Privacy Policy

This Privacy Policy applies to the website https://nivato.pl.

The security of Users’ personal data is important to us. For that reason we continually raise our level of protection and ensure that we act in accordance with the GDPR (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC).

This Privacy Policy contains the most important information about how we process personal data.

In respect of the joint operation of nivato.pl and processes in which both entities jointly determine the purposes and essential means of processing, the joint controllers of Users’ personal data are:

• Marek Kupaj, conducting business as Nivato Marek Kupaj, Stara Kakawa 65, 62-872 Godziesze Małe, Poland, NIP 9681000625, REGON 388436395.

• Nivato spółka z ograniczoną odpowiedzialnością with its registered office in Stara Kakawa, Stara Kakawa 65, 62-872 Godziesze Małe, Poland, KRS 0001138219, NIP 9681014159, REGON 540177631.

Later in this document, “Controller” means, depending on the process, the relevant controller or the Joint Controllers acting together.

How to contact the Joint Controllers?

• postal address: Stara Kakawa 65, 62-872 Godziesze Małe, Poland;

• e-mail: biuro@nivato.pl;

• joint contact point for personal data protection matters: rodo@nivato.pl.

The data subject may exercise their rights vis-à-vis each of the Joint Controllers regardless of the joint contact point.

Essential content of the Joint Controllers’ arrangement:

• Joint controllership covers in particular the joint handling of website forms, enquiries, prospective customers and offers, contacts carried out as part of joint activity, as well as joint informational, marketing and website-security activities — provided that both entities actually jointly determine their purposes and essential means of implementation.

• If a matter concerns a contract concluded with only one of the entities, that entity’s own settlements, tax obligations or another process conducted independently, that entity acts as a separate controller.

• Recruitment may be conducted jointly or separately. The relevant controller or Joint Controllers are indicated in the information clause attached to the specific job advertisement.

• The Joint Controller that collects the data provides access to the relevant processing information, and the Joint Controllers cooperate in fulfilling data-subject rights and handling any personal-data breaches.

The Controller processes Users’ personal data:

• relating to use of the website, including technical data and online identifiers such as IP address, device and browser information, session data and information stored in cookies or local storage, including language settings and preferences regarding cookies and similar technologies;

• provided in connection with contacting the Controller, in particular via the contact form for a quote request, service or fault report or general contact, and via e-mail or telephone, including data of the represented entity and the content of the message;

• provided in connection with using the Controller’s services, preparing an offer, agreeing terms of cooperation, placing and fulfilling orders, payments, delivery, complaints, repairs or service, as well as newsletter subscription or consent to marketing contact;

• data of candidates for employment or cooperation in recruitment processes conducted under the Nivato brand — to the extent described in a separate information clause for candidates.

The scope of personal data processed by the Controller varies and depends on which services and features the User uses and on the consents given. It may include in particular first and last name, residential, registered-office or delivery address, tax identification number (NIP), telephone number, e-mail address, bank account number and information about an order or request.

The User’s personal data will be processed by the Controller for the following purposes:

• performance of a contract to which the data subject is a party, or taking steps at the data subject’s request prior to entering into a contract, in particular enabling use of the website, handling enquiries and offers if the contact is aimed at concluding or performing a contract, accepting and fulfilling an order, payment, delivery, complaint, repair or service (Art. 6(1)(b) GDPR);

• fulfilment of the Controller’s legal obligations, in particular tax, accounting and consumer obligations and obligations related to handling complaints (Art. 6(1)(c) GDPR);

• pursuit of the Controller’s legitimate interests, in particular ensuring the security of the website and IT systems, preventing abuse, keeping technical logs, conducting correspondence and handling enquiries or reports that are not aimed at concluding or performing a contract, preparing and presenting an offer when contacted by representatives or employees of businesses, handling faults and service matters unrelated to a contract, keeping basic technical statistics, direct marketing of own products or services, and establishing, pursuing or defending claims (Art. 6(1)(f) GDPR).

In other cases, in particular for sending a newsletter, commercial information or marketing contact by e-mail or telephone, and for using optional cookies, local storage and similar technologies for analytical, statistical, marketing, advertising, remarketing, profiling or displaying optional third-party content, data are processed on the basis of consent (Art. 6(1)(a) GDPR).

