Customer). All communication may be conducted in Polish or English.
This policy aims to present the principles and procedures concerning the processing of personal data obtained via the Administrator’s website, as well as in connection with services and tools available to users therein. It also covers the processing of personal data in the context of concluding and performing contracts, which occurs independently of the use of the website.
If necessary, the provisions contained in this Policy may be amended. Users will be informed of any updates by publishing a new version of the document. Persons who have previously consented to the processing of their personal data for the purpose of e-mail contact or provided an e-mail address during the conclusion of a contract will also be notified of the changes electronically.

§ 2 LEGAL GROUNDS AND PURPOSES OF PROCESSING, DATA STORAGE

The processing of personal data of users is conducted in compliance with the provisions of the Regulation (EU) 2016/679 of the European Parliament and of the Council, known as the GDPR, as well as the Act of 10 May 2018 on the Protection of Personal Data and the Act of 18 July 2002 on the Provision of Services by Electronic Means – taking into account all subsequent amendments to these acts. Additionally, to the extent necessary for handling notifications provided for in Article 16(1) of the Digital Services Act (DSA) dated 19 October 2022, data may also be processed pursuant to Article 3(h) of the aforementioned regulation.
The Administrator may collect specific personal data for strictly defined purposes:

Purpose of data processing	Legal basis for processing and data retention period	Data retention period	Scope of data processed
Performing a contract with the customer or taking action at the request of the data subject before entering into the aforementioned contracts	Article 6(1)(b) of the GDPR (performance of a contract).	– for the duration of the aforementioned contract until the expiration of the legal obligation related to accounting – data will be processed until the expiration of the period during which it is possible to assert claims	– name; – e-mail address; – telephone number; – address (street, house number, apartment number, postal code, city, country), – company name, – TIN
Newsletter	Article 6(1)(f) of the GDPR (legitimate interest of the controller). The administrator may process data for direct marketing purposes only after obtaining consent and in the absence of an objection from the data subject.	– until you withdraw your consent – remember, you can withdraw your consent at any time. The processing of data until you withdraw your consent remains lawful. – data will be processed until the expiration of the period during which it is possible to assert claims	– email address; – telephone number;
Marketing	Article 6(1)(a) of the GDPR (consent).	– until you withdraw your consent – remember, you can withdraw your consent at any time. The processing of data until you withdraw your consent remains lawful. – data will be processed until the expiration of the period during which it is possible to assert claims – until, you unsubscribe from the newsletter.	– name; – e-mail address; – telephone number; – address (street, house number, apartment number, postal code, city, country),
Customer’s expression of opinion	Article 6(1)(a) of the GDPR (consent).	– in the absence of an opinion for a period of 30 days after you make a purchase or until, your objection is upheld against processing; – when an opinion is expressed, until it is deleted or until an objection to processing is upheld – data will be processed until the expiration of the period during which it is possible to assert claims	– name; – e-mail address; – telephone number;
Bookkeeping	Article 6(1)(c) of the RODO Regulation in conjunction with Article 86(1) of the Tax Ordinance, i.e. dated January 17, 2017. (Journal of Laws of 2017, item 201) or Article 74(2) of the Accounting Act, i.e. of January 30, 2018. (Journal of Laws of 2018, item 395).	– data will be processed until the expiration of the period during which claims can be asserted – the data shall be kept for the period required by law mandating the retention of tax books (until the expiration of the statute of limitations for tax liabilities, unless otherwise provided by tax laws) or accounting books (5 years, counting from the beginning of the year following the fiscal year to which the data refer).	– name; – e-mail address; – telephone number; – address (street, house number, apartment number, postal code, city, country), – TIN; – company name;
Making a refund	Performing the Contract or taking action at the request of the data subject prior to entering into the Contract (Article 6(1)(b) of the RODO).	– 5 years after the termination of business relations with the customer	– name; – e-mail address; – telephone number; – address (street, house number, apartment number, postal code, city, country), – data of the business entity.
Determining, asserting or defending claims that the Administrator may assert or that may be asserted against the Administrator	Article 6(1)(f) of the GDPR Regulation	– the data are kept for the period of our legitimate interest, but no longer than the period of the statute of limitations for claims against the data subject for business activities.	– name; – e-mail address; – telephone number; – address (street, house number, apartment number, postal code, city, country), – TIN; – company name;
Conduct research and analysis to improve performance of available services	Article 6(1)(f) of the GDPR Regulation	– the data will be processed until the expiration of the period during which claims can be asserted – until the expiration or deletion of cookies used for analytical purposes	– company name; – e-mail address; – telephone number; – address (street, house number, apartment number, postal code, city, country), – computer components, – settings, – installed software.
