RODO

Table of contents
1.General provisions
2.Basis for the processing of data
3.Purpose, basis and period of processing data on the website
4.Data recipients on the website
5.Profiling the website
6.The rights of the data subject
7.Cookies on the website and analytics
8.Final provisions

1) General provisions

1. This Privacy Policy of the Website is of informative nature, which means that it is not a source of obligations for Service Recipients of the Website. The Privacy Policy contains, above all, the principles concerning the processing of data by the Controller on the Website, including the basis, purpose and period of personal data processing and the rights of data subjects as well as information regarding the use of cookies and analytical tools on the Website.
   2. The Controller of the personal data collected via the Website shall be the company Diamondherd Sp. z o.o. with its registered office in Szosa Chełmińska 265 87-100 ToruńCommercial Division of the National Court Register; share capital in the amount of: PLN 5000.00; NIP: 9562382371, REGON: 52466029700000, e-mail address: [email protected], telephone number: +48 605063888 – here in after referred to as “Controller” and being simultaneously the Service Provider of the Website.
   3. Personal data on the Website shall be processed by the Controller in accordance with the binding legal regulations, in particular the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) ­ hereinafter referred to as “GDPR” or “GDPR Regulation”. The official text of the GDPR Regulation: http://eur-lex.europa.eu/legal-content/PL/TXT/?uri=CELEX%3A32016R0679.
   4. Using the Website is voluntary. Similarly, providing personal data by the Service Recipient using the Website is voluntary, subject to two exceptions: (1) entering into contracts with the Controller – failure to provide the personal data necessary for the conclusion and performance of the contract for the provision of an Electronic Service with the Controller in the cases and within the scope indicated on the Website and the Terms and Conditions of the Website shall result in no possibility to enter into the contract. Providing personal data is a contractual requirement in such a case and if the data subject is willing to use the Electronic Services performed by the Controller, they shall be obligated to provide the required data. The scope of the data required to enter into the contract and use the Electronic Services is each time specified in advance on the Website and in the Terms and Conditions; (2) statutory obligations of the Controller – in the case of Service Recipient who purchased a paid Electronic Service (e.g. Premium Account subscription), specifying the personal data is a statutory requirement resulting from the commonly binding legal regulations obligating the Controller to process the personal data (e.g. processing data to keep ledgers) and failure to specify the data will render it impossible for the Controller to perform the obligations.
   5. The Controller assures due diligence to protect the interest of persons being data subjects, in particular being responsible and liable for and assuring that the data collected are: (1) processed in accordance with the Act; (2) collected for specific, legal purposes and not subject to further processing inconsistent with the purposes; (3) correct as regards the subject matter and adequate as regards the purpose of the processing; (4) stored in a form making it possible to identify the people they apply to, no longer than it proves necessary to attain the purpose of processing and (5) processed in a manner ensuring security of the personal data, including the protection against illicit or illegal processing or accidental loss, damage or destruction, with the use of appropriate technical and organisational measures.
   6. Taking into account the nature, scope, context and purpose of processing as well as the risk of breaching the rights or freedoms of natural persons with varied likelihood and degree of threat, the Controller is implementing appropriate technical and organisational measures so that the processing takes place pursuant to the GDPR Regulation and it is possible to show it. The measures are reviewed and updated, as necessary. The Controller applies technical measures preventing the acquisition and modification of personal data sent electronically by unauthorised persons.
   7. Any words, phrases and acronyms used in this privacy policy starting with a capital letter (e.g. Service Provider, Website, Electronic Service) shall be understood in accordance with the definition contained in the Terms and Conditions of the Website.
   

2) Basis for the processing of data

1. The Controller is authorised to process the personal data in cases, and to the extent, when at least one of the following conditions is met: (1) the data subject consented to the processing of their data to one or more specified ends; (2) processing is necessary for contract performance the data subject is a party to, or to take actions to the request of the data subject, prior to contract conclusion; (3) processing is necessary to meet the legal obligation of the Controller; or (4) processing is necessary for the needs resulting from the legally justified interests of the Controller or third party, except for situations when the interests or basic rights and freedoms of the data subject override such interests and they require personal data protection, especially when the data subject is a child.
   2. The processing of personal data by the Controller each time requires having at least one basis indicated in item 2.1 of the privacy policy. Specific bases for processing personal data of the Service Recipients of the Website by the Controller are specified in the following point of the privacy policy – as regards the specific goal of processing personal data by the Controller.
   
