Privacy Policy.

The controller of personal data within the meaning of Article 4(7) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (GDPR) is Future First Aleksandra Gawęda Spółka Komandytowa with its registered office in Warsaw at ul. Chmielna 2 lok. 31, 00-020 Warsaw, Poland, NIP: 5253091030, REGON: 544815459, entered into the Register of Entrepreneurs of the National Court Register under KRS: 0001242611, registry court: District Court for the Capital City of Warsaw, 12th Commercial Division of the National Court Register.

Controller's e-mail address: kontakt@futurefirst.pl.

In accordance with Article 32(1) GDPR, the controller observes the personal data protection rules and applies appropriate technical and organisational measures to prevent the accidental or unlawful destruction, loss, modification, unauthorised disclosure of, or unauthorised access to personal data processed in connection with its activity.

The provision of personal data by the client is voluntary but necessary in order to conclude a contract with the data controller.

The data controller processes personal data to the extent necessary to perform the contract or provide services to the data subject.

The controller processes personal data for the following purposes:

• preparing an offer in response to the client's interest, which is the legitimate interest of the data controller (Article 6(1)(f) GDPR);
• concluding and performing contracts with clients, on the basis of the concluded contract (Article 6(1)(b) GDPR);
• providing services by electronic means via the websites, on the basis of the concluded contract (Article 6(1)(b) GDPR);
• handling the complaints process, on the basis of an obligation incumbent on the data controller in connection with applicable law (Article 6(1)(c) GDPR);
• accounting purposes related to issuing and accepting settlement documents, on the basis of tax law provisions (Article 6(1)(c) GDPR);
• archiving data for the possible establishment, pursuit or defence of claims or the need to demonstrate facts, which is the legitimate interest of the data controller (Article 6(1)(f) GDPR);
• contact by telephone or by e-mail, in particular in response to enquiries addressed to the data controller, which is the legitimate interest of the data controller (Article 6(1)(f) GDPR);
• sending technical information concerning the functioning of the Portal and the services used by the client, which is the legitimate interest of the data controller (Article 6(1)(f) GDPR);
• marketing, which is its legitimate interest (Article 6(1)(f) GDPR) or takes place on the basis of previously granted consent (Article 6(1)(a) GDPR).

Recipients of personal data processed by the data controller may be entities cooperating with the data controller, where this is necessary to perform the contract concluded with the data subject.

Recipients of personal data processed by the data controller may also be subcontractors - entities whose services the data controller uses when processing data, e.g. accounting offices, law firms, entities providing IT services (including hosting services).

The data controller may be obliged to disclose personal data on the basis of applicable law, in particular to disclose personal data to authorised state authorities or institutions.

Some of the tools used by the controller (including providers of analytical and advertising tools, such as Google or Meta) may involve the transfer of personal data outside the European Economic Area. In such cases, the controller ensures an adequate level of data protection by applying the Standard Contractual Clauses approved by the European Commission and by selecting providers covered by a European Commission adequacy decision (e.g. the EU-US Data Privacy Framework).

The data controller stores personal data for the duration of the contract concluded with the data subject and, after its termination, for purposes related to the pursuit of claims related to the contract and the performance of obligations arising from applicable law, but for no longer than the limitation period under the provisions of the Civil Code.

The data controller stores personal data contained in settlement documents for the period indicated by tax law provisions.

The data controller stores personal data processed for marketing purposes for a period of 10 years, but no longer than until consent to the processing of data is withdrawn or an objection to the processing of data is raised.

The data controller stores personal data for purposes other than those indicated in paragraphs 1-3 for a period of one year, unless consent to the processing of data was withdrawn earlier and the processing of data cannot be continued on a basis other than the consent of the data subject.

Every data subject has the right:

• of access - to obtain from the controller confirmation as to whether their personal data is being processed. If data about a person is being processed, they are entitled to obtain access to it and to obtain the following information: about the purposes of processing, the categories of personal data, the recipients or categories of recipients to whom the data has been or will be disclosed, the period for which the data will be stored or the criteria used to determine that period, the right to request rectification, erasure or restriction of processing of personal data available to the data subject, and to object to such processing (Article 15 GDPR);
• to receive a copy of the data - to obtain a copy of the data undergoing processing, whereby the first copy is free of charge, and for further copies the controller may charge a reasonable fee based on administrative costs (Article 15(3) GDPR);
• to rectification - to request the rectification of their personal data which is inaccurate, or the completion of incomplete data (Article 16 GDPR);
• to erasure - to request the erasure of their personal data if the controller no longer has a legal basis for its processing or the data is no longer necessary for the purposes of processing (Article 17 GDPR);
• to restriction of processing - to request the restriction of the processing of personal data (Article 18 GDPR) where:
  • the data subject contests the accuracy of the personal data - for a period enabling the controller to verify the accuracy of the data,
  • the processing is unlawful and the data subject opposes the erasure of the data and requests instead the restriction of its use,
  • the controller no longer needs the data, but it is required by the data subject for the establishment, exercise or defence of claims,
  • the data subject has objected to processing - pending the verification of whether the legitimate grounds of the controller override those of the data subject;
• to data portability - to receive, in a structured, commonly used and machine-readable format, the personal data concerning them which they provided to the controller, and to request the transmission of this data to another controller, where the data is processed on the basis of the data subject's consent or a contract concluded with them and where the data is processed by automated means (Article 20 GDPR);
• to object - to object to the processing of their personal data for the controller's legitimate purposes, on grounds relating to their particular situation, including profiling. The controller then assesses the existence of compelling legitimate grounds for processing which override the interests, rights and freedoms of the data subject, or grounds for the establishment, exercise or defence of claims (Article 21 GDPR);
• to withdraw consent - at any time, without affecting the lawfulness of processing carried out before its withdrawal.

