CLOUDFERRO PRIVACY POLICY

When you, as an individual, contact us or use our services, whether you are acting on your own behalf or on behalf of another entity (e.g. your employer, and our client) or when your data has been disclosed to us (e.g. as contact details for the performance of contracts), we process your personal data.

The following information is intended to explain who we are, how we obtain information and what we do with it. If anything is not clear to you or raises any concerns, please contact us.

1. Who are we and how to contact us?
   1. CloudFerro SA, with its registered office in Warsaw (00-511) at ul. Nowogrodzka 31, is the controller of your personal data (hereinafter Controller) within the meaning of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (hereinafter GDPR), in connection with your use of our website, available at: https://cloudferro.com/ (hereinafter the Site), to the extent necessary for the provision of the various services offered, as well as for information about your activity on the Site.
   2. Personal data is information about a natural person identified or identifiable by one or more factors specific to his or her physical, physiological, genetic, mental, economic, cultural, or social identity, including device IP, location data, internet identifier and information collected through cookies and other similar technology.
   3. The following describes the specific principles and purposes of the processing of your personal data collected when you use our Site, enter into a contract with us or take part in our recruitments.
   4. Contact with us is possible:
      1. at the following address: CloudFerro S.A. 31 Nowogrodzka Street, 00-511 Warsaw
      2. on telephone number +48 22 354 65 73,
      3. by email at: info@cloudferro.com.
   5. In matters related to the processing of your personal data, you can also contact our Data Protection Officer, who is Piotr Kociszewski, at the e-mail address: iod@cloudferro.com or by traditional correspondence to our address above.

2. WHAT DATA DO WE PROCESS?
   1. The extent of the data we process depends on the information you provide to us in connection with your use of the Site or, for example, your employer/principal in connection with the conclusion and performance of a contract.
   2. We obtain this information directly from you or - if you are the designated contact person or you are the person representing our contractor/customer - from other persons, e.g., your employers/contractors.

3. FOR WHAT PURPOSES AND ON WHAT LEGAL BASIS DO WE PROCESS YOUR PERSONAL DATA?
   1. Your provision of personal data is voluntary; however, it may sometimes be necessary for the purposes of our cooperation, e.g., necessary to conclude or perform a contract or to respond to an enquiry or for correspondence. This means that their failure to do so may sometimes constitute grounds for the Controller to refuse to cooperate with you, or for the Controller to take legal action to resolve a possible case.

3. USE OF THE WEBSITE
   2. We process your personal data left on the Site or provided by you (including your IP address or other identifiers and information collected through cookies or other similar technologies):
      1. for the purpose of providing electronic services in terms of providing you with access to the content collected on the Site - in which case the legal basis for the processing is the necessity of the processing for the performance of the contract (Article 6(1)(b) GDPR).
      2. for our analytical and statistical purposes, in which case the legal basis for the processing is our legitimate interest (Article 6(1)(f) GDPR), consisting of conducting analyses of user activity as well as user preferences in order to improve the functionalities used and services provided.
      3. for our marketing purposes - the rules for processing personal data for marketing purposes are described in the MARKETING and DIRECT MARKETING section.
   3. Your activity on the Site, including your personal data, is recorded in system logs (a special computer program used to keep a chronological record containing information about events and activities that relate to the computer system used to provide our services). The information collected in the logs is processed primarily for purposes related to the provision of services. We also process it for technical, administrative purposes, for the purposes of ensuring the security of the IT system and the management of this system, as well as for analytical and statistical purposes - in this regard, the legal basis for processing is our legitimate interest (Article 6(1)(f) GDPR).

3. CONTACT FORM
   4. We provide you with the possibility to contact us using an electronic contact form. The use of the form requires the provision of personal data necessary to make contact with you and to respond to your enquiry. The provision of data marked as mandatory is required in order to carry out the requested contact or to address the enquiry, and their failure to do so will result in the impossibility to carry out the requested contact or to handle the enquiry sent. The provision of other data is voluntary.
   5. We process the personal data obtained via the above form:
      1. in order to identify the sender and to handle his/her enquiry sent via the form provided and to respond to the enquiry - the legal basis for the processing of mandatory data is our legitimate interest (Article 6(1)(f) GDPR) in responding to enquiries addressed to us regarding our business activities; as regards data provided on an optional basis, the legal basis for the processing is consent (Article 6(1)(a) GDPR);
      2. for analytical and statistical purposes - the legal basis for the processing is our legitimate interest (Article 6(1)(f) of the DPA), consisting of keeping statistics on the requests made by users through the Website in order to improve its functionality.

