This Privacy Policy has been developed based on the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, hereinafter referred to as GDPR.

PERSONAL DATA CONTROLLER

  1. The controller of the personal data of individual service recipients is IMPALL Rozwandowicz Bocheński Sp.K. based in Łódź, at Pojezierska Street 95A, registered in the Register of Entrepreneurs under the number KRS: 0000971230, NIP: 729-261-96-25, whose registry files are kept by the District Court for Łódź – Śródmieście in Łódź, 20th Commercial Division. Contact with the Controller is possible from Monday to Friday between 8:00 AM and 5:00 PM via email at contact@impall.eu, by phone at +48 42 640 30 13, and by fax at +48 42 640 20 08.

REQUIREMENT TO PROVIDE AND CATEGORIES OF PERSONAL DATA PROCESSED

  1. The Controller processes the following personal data of service recipients:
  2. – First and last name,
    – Email address.
  3. The provision of personal data specified in point 2 is not a statutory requirement and is voluntary, but it is a condition for concluding a service agreement with the Controller via electronic means, hereinafter referred to as the “Agreement.” If the service recipient does not provide this data, the Agreement will not be concluded.
  4. During the term of the Agreement, the Controller may come into possession of other data of the service recipient, such as the IP address of the device used by the service recipient and data related to the use of a specific telecommunication network, software, or devices, as well as the manner of using the Controller’s website.

PURPOSES OF PERSONAL DATA PROCESSING

  1. The Controller processes the personal data of service recipients for the following purposes:
  2. – Conclusion and performance of the Agreement between the parties, particularly the proper provision of services and handling complaints,
    – Fulfillment of the Controller’s legal obligations, particularly issuing and storing invoices and other accounting documents,
    – Assertion and defense of claims,
    – Detection and prevention of fraud,
    – Direct marketing,
    – Creating analyses and statistics for the Controller’s own needs, particularly reporting, marketing and market research, service development planning, studying service recipients’ preferences and behaviors to improve the quality of services provided by the Controller,
    – As specified in points 5e and 5f after the Agreement has been executed – with the service recipient’s consent,
    – Transfer to third parties – with the service recipient’s consent, within the scope and purpose covered by that consent.

LEGAL BASIS FOR PERSONAL DATA PROCESSING

  1. The legal basis for processing the personal data of service recipients for the purpose specified:
  2. – In point 5a – is Article 6(1)(b) GDPR (performance of the Agreement),
    – In point 5b – is Article 6(1)(c) GDPR (legal obligation),
    – In points 5c-f – is Article 6(1)(f) GDPR (legitimate interests of the Controller),
    – In points 5g and 5h – is Article 6(1)(a) GDPR (consent of the service recipient).

DATA RETENTION PERIOD

  1. The Controller will store personal data processed for the purpose specified:
  2. – In point 5a – for the duration of the Agreement and settlements after its termination,
    – In point 5b – for the period required by applicable law,
    – In points 5c and 5d – until the expiration of claims arising from the Agreement,
    – In points 5e and 5f – for the duration of the Agreement,
    – In points 5g and 5h – until the consent is withdrawn by the service recipient.
  3. According to Article 19(2) of the Act on the Provision of Electronic Services, after the end of service use, the Controller may process only those personal data of the service recipients that are:
  4. – Necessary for the settlement of the service and the assertion of payment claims,
    – Necessary for advertising, market research, and behavior and preference studies of service recipients with the aim of improving the quality of services provided by the Controller – with the service recipient’s consent,
    – Necessary to clarify the circumstances of unauthorized use of the service,
    – Permitted for processing under mandatory provisions of law or the Agreement.

RECIPIENTS OF PERSONAL DATA

  1. The Controller does not transfer the personal data of service recipients to third parties unless prior, explicit consent is obtained from the service recipient or if the transfer of such data is required by applicable law.
  2. The Controller entrusts the personal data of service recipients to the following processors:
  3. – Those providing marketing and advertising services on behalf of the Controller,
    – Those servicing the Controller’s IT systems,
    – Those providing postal, courier, payment, auditing, legal, and accounting services to the Controller.

TRANSFER OF PERSONAL DATA TO THIRD COUNTRIES AND INTERNATIONAL ORGANIZATIONS

  1. The personal data of service recipients will not be transferred outside the European Economic Area.

RIGHTS OF SERVICE RECIPIENTS

  1. Service recipients have the following rights:
  2. – The right to request access to their data, i.e., to obtain confirmation of whether their personal data is being processed,
    – The right to rectify data, i.e., to request the correction of their inaccurate personal data,
    – The right to request the deletion of their personal data,
    – The right to request the restriction of their personal data,
    – The right to object to the processing of their data,
    – The right to data portability.
  3. The scope of each of the rights specified in point 12 and the situations in which they can be exercised are defined by applicable law, particularly GDPR.
  4. The service recipient may exercise the rights specified in point 12 by contacting the Controller.

RIGHT TO WITHDRAW CONSENT

  1. If the processing of personal data of the service recipient is based on their consent, the service recipient has the right to withdraw it at any time without affecting the lawfulness of the processing carried out based on the consent before its withdrawal.

PROFILING

  1. For the purposes specified in points 5c-f, the Controller may perform automated analysis of service recipients’ data and make predictions about their preferences or future behaviors. Profiling may particularly serve to analyze and forecast personal preferences or interests of service recipients. Such actions by the Controller will not have any legal effects on the service recipients or significantly impact their situation.

COOKIES

  1. For the purposes specified in points 5c-f, the Controller may use so-called cookies. These are small text files placed on the service recipient’s device, based on which information is collected that allows, in particular, the identification of the service recipient’s device, their IP address, and the browser used by the service recipient.
  2. The service recipient can configure their browser – using the appropriate options available – to disable automatic cookie installation, prevent their use, or completely remove them from their device. The procedure for handling and deleting cookies differs depending on the browser used by the service recipient.
  3. Cookies are categorized as:
  4. – Temporary (session) – files temporarily stored in the browser’s cache, which remain there until the session ends,
    – Permanent – files that remain in the browser’s cache for as long as the browser settings selected by the service recipient allow,
    – First-party – files managed by the Controller,
    – Third-party – files managed by third parties,
    – Configuration – files related to the service recipient’s navigation on the Controller’s website, ensuring proper navigation. They particularly allow tracking the choices made by the service recipient (e.g., language selection, font size), recognizing the device used by the service recipient, and managing the browsing session,
    – Analytical – files used for statistical and analytical purposes,
    – Advertising – files used for advertising purposes, e.g., to display personalized ads.
  5. Detailed rules regarding cookies used on the Controller’s website are provided under the following links:
  6. – https://policies.google.com/privacy/update?hl=en