This document sets out the rules for collecting and using information about Users of the website owned by EX7 Sp. z o.o.
1. Data controller
The owner of the website and the controller of personal data is EX7 Sp. z o.o., Al. 29 Listopada 20, 31-401 Kraków, Poland, entered in the Register of Entrepreneurs of the National Court Register under KRS number 0000509140, REGON: 123114412, NIP (VAT ID): 6793100543, hereinafter “EX7”. The purpose of this privacy and cookie policy is to draw Users’ attention to the importance of protecting the privacy of people using ex7.pl (the “website”), while meeting the requirements of the Polish Telecommunications Law of 16 July 2004, the Polish Act on Providing Services by Electronic Means of 18 July 2002, Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR), and the Polish Personal Data Protection Act of 10 May 2018.
2. What personal data we collect
EX7 collects and uses personal data and other information necessary for the proper use of the website or the provision of services. Each time Users provide their personal data to EX7, they consent to EX7 receiving and processing it by confirming that they have read this document.
By completing and submitting the website’s contact form, Users provide their personal data — e-mail address and/or phone number. Personal data may also be provided in other ways, depending on the User’s needs — for example in an e-mail sent to EX7 to request information.
EX7 always asks only for the data necessary to provide a service or complete a task. Providing personal data is voluntary, and Users have the right to access and correct their personal data at any time.
3. Purposes and legal basis of processing
EX7 processes personal data for the following purposes:
- the controller’s legitimate interest under Art. 6(1)(f) GDPR, consisting in keeping anonymous visitor statistics for the website (see section 9). The statistics do not use cookies and do not allow Users to be identified.
- the controller’s legitimate interest under Art. 6(1)(f) GDPR, consisting in responding to enquiries submitted through the contact form. The data processed are the e-mail address and/or phone number and the IP address of the computer from which the enquiry was sent. Once the enquiry has been answered, the data is deleted within 30 days.
4. Data retention
EX7 follows the principles of data avoidance and data minimisation. Users’ personal data is therefore stored only for as long as necessary to achieve the purposes of processing, or for as long as required by law. Once the purpose ceases or the statutory retention period expires, the data is routinely blocked or deleted in accordance with the law.
5. Users’ rights
Every User may request:
- access to their personal data,
- rectification of their personal data,
- restriction of processing,
- erasure of their personal data,
- data portability.
Users may also object to the processing of their personal data.
To exercise these rights, Users should contact the controller by e-mail at rodo@ex7.pl or by post at the controller’s office address.
EX7 fulfils Users’ requests without undue delay to the extent provided for by law. Erasure, restriction, portability or objection to processing will affect the services provided and may prevent them from being performed properly.
6. Data security
To minimise the risks associated with unauthorised access to personal data, EX7 strives to ensure an appropriate level of privacy and security. The tools used by EX7 have been selected to ensure proper protection of personal data processing in accordance with legal requirements.
7. Third parties
Under the GDPR and Polish data protection law, EX7 may entrust the processing of collected data to other entities; this does not include commercial use of the information by third parties, only data administration activities. In certain cases specified by law, EX7 is obliged to disclose personal data and other information to public authorities in connection with their duties. The website may also contain links to other websites. The privacy and cookie policies of those websites may differ from this document, and EX7 is not responsible for their operation.
8. Other information collected when using the website
Each time the website is accessed, the hosting provider’s servers (Cloudflare) automatically record technical data such as the IP address, the date and time of the request and the browser type. This data is used solely to keep the website running and secure (e.g. to protect it against attacks) and is not combined with personal data provided by Users in other ways. Aggregated visit statistics are described in section 9. As with personal data, EX7 may be required to disclose this information under applicable law.
9. Anonymous statistics
To understand which content is read most and to improve the website, EX7 uses Cloudflare Web Analytics, provided by Cloudflare, Inc. The service collects only aggregated, anonymous visit data, such as pages viewed, the referring website, approximate country, browser and device type, and page load time.
Cloudflare Web Analytics:
- does not store cookies or similar identifiers on the User’s device,
- does not create User profiles or track Users across websites,
- does not store full IP addresses and does not allow any individual to be identified,
- is not used for advertising.
EX7 sees this data only as aggregated reports. More information on how Cloudflare processes data: cloudflare.com/privacypolicy.
10. Cookies and browser storage
Cookies are small text files stored on the User’s device (computer, laptop, smartphone).
ex7.pl does not use analytics or advertising cookies and does not track Users. Visit statistics are collected without cookies (section 9).
The only information stored on the User’s device is what is needed for a feature the User actively uses:
- the selected website language — when the User chooses a language version or closes the suggestion to switch languages, this choice is saved in the browser’s storage (localStorage) so the suggestion is not shown again. It contains no personal data and is not sent to EX7.
YouTube videos. Videos embedded on the website do not load automatically — until the play button is clicked, only a thumbnail is shown. After clicking, the player is loaded from YouTube (Google Ireland Ltd.) in privacy-enhanced mode (youtube-nocookie.com), and YouTube may store its own cookies on the User’s device in accordance with its privacy policy: policies.google.com/privacy.
Users can delete stored information or block it at any time in their browser settings.
11. Minors
EX7 does not collect personal data from minors. If a person under 18 nevertheless provides such data, EX7 will try to contact their parents or legal guardians, and if parents or legal guardians find that a minor in their care has provided personal data, EX7 encourages them to get in touch so that the data can be deleted.
12. Security and changes
EX7 makes every effort to protect the website and the data collected against loss, unlawful use, unauthorised access or modification. EX7 protects all User data with at least the same care as its own confidential information. To protect personal data and other information described in this document, EX7 uses access passwords, limits the number of people with access rights and keeps the servers storing data in dedicated premises or entrusts them to specialised providers, in accordance with applicable law.
Users can cancel any services they have ordered and, at any stage of data collection and processing, may contact EX7 to request the deletion of data concerning them. EX7 reserves the right to amend this privacy policy and the way data is collected or managed as the website develops, the law changes or other circumstances arise. In such cases, Users will be informed of the changes without delay in a way that allows them to read the new version.
13. Profiling
The controller will not make automated decisions about you based on your data, including decisions resulting from profiling.