3. E-MAIL OR TRADITIONAL CORRESPONDENCE
   6. When you address us by email or post, correspondence that is not related to the services provided to you or any other contract you have with us, the personal data contained in that correspondence is processed for the sole purpose of communication and resolution of the matter to which the correspondence relates.
   7. The legal basis for the processing is our legitimate interest (Article 6(1)(f) of the GDPR) to deal with correspondence addressed to us in connection with our business activities.
   8. We only process personal data relevant to the matter to which the correspondence relates. All correspondence is stored in a way that ensures the security of the personal data (and other information) it contains and is only disclosed to authorised persons.

3. CALL
   9. When you contact us by telephone, on matters not related to the contract concluded or the services provided, we may only request your personal data if this is necessary to handle the matter contacted. The legal basis in this case is our legitimate interest (Article 6(1)(f) GDPR) consisting of the need to resolve the reported matter related to our business.

3. RECRUITMENT
   10. As part of our recruitment processes, we expect you to provide personal data (e.g., in your CV or resume) only to the extent specified in the employment legislation. Accordingly, information should not be provided to a broader extent. In the event that the applications sent will contain additional data beyond the scope indicated by the employment legislation, their processing will be based on the candidate's consent (Art. 6(1)(a) GDPR), expressed through the unambiguous affirmative action of the candidate sending the application documents. In the event that the applications sent contain information that is not relevant to the purpose of the recruitment, they will not be used or taken into account in the recruitment process.
   11. Your personal data is processed:
       1. where the preferred form of employment is an employment contract - in order to comply with legal obligations relating to the employment process, including primarily the Labour Code - the legal basis for the processing is a legal obligation incumbent on us (Article 6(1)(c) of the GDPR in relation to employment law).
       2. where the preferred form of employment is a civil law contract - in order to conduct the recruitment process - the legal basis for processing the data contained in the application documents is to take action prior to the conclusion of a contract at the request of the data subject (Article 6(1)(b) GDPR).
       3. for the purpose of carrying out the recruitment process in respect of data not required by law or by us, and for the purpose of future recruitment processes - the legal basis for the processing is consent (Article 6(1)(a) GDPR).
       4. for the purpose of verifying your qualifications and skills and determining the terms and conditions of cooperation - the legal basis for the processing of your data is our legitimate interest (Article 6(1)(f) GDPR). Our legitimate interest is to verify job applicants and to determine the terms and conditions of possible cooperation.
   12. To the extent that your personal data are processed on the basis of your consent, you may withdraw it at any time, without affecting the lawfulness of the processing carried out before the withdrawal. If you have given your consent for the purposes of future recruitment processes, your personal data will be deleted no later than after five years - unless your consent has been withdrawn beforehand.
   13. The provision of data to the extent specified in Article 22(1) of the Labour Code is required - in the case of your preference for employment based on an employment contract - by law, including primarily the Labour Code, and in the case of your preference for employment based on a civil law contract - by us. The consequence of failing to provide this data is that your application cannot be considered in the recruitment process. Provision of other data is voluntary.

3. PROCESSING OF PERSONAL DATA OF PERSONS APPOINTED TO CONTACT OR REPRESENT CLIENTS/CUSTOMERS
   14. In connection with the conclusion of contracts in the course of our business, we obtain data from contractors / customers on the persons involved in the conclusion and execution of such contracts (e.g., contact persons, representatives, agents). The extent of the data provided is in each case limited to the extent necessary for the performance of the contract and does not normally include information other than name and business contact details (in the case of contact persons) or name, function, signature, data contained in public records or in the content of a power of attorney (in the case of representatives or agents).
   15. Such personal data is processed for our and our contractor's legitimate interest (Article 6(1)(f) GDPR) in enabling the correct and effective performance of the contract. Such data may be disclosed to third parties involved in the performance of the contract.
   16. The personal data referred to above may also be processed in order to comply with a legal obligation incumbent on us in connection with the obligation to keep books of account and tax settlements, in the case of persons whose data will be contained in documents whose obligation to keep and maintain arises from tax and accounting law - the legal basis for the processing is the legal obligation incumbent on us (Art. 6(1)(c) GDPR).
   17. The data are processed for the period necessary to pursue the above interests and comply with regulatory obligations.

