PRIVACY POLICY

www.refereewise.com

I. DEFINITIONS

1. Data Controller of the web application at: www.refereewise.com hereinafter referred to as the Application, is REFEREEWISE SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ with its registered office in Wrocław at: Jana Czochralskiego 9/7, 50-231 Wrocław entered in the Register of Entrepreneurs of the National Court Register kept by the District Court for Wrocław-Fabryczna in Wrocław, VI Economic Department of the National Court Register, under KRS number: 0001041139, NIP: 8952258141, REGON: 52554040200000, hereinafter referred to as the Data Controller.
2. Any enquiries, requests, complaints regarding the processing of personal data by the Personal Data Controller, hereinafter referred to as Submissions, should be addressed to the following e-mail address: contact@refereewise.com or in writing to Jana Czochralskiego 9/7, 50-231 Wrocław. The content of the Notification must clearly indicate:
   1. the details of the person or persons to whom the Report relates,
   2. the event that gave rise to the complaint,
   3. present your demands and the legal basis for these demands,
   4. indicate the expected manner of settling the case.
3. We collect the following personal data on our Application:
   1. name - may be processed when you, as a user of our Application, provide it to us by email, when contacting us by telephone, via the contact form available on our Application or by traditional means,
   2. telephone number - this may be processed when you contact us by telephone, or when you provide it to us via e-mail, via the contact form available on our Application, or by post,
   3. e-mail address - may be processed when you, as a user of the Application, provide it to us via e-mail, the contact form available on our Application, by post as well as when contacted by telephone,
   4. IP address of the device and potential personal data contained in cookies - information resulting from the general principles of Internet connections, such as IP address (and other information contained in system logs), is used for technical and statistical purposes, including in particular the collection of general demographic information (e.g. about the region from which the connection is made). This type of data is also used for marketing and analytical purposes if consent is given under Article 173(1) of the Telecommunications Act,
   5. tax idetification numberand company name - data necessary for the issuing of any invoices and other documents relating to our use of the Application,
   6. possibly other data may be collected as part of the handling of specific cases or may be given to users of our Application via email, post or telephone contact.
4. Each person using our Application shall be able to choose whether and to what extent they wish to use our services and share information and data about themselves, to the extent set out in the contents of this Privacy Policy.
5. We process personal data in order to:
   1. to make purchases on our Application by means of the order form provided on the Application website (Art. 6(1)(b) GDPR) - in this regard, the personal data provided will cease to be processed when the specific transaction is finalised;
   2. concluding and performing contracts in connection with the services we offer (Art. 6(1)(b) GDPR) - in this respect, data will cease to be processed when the contract in question is fulfilled,
   3. to maintain an individual user account (Article 6(1)(b) GDPR) - in this respect, personal data will cease to be processed when the user deletes the account,
   4. to comply with legal obligations incumbent on the Data Controller, in particular record keeping, issuing invoices, etc. (Art. 6(1)(c) GDPR) - in this respect, personal data will be deleted once certain legal obligations have been fulfilled,
   5. to provide the service (subscription) to the newsletter (Article 6(1)(a) GDPR) - in this regard, the personal data provided will be deleted when consent is withdrawn and the list of newsletter subscribers is deleted,
   6. targeting marketing content concerning the Data Controller and conducting website analytics in connection with the use of cookies (Article 6(1)(a) GDPR) - in this regard, personal data is processed until the end of the session or the deletion of cookies by the user, the withdrawal of consent or until an effective objection is made to processing for this purpose,
   7. the operation of the website (Article 6(1)(f) GDPR in conjunction with Article 173(1) of the Telecommunications Law) - in this regard, personal data will cease to be processed when the cookie file expires, when the user deletes cookies or when the session in question ends, respectively,
   8. ongoing communication related to the operation of the Application (Article 6(1)(f) GDPR, i.e. legitimate interest of Data Controller) - in this regard, your personal data will cease to be processed at the moment of answering a given question or inquiry,
   9. to establish, assert or defend against claims (Article 6(1)(f) GDPR, i.e. the legitimate interest of the Personal Data Controller) - in this regard, your personal data will be deleted when the claims in question expire, but as a general rule after the expiry of the 3-year limitation period for claims.
6. The source of the Personal Data processed by the Controller is the data subjects.
7. Where there is a button or function that is a link to an external service, application or social media, there is a co-administration relationship between the Data Controller of this Application and the Controller of the external site. The co-administration is limited only to data to the extent necessary for operations related to the operation of the button or function in question. The Data Controller is not responsible for the policies regarding the further processing of personal data of other entities and organisations or social network providers. Our Joint Administrators within our Application are:
