PRIVACY & COOKIES POLICY

1. Who is the controller of your personal data

The controller of personal data processed in connection with the use of the website is CODESPHERIC spółka z ograniczoną odpowiedzialnością (a Polish limited liability company), with its registered office at ul. Twarda 18, 00-105 Warsaw, Poland, entered in the Register of Entrepreneurs of the National Court Register under KRS number 0000971711, hereinafter “Codespheric”, “we” or the “Controller”.

For matters concerning personal data, contact us at [email protected] or at the correspondence address indicated above.

2. Scope of this Policy

This Policy applies to the processing of data relating to visitors to codespheric.com, people using the contact form and newsletter subscribers. The rules governing the processing of data relating to candidates for employment or other forms of cooperation are set out in a separate document, “Candidate Privacy Notice”, provided during the recruitment process.

The website may contain links to external websites, including Codespheric’s social media profiles. We are not responsible for the privacy practices of third-party websites; we encourage you to review their policies directly.

3. Purposes, legal bases and retention periods

3.1. Website operation, security and stability

The server hosting the website automatically records information in logs, such as your IP address, the date and time of the request, browser and operating-system type, referring address and volume of data transferred. We process this information to ensure that the website functions properly, maintain its security and detect misuse and incidents.

Legal basis: Article 6(1)(f) GDPR — our legitimate interest in ensuring the security and proper operation of the website.

Retention period: 12 months from the date the event is recorded in the logs.

3.2. Responding to enquiries submitted via the contact form or email

We process the information provided in the form or message (at least your name, email address and the content of your enquiry) to respond and correspond with you.

Legal basis: Article 6(1)(b) GDPR where the enquiry concerns entering into or performing a contract; Article 6(1)(f) GDPR in other cases, based on our legitimate interest in communicating with people interested in our services.

Retention period: for the duration of the correspondence and for a further 3 months, unless the correspondence leads to cooperation or is necessary to establish, exercise or defend legal claims.

3.3. Newsletter and marketing communications

If you subscribe to our newsletter or complete a marketing form, we process your email address and information about your interactions with our messages (such as opens and clicks) to send you information about our services, publications and events.

Legal basis: Article 6(1)(a) GDPR — your consent to receive commercial information by electronic means (see Article 398 of the Polish Electronic Communications Law); for measuring the effectiveness of communications, Article 6(1)(f) GDPR. You may withdraw your consent at any time using the link in the footer of each message or by contacting us.

Retention period: until you withdraw consent or object; following withdrawal, for the period necessary to demonstrate that consent was given and withdrawn.

3.4. Website analytics and usage statistics

We do not currently use an analytics tool to collect website usage statistics. If we introduce analytics in future, we will first provide consent controls and update this Policy. No analytics data is currently collected for this purpose.

3.5. Establishing, exercising or defending legal claims

Where necessary, we may process data to establish, exercise or defend legal claims.

Legal basis: Article 6(1)(f) GDPR — our legitimate interest in protecting the Controller’s rights.

Retention period: until the applicable statutory limitation periods for claims expire.

3.6. Compliance with legal obligations

Where the law requires us to process data (for example, for accounting and tax purposes or to respond to a public authority), we process it under Article 6(1)(c) GDPR for the period required by the relevant legislation.

4. Cookies and similar technologies

Cookies are small text files stored on your device. The website currently uses the payload-token cookie to authenticate CMS operators and support authenticated site previews; it expires after 2 hours. The website also stores your theme choice (light or dark) in your browser’s local storage under codespheric-theme. This setting is stored in your browser, not in a cookie. No analytics or marketing cookies are currently used.

You can delete cookies and local storage using your browser’s site-data controls. Deleting the payload-token cookie ends your authenticated CMS session; deleting codespheric-theme clears your saved theme choice.

5. Google Analytics

Google Analytics 4 is not currently implemented or active on this website, and we do not currently collect website usage data through Google Analytics. If we activate Google Analytics in future, we will first provide consent controls and update this Policy to explain its data collection and related processing. It will be enabled only after consent through those controls. If consent is withdrawn, Google Analytics will continue in restricted mode under Google Consent Mode, without storing identifiers on your device.

6. List of cookies

7. Recipients of personal data

Only authorised Codespheric employees and contractors have access to data, to the extent necessary to perform their duties. Data recipients may also include:

• providers of hosting services and website maintenance and development;
• providers of email and communication tools;
• providers of newsletter distribution and marketing automation tools;
• providers of legal, accounting or advisory services to us;
• entities authorised to obtain data under applicable law.

Entities processing data on our behalf do so under data processing agreements and solely in accordance with our instructions.

8. Transfers of data outside the European Economic Area

Some of the tools we use may involve transferring data outside the EEA, particularly to the United States. In such cases, we ensure that mechanisms provided for in Chapter V GDPR are applied: European Commission adequacy decisions (including the EU–U.S. Data Privacy Framework) or Standard Contractual Clauses approved by the European Commission, together with supplementary safeguards.

You may obtain a copy of the safeguards used and information about the countries to which data is transferred by contacting us at the address provided in Section 1.

9. Your rights

To the extent provided for by the GDPR and depending on the legal basis for processing, you have the right to:

• access your data and obtain a copy of it;
• rectify inaccurate data or complete incomplete data;
• have your data erased;
• restrict processing;
• data portability, where processing is based on consent or a contract and is carried out by automated means;
• object to processing based on our legitimate interests on grounds relating to your particular situation, and object to direct marketing at any time without giving reasons;
• withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

To exercise your rights, contact us at [email protected]. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, Poland) if you believe that we process your data unlawfully.

10. Voluntary provision of data

Providing data through the website is voluntary. Providing information marked as mandatory in a form is necessary for us to respond to your enquiry, and providing your email address is necessary to receive the newsletter. Without this information, we will be unable to handle your enquiry or send you the newsletter, respectively.

11. Automated decision-making and profiling

We do not make decisions about website visitors based solely on automated processing that would produce legal effects concerning them or similarly significantly affect them.

12. Data security

We apply technical and organisational measures appropriate to the risk to the rights and freedoms of individuals, including encryption of data in transit (HTTPS), access controls and regular reviews of the safeguards in place.

13. Changes to this Policy

This Policy may be updated from time to time, particularly if the website, the tools we use or applicable legislation changes. The current version is always available on the website.