Customer account registration	Performing the Contract or taking action at the request of the data subject prior to entering into the Contract (Article 6(1)(b) GDPR	5 years after the termination of business relations with the customer	– name; – e-mail address; – telephone number; – address (street, house number, apartment number, postal code, city, country), – data of the business entity.
Providing customer service	Performing the Contract or taking action at the request of the data subject prior to entering into the Contract (Article 6(1)(b) GDPR	– 5 years after termination of business relationship with the Customer – 2 years after the last update of the Customer’s inquiry	– name; – e-mail address; – telephone number; – address (street, house number, apartment number, postal code, city, country), – data of the business entity,
Correct functioning of the service	Maintaining the performance of the Service and improving it (Article 6(1)(f) GDPR)	• 5 years after the termination of business relations with the customer	– As in the cell above, – Information about the activities performed on the site (button clicks, time of visits, notifications read, other information depending on the specific business case).
Allowing the customer to reset the password	Protecting and securing the service, customers’ interests, safeguarding the customer’s security (Article 6(1)(f) GDPR)	• 5 years after the termination of business relations with the customer	– name; – e-mail address; – business entity data, – Customer’s password, – User ID.
Oversee compliance with regulations, contracts, privacy policies	Protecting and securing the service, customers’ interests, safeguarding the customer’s security (Article 6(1)(f) GDPR)	• 5 years after the termination of business relations with the customer	– transaction data, – data of the business entity.
Processing of requests for personal data,	Article 6(1)(c) GDPR	– The period of the existence of the legitimate interest of the Administrator, but no longer than the period of the statute of limitations for claims against the data subject for business activities.	– name; – e-mail address; – telephone number; – address (street, house number, apartment number, postal code, city, country), – TIN; – company name.
Provide information to authorities, law enforcement and other state institutions,	Article 6(1)(c) GDPR	– The period of the existence of the legitimate interest of the Administrator, but no longer than the period of the statute of limitations for claims against the data subject for business activities.	– name; – e-mail address; – telephone number; – address (street, house number, apartment number, postal code, city, country), – TIN; – company name.
Fulfillment of the legal obligation set forth in Article 16 (1), (4), (5) and (6) of the DSA to: 1. accepting from a request for the presence in the hosting service of information that the requester believes constitutes illegal content, as defined in Article 3(h) of the DSA; 2. processing the notification; 3. to inform about the decision made on the notification made; 4. to inform about the possibility of appealing against the decision made, as referred to in 3).	Article 6(1)(c) GDPR	– Until informed of: 1) the decision made by the Administrator on the application made; 2) the possibility to appeal the decision referred to in point 2).	– name; – e-mail address; – telephone number; – address (street, house number, apartment number, postal code, city, country), – TIN; – company name.
Processing of personal data to the extent that, based on proceedings before authorized public administration bodies, including law enforcement agencies, on the purposes or grounds for the processing of personal data, the Administrator required to process them.	Article 6(1)(c) GDPR	– For the duration of such obligation	– name; – e-mail address; – telephone number; – address (street, house number, apartment number, postal code, city, country), – TIN; – company name.
Undertake activities to identify and report potential product risks, ensure product compliance with safety requirements, and inform competent authorities or users of the need to take safety measures, to the extent required by the GPSR Regulation.	Article 6(1)(c) GDPR	– For the duration of such obligation	– name; – e-mail address; – telephone number; – address (street, house number, apartment number, postal code, city, country), – TIN; – company name.

The Administrator may engage in profiling for marketing purposes directly targeted at the user; however, such activities do not influence decisions regarding the conclusion of contracts, refusal to provide services, or access to website functionalities. The effects of profiling activities may include, for example, granting an individual discount, sending a discount code, reminding about an abandoned shopping cart, presenting a product consistent with previous preferences, or offering more favorable terms than those usually available. Despite the use of profiling mechanisms, the final decision to accept the offered terms always rests with the user. This process involves the automated evaluation or prediction of user activity on the website—for example, based on adding a product to the cart, browsing specific subpages, or analyzing visit history. The prerequisite for conducting such analysis is that the Administrator already possesses the personal data of the individual, making it possible, for example, to send a personalized promotional code.
To ensure the proper functioning of the service and its features, during the user’s visit to the website, technical data may be collected automatically, including but not limited to:

a) the user’s IP address;

b) information about the device, operating system, and its components, such as hardware or mobile device identification numbers;

c) data about the operating platform used;

d) technical settings and active modules;

e) details of the web browser, including its type and preferred interface language.

