PRIVACY POLICY OF THE IT INSURANCE SERVICE

This Privacy Policy (hereinafter referred to as the “Policy”) contains information about the processing of your personal data in connection with the use of the “IT Insurance” website, operating at https://ubezpieczenieit.pl (hereinafter referred to as the “Service”).

All capitalized terms not otherwise defined in the Policy have the meaning given to them in the Terms and Conditions, available at: https://ubezpieczenieit.pl/regulaminy

Personal Data Administrator

The administrator of your personal data is Ubezpieczenie IT spółka z ograniczoną odpowiedzialnością with its registered office in Gdynia (registered office address: ul. Wrocławska 98/1, 81-530 Gdynia), entered in the Register of Entrepreneurs of the National Court Register kept by the District Court Gdańsk – North, VIII Economic Division of the National Court Register under number: 0000527586, holding NIP: 5862292598, REGON: 2221784010, share capital: PLN 10,000 paid in full (hereinafter: “Administrator”).

Contacting the Administrator

In all matters related to the processing of personal data, you can contact the Administrator by e-mail, at: help@ubezpieczenieit.pl.

Data Protection Measures

The Administrator employs modern organizational and technical safeguards to ensure the best possible protection of your personal data and ensures that it is processed in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter: “RODO”), the Law of May 10, 2018 on the Protection of Personal Data and other data protection laws.

Information on processed personal data

Use of the Website requires processing of your personal data. Below you will find detailed information about the purposes and legal grounds for processing, as well as the period of processing and the obligation or voluntariness of providing it.

Purpose of processing	Personal data processed	Legal basis
Use Calculation Service	1) name, 2) company, 3) phone number, 4) e-mail address, 5) mailing address	Article 6(1)(b) of the RODO (processing is necessary for performance of the Agreement for the provision of the Calculation Service concluded with the data subject, or taking steps to conclude it)
Provision of the aforementioned personal data is a condition for the conclusion and performance of the Agreement for the provision of the Calculation Service (their provision is voluntary, but the consequence of their failure will be the inability of to conclude and perform the aforementioned Agreement, including the preparation of the Calculation). The Administrator will process the aforementioned personal data until the statute of limitations for claims arising from the Agreement for the provision of the Calculation Service.

Purpose of processing	Personal data processed	Legal basis
Conclusion and execution of the Agreement for delivery of Newsletter	email address	Art. 6(1)(b) RODO (processing is necessary for execution of the Agreement for the provision of Newsletter concluded with the data subject, or taking action in order to conclude it) and art. 6(1)(f) RODO (processing is necessary for realization of the Administrator’s legitimate interests, including case of informing about news and promotions available on the Website)
Provision of the aforementioned personal data is voluntary, but necessary in order to receive the Newsletter (the consequence of failing to provide such data will be the inability to receive the Newsletter). The Administrator will process the aforementioned personal data until an effective objection is raised or the purpose of the processing is achieved, or until the statute of limitations for claims under the Agreement for delivery of the Newsletter (depending on which of the aforementioned events occurs first).

Purpose of processing	Personal data processed	Legal basis
Conductcomplaint proceedings	1) name 2) e-mail address	Article 6(1)(c) RODO (processing is necessary to fulfill a legal obligation incumbent on the Administrator, including in the case of obligations: – to respond to a complaint – Art. 7a of the Consumer Rights Act and under the provisions of the Complaints Act,; – to fulfill the Customer’s rights under the provisions of the liability of the Administrator in the event of non-compliance of the Digital Item with the Agreement relating to it)
Provision of the aforementioned personal data is a condition for receiving a response to a complaint or realization of the Customer’s rights arising from the provisions on the Administrator’s liability in the event of non-compliance of the Subject of digital services with the Agreement relating to it or objections to activities of the insurance agent undertaken by the Administrator (their provision is voluntary, but the consequence of their failure will be the inability to receive a response to complaint and realization of the aforementioned rights). The Administrator will process the aforementioned personal data for the duration of the complaint procedure, and in case of realization of the aforementioned rights of the Customer – until their statute of limitations.

Purpose of processing	Personal data processed	Legal basis
Support form contact	1) name 2) e-mail address	Article 6(1)(f) of the RODO (processing is necessary to realize the legitimate interests of the Administrator, including the case of responding to a request for contact)
Provision of the aforementioned personal data is voluntary, but necessary in order to receive a response to request for contact (the consequence of failure to do so will be the inability to receive a response). The Administrator will process the aforementioned personal data until an effective objection is made or the purpose of the processing is achieved (whichever occurs first).

Purpose of processing	Personal data processed	Legal basis
Sending email notifications	1) name 2) e-mail address	Article 6(1)(f) of the RODO (processing is necessary for the purpose of realizing the Administrator’s legitimate interests, including the case of informing Service Recipients about activities undertaken in relation to the provision of services)
Provision of the aforementioned personal data voluntary, but necessary in order to receive information about activities related to the provision of services (the consequence of failure to do so will be the inability of to receive the aforementioned information). The Administrator will process the above personal data until an objection is successfully raised or the purpose of the processing is achieved.