Sending commercial information, including direct marketing using telecommunications terminal equipment, additionally requires prior consent as referred to in Art. 398 of the Act of 12 July 2024 — Electronic Communications Law. Storing information or obtaining access to information stored on the User’s device requires consent under Art. 399 of that Act, except in the cases specified therein. The scope and purpose of the consent given are indicated in its wording.

In recruitment, the detailed purposes and legal bases of processing are indicated in the information clause for candidates, taking into account whether the recruitment is conducted jointly or by one entity for its own needs.

The period of processing the User’s personal data depends on the purpose and legal basis of processing, i.e.:

• the period for which consent was given, and if consent was not given for a predetermined time — until it is withdrawn or the purpose for which it was given ceases;

• the time needed to perform the contract, in particular the period of providing services, fulfilling an order, delivery, payment, complaint, repair or service, and then the period necessary to settle the contract;

• the period specified by law for retaining particular documentation or for fulfilling the Controller’s legal obligations, in particular tax and accounting obligations;

• the period necessary to pursue the Controller’s legitimate interests, including keeping and demonstrating correspondence and establishing, pursuing or defending claims, taking into account limitation periods, or until a successful objection is lodged, if applicable;

and also:

• for cookies, local storage and similar technologies — the period resulting from their function, the website settings or the User’s device, no longer than until consent is withdrawn, the User deletes the data or the identifier expires. Essential technologies may be used for as long as necessary for the website to function properly or to provide a service requested by the User;

• for recruitment data — in accordance with the period indicated in the candidates’ clause; in the case of voluntary consent to future recruitments — no longer than the period indicated when consent is given, currently up to 2 years.

After the period appropriate for a given category of data and purpose of processing, the User’s personal data will be deleted or anonymised by the Controller, subject to data in backups, which are deleted in accordance with the adopted backup creation and overwriting cycle.

We may disclose Users’ personal data to:

• entities providing technical and IT support, including website, system, database and remote-access support;

• providers of hosting, e-mail, cloud services and external storage;

• providers of office, store, communication, analytical, statistical and marketing software, including Google or EmbedSocial tools, if used;

• payment operators, banks and entities enabling instalment payments, if their involvement is necessary to process a payment;

• entities involved in fulfilling an order or service, in particular suppliers, courier, transport and service companies and subcontractors;

• entities providing accounting, legal or advisory services, as well as entities or authorities authorised by law to obtain the User’s data and entities to whom disclosure is necessary to protect the rights of the Controller or third parties, including pursuing or defending claims.

The party to contracts with hosting, e-mail and IT providers for nivato.pl is Nivato Marek Kupaj; if a provider processes data for a process covered by joint controllership, the relevant arrangements cover processing on behalf of both Joint Controllers.

In connection with the use of global cloud, communication, analytical, marketing, advertising or payment services, the User’s data may be transferred outside the European Economic Area. The Controller verifies the transfer basis in each case and applies the mechanisms required by Chapter V GDPR, in particular an adequacy decision, including the EU-US Data Privacy Framework for certified recipients, or the European Commission’s standard contractual clauses together with additional safeguards if needed. Detailed information about the safeguards applied, including how to obtain a copy of them, can be obtained by contacting the Controller.

Providing personal data by the User is voluntary. However, providing data necessary to conclude or perform a contract, handle an enquiry, prepare an offer, fulfil an order, payment, delivery, complaint, repair, service or run a recruitment process is required to achieve the given purpose. Refusal may result in inability to use the website or some of its features, receive an offer, conclude or perform a contract, or take part in recruitment.

Lack of consent to optional cookies, local storage, the newsletter or marketing contact does not affect the ability to use the website’s basic functions. Marketing consent or consent to optional cookies is not a condition for sending a form, receiving a reply or an offer; however, lack of consent may prevent use of features that objectively require a particular third-party technology.

The User may withdraw consent to the processing of personal data at any time. Withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. After withdrawal, the Controller will not continue to process the data for purposes requiring consent, unless another legal basis applies.

Consent may be withdrawn by e-mail or written contact with the Controller, by using the opt-out mechanism in a marketing message, or by changing settings in the consent panel — depending on the type of consent given.

