PRIVACY POLICY

Arkadiusz Gluziński Krakowtogether.Com with its registered office in Kraków

1. DEFINITIONS

1.1. Administrator – Arkadiusz Gluziński Krakowtogether.Com with its registered office in Kraków, ul. Józefa Dietla 75, 31-050 Kraków, NIP (Tax Identification Number): 6793218434; REGON (Statistical Number): 389178676.

1.2. Personal Data – information about an identified or identifiable natural person through one or several specific factors determining physical, physiological, genetic, mental, economic, cultural, or social identity, including device IP, location data, online identifier, and information collected via cookies and other similar technologies.

1.3. Policy – this Privacy Policy.

1.4. GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.

1.5. Website – the website operated by the Administrator at https://www.krakowtogether.com 

1.6. User – any natural person visiting the Website or using one or several services or functionalities described in the Policy (including acting on their own behalf or on behalf of a legal entity).

1.7. Account – a unique profile created for the User to gain access to selected services or functionalities of the Website.

2. DATA PROCESSING IN CONNECTION WITH THE USE OF THE WEBSITE

2.1. In connection with the User's use of the Website, the Administrator collects data to the extent necessary to provide specific services offered, as well as information about the Users' activity on the Website. Detailed rules and purposes of processing Personal Data collected during the use of the Website by the User are described below.

3. PURPOSES AND LEGAL BASES FOR DATA PROCESSING ON THE WEBSITE

USE OF THE WEBSITE

3.1. Personal Data of all persons using the Website (including IP address, mobile device identifiers, browser data, operating system, time of visit, and other diagnostic information collected via tools used by the Administrator) are processed by the Administrator:

3.1.1. for the purpose of providing electronic services in terms of making content collected on the Website available to Users – the legal basis for processing is the necessity of processing for the performance of a contract (Art. 6(1)(b) of the GDPR);

3.1.2. for analytical and statistical purposes – the legal basis for processing is the Administrator's legitimate interest (Art. 6(1)(f) of the GDPR), consisting of analyzing Users' activity and their preferences to improve applied functionalities and provided services;

3.1.3. for the purpose of potential establishment, exercise, or defense of claims – the legal basis for processing is the Administrator's legitimate interest (Art. 6(1)(f) of the GDPR), consisting of protecting its rights.

USER ACCOUNT AND CONTRACT PERFORMANCE

3.2. In the case of registering an Account or placing orders for products/services through the Website, the Administrator processes Personal Data (such as: name and surname, email address, phone number):

3.2.1. for the purpose of providing services related to the maintenance and operation of the Account and the execution of sales/service contracts – the legal basis for processing is the necessity for the performance of a contract (Art. 6(1)(b) of the GDPR);

3.2.2. for the purpose of sending informational communications and security updates related to the ordered services – the legal basis is the necessity for the performance of a contract or the Administrator's legitimate interest (Art. 6(1)(b) and (f) of the GDPR).

CONTACT

3.3. The Administrator provides the possibility of contacting them using the contact details available on the Website (phone number; email address: support@krakowtogether.com ; postal address). Using the option to contact requires providing Personal Data necessary to establish contact with the User and answer the inquiry.

3.4. Personal Data obtained in connection with the User establishing contact is processed by the Administrator:

3.4.1. for the purpose of identifying the sender and handling their inquiry, as well as answering the inquiry – the legal basis for processing mandatory data is the Administrator's legitimate interest (Art. 6(1)(f) of the GDPR), consisting of responding to inquiries directed to it regarding its business activities; regarding data provided optionally, the legal basis is consent (Art. 6(1)(a) of the GDPR);

3.4.2. for analytical and statistical purposes – the legal basis for processing is the Administrator's legitimate interest (Art. 6(1)(f) of the GDPR), consisting of keeping statistics of inquiries submitted by Users via the Website to improve its functionality;

3.4.3. for the purpose of establishing, exercising, or defending against claims – the legal basis for processing is the Administrator's legitimate interest (Art. 6(1)(f) of the GDPR), consisting of protecting its rights.

RESTRUCTURING / CORPORATE TRANSFORMATIONS

3.5. In the event of a merger, acquisition, reorganization, sale of the Administrator's assets, or bankruptcy proceedings, Users' Personal Data may be acquired by a third party as part of the transferred assets – the legal basis for processing in this scope is the Administrator's legitimate interest (Art. 6(1)(f) of the GDPR).