Purpose of processing	Personal data processed	Legal basis
Fulfillment of obligations related to protection of personal data	1) your name 2) the contact information you provided ( e-mail address; mailing address; phone number)	Article 6(1)(c) of the RODO (processing is necessary for fulfillment of a legal obligation incumbent on the Administrator, including in the case of obligations under data protection legislation)
Provision of the aforementioned personal data is voluntary, but necessary in order for the Administrator to properly perform its obligations under data protection laws, including the exercise of rights granted to you by RODO (the consequence of not providing the aforementioned data will be the inability to properly exercise the aforementioned rights). The Administrator will process the above personal data until the expiration of the statute of limitations for claims of violation of data protection laws.

Purpose of processing	Personal data processed	Legal basis
Determine, investigate or defend against claims	1) name/company 2) e-mail address 3) address of residence/site 4) REGON number 5) TIN	Article 6(1)(f) of the RODO (processing is necessary for the realization of the legitimate interests of the Administrator, including the case of establishing, investigating or defending against claims that may arise in connection with the performance of Agreements concluded with the Administrator)
Provision of the aforementioned personal data is voluntary, but necessary in order to establish, investigate or defend against claims that may arise in connection with the performance of the Agreements concluded with Administrator (the consequence of failure to provide the aforementioned data will be the inability of Administrator to take the aforementioned actions) Administrator will process the aforementioned personal data until the expiration of the statute of limitations of claims that may arise in connection with the performance of the Agreements concluded with Administrator.

Purpose of processing	Personal data processed	Legal basis
Analysis of your activity on Service	1) date and time of visit; 2) IP number of the device; 3) type of operating system of the device; 4) approximate location; 5) type of browser of the Internet; 6) time spent on the Website; 7) sub-pages visited and other actions taken within the Website.	Article 6(1)(f) RODO (processing is necessary for the purpose of realizing the Administrator’s legitimate interests, including the case of obtaining information about your activity on the Service)
Provision of the aforementioned personal data is voluntary, but necessary in order for Administrator to obtain information about your activity on the Website (the consequence of not providing it will be the Administrator’s inability to obtain the aforementioned information). The Administrator will process the above personal data until an objection is successfully raised or the purpose of the processing is achieved.

Purpose of processing	Personal data processed	Legal basis
Administering Service	1) IP address; 2) server date and time; 3) web browser information; 4) operating system information. The above-mentioned data are recorded automatically in the so-called server logs, every time is used on the Website (administering it without using server logs and automatic recording would not be possible).	Article 6(1)(f) of the RODO (processing is necessary for the purpose of realization of the Administrator’s legitimate interest, including case of ensuring proper operation of the Service)
Provision of the aforementioned personal data is voluntary, but necessary in order to ensure proper operation of the Website (the consequence of failure to provide such data will be the inability to ensure proper operation of the Website). The Administrator will process the aforementioned personal data until an effective objection is made or the purpose of the processing is achieved.

Profiling

In order to create your profile for marketing purposes and to target you with direct marketing tailored to your preferences, the Administrator will process your personal data by automated means, including profiling – but this will not have any legal effect on you or similarly materially affect you.
The scope of the personal data profiled corresponds to the scope indicated above with regard to the analysis of your activity on the Website and the data you save in your Business Account. The legal basis for the processing of personal data for the above purpose is Article 6(1)(f) of the RODO, according to which the Administrator may process personal data in order to realize its legitimate interest, in this case to conduct marketing activities tailored to the preferences of the recipients. Providing the aforementioned personal data is voluntary, but necessary to realize the aforementioned purpose (the consequence of failing to provide such data will be the Administrator’s inability to conduct marketing activities tailored to the recipients’ preferences). The Administrator will process personal data for the purpose of profiling until an effective objection is raised or the purpose of the processing is achieved.

Recipients of personal data

Recipients of personal data may be the following external entities cooperating with the Administrator:
a) hosting company;
b) domain provider;
c) online payment system providers;
d) newsletter service provider;
e) companies providing tools for analyzing activity on the Website and direct marketing to people using it (among others.Google Analytics, among others);
f) insurers.

In addition, personal data may also be transferred to public or private entities, if such obligation arises from generally applicable laws, a final court judgment or a valid administrative decision.

