Privacy policy of MURENETI Sp. z o.o.

MURENETI Sp. z o.o., with its registered office in Warsaw (04-767), ul. Patriotów 303 (hereinafter: the "Controller"), respects your right to privacy and processes your personal data in accordance with national and European law.

The Controller ensures the security of personal data, i.e. its confidentiality, availability and integrity, as well as the accountability of the activities it carries out.

To make our processing operations transparent to you, in this privacy policy we set out the key information on the processing of personal data by the Controller under Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter: the "GDPR").

The Controller, i.e. the entity that determines the purposes and means of the processing of personal data, is MURENETI Sp. z o.o., with its registered office in Warsaw 04-767, ul. Patriotów 303.

Depending on your relationship with us, in carrying out our business functions we process personal data for different purposes, with the scope of processing depending on the circumstances:

1. Users of the mureneti.pl website.

   Purpose of processing and legal basis	Data retention period	Source and categories of personal data not collected directly from you
   Users are not required to provide their personal data in order to use the mureneti.pl Website. However, if you wish to use its functionalities, we then process the data necessary to prepare an IT support subscription offer for you and, if the offer is accepted, the data necessary to conclude and perform the contract. The legal basis for the processing is then Article 6(1)(b) GDPR, i.e. processing necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract. With regard to persons acting on behalf of or for the Client, however, the legal basis for the processing is Article 6(1)(f) GDPR, i.e. the legitimate interest of the Controller, namely the conclusion of the contract. The data will also be processed for the purpose of fulfilling obligations under the Polish Telecommunications Law (Prawo telekomunikacyjne) and the Polish Act on the Provision of Electronic Services (ustawa o świadczeniu usług drogą elektroniczną) (Article 6(1)(c) GDPR). Where applicable, the data will also be processed for the purposes of settlements, accounting and financial reporting (Article 6(1)(c) and (f) GDPR). Your data may also be processed in connection with the pursuit of other legitimate interests of the Controller (Article 6(1)(f) GDPR): - to establish, exercise and defend against claims, - for statistical purposes related to improving work efficiency and the quality of the services provided and tailoring them to their recipients.	If a contract is concluded as a result of the offer we have presented, your personal data will be stored for the term of the contract and, after its termination, for the period required by law or until the limitation periods for claims related to it have expired. If no contract is concluded following the offer presented to you, your data will be stored for a period of 1 month from the date on which the offer was presented to you and, if you have consented to the processing of your data for the purpose of sending you offers of our services, until you withdraw your consent or object, i.e. indicate to us in any way that you no longer wish to remain in contact with us or receive information about our activities.	If we have not obtained the personal data directly from you, their source is your Employer/Business Partner, who provided us with your data for the purpose of concluding or performing a contract. In this case, the personal data obtained comprise the data necessary to conclude and perform the contract (typically first name, surname, email address, telephone number and/or postal address, workplace and job title).

2. Newsletter subscribers and recipients of marketing communications

   Purpose of processing and legal basis	Data retention period	Source and categories of personal data not collected directly from you
   Pursuit of the legitimate interest of the Controller (Article 6(1)(f) GDPR), consisting in the marketing of its own products and services and, where explicit consent has been given, also of the products and services of companies working with the Controller (Article 6(1)(a) GDPR), using the following forms of communication: - newsletter (sending of an information bulletin), - voice calls (telemarketing), - sending of commercial information (email messages), - sending of commercial information (text messages/SMS), - sending of promotional materials by post. The purposes specified in the wording of consents to the processing of personal data – where such consents have been given (Article 6(1)(a) GDPR), The purpose of fulfilling obligations under the law, in particular the Telecommunications Law and the Act on the Provision of Electronic Services (Article 6(1)(c) GDPR). The data are also processed in connection with the pursuit of other legitimate interests of the Controller (Article 6(1)(f) GDPR): - to establish, exercise and defend claims, - for statistical purposes related to improving work efficiency and the quality of the services provided and tailoring them to their recipients.	Your personal data will be stored until you withdraw your consent or object, i.e. indicate to us in any way that you no longer wish to remain in contact with us or receive information about our activities. After consent has been withdrawn or an objection has been raised, the personal data may be stored for the purpose of demonstrating the proper fulfilment of the legal obligations incumbent on the Controller and of claims related to them.	If we have not obtained the personal data directly from you, their source is an entity that held your consent to their disclosure to the Controller, or another valid legal basis. In this case, the personal data obtained comprise the data necessary to carry out the given type of marketing activity (typically first name, surname, email address, telephone number and/or postal address).

