Contact

Privacy Policy

§ 1. INTRODUCTION

This Privacy Policy sets out the rules for the processing and protection of personal data within the Service operated by PriceMind spółka z ograniczoną odpowiedzialnością (limited liability company) with its registered office in Lublin, address: ul. Łużyczan 10/U2, 20-830 Lublin, entered in the register of entrepreneurs maintained by the District Court Lublin – Wschód in Lublin with its registered office in Świdnik, 6th Commercial Division of the National Court Register under KRS number: 0000809016, REGON: 384630083, NIP: 7123394112, share capital PLN 50,000; electronic mail address (hereinafter: the Controller).

Any questions or concerns regarding the processing of personal data may be addressed by electronic mail to: info@pricemind.eu

The Controller warrants that personal data entrusted to it by persons using the Service are processed in accordance with generally applicable laws, and in particular with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (OJ L 119, 4.5.2016) — hereinafter referred to as the GDPR.

The Controller’s objective is to ensure that Users are afforded a level of privacy protection meeting at least the requirements arising from applicable law, and in particular from the GDPR.

Any person using the Service accepts all principles set forth in this Privacy Policy.

The Controller reserves the right to amend this Privacy Policy where required by law or by changes to the functionality of the Service. Notice of any amendments and their effective date shall be made available by means of an announcement published within the Service.

§ 2. DEFINITIONS

User — a natural person whose personal data are processed by the Controller in connection with the use of the Service.

Personal data — any information relating to an identified or identifiable natural person, including in particular: name and surname, identification number, contact details, device IP address, location data, online identifier, and information collected by means of cookies or similar technologies.

Service — the ICT system operated at www.pricemind.eu, comprising an integrated set of computer programs, databases and associated elements (e.g. graphic elements), enabling the provision of services by electronic means.

Processing of personal data — any operation performed on personal data, including collection, recording, organisation, storage, consultation, modification, disclosure, erasure or destruction thereof, regardless of whether carried out by automated or manual means.

Personal data breach — an incident resulting in the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.

§ 3. PURPOSES, LEGAL BASES AND SCOPE OF PROCESSING

The Controller processes personal data only where at least one of the following conditions is satisfied:

  • with the User’s consent — for the purpose of carrying out the activities to which that consent relates, including the conduct of marketing activities (Article 6(1)(a) GDPR);
  • where processing is necessary for the performance of a contract concluded with the User (Article 6(1)(b) GDPR);
  • where processing is necessary for the handling of a complaint constituting performance of a contract concluded with the User (Article 6(1)(b) GDPR);
  • where processing arises from a legal obligation incumbent upon the Controller (Article 6(1)(c) GDPR);
  • where processing serves the pursuit of the Controller’s legitimate interests, such as the assertion or defence of legal claims (Article 6(1)(f) GDPR).

Each User independently determines the scope of personal data they disclose, subject to the proviso that the absence of certain data may prevent the provision of particular services or features available within the Service.

Personal data are processed to the extent necessary for the achievement of the given purpose and for no longer than permitted under applicable law.

§ 4. DATA SECURITY

The Controller regularly conducts risk assessments to identify threats associated with the processing of personal data and implements appropriate technical and organisational measures to ensure their security.

The Controller ensures that access to personal data is granted exclusively to persons authorised by the Controller and only to the extent necessary for the performance of their assigned duties. Authorisations are granted on an individual basis and are duly documented.

The Controller maintains a register of persons authorised to process personal data. Such persons are bound to maintain strict confidentiality with respect to both the data itself and the security measures applied — including following the termination of their engagement with the Controller.

Personal data are protected against unauthorised access, modification, loss or destruction by means including:

  • encryption of data transmissions,
  • server-level security controls,
  • role-based access restrictions,
  • access control procedures and audit of data operations.

The Controller’s IT systems are monitored for security breaches and subject to regular updates and testing.

In the event of a personal data breach, the Controller implements procedures enabling rapid assessment of the scale of the incident and — where required — notifies the competent supervisory authority and the data subjects concerned, in accordance with applicable law.

The Controller makes use of trusted third-party providers offering cloud-based solutions. The processing of personal data within the framework of such services takes place exclusively on the basis of agreements ensuring compliance with applicable law, including the GDPR, and with the application of appropriate security mechanisms and access controls.