Transfer of personal data to a third country

In connection with the Administrator’s use of services provided by Google LLC, your personal data may be transferred to the following third countries: United Kingdom, Canada, USA, Chile, Brazil, Israel, Saudi Arabia, Qatar, India, China, South Korea, Japan, Singapore, Taiwan (Republic of China), Indonesia and Australia. The basis for the transfer of data to the aforementioned third countries is:

– in the case of the United Kingdom, Canada, Israel and Japan, decisions of the European Commission stating an adequate level of protection for personal data in each of the aforementioned third countries;

– in the case of the USA, Chile, Brazil, Saudi Arabia, Qatar, India, China, South Korea, Singapore, Taiwan (Republic of China), Indonesia, and Australia – contractual clauses providing an adequate level of protection, in accordance with the standard contractual clauses set forth in Commission Implementing Decision (EU) 2021/914 of June 4, 2021 on standard contractual clauses for the transfer of personal data to third countries under Regulation (EU) 2016/679 of the European Parliament and of the Council.

You may obtain from the Administrator a copy of the data transferred to a third country.

Rights

In connection with the processing of personal data, you have the following rights:

1) The right to know what personal data concerning you is processed by the Administrator and to receive a copy of this data (the so-called right of access). The issuance of the first copy of data is free of charge, for subsequent copies the Administrator may charge a fee;
2) if the processed data becomes outdated or incomplete (or otherwise incorrect) you have the right to request rectification;
3) In certain situations, you may ask the Administrator to delete your personal data, e.g. when:
a) the data are no longer needed by the Administrator for the purposes communicated by the Administrator;
b) you have effectively withdrawn your consent to data processing – unless the Administrator has the right to process the data on another legal basis;
c) the processing is unlawful;
d) the need to delete the data arises from a legal obligation of the Administrator;
4) in case your personal data is processed by the Administrator on the basis of your consent to processing or for the purpose of performing the Agreement concluded with it, you have the right to transfer your data to another administrator;
5) where personal data is processed by the Administrator on the basis of your consent to processing, you have the right to withdraw this consent at any time (withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal);
6) if you consider that the processed personal data is incorrect, its processing is unlawful, or the Administrator no longer needs certain data, you may request that for a certain necessary period of time (e.g., to verify the correctness of the data or to assert claims) the Administrator not perform any operations on the data, but only store it;
7) You have the right to object to the processing of personal data whose
basis for processing is the legitimate interest of the Administrator. If you successfully object, the Administrator will stop processing your personal data for the above-mentioned purpose;
8) You have the right to lodge a complaint with the President of the Office for Personal Data Protection if you consider that the processing of personal data violates the provisions of the RODO.

Cookies

(1) The Administrator informs that the Service uses “cookies” (cookies), installed on your terminal device. These are small text files that can be read by the Administrator’s system, as well as by systems belonging to other entities whose services are used by the Administrator (e.g. Facebook, Google).
2 ) Administrator uses cookies for the following purposes:
a) ensuring proper operation of the Site – thanks to cookies, it is possible to efficiently operate the Site, use its functions and conveniently move between different subpages;
b) increasing the comfort of browsing the Site – thanks to cookies, it is possible to detect errors on some subpages and constantly improve them;
c) creating statistics – cookies are used to analyze the use of the Site by Users. This makes it possible to constantly improve the Site and adjust its operation to the preferences of the Service Recipients;
d) conducting marketing activities – thanks to cookies, the Administrator can direct advertisements tailored to their preferences to the Service Recipients.
(3) The administrator may place both permanent and temporary (session) files on your device. Session files are usually deleted when you close your browser, while closing your browser does not delete permanent files.
(4) Information about the cookies used by the Administrator is displayed in the panel located at the bottom of the Website. Depending on your decision, you can enable or disable cookies of each category (except for essential cookies) and change these settings at any time.
(5) Data collected through cookies do not allow the Administrator to identify you.
6 The administrator uses the following cookies or tools that use them:

TOOL	SUPPLIER	FUNCTIONS AND SCOPE OF DATA RETRIEVED	DURATION
Essential cookies	Administrator	The operation of these files is necessary for the proper functioning of the website of the Service, so you cannot disable them. Thanks to these files (which collect, among other things, the IP number of your device), it is possible to inform you about cookies operating on website of the Service	Most of the necessary cookies are session cookies, but some remain on your end device for a period of 12 months or until they are deleted;
Google Analytics	Google	This tool makes it possible to collect statistical data about the way Service Recipients use , including the number of visits, duration of visits, search engine used, location. The collected data helps to improve the Service and make it more friendly for Service Recipients.	Up to 2 years or until their removal (depending on whichever event occurs first)
Google Search Console	Google	This tool makes it possible to collect statistical data about the wayService Recipients use the Site, including the number of visits, the duration of visits, the search engine used, location. The collected data helps to improve the Service and make it more friendly for Service Recipients.	Up to 2 years or until their removal (depending on whichever event occurs first)

7 Through most commonly used browsers, you can check whether cookies have been installed on your end device, as well as delete installed cookies and block future installation of cookies by the Service. However, disabling or restricting the use of cookies may cause quite serious difficulties in using the Service, such as the need to log on to each subpage, longer loading time of the Service page, limitations in the use of certain functionalities.

Final Provisions

To the extent not regulated by the Policy, the generally applicable data protection regulations shall apply.

The policy is effective as of 19/11/2023.