Privacy policy

I. General information

1. The data controller for personal data collected via the website https://sao.com.pl/ (‘the Website’) is SAO Investments sp. z o.o., with its registered office in Kraków, at ul. Królowej Jadwigi 110, 30-209 Kraków, entered in the Register of Entrepreneurs of the National Court Register under KRS number 0000928395, with tax identification number (NIP) 6772469970 and statistical number (REGON) 520245868 (“Controller” or “SAO”).
2. Data protection is carried out in accordance with the requirements of generally applicable legal provisions, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (‘GDPR’), the Act of 10 May 2018 on the protection of personal data, and the Act of 18 July 2002 on the provision of electronic services.
3. Any enquiries, requests or complaints regarding the processing of personal data by the Controller should be sent by email to: rodo@sao.com.pl or in writing to the Controller’s address: ul. Królowej Jadwigi 110, 30-209 Kraków.

II. Administration of personal data

1. The User is entitled to browse the website without providing SAO with any personal data. The website resources being viewed are identified by their URLs. The detailed list of information stored in the web server’s log files is as follows:  - the public IP address from which the request originated;  - the client’s hostname - identified via the HTTP protocol, where possible;  - the time the request was received;  - the first line of the HTTP request;  - HTTP response code;  - the number of bytes sent by the server;  - the URL of the page previously visited by the user (referrer link) - where the user accessed the Website via a link;  - information about the user’s browser;  - information about the user’s location;
2. The usage data listed above is used for administrative, diagnostic and statistical purposes. The data may also be used for purposes such as demographic analysis of users, compiling statistics on the types of web browsers used, etc. Periodic analysis of this data enables the detection of any malfunctions on the Website, as well as the continuous improvement of its quality.
3. The usage data listed in point 1, in particular the IP address and location information, may constitute personal data within the meaning of the GDPR. The Data Controller does not use this data to identify specific Users and does not combine it with other data held (e.g. data provided in the contact form), unless this is necessary to ensure the security of the Website, to detect misuse, or to establish, pursue or defend legal claims. This data is retained only for the period necessary to fulfil the purposes set out in point 2.
4. The scope of Users’ personal data provided includes the personal data necessary for SAO to respond to or make contact with the person providing the data, i.e. first name(s), surname, email address, telephone number, and any similar information. The Controller does not process special categories of Users’ data.
5. Users’ personal data is processed only to the extent that is appropriate and necessary in relation to the purpose for which it is processed, i.e. for the following purposes and on the following legal bases:  - responding to enquiries and corresponding with the User (contact form, email, telephone) - Article 6(1)(f) of the GDPR (the Controller’s legitimate interest in handling enquiries and correspondence), and if the enquiry concerns the conclusion of a contract - Article 6(1)(b) of the GDPR (taking steps at the request of the data subject prior to entering into a contract);  - the conclusion and performance of a contract with the User - Article 6(1)(b) of the GDPR;  - ensuring the proper functioning, administration and security of the Website, including maintaining server logs and using necessary cookies - Article 6(1)(f) of the GDPR (the Controller’s legitimate interest in ensuring the functioning and security of the Website);  - conducting analyses and compiling statistics on the use of the Website, including through the use of Google Analytics - Article 6(1)(a) of the GDPR (the User’s consent expressed in the cookie settings);  - marketing of SAO’s products and services, including the display of adverts tailored to the User’s interests and the sending of commercial communications by electronic means - Article 6(1)(a) of the GDPR (the User’s consent), whereby commercial communications are sent by electronic means only after obtaining the consent required by law;  - fulfilling the legal obligations incumbent on the Controller, in particular handling requests from data subjects and fulfilling tax and accounting obligations - Article 6(1)(c) of the GDPR;  - establishing, exercising or defending legal claims - Article 6(1)(f) of the GDPR (the Controller’s legitimate interest in protecting its rights).
6. In order to maintain, develop and analyse relationships with website Users, as well as to compile statistics and market products and services, SAO may use profiling, which involves using the User’s personal data to evaluate certain characteristics of the User, in particular to analyse or predict aspects relating to personal preferences, interests, location or movements.
7. Users’ personal data may be disclosed to the following categories of recipients:  - data processors acting on behalf of the Controller under a data processing agreement (Article 28 of the GDPR), in particular providers of hosting, IT, email, and analytical and marketing tools - solely to the extent necessary to provide these services;  - Google Ireland Limited - in connection with the use of Google Analytics and Google Ads, to the extent covered by the User’s consent;  - companies within the SAO Group - where necessary to handle the User’s enquiry;  - entities providing legal, advisory and audit services to the Controller, which are bound by a duty of confidentiality;  - public authorities, including courts, law enforcement agencies and regulatory bodies - only where the obligation to disclose data arises from statutory provisions.
8. In connection with the use of Google services, Users’ data may be transferred to the United States of America. Such transfers are made on the basis of a decision by the European Commission confirming an adequate level of protection (the EU-US Data Privacy Framework) and, in all other respects, on the basis of standard contractual clauses adopted by the European Commission (Article 46(2)(c) of the GDPR). Apart from this case, Users’ data is not transferred outside the European Economic Area or to international organisations.