4. SOCIAL MEDIA AND EXTERNAL SERVICES

4.1. The Administrator processes Personal Data of Users visiting profiles operated by the Administrator on social media portals (e.g., LinkedIn, Facebook, Instagram) or using the login/registration option through External Social Media Services.

4.2. This data is processed:

4.2.1. for the purpose of administering and running the profile on a given social media platform, including informing Users about the Administrator's activities and promoting various events and services;

4.2.2. for the purpose of conducting correspondence with Users and enabling social interactions;

– the legal basis for processing Personal Data by the Administrator for this purpose is its legitimate interest (Art. 6(1)(f) of the GDPR), consisting of promoting its own brand and building relationships with Users.

4.3. In this case, processed data includes: username and possibly other data if made available by Users.

5. COOKIES AND SIMILAR TECHNOLOGY

5.1. The Administrator uses cookies (session and persistent) and similar tracking technologies (e.g., Flash Cookies, Web Beacons, tags, scripts) to provide the User with services supplied electronically, improve the quality of these services, and analyze traffic on the Website.

5.2. Cookies are small text files installed on the device of a User browsing the Website. Cookies collect information that facilitates the use of the website – e.g., by remembering the User's visits to the Website and actions taken by them.

STRICTLY NECESSARY COOKIES

5.3. The Administrator uses necessary cookies primarily to provide Users with services and functionalities of the Website that the User wishes to use (including maintaining sessions, authentication, fraud prevention). Necessary cookies may be installed by the Administrator through the Website.

5.4. The legal basis for data processing in connection with the use of necessary cookies is the necessity of processing for the performance of a contract (Art. 6(1)(b) of the GDPR).

FUNCTIONAL AND ACCEPTANCE COOKIES

5.5. The Administrator may use persistent cookies to remember User preferences (e.g., language selection, login details) and to verify the acceptance of the cookies notification. The legal basis for their use is the Administrator's legitimate interest (Art. 6(1)(f) of the GDPR) or the User's consent (Art. 6(1)(a) of the GDPR).

6. MANAGING COOKIE SETTINGS

6.1. The use of strictly necessary cookies is required for the proper provision of the telecommunications service (data transmission to display content) – the User cannot opt out of these cookies if they wish to use the Website.

6.2. Regarding other cookies or Flash objects / Web Beacons, the User can manage their preferences via their web browser settings or by using external tools (e.g., dedicated pages for managing Flash objects on Adobe's help pages).

6.3. The User can verify the status of their current privacy settings for the browser being used at any time using the tools available at the following links:

6.3.1. http://www.youronlinechoices.com/

6.3.2. http://optout.aboutads.info/?c=2&lang=EN

6.4. Disabling or limiting cookie support may affect the availability of certain functionalities of the Website.

6.5. To exercise the rights to access, rectify, erase, restrict, transfer, object to the processing of personal data, file a complaint, or ask another question regarding cookies, an inquiry should be sent to the Administrator's contact details provided in the Privacy Policy.

7. PERIOD OF PERSONAL DATA PROCESSING

7.1. The period of data processing by the Administrator depends on the type of service provided and the purpose of processing. As a rule, data is processed for the duration of the service provision (or Account maintenance), until the consent granted is withdrawn, or until an effective objection to data processing is raised in cases where the legal basis for processing is the Administrator's legitimate interest.

7.2. The data processing period may be extended if processing is necessary to establish, exercise, or defend against potential claims, and after that time only if and to the extent required by law. After the expiration of the processing period, the data is irreversibly erased or anonymized.

8. DATA SUBJECT RIGHTS

8.1. Data subjects have the following rights:

8.1.1. Right to information on personal data processing – on this basis, the Administrator provides the natural person making the request with information regarding data processing, including primarily the purposes and legal bases for processing, the scope of data held, entities to which it is disclosed, and the planned date of data erasure;

8.1.2. Right to obtain a copy of data – on this basis, the Administrator provides a copy of the processed data concerning the natural person making the request;

8.1.3. Right to rectification – the Administrator is obliged to remove potential inconsistencies or errors in the processed Personal Data and supplement them if they are incomplete;

8.1.4. Right to erasure (Right to be forgotten) – on this basis, one can demand the erasure of data whose processing is no longer necessary to achieve any of the purposes for which it was collected;

8.1.5. Right to restriction of processing – upon making such a request, the Administrator ceases performing operations on Personal Data – with the exception of operations consented to by the data subject – and storing them, in accordance with adopted retention rules or until the reasons for restricting data processing cease to exist;