3. Clients and persons designated to perform the contract

   Purpose of processing and legal basis	Data retention period	Source and categories of personal data not collected directly from you
   To perform the contract with the Client or to take steps prior to entering into a contract at the Client's request, expressed in any manner, e.g. by completing the contact form on the website (Article 6(1)(b) GDPR – if you are the Client; Article 6(1)(f) GDPR – if you are a person acting on behalf of or for the Client), for the purposes of settlements, accounting and financial reporting (Article 6(1)(c) and (f) GDPR), to fulfil obligations under the law (Article 6(1)(c) GDPR), for the purposes specified in the wording of consents to the processing of personal data – where such consents have been given (Article 6(1)(a) GDPR). Note: providing data other than those requested by the Controller, or data marked as optional, is a clear affirmative action equivalent to consenting to the processing of personal data for the purposes for which they were provided. The data may also be processed in connection with the pursuit of the legitimate interests of the Controller (Article 6(1)(f) GDPR): - to establish, exercise and defend against claims, - for statistical purposes related to improving work efficiency and the quality of the services provided and tailoring them to their recipients.	Your personal data will be stored until the limitation periods for claims arising from the contract with the Client have expired.	The personal data have been obtained from you, from the Client or from a person cooperating with us on behalf of the Client. We obtain personal data to the extent necessary to conclude and perform the contract, most commonly: first name, surname, postal address, email address, telephone number, order details and invoicing details. Where the contract is concluded in writing, we also process the PESEL number (Polish national identification number) or identity card number. Where transactions are handled electronically – also the login, password and purchase and activity history.

NOTE: There are also situations in which our organisation acts as a processor, and the controller of the data is the entity on whose behalf we process them. Where such a situation arises, you will receive information about the processing from that entity.

Detailed information on the processing of personal data on the website:

Cookies - Information on the cookies used is provided in a separate document – the Cookie Policy (link).

RECIPIENTS OF DATA

In connection with our business activities, your personal data may be disclosed to the following entities:

1. state authorities or other entities authorised by law – where this is necessary to fulfil legal obligations,
2. entities supporting us in our business activities on our behalf, in particular: providers of external ICT systems supporting our business, subcontractors, entities auditing our business or expert appraisers, whereby such entities will process the data on the basis of a contract with the Controller and solely in accordance with its instructions,
3. entities providing accounting, HR or legal services – to the extent necessary to ensure the fulfilment of legal obligations or to establish, exercise and defend claims,
4. companies disposing of or archiving documents and other storage media – to the extent that the data are stored in paper form or on such media,
5. companies providing courier and postal services – where correspondence is sent,

YOUR DATA PROTECTION RIGHTS

Every person whose data are processed by the Controller has the right to:

1. access their personal data,
2. rectification of their personal data,
3. erasure of their personal data,
4. restriction of the processing of their personal data,
5. object to the processing of their personal data (in accordance with Article 21(1) GDPR, when lodging an objection you should state the grounds relating to your particular situation),
6. portability of their personal data.

More information on the rights of data subjects is available in Articles 12–23 of the GDPR, the text of which can be found at: https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679

In addition, you have the right to lodge a complaint with the supervisory authority, i.e. the President of the Personal Data Protection Office (Prezes UODO), ul. Stawki 2, 00-193 Warszawa; more information is available at: https://uodo.gov.pl/pl/p/skargi

WHETHER YOU NEED TO PROVIDE PERSONAL DATA

Providing data is necessary to conclude contracts, to settle accounts relating to our business activities and for the Controller to comply with legal requirements. In all other respects (in particular for the processing of data by the Controller for marketing purposes), providing data is voluntary.

TRANSFERS OF DATA TO THIRD COUNTRIES OR INTERNATIONAL ORGANISATIONS

As a rule, personal data will not be transferred outside the European Economic Area (hereinafter: the "EEA"). However, in view of the services provided by our subcontractors in supporting ICT services and IT infrastructure, the Controller may commission certain IT operations or tasks to reputable subcontractors operating outside the EEA, which may result in your data being transferred outside the EEA. In accordance with a decision of the European Commission, the recipients' countries outside the EEA ensure an adequate level of protection of personal data consistent with EEA standards.

In the case of recipients in countries not covered by a European Commission decision, in order to ensure an adequate level of such protection the data exporter (the Controller or a processor acting on behalf of the Controller) enters into agreements with the recipients of the personal data that are based on the standard contractual clauses adopted by the European Commission in accordance with Article 46(2)(c) GDPR.

A copy of the standard contractual clauses may be obtained from the Controller – its contact details are given above. The method used by the Controller to safeguard your data complies with the principles laid down in Chapter V of the GDPR. You may request further information on the safeguards applied in this respect, obtain a copy of those safeguards and find out where they are made available.

AUTOMATED PROCESSING OF PERSONAL DATA

Your data will not be subject to automated decision-making, including profiling.