Taking into account the scope, nature, purpose, and context of the data processing, as well as the degree and type of risk to the rights or freedoms of natural persons, the Administrator implements appropriate technical and organizational measures to ensure that the processing complies with applicable laws—particularly the GDPR. The implemented safeguards are regularly monitored and updated as necessary. The Administrator also employs protections preventing unauthorized persons from accessing electronically transmitted data and from unlawful modification thereof.

§ 3 DISCLOSURE OF DATA TO THIRD PARTIES

The Administrator ensures that all collected personal data is used solely for the purpose of fulfilling obligations toward the users of the service. Such information shall not be disclosed to third parties, except where:

a) the user has given explicit and prior consent; or

b) such disclosure is required or may be required by applicable law, e.g., upon request of authorized public authorities.

Personal data of users and customers may also be disclosed to certain recipients or groups of entities, in particular:

a) providers of technological, IT, and organizational tools supporting the Administrator in conducting business activities and managing the website (e.g., software providers, hosting services, marketing services, helpdesk systems, or order and payment processing solutions) — data is shared strictly to the extent necessary to fulfill the specific purpose and in compliance with this policy;

b) companies providing accounting, legal, and advisory services (e.g., accounting offices, law firms, debt collection agencies), which process data solely to the extent necessary and under the Administrator’s instructions;

c) payment system operators — to enable the processing of payments by the user; data is shared only to the minimal extent necessary for payment processing. For this service, the payment gateway provider is:

• Tpay (Krajowy Integrator Płatności S.A.);

d) courier, logistics companies, and delivery intermediaries — if the customer selects physical delivery, the Administrator discloses personal data to carriers only to the extent necessary to deliver the order.

The Administrator may also disclose anonymized data (which does not allow user identification) to external providers, e.g., for evaluating the effectiveness of advertising and marketing activities. Due to the location of such providers, data may be transferred outside the European Economic Area, but only in compliance with applicable data protection standards—e.g., based on European Commission-approved contractual clauses or appropriate agreements between the EU and the third country. In particular, data may be disclosed to:

a) Google LLC — in connection with the use of tools such as Google Analytics (statistical analysis), Google Tag Manager (script management), Google Ads (advertising), Google Search Console (website visibility monitoring), Google Workspace (collaboration and communication tools: Gmail, Google Drive, etc.);

b) Meta Platforms, Inc. — for the use of Facebook Pixel functionality, used for analyzing ad effectiveness and creating personalized audience groups;

c) TikTok Technology Limited — within the TikTok Ads system for advertising analytics and remarketing list creation;

d) GetResponse Sp. z o.o. — for conducting mailing activities and email marketing automation campaigns.

The Administrator continuously monitors and assesses risks related to personal data processing, ensuring that data access is granted solely to authorized personnel and only to the extent necessary for performing their duties. All data operations are logged and may be performed only by authorized individuals.
The Administrator strives to ensure that all third parties with whom it cooperates and to whom it entrusts data implement adequate and effective personal data protection measures and maintain security at a level at least equivalent to the standards required in the EU.
The Administrator’s service may use Google Analytics provided by Google LLC to analyze website traffic. This tool collects information using cookies. Data about user activity on the site is usually sent to Google servers in the USA. Typically, the user’s IP address is truncated before transmission — only in exceptional cases is it sent in full. Google acts on behalf of the Administrator and does not combine the user’s IP address with other data held by Google. Details on Google’s data processing are available at: www.google.com/policies/privacy/partners. The user can also block data collection by installing the appropriate browser plugin available at http://tools.google.com/dlpage/gaoptout.
When transferring data to third parties, the Administrator exercises the utmost diligence to ensure compliance with Articles 46 and 49 of the GDPR. In practice, this means applying the EU standard contractual clauses or other mechanisms guaranteeing an adequate level of data protection. The Administrator also evaluates applicable laws in destination countries and updates safeguards and transfer mechanisms as necessary.
If personal data is transferred to entities in the United States, the Administrator does so only with companies covered by the European Commission’s decision of 10 July 2023 on the “EU–US Data Privacy Framework.” These organizations are listed on a special register maintained by the US Department of Commerce, which allows for lawful data transfer without additional authorizations. If the data recipient does not participate in this program, data is transferred based on Articles 46 or 49 GDPR, using standard contractual clauses or other safeguards for transfers outside the European Economic Area.