3. PROCESSING OF PERSONAL DATA IN CONNECTION WITH THE PROVISION OF SERVICES OR PERFORMANCE OF OTHER CONTRACTS
   18. In connection with the conclusion of contracts in the course of our business, we obtain personal data of our contractors / customers. The provision of personal data by the contractor / customer is required in order to conclude and perform a contract with us. Failure to provide data will result in the impossibility of concluding and performing this contract.
   19. Such personal data are processed for the purpose of entering into and performing contracts with us. The legal basis for the processing of personal data is the necessity of the processing for the performance of a contract to which the data subject is party, or to take steps at the request of the data subject prior to entering into a contract (Article 6(1)(b) GDPR). Personal data may also be processed for the purpose of complying with a legal obligation incumbent on us, in connection with the obligation to keep accounts and tax returns - the legal basis for the processing is a legal obligation incumbent on us (Article 6(1)(c) GDPR). Such data may be disclosed to third parties involved in the performance of the contract.
   20. The data are processed for the period necessary to pursue the above interests and comply with regulatory obligations.

3. MARKETING
   21. We process your personal data in order to carry out marketing activities, which may consist of various analytical and statistical activities, as well as those related to direct marketing of services (sending commercial information by e-mail).

3. DIRECT MARKETING
   22. Your personal data may also be used by us to target you with marketing content via email. Such activities are only undertaken by us if you have given us your consent, which you can withdraw at any time.
   23. Your personal data is processed:
       1. for the purpose of sending requested commercial information - the legal basis for the processing, including using profiling, is our legitimate interest (Article 6(1)(f) GDPR in connection with the relevant electronic communication legislation) to promote our services in connection with the consented communication channel.
       2. for analytical and statistical purposes - the legal basis for the processing is our legitimate interest (Article 6(1)(f) of the DPA), consisting of conducting analyses of user activity on the Site in order to improve the functionalities used.

3. SOCIAL NETWORKS
   24. If you visit our social media profiles (X, Facebook, Instagram, YouTube, GitHub), we process your personal data. This data is processed exclusively in connection with the operation of the profile, including to keep you informed about our activities and to promote various events, services, and products. The legal basis for our processing of your personal data for this purpose is our legitimate interest (Art. 6(1)(f) GDPR) in promoting our own brand.
       
       NOTE: The above information does not apply to the processing of personal data by service Controllers (X, Facebook, Instagram, YouTube, GitHub).

4. HOW LONG DO WE PROCESS YOUR DATA?
   1. As a general rule, your data will only be processed for as long as is necessary for the purpose for which your data is processed.
   2. The duration of the processing of your data depends on the type of service provided and the purpose of the processing. As a general rule, your data is processed for the duration of the service, until you withdraw your consent or make an effective objection to the processing in cases where the legal basis for the processing is our legitimate interest.
   3. The processing period may be extended if the processing is necessary for the establishment and assertion of possible claims or the defence against claims, and thereafter only if and to the extent required by law. After the expiry of the processing period, the data shall be irreversibly deleted or anonymised.

5. WHO ACTUALLY HAS ACCESS TO YOUR PERSONAL DATA?
   1. Your personal data can only be accessed by:
      1. duly authorised employees or associates of the Controller, who are obliged to keep them confidential and not to use them for purposes other than those for which we obtained your data.
      2. entities that support us in the provision of services, i.e.: consulting, auditing, accounting, tax and legal service providers, debt collection, IT, banking, archiving and document destruction, marketing; entities that provide parcel delivery and postal services, entities that you may use when using our services, i.e., payment processors.
      3. All persons who have access to your data are those who need such access in order to carry out certain activities.
   2. We may also be obliged to provide certain information to public authorities for the purposes of their investigations. In this case, information shall only be provided if there is an appropriate legal basis for doing so.