In order to ensure the continuity of the Service and to protect data against loss, the Controller performs regular backups of personal data. Such backups are stored in secure locations, with technical and organisational measures in place to prevent access by unauthorised persons. The retention period for backups is determined by the nature of the data and the purpose for which they are processed.

§ 5. RECIPIENTS OF DATA

Recipients of Users’ personal data may include entities cooperating with the Controller to whom specific activities requiring data processing have been entrusted, in particular in the areas of electronic mail handling, hosting, ICT and IT services, as well as administrative, legal and advisory support.

Third-party entities with access to personal data process such data solely on the basis of a data processing agreement and exclusively on the Controller’s instructions.

Users’ personal data may also be disclosed to public bodies or authorities entitled to receive them — solely in justified cases and on the basis of generally applicable law.

§ 6. RECEIPT OF COMMERCIAL COMMUNICATIONS

Where the Service provides for such possibility, the User may consent to receiving commercial communications by electronic means. Such consent may be withdrawn at any time, without stating a reason, by submitting a relevant request to the Controller’s electronic mail address.

§ 7. USERS’ RIGHTS

Every data subject is entitled to the following rights:

  • Right of access (Article 15 GDPR) — the Controller provides information regarding the processing of personal data, including the purposes, legal bases, categories of data, recipients and intended erasure date, and makes available the personal data covered by the request;
  • Right to obtain a copy (Article 15(3) GDPR) — the data subject requesting such a copy is entitled to receive a copy of the data being processed, insofar as this does not infringe the rights of third parties and is technically feasible;
  • Right to rectification (Article 16 GDPR) — the data subject may request the correction of inaccurate data and the completion or updating of data that are incomplete or have changed;
  • Right to erasure (“right to be forgotten”) (Article 17 GDPR) — the data subject may request the erasure of data that are no longer necessary for the purposes for which they were collected;
  • Right to restriction of processing (Article 18 GDPR) — the Controller ceases operations on the data, other than storage, where the data subject submits a request for restriction or where such obligation arises from the legal situation (e.g. due to pending administrative proceedings);
  • Right to data portability (Article 20 GDPR) — the data subject is entitled to receive their data in a structured format and to transmit them to another controller;
  • Right to object to processing for purposes other than marketing (Article 21 GDPR) — the data subject may raise an objection to the processing of their data, which is subject to assessment by the Controller;
  • Right to object to processing for marketing purposes (Article 21(2) GDPR) — the data subject may at any time object to the processing of their personal data for marketing purposes, without being required to provide justification;
  • Right to withdraw consent (Article 7(3) GDPR) — where data are processed on the basis of consent, the data subject has the right to withdraw such consent at any time; such withdrawal does not, however, affect the lawfulness of processing carried out prior to its withdrawal;
  • Right to lodge a complaint (Article 77 GDPR) — where the data subject considers that the processing of personal data infringes the GDPR or other data protection provisions, they may lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office (https://uodo.gov.pl/pl/p/kontakt).

Requests concerning the exercise of data subjects’ rights may be submitted:

  • in writing to the Controller’s registered office address;
  • by electronic mail to the Controller’s e-mail address.

A response to any such request shall be provided within one month of its receipt. Should it prove necessary to extend that period, the Controller shall inform the applicant of the reasons for such extension.

Responses shall be sent to the electronic mail address from which the request was submitted, or — in the case of requests submitted by post — by registered letter to the address indicated by the applicant.

§ 8. COOKIES AND SIMILAR TECHNOLOGIES

The Service makes use of cookies and other similar technologies (e.g. local storage, tracking pixels), which enable the proper functioning of the Service, traffic analysis and the tailoring of content to the User’s preferences.

Cookies are data files stored on the User’s end device. They are used in particular for the purposes of:

  • maintaining sessions following log-in,
  • storing settings and preferences,
  • collecting statistical data,
  • conducting analytical and marketing activities — exclusively with the User’s consent.

Web browsers typically permit the storage of cookies on the User’s end device by default. The User may at any time independently manage browser settings, including restricting or entirely blocking cookies. Such restrictions may, however, affect the functionality of the Service.