§ 4 USER RIGHTS

The data subject whose personal data is processed by the Administrator has a number of rights arising from the provisions of the GDPR, including:

a) Right of access, rectification, restriction, erasure, and data portability – every natural person has the right to request from the Administrator access to their personal data, correction of errors, deletion of data (the so-called “right to be forgotten”), temporary restriction of processing, as well as the transfer of data to another entity. The scope and rules for exercising these rights are defined in Articles 15 to 21 of the General Data Protection Regulation (GDPR).

b) Right to withdraw consent – where the legal basis for data processing is the consent of the data subject (pursuant to Article 6(1)(a) or Article 9(2)(a) GDPR), the data subject has the right to withdraw that consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out prior to its withdrawal.

c) Right to lodge a complaint with a supervisory authority – any person may file a complaint with the relevant supervisory authority responsible for monitoring compliance with data protection laws if they consider that the Administrator’s actions violate their rights. In Poland, this authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych) based in Warsaw.

d) Right to object to data processing – at any time, the data subject may object to the processing of their data where the basis for processing is the public interest (Article 6(1)(e) GDPR) or the legitimate interest of the Administrator (Article 6(1)(f) GDPR), including profiling. In such cases, the Administrator may no longer continue processing unless it demonstrates the existence of overriding legitimate grounds or the necessity to establish, assert, or defend legal claims.

e) Right to object to marketing activities – where personal data is processed for the purpose of direct marketing based on the legitimate interest of the Administrator, the data subject may request at any time that the processing of their data for this purpose cease, including profiling related to direct marketing.

Exercise of the above rights is made by submitting a relevant request via email to the address specified by the Administrator. The request must include the full name of the data subject.
The user declares that all personal data provided or posted in the service is accurate and truthful.

§ 5 COOKIES

Cookies are small data packets—usually in the form of text files—that are saved and stored on the end devices of persons visiting the website, such as desktop computers, laptops, or smartphones. Their purpose is to enable the user’s browser to remember certain information, which allows, among other things, the personalization of the way the website is displayed and its adaptation to the visitor’s preferences. This enables the website to recognize returning users and remember their previous interactions, such as visited subpages, clicks, or selected settings.
A standard cookie contains, among other things, the domain name from which it originates, a unique identifier associated with the user’s browser, and the duration for which the cookie will be stored on the end device.
The purposes of using cookies on the website include:

a) tailoring the content and functionality of the site to the user’s preferences and expectations, as well as facilitating the use of the service;

b) creating anonymous statistical analyses concerning the use of the website, allowing its optimization;

c) presenting advertising content that corresponds to the user’s interests and previous activities.

Cookies are never used to identify visitors directly or establish their identity.

Cookies are divided into various types according to their functions:

a) Essential cookies – enable the proper functioning of key website features and are necessary for accessing many basic services. Disabling them will prevent the proper operation of the service;

b) Functional cookies – support additional website features, allowing, among other things, customization of the site’s appearance and content to individual user settings. Their absence may reduce user comfort, although the website will still function;

c) Configuration cookies – enable the personalization of settings and functions offered on the site;

d) Security cookies – responsible for protecting the service and verifying user authenticity, while also enhancing server performance;

e) Authentication cookies – allow the system to recognize that a given user is logged in, thereby displaying the appropriate features and information;

f) Session cookies – track user actions during a single visit session, e.g., noting visited subpages or display errors. This information helps improve the service;

g) Advertising cookies – allow for the presentation of personalized advertisements aligned with the user’s interests and for the assessment of their effectiveness;

h) Analytical cookies – used to collect data on general user behavior, which is used to create reports and statistical analyses without identifying specific individuals.

Although cookies generally do not collect data enabling direct identification of individuals, in certain cases they may process data considered personal—e.g., session identifiers linked to a particular user. Such data are used solely to provide a specific website function and are protected by encryption to prevent unauthorized access.
Cookies used on the website do not pose a threat to the user’s device or data. On the contrary, they are necessary for the proper operation of the service. Most web browsers accept cookies by default. However, users may manually change these settings by accessing their browser’s configuration options. The method of changing settings varies depending on the software and is described in the help section of the respective browser.
The Administrator may also use so-called server logs, which record technical data related to visits, such as IP addresses. These data are used to monitor traffic, detect technical problems, prevent abuses, and ensure compliance with the terms of use of the service.
Detailed information on how to disable, modify, or delete cookies in the most commonly used browsers can be found in the “Help” section of the respective program.
When accessing the service via smartphone, tablet, or other mobile devices, instructions for managing cookies are available in the user manual of the device or on the operating system manufacturer’s website.