   1. Google Ireland Ltd. (SSO Google) with its registered office at: Google Building Gordon House, 4 Barrow St, Grand Canal Dock, Dublin 4, D04 V4X7, Ireland.
   2. Meta Platforms Ireland Limited (Meta adverts) with its registered office at: Merrion Road, Dublin 4 D04 X2K5, Ireland.
8. Data Controller uses the tools of Google Ireland Ltd (Google Analitics) Microsoft Ireland Operations Ltd. (Microsoft 365), Twilio Inc. (SendGrid), Functional Software, Inc. (Sentry), Meta Platforms, Inc. (Meta adverts). As a general rule, the data processed through the use of these tools, is processed on servers located within the EEA. However, the providers of these tools may be obliged to transfer the data to third parties if such an obligation is imposed on them by law or is necessary due to the characteristics of the services provided (SaaS, hosting, etc.), including Meta, for conducting advertising and remarketing activities. The scope of personal data transferred in this regard refers exclusively to potential personal data contained in cookies. The legal bases for the processing of the personal data indicated in the preceding sentence are indicated in points 5(d) and 5(e) of this Policy. The transfer of personal data to the United States takes place on the basis of the European Commission's Decision of 10.07.2023 to ensure an adequate level of protection by the EU-US Data Protection Framework (Article 45(1) GDPR). Our data importers of personal data, i.e. Google Ireland Ltd, Microsoft Ireland Operations Ltd., Twilio Inc. , Functional Software, Inc., Meta Platforms, Inc., meeting the criteria of the decision and participating in the Data Protection Framework programme, are listed at: https://www.dataprivacyframework.gov/s/participant-search. Entities may transfer data to third countries - based on the Standard Contractual Clauses adopted by these entities.
9. We do not share any personal data with third parties without the express consent of the data subject. Personal data without the consent of the data subject may only be disclosed to entities under public law, i.e. authorities and administrations (e.g. tax authorities, law enforcement agencies and other entities empowered by generally applicable laws).
10. Personal data may be entrusted for processing to entities processing such data on our behalf as Personal Data Controller. In such a situation, we as the Personal Data Controller shall enter into an entrustment agreement with the processor for the processing of personal data. The processor shall process the entrusted personal data only for the purposes, to the extent and for the purposes indicated in the entrustment agreement referred to in the preceding sentence. Without the entrustment of personal data for processing, we would not be able to carry out our activities on the Application. As Data Controller, we entrust personal data for processing to the following entities in particular:
    1. providing hosting services for the website on which our Application operates,
    2. providing accounting services,
    3. providing other services to us that are necessary for the day-to-day operation of the Application.
11. Personal data is not subject to profiling by us as a Personal Data Controller within the meaning of the provisions of the DPA.
12. In accordance with the provisions of the GDPR, any person whose personal data we process as a Personal Data Controller has the right to:
    1. access to his/her personal data, as referred to in Article 15 of the GDPR,
    2. to be informed of the processing of their personal data as referred to in Article 12 of the GDPR,
    3. to correct, complete, update, rectify personal data as referred to in Article 16 of the GDPR,
    4. to withdraw consent at any time, as referred to in Article 7(3) GDPR,
    5. erasure of data (right to be forgotten) as referred to in Article 17 GDPR,
    6. the restriction of processing referred to in Article 18 GDPR,
    7. data portability as referred to in Article 20 GDPR,
    8. to object to the processing of personal data as referred to in Article 21 GDPR,
    9. where the legal basis is consent, the right to withdraw consent at any time without affecting the lawfulness of the processing carried out on the basis of consent before its withdrawal,
    10. not to be subject to the profiling referred to in Article 22 in conjunction with Article 4(4) of the GDPR,
    11. to lodge a complaint with the supervisory authority (i.e. the President of the Office for the Protection of Personal Data) referred to in Article 77 of the GDPR.
13. If you wish to exercise your rights referred to in the preceding paragraph, please send a message by e-mail to the e-mail address or in writing to the postal address referred to in paragraph 2 above.
14. Each identified security breach shall be documented and, in the event of the occurrence of one of the situations set out in the provisions of the GDPR or the Act, the data subjects and, if applicable, the PUODO shall be informed of such security breach.
15. The Cookies Policy is a separate document located at: https://refereewise.com/en-gb/cookies-policy/.
16. In matters not regulated by this Privacy Policy, the relevant provisions of generally applicable law shall apply accordingly. In the event of any inconsistency between the provisions of this Privacy Policy and the aforementioned provisions, these provisions shall prevail.