8.1.6. Right to data portability – on this basis – to the extent that data is processed in an automated manner in connection with an executed contract or consent – the Administrator issues the data provided by the person concerned in a machine-readable format;

8.1.7. Right to object to processing for marketing purposes – the data subject may object at any time to the processing of Personal Data for marketing purposes, without the need to justify such an objection;

8.1.8. Right to object to other processing purposes – the data subject may object at any time – on grounds relating to their particular situation – to the processing of Personal Data based on the Administrator's legitimate interest;

8.1.9. Right to withdraw consent – if data is processed based on granted consent, the Data Subject has the right to withdraw it at any time, which, however, does not affect the lawfulness of the processing carried out prior to its withdrawal;

8.1.10. Right to lodge a complaint – if it is considered that the processing of Personal Data violates the provisions of the GDPR or other regulations regarding personal data protection, the Data Subject may lodge a complaint with a supervisory authority. In Poland, the supervisory authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych).

9. SUBMITTING REQUESTS RELATED TO EXERCISING RIGHTS

9.1. A request regarding the exercise of Data Subject rights can be submitted:

9.1.1. in writing to the Administrator's registered office address;

9.1.2. electronically via email address: support@krakowtogether.com 

9.2. The application should, as far as possible, precisely indicate what the request concerns (the scope of the right, the processing operation, the purpose).

9.3. If the Administrator is unable to identify the natural person based on the submitted request, it will request additional information from the applicant.

9.4. A response to the application should be provided without undue delay, no later than within one month of its receipt (or within 14 days if derived from the Administrator's internal operational procedures).

9.5. The Administrator provides the response in the same form in which the request was received, unless the applicant requested a response in another form.

10. RECIPIENTS OF DATA

10.1. In connection with the provision of services, Personal Data may be disclosed to external entities (Service Providers), in particular: entities providing IT, hosting, and traffic analysis services to the Administrator, providers of marketing tools, as well as entities providing legal, accounting, and advisory services.

10.2. Subject to User consent or public interactions (e.g., on social media portals), data may be visible to other network Users.

10.3. The Administrator reserves the right to disclose selected information regarding the User to competent authorities or third parties (including law enforcement agencies) who submit a request for such information based on appropriate legal grounds and in accordance with applicable laws.

11. TRANSFER OF DATA OUTSIDE THE EEA

11.1. The level of Personal Data protection outside the European Economic Area (EEA) differs from that provided by European law. For this reason, the Administrator transfers Personal Data outside the EEA only when necessary and with an adequate level of protection, primarily through:

11.1.1. cooperation with entities processing Personal Data in countries for which an appropriate European Commission adequacy decision has been issued;

11.1.2. application of Standard Contractual Clauses issued by the European Commission;

11.1.3. application of Binding Corporate Rules approved by the competent supervisory authority.

11.2. The Administrator always informs about the intention to transfer Personal Data outside the EEA at the stage of its collection.

12. PERSONAL DATA SECURITY

12.1. The Administrator conducts risk analyses on an ongoing basis to ensure that Personal Data is processed securely – ensuring above all that only authorized persons have access to the data and only to the extent necessary for their tasks.

12.2. The Administrator takes all necessary measures (technical and organizational) to ensure that its subcontractors and other cooperating entities also guarantee appropriate security measures whenever they process Personal Data on behalf of the Administrator. Nevertheless, the Administrator notes that no method of data transmission over the Internet or electronic storage method guarantees 100% absolute security.

13. LINKS TO EXTERNAL WEBSITES

13.1. The Website may contain links to other websites not operated by the Administrator. The Administrator is not responsible for the content, practices, or privacy policies used by these third parties and encourages Users to read the privacy documentation of every visited website.

14. CONTACT DETAILS

14.1. Contact with the Administrator is possible via email address: support@krakowtogether.com or in writing to the Company's registered address: Arkadiusz Gluziński Krakowtogether.Com, ul. Józefa Dietla 75, 31-050 Kraków.

15. CHANGES TO THE PRIVACY POLICY

15.1. The Policy is reviewed on an ongoing basis and updated as necessary.

15.2. Users will be informed about changes to the Privacy Policy through the publication of a new version of the document on the Website (and – where appropriate – via email or through a notice on the Website in advance).

15.3. The current version of the Policy was adopted and is effective as of 23.07.2026