   

3) Purpose, basis and period of processing data on the website

1. Each time, the purpose, basis and period as well as the recipients of personal data being processed by the Controller result from actions undertaken by a given Service Recipient on the Website.
   2. The Controller may process the personal data on the Website for the purposes, on the bases and within the periods as follows:
   
   

4) Data recipients on the website

1. For the needs of proper functioning of the Website, inclusive of the performance of the Electronic Services, it shall be necessary for the Controller to make use of external companies’ services (e.g. software provider, or payment system provider). The Controller uses solely the services of such processing entities which ensure sufficient guarantee to implement appropriate technical and organisational measures so that the processing meets the requirements set out in the GDPR Regulation and protects the rights of data subjects.
   2. The Controller may provide personal data to a third country, while the Controller ensures that it shall only be a third country which is considered to provide adequate level of protection – in accordance with the GDPR Regulation, and in the case of other countries, the data transfer will occur on the basis of the standard contractual clauses. The Controller ensures that the data subject has a right to get a copy of their data. The Controller provides personal data to a third country only in case and scope necessary to execute a certain purpose of data processing consistent with this privacy policy.
   3. Providing data by the Controller does not take place in every case and not to all the recipients or categories of recipients defined in the privacy policy – the Controller provides the data only in the case it proves necessary to attain a given purpose of personal data processing and solely within the necessary scope.
   4. Personal data of the Website Service Recipients may be provided to the following recipients or categories of recipients:
   a. e-payments or payment card service providers – in the case of a Service Recipient who uses on the Website the option of e-payment or payment card (e.g. to pay for Premium Account subscription), the Controller makes the collected personal data available to the selected payment service provider on the Website for the Controller to the extent necessary to perform the payment of the Service Recipient.
   b. service providers rendering for the Controller technical, IT or organisational solutions, making it possible for the Controller to conduct a business, inclusive of the Website and Electronic Services provided via it (in particular computer software providers, e-mail companies and hosting providers as well as software providers for company management and technical aid for the Controller) – the Controller makes the collected personal data of the Service Recipient available to the selected provider operating to their order only in the case and to the extent necessary for attaining a given purpose of data processing in accordance herewith.
   c. accounting, legal and counselling services providers rendering for the Controller accounting, legal or counselling services (in particular an accounting agency, law firm or debt collection company) – the Controller makes the collected personal data of the Service Recipient available to the selected provider operating to their order only in the case and to the extent necessary for attaining a given purpose of data processing in accordance herewith.

5) Profiling on the website

1. The GDPR Regulation obligates the Controller to inform about the automated decision-making process, including profiling referred to in Article 22, par. 1 and 4 of the GDPR Regulation, and – at least in those cases – the vital information concerning the decision-making process as well as the meaning and foreseeable consequences of processing for the person being the data subject. Bearing in mind the above, the Controller specifies in this point of the privacy policy the information concerning the possible profiling.
   2 . The Controller may use profiling in the Website for direct marketing purposes, yet the decisions made on its basis by the Controller do not concern the conclusion or rejection to conclude any contract, or the possibility to make use of Electronic Services on the Website. The result of profiling on the Website may be e.g. reminding about unfinished process on the Website, sending Advertisement which may be related to the interests or preferences of the person, or offering better conditions as compared with the standard offer of the Website. Regardless of profiling, the person makes decisions freely, whether they want to use e.g. better conditions of the Website use offered by the Controller.
   3. Profiling on the Website consists in automatic analysis or forecast of the conduct of a given person on the website of the Website, e.g. by the analysis of the history of purchased services, browsed pages or other activities on the Website. The condition for such profiling is for the Controller to have the personal data of the person, so that they can later send them e.g. an offer.
   4. The data subject shall have the right not to depend on the decision which is only based on automated processing, including profiling, and has some legal effects on the person or similarly affects them.
   