In connection with the processing of the User’s data, the User has, to the extent and on the terms set out in the GDPR, the rights listed below. They may be exercised using the contact channels indicated in this document. These are:

• the right of access to one’s data and to obtain a copy (Art. 15 GDPR);

• the right to rectification or completion of personal data (Art. 16 GDPR);

• the right to erasure of personal data if the conditions set out in the GDPR are met (Art. 17 GDPR);

• the right to restriction of processing (Art. 18 GDPR);

• the right to data portability to another controller — in the cases set out in Art. 20 GDPR;

• the right to object to processing:

- on grounds relating to the User’s particular situation — against processing based on Art. 6(1)(f) GDPR, including profiling based on that ground (Art. 21(1) GDPR);

- at any time — if personal data are processed for direct marketing, including profiling, to the extent that processing is related to such marketing (Art. 21(2) GDPR).

To exercise the above rights, contact the Controller. In matters covered by joint controllership, rights may be exercised vis-à-vis each of the Joint Controllers; to make contact easier, the address rodo@nivato.pl has been established.

If the User considers that their data are processed contrary to the law, they may lodge a complaint with the President of the Personal Data Protection Office (UODO).

The website uses cookies and similar technologies, including local storage.

The following may be used on the Website:

• essential cookies — ensuring the correct and secure operation of the Website and maintaining the session;

• functional cookies — used to remember User settings and to provide additional features and third-party content;

• analytical and statistical cookies — used to analyse how the Website is used and its effectiveness;

• marketing cookies — used to analyse the User’s interests, measure campaign effectiveness and tailor advertising.

The website uses the “lang” cookie to remember the selected language version and the “cookie-consent” cookie and local storage entry to store the User’s preferences regarding cookies and similar technologies.

The “lang” cookie is essential and may be set without consent. The “cookie-consent” cookie and local storage entry are used to store the User’s choice and are saved after the User makes a choice.

Essential cookies and similar technologies may be used without the User’s consent. Other cookies and similar technologies, including functional, analytical and marketing technologies, are used after consent given via the cookie settings panel, unless a given technology is necessary to provide a service expressly requested by the User.

The User may accept or reject optional technologies and at any time change settings or withdraw consent via the cookie settings panel. Withdrawal of consent does not affect the lawfulness of actions taken before withdrawal. Refusal of consent does not block the Website’s basic functions, except for functions that objectively require a particular third-party technology.

The website uses tools provided by third parties, in particular Google Analytics to analyse traffic, entry sources, page views and how the Website is used (analytical technology — after analytics consent), Google Tag and Google Ads to handle tags, measure conversions, optimise campaigns and carry out remarketing (marketing technologies — after marketing consent), EmbedSocial to display Google reviews and related third-party content (marketing technology — after marketing consent), Google reCAPTCHA to protect forms against spam and automated filling (functional technology — after functional consent, unless in a given configuration it meets the criteria of a technology strictly necessary for a service expressly requested by the User), and Google Maps to display a map and the company’s location (functional technology — after functional consent). Optional technologies are launched after the User’s consent appropriate to the given purpose.

The “lang” cookie is stored for 1 year, and the “cookie-consent” cookie and local storage entry — for 365 days. Cookies used by Google Analytics may last up to 2 years, and cookies related to Google reCAPTCHA — up to about 6 months. The duration of other technologies depends on their configuration and their providers’ settings.

Cookies may be session or persistent. The User may also manage them via browser settings. Restricting essential cookies may affect the correct operation of the Website.

If information obtained via cookies or similar technologies constitutes personal data, it is processed in accordance with this Privacy Policy.

The Controller may profile Users in connection with the use of analytical or marketing cookies and similar technologies, in particular to analyse how the Website is used, measure campaign effectiveness and tailor advertising messages.

Profiling is based on the User’s consent and does not lead to decisions producing legal effects concerning the User or similarly significantly affecting them.

The User may withdraw consent at any time via the cookie settings panel.

The policy may be updated if the way the website operates, the scope of joint controllership, the technologies used or the law changes. The current version is published on nivato.pl. Changing the language version of the website does not affect the identity of the controller or the Joint Controllers.