III. Rights of data subjects

1. In accordance with the provisions of the GDPR, any data subject whose personal data we process as the Data Controller has the right to:  - be informed about the processing of personal data, as referred to in Article 12 of the GDPR;  - access their personal data, as referred to in Article 15 of the GDPR;  - correct, supplement, update or rectify their personal data, as referred to in Article 16 of the GDPR;  - the erasure of data (the right to be forgotten), as referred to in Article 17 of the GDPR;  - restriction of processing, as referred to in Article 18 of the GDPR;  - data portability, as referred to in Article 20 of the GDPR;  - to object to the processing of personal data, as referred to in Article 21 of the GDPR;  - to lodge a complaint with the supervisory authority (i.e. the President of the Personal Data Protection Office), as referred to in Article 77 of the GDPR - if you consider that we are processing your personal data unlawfully or in any way infringing your rights under generally applicable data protection legislation.
2. With regard to the right to erasure (the right to be forgotten), we would like to point out that, in accordance with the provisions of the GDPR, you do not have the right to exercise this right if:  - the processing of your personal data is necessary to exercise the right to freedom of expression and information,  - the processing of personal data is necessary for our company to comply with legal obligations arising from legislation - we cannot delete your data for the period necessary to fulfil the obligations (e.g. tax obligations) imposed on us by law,  - the processing of your data is carried out for the purposes of pursuing, establishing or defending legal claims.
3. If we process personal data on the basis of consent, such personal data will only be processed for the duration of the consent, which the data subject may withdraw or restrict at any time. If they do so, we will cease to process personal data for the purposes to which the withdrawn or restricted consent relates.
4. We respect the right to privacy and are committed to data security. We make every effort to protect data from unauthorised access by third parties and, in this regard, we implement high-level organisational and technical security measures; in particular, we have access controls in place, thereby minimising the impact of any potential data breach. Access to personal data is restricted to a limited number of our employees. Employees are obliged to keep personal data confidential and to comply with security measures to protect it. These employees are authorised to process personal data only on the basis of explicit instructions.
5. Data will be processed for marketing purposes until the User withdraws their consent to such processing.
6. Personal data will be processed and stored for the duration of the contract or the provision of services by SAO, at the latest until the limitation period for claims arising from the contract or the provision of services expires, or until the statutory data retention obligation ceases to apply. The Data Controller makes every effort to minimise the retention period for personal data that is no longer used. Please note, however, that this may occur for operational and technical reasons.

IV. ‘Cookies’

1. The website uses ‘cookies’. These are small text files sent by a web server and stored by the browser software on your computer. When your browser connects to the website again, the site recognises the type of device from which you are connecting. The parameters allow the information contained within them to be read only by the server that created them. Cookies therefore make it easier to use websites that have been visited previously.
2. The information collected relates to the IP address, the type of browser used, the language, the type of operating system, the internet service provider, time and date details, location, and information submitted to the website via the contact form.
3. The data collected is used to monitor and analyse how users interact with the Website, in order to improve its functionality and ensure more efficient and seamless navigation. We monitor user information using Google Analytics, which tracks user behaviour on the site.
4. ‘Cookies’ identify the user, which allows the content of the website they are using to be tailored to their needs. By remembering their preferences, they enable advertisements targeted at them to be appropriately tailored. The Website uses cookies to guarantee the highest standard of service, and the data collected is used solely within the company for the purpose of optimising operations.
5. We use the following cookies on the Website:  - Essential for the website to function: These are necessary for the website to function correctly; they allow you to navigate the site and use its features. For example, they may remember your previous actions (such as pages you have opened) when you return to the site during the same session.  - Performance cookies: These collect information on how visitors use the Website by providing insights into the areas they visit, the time they spend on them and any issues they encounter, such as error messages. This enables us to improve the Website’s performance.  - Functionality cookies: Remembering settings and choices (e.g. the User’s region, personalised content settings) to provide the User with more personalised content and services. They also enable the User to watch videos and use social media tools, such as blogs, chats and forums.  - Advertising: To deliver adverts to you that match your interests and to limit the number of times a particular advert is displayed. These cookies also allow us to measure the effectiveness of advertising campaigns.
6. You can disable or re-enable the collection of cookies at any time by changing the settings in your web browser. Instructions on managing cookies are available in the settings of your web browser at , and on the website: http://www.allaboutcookies.org/manage-cookies
7. Deleting cookies or disabling them in your browser may result in the Website not functioning correctly and may restrict access to various features of the Website.
8. Additional personal data, such as an email address, is collected only where the User has expressly consented to this when completing a form. We retain and use this data solely for the purposes necessary to perform the relevant function.