6) The rights of the data subject

1. The right to access, rectify, restrict, erase or transmit – the data subject shall have the right to demand the Controller to have access to their personal data, rectify, erase (“the right to be forgotten”) or restrict the processing and shall have the right to object to the processing and transmit their data. Detailed conditions of the above rights shall be indicated in Articles 15­22 of the GDPR Regulation.
   2. The right to withdraw the consent at any time – the person whose data are being processed by the Controller on the basis of the consent given (pursuant to Article 6, par. 1, point a) or Article 9, par. 2, point a) of the GDPR Regulation), they shall have the right to withdraw their consent at any time without any impact on the compatibility with the right to process made based on the consent prior to the withdrawal.
   3. The right to lodge a complaint with a supervisory body – the person whose data are being processed by the Controller shall have the right to lodge a complaint with a supervisory body in a manner and mode specified in the provisions of the GDPR Regulation and the Polish law, in particular the Polish Personal Data Protection Act. The supervisory body in Poland shall be the President of the Office for Personal Data Protection.
   4. he right to object – the data subject shall have the right, at any time, to lodge a complaint – for reasons related to their particular situation – as regards the processing of their personal data based on Article 6, par. 1, point e) (public interest or official authority) or f) (legitimate interest of the controller) in the case of profiling based on the provisions. The Controller in such a case must stop processing the personal data, unless they show the existence of legally significant and justified bases for the processing, overriding the interests, rights and freedoms of the data subject, or the bases for determining, pursuing or defending the claims.
   5. The right to object as regards direct marketing – in the case the personal data are being processed for the needs of direct marketing, the data subject shall have the right, at any time, to lodge a complaint as regards the processing of their personal data for the needs of such marketing, including profiling, to the extent to which the processing is related to direct marketing.
   6. To perform the rights mentioned in this point of the privacy policy, one may contact the Controller by sending them an appropriate message in writing, via e-mail to the address of the Controller indicated at the beginning of the privacy policy.
   

7) Cookies on the website and analytics

1. Cookies are small pieces of text files sent by the server and saved at the visitor’s of the Website (e.g. on the hard disk of a computer, laptop, or smartphone’s memory card – depending on the type of device used by the Website’s visitor). Detailed information on Cookies as well as the history of their origin can be found e.g. at: https://en.wikipedia.org/wiki/HTTP_cookie.
   2. Cookies, which can be sent via the Website, can be divided into various types, according to the following criteria:
   
   

3.The Controller may process information contained in Cookies during visiting of the Website for the following particular reasons:
-Identification of the Service Recipients as logged in to the Website and showing them that they are actually logged in (strictly necessary Cookies)
-Saving data from the filled-in forms, questionnaires or login data for the Website (strictly necessary Cookies and/or functional/preferential Cookies)
-Adjustment of the Website contents to individual preferences of the Service Recipient (e.g. colours, font size, layout) and optimisation of the use of the website (functional/preferential Cookies)
-Keeping anonymous statistics presenting the visitor’s behaviours on the Website (analytical and performance Cookies)
-Displaying and rendering the advertisements, limiting the number of ads display, ignoring ads which the Service Recipient wish not to see, measuring ads effectiveness and ads personalization, namely evaluating the conduct of visitors of the Website through anonymous analysis of their activities (e.g. repeated visits on particular pages, key words etc.) to create their profile and provide them with adverts matching their interests, also when they visit other websites in the advertising network of Google Ireland Ltd. (marketing, advertising and social Cookies)
4.Checking in the most popular internet browsers, which Cookie files (including the expiry period of Cookies and their provider) are being sent in a given moment by the Website can be done, as follows:

5.As a standard, most internet browsers on the market accept saving Cookies by default. Every person has the possibility to specify the conditions of using Cookies in the browser settings. It means that one may, e.g. partially restrict (e.g. temporarily) or fully disable saving Cookies – in the latter case it may have an impact on some functionalities of the Website.
6.The browser settings concerning Cookies are essential as regards the consent to use Cookies by our Website – in accordance with the law, such consent may also be expressed in the browser settings. In view of lack of such consent, change the browser setting accordingly as regards Cookies. Detailed information concerning the change in Cookies settings and their individual removal in the most common browsers is available in the help section of the browser and the following websites (click the link):
-Chrome
-Firefox
-Internet Explorer
-Opera
-Safari
-Microsoft Edge
7.The Controller may use Google Analytics and Universal Analytics services on the Website, which are provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). The services help the Controller to analyse the frequency of visits on the Website. The data collected are processed under the above services to generate statistics helpful while administering the Website and analysing the frequency of visits on the Website. The data are of collective nature. Using the above services on the Website, the Controller collects such data as the sources and medium of acquiring visitors of the Website and the manner of their conduct on the website of the Website, information concerning their devices and browsers used to visit the website, IP and domain, geographical data and demographic data (age, sex) and interests.
8.It is possible to easily block sharing information with Google Analytics as regards the activity on the website of the Website – install to that end an opt-out add-on made available by Google Ireland Ltd. available at: https://tools.google.com/dlpage/gaoptout?hl=pl.
9.Due to the use of advertising and analytical services on the Website provided by Google Ireland Ltd., the Controller indicates that detailed information on the rules of processing the data of visitors to the Website (including information stored in Cookie files) by Google Ireland Ltd. is made available in the privacy policy of Google services available at: https://policies.google.com/technologies/partner-sites.

8) Final provisions

This Website may contain links to other websites. The Controller encourages that at the time of being transferred to other websites, become familiar with the privacy policy. This privacy policy shall apply only to the Website of the Controller.