The Controller cooperates with third-party service providers, the list of whom is subject to change. Such entities may use cookies for the purposes of:

  • monitoring traffic within the Service,
  • compiling aggregate and anonymised statistics,
  • controlling the frequency of content or advertisement display,
  • assessing the effectiveness of newsletter sign-ups,
  • communicating with the User (e.g. via chat),
  • integration with social media platforms.

Detailed information regarding the cookies used and the manner of managing them is available in the browser settings and in the Cookie Policy.

The Controller may use the Google Analytics tool to analyse statistics. In such case, the User’s data may be transferred to Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). The User may block access to their data by installing the following plug-in: https://tools.google.com/dlpage/gaoptout.

The Controller encourages Users to review the details of data processing by Google Analytics, available at: https://policies.google.com/privacy?hl=pl.

§ 9. SERVER LOGS

Use of the Service’s website involves the transmission of queries to the server on which it is hosted. Each such query is automatically recorded in the server logs.

Logs include, inter alia, the User’s IP address, the date and time of the query, and information regarding the web browser and operating system in use. These records are stored exclusively on the server.

The data contained in the logs are not associated with specific individuals and are not used by the Controller for the purpose of identifying Users.

Server logs constitute solely auxiliary material used for the management and maintenance of the Service and the analysis of its security. Access thereto is restricted to persons authorised to administer the server infrastructure.

Data contained in server logs may also be used in the event of suspected activities compromising the security of the Service, including unauthorised access attempts. Such information may be used for the analysis of the incident, determination of its causes and implementation of appropriate remedial measures. Where duly justified, such data may be disclosed to law enforcement authorities or institutions empowered to receive them under applicable law.

§ 10. TRANSFERS OF DATA OUTSIDE THE EEA

As a general rule, the Controller does not transfer personal data outside the European Economic Area (EEA). Where such a transfer does occur, it takes place exclusively to third countries or entities in respect of which the European Commission has issued a decision recognising an adequate level of data protection (Article 45 GDPR).

The current list of third countries recognised by the European Commission as ensuring an adequate level of data protection is available at: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en.

§ 11. AUTOMATED DECISION-MAKING AND PROFILING

Within the Service, the Controller may process the User’s personal data in an automated manner for the purpose of tailoring the content presented — including informational messages and advertisements — to the User’s preferences and interests. Such processing may include profiling, consisting of the automated analysis of the User’s data (e.g. activity on the Controller’s websites) with a view to assessing the User’s interest in the Controller’s services.

The profiling employed by the Controller serves exclusively informational and marketing purposes, consisting in the adaptation of content to the User’s anticipated interests. It does not give rise to decisions made solely by automated means that would produce legal effects concerning the User or similarly significantly affect their personal, professional or financial situation — within the meaning of Article 22 GDPR.

The User has the right at any time to object to the processing of their personal data for profiling purposes, and in particular for marketing purposes — in accordance with Article 21(1) GDPR. Such an objection may be submitted by sending a relevant request to the Controller’s contact address indicated in this Policy.

Where the relevant technical features are made available, the User may also raise an objection by modifying their account settings or by making use of the marketing consent management tools available within the Service.

§ 12. AMENDMENTS TO THE PRIVACY POLICY

The Controller reserves the right to amend this Privacy Policy, in particular in the event of:

  • changes to applicable law governing the protection of personal data,
  • the introduction of new services, features or technologies within the Service,
  • the need to align the document with the guidance of supervisory authorities.

The amended Privacy Policy shall be published on the Service’s website together with the indication of its effective date.

Users shall be informed of material changes to the content of the Policy by means of an appropriate notice published within the Service or transmitted directly — where the Controller holds their contact details and where required by applicable law.

Continued use of the Service following the entry into force of any amendments shall constitute acceptance of the updated Privacy Policy.

§ 13. FINAL PROVISIONS

Matters not regulated by this Privacy Policy shall be governed by generally applicable law, and in particular:

  • Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR),
  • the Act of 10 May 2018 on the Protection of Personal Data,
  • the Act of 18 July 2002 on the Provision of Services by Electronic Means,
  • the Act of 12 July 2024 — Electronic Communications Law.

All questions, comments or requests concerning the processing of personal data should be addressed to the Controller using the contact details indicated in the “Introduction” section or on the Service’s website.

This Privacy Policy is effective as of 1 January 2026.

We respond to all messages.

Contact