To exercise the above rights, the data subject should contact the controller at kontakt@futurefirst.pl and inform them which right they wish to exercise and to what extent.

The data subject has the right to lodge a complaint with the supervisory authority, which is the President of the Personal Data Protection Office in Warsaw (ul. Stawki 2, 00-193 Warsaw).

The personal data obtained by the data controller will not be processed in the form of profiling within the meaning of Article 22 GDPR.

The personal data will not be subject to automated decision-making producing legal effects concerning the data subject or similarly significantly affecting them.

On the website the controller uses plugins linking to social media portals. These plugins are marked with the logo of the given social media service.

Data is transferred to social media portals only when the user has actively clicked the relevant plugin button. After clicking the plugin icon, the web browser will start a connection with the servers of the given social media portal, and the user will be redirected to the page of the external service provider, i.e. the owner of the given social media service, and the user's web browser will establish a direct connection with the servers of those social media services. The use of these functions may involve the use of external cookies. From the moment of clicking on a given plugin, personal data is processed on the given social media portal, and the owner of the social media portal becomes a joint controller of personal data. The controller informs that, from the moment of actively clicking the plugin button, the controller has no influence over the nature and scope of the personal data collected by the given social media portal.

Data is transferred regardless of whether the user has an account on the given social media portal or whether they are logged in. Where the user is logged in to a given social media platform, the collected personal data will be directly assigned to the account (profile) used by them.

For more information on the purpose and scope of the collection of personal data, including the rules for its processing by the provider of the given portal, please refer to the privacy policies of those providers.

The controller uses Google Analytics - an online analytics service provided by Google Inc. based in the USA.

Google Analytics uses cookies that enable the analysis of the user's use of the website. The information generated by the cookie about the use of the website is transferred to and stored on a Google server. On behalf of the controller, Google will use this information to analyse users' use of the website in order to prepare reports on website activity and to provide other services related to the use of the website and the Internet for the commissioning entity.

The data will not be used to identify any natural person.

The user can prevent cookies from being stored by means of the appropriate browser settings; however, in such a case they may not be able to use the full functionality of the website. In addition, users can prevent Google from collecting data generated by cookies and relating to their use of the website (including the IP address), as well as the processing of this data by Google, by downloading and installing the browser plugin available at the following link: https://tools.google.com/dlpage/gaoptout.

The controller uses the Meta Pixel - an analytics tool that helps measure the effectiveness of advertising based on the analysis of actions taken by users on the website.

The controller uses the Meta Pixel tool in order to direct personalised advertising to the Client in Meta Inc. services (e.g. Facebook, Instagram). This involves the use of cookies of Meta Platforms Inc. The legal basis for the controller's use of the Meta Pixel tool is Article 6(1)(f) GDPR and - where required - the user's consent (Article 6(1)(a) GDPR).

The controller uses the Hotjar analytics tool, which tracks user behaviour taken within the controller's websites.

Hotjar collects non-personal data, including standard internet protocol data and behaviour patterns, when the user visits the website. This is intended to increase user convenience, determine preferences, diagnose technical problems, analyse events and improve the website. The following information is collected with regard to the device and browser: the device's IP address (collected and stored anonymously), screen resolution, device type (device identification elements), operating system and browser type, geographic location (country only), preferred language when displaying the website. The following information is collected with regard to user interaction: mouse handling (movements, position and clicks), keyboard entries.

Hotjar also collects log data collected by the website on a random basis: indicating the domain, the pages visited, geographic location (country only), preferred language, the date and time when the pages were viewed.

By visiting https://www.hotjar.com/opt-out and clicking "Disable Hotjar", the user may at any time decline the collection of their data by Hotjar when visiting the website.

For all matters concerning the protection of personal data, you can contact the controller:

• e-mail: kontakt@futurefirst.pl
• postal address: ul. Chmielna 2 lok. 31, 00-020 Warsaw, Poland