6. YOUR RIGHTS
   1. You have the following rights: to access your data and to receive a copy of your data, to rectify your data, to request erasure of your data, to request restriction of data processing, the right to data portability.
   2. You also have the right to object to the processing of your data for marketing purposes if the processing is carried out in connection with our legitimate interest and, for reasons relating to your particular situation, in other cases where the legal basis for the processing is our legitimate interest (e.g. in connection with the performance of analytical and statistical purposes).
   3. In order to exercise the above-mentioned rights, please contact us by e-mail at: iod@cloudferro.com or using the contact details indicated in section 1.4.
   4. If you have doubts about the lawfulness of our processing of your personal data, you have the right to lodge a complaint with the supervisory authority, which in Poland is the President of the Office for Personal Data Protection.

7. DATA TRANSFER OUTSIDE THE EEA
   1. The level of protection of Personal Data outside the European Economic Area (EEA) differs from that provided by European law. For this reason, we transfer your personal data outside the EEA only when necessary and with an adequate level of protection, primarily by:
      1. cooperation with processors of personal data in countries for which a relevant decision of the European Commission has been issued regarding the determination of an adequate level of protection of personal data; in some cases, the European Commission additionally requires such processor to participate in programmes approved by it for entities outside the EEA, the participants of which are obliged to provide personal data with the same protection as they enjoy in the European Union (for details, see here);
      2. the use of standard contractual clauses issued by the European Commission; together with the required additional security measures, these provide personal data with the same protection as they enjoy in the European Union; model contracts can be found here;
      3. the application of binding corporate rules approved by the competent supervisory authority.
   2. We always inform you of our intention to transfer your personal data outside the EEA at the stage of collection.

8. SECURITY OF PERSONAL DATA
   1. We carry out risk analysis on an ongoing basis to ensure that we process personal data securely - ensuring, above all, that only authorised persons have access to data and only to the extent that this is necessary for their tasks. We ensure that all operations on personal data are recorded and carried out only by authorised employees and associates.
   2. We take all necessary measures to ensure that our subcontractors and other cooperating entities also provide guarantees that appropriate security measures are applied whenever they process personal data on our behalf.

9. CHANGES TO THE PRIVACY POLICY
   1. The policy is reviewed on an ongoing basis and updated, as necessary. The current version of the policy has been adopted and is effective as of April 10, 2024.

10. COOKIES AND SIMILAR TECHNOLOGY
    1. Cookies are small text files stored on your device when you use websites. Among other things, they remember your visit and settings. They perform various functions, but the Controller uses them primarily to enable you to access the Website and to facilitate your use of the services available on the Website.
       
       The Controller also uses cookies for analytical and marketing purposes, but only if you have consented to this on the cookie banner displayed on the Site. This consent can be withdrawn at any time using the "MANAGE COOKIES" button located in the footer of the Site.
    2. Cookies are divided into permanent and session cookies - depending on how long they are stored, and into necessary and optional cookies - depending on the purposes for which they are used.

10. PERMANENT AND SESSION COOKIES

10. NECESSARY AND OPTIONAL COOKIES

10. 3. The specific purposes of the use of cookies are described on the cookie banner that is displayed when the User first visits the Site and can later be accessed via the "MANAGE COOKIES" button located in the footer of the Site.

10. TRUSTED PARTNERS OF THE CONTROLLER
    4. The Website uses cookies of the Controller and – from time to time – of its trusted partners. You can find information about the Controller's trusted partners on the cookie banner or in the list below. Please refer to their privacy policies for details on how they process User data.

10. MANAGEMENT OF COOKIE SETTINGS
    5. You can manage your cookie settings via the cookie banner. The Controller shall make the Site available to you in accordance with these settings. Banner cookies allow you to:
       1. obtain detailed information on the cookies that the Controller uses on the Site and on the Controller's trusted partners.
       2. give or withdraw your consent to the use of optional cookies by the Controller and its trusted partners.
    6. The cookie banner displays when you first visit the Site and remembers your consents. You can make changes to your settings at any time using the "Manage cookies" button at the footer of the Site.
    7. You can also manage cookies by changing your browser settings. You can find detailed information on this at the links below.

10. 8. Some cookies are essential to the operation of the Site, so changing your browser settings may render some services inoperable or even prevent you from using the Site.