Privacy Policy and Cookie Policy

Privacy Policy

§1. Introduction and key details

This Privacy Policy (the “Policy”) explains how Prometeia Capital sp. z o.o., with its registered office in Wrocław (“PROMETEIA”), uses (processes) the personal data of people who visit or use the services provided by PROMETEIA through its website (domain: prometeia.pl), of which PROMETEIA is the controller, as well as the personal data of people whom PROMETEIA contacts or who contact PROMETEIA by email or through the contact form on that website (together, “Users”).

We respect the privacy of our Users. We publish this Policy so that every User knows the extent to which their personal data is processed and can decide independently, knowingly and freely whether to use our website, our contact form and email correspondence.

This Policy sets out in general terms how, on what basis and to what extent we collect Users’ personal data, the purposes for which we use it, who we share it with and how we protect it. It also explains the rights available to Users under applicable data protection law.

The Policy is general in nature and presents the most important aspects of personal data processing. It is supplemented by individual terms of service or privacy notices, which Users receive at the point their data is collected in connection with specific services, for example: newsletter subscriptions, contact forms (contact requests, requests for proposal), competitions, promotional campaigns and events.

Additional or supplementary information on the processing of personal data by PROMETEIA can also be found in contractual documentation and in the privacy notices provided to our clients.

Where we use cookies or other data-collecting technologies on our website, further information is set out in the Cookie Policy.

§2. Applicable data protection law

The PROMETEIA Privacy Policy is based on the following legislation:

1. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (“GDPR”),
2. the Polish Personal Data Protection Act of 10 May 2018,
3. the Polish Telecommunications Act of 16 July 2004,
4. the Polish Act of 18 July 2002 on the provision of services by electronic means.

§3. Principles governing the processing of your personal data

We value the trust our Users place in us. In processing their personal data we take care that it is handled securely, fairly, lawfully and transparently. The principles we follow are set out below:

1. We collect personal data only to the minimum extent necessary for the purposes for which it is collected;
2. The purposes for collecting Users’ personal data are clearly defined and grounded in law – we do not process data in ways incompatible with those purposes;
3. We keep Users’ personal data accurate and up to date and respond promptly to any request for rectification or updating;
4. We give effect to Users’ right to access and correct their personal data;
5. We give effect to Users’ rights to erasure, withdrawal of consent, restriction of processing, data portability, objection to processing, and not to be subject to a decision based solely on automated processing, including profiling;
6. We limit data retention in accordance with the law, to the period necessary for the purposes for which the data was collected, unless circumstances arise that extend that period;
7. We protect Users’ personal data against loss, unauthorised access, accidental loss or alteration, and other unlawful forms of processing;
8. Where personal data is shared with other entities, this is done securely, under contractual safeguards and in compliance with applicable law.

§4. Users’ rights in relation to the processing of personal data

PROMETEIA gives effect to Users’ rights in relation to the processing of their personal data. These rights arise under applicable data protection law, in particular Articles 16–21 GDPR. Users have the right to:

1. Withdraw consent to the processing of personal data at any time, where consent is the legal basis for processing;
2. Be informed how PROMETEIA processes their personal data;
3. Access their data: to obtain confirmation from PROMETEIA whether and how their personal data is processed by PROMETEIA, and access to it, to the extent provided in Article 15 GDPR;
4. Rectify out-of-date or inaccurate personal data, and have incomplete data completed;
5. Object to the processing of personal data on grounds relating to their particular situation where we process personal data on the basis of our legitimate interest (e.g. analytical, statistical, evidential or archiving purposes); following your objection we will have to cease processing your data, unless we demonstrate compelling legitimate grounds for the processing which objectively override your interests, or which are necessary for the establishment, exercise or defence of legal claims. The right to object also applies where processing is for direct marketing purposes, including profiling;
6. Not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning the User or similarly significantly affects them;
7. Have their personal data erased by PROMETEIA (the “right to be forgotten”) – in principle, to request that PROMETEIA erase their personal data without undue delay; exceptions to this right apply under Article 17 GDPR;
8. Restrict the processing of personal data, which in practice may mean temporarily blocking access to your data or moving it to another system;
9. Data portability: you have the right to receive a copy of the personal data you have provided to us, where processing is based on your consent or on a contract and is carried out by automated means;
10. Lodge a complaint with the supervisory authority – the President of the Personal Data Protection Office (UODO) in Poland.

Any request concerning the processing of your personal data, including the exercise of your rights, may be sent by email to biuro@prometeia.pl or in writing to: Prometeia Capital sp. z o.o., ul. Strzegomska 138, 54-429 Wrocław, Poland.

We will act on your request without undue delay and no later than one month after receiving it. That period may be extended by a further two months where the request is complex or where we receive a number of requests; we will inform you if that happens. Until the request is processed, you may still receive communications you have opted out of by withdrawing consent or objecting.

When submitting a request to PROMETEIA, please provide your name and contact details (telephone number or email address; for written requests, also a correspondence address). If the request concerns the use of our websites, please provide the website address or details of the service provided through our website, together with any further explanation of the request. For certain requests we may need to verify the User’s identity.

§5. Security of personal data

PROMETEIA applies technical and organisational measures to protect Users’ personal data against unlawful or unauthorised access or use, and against accidental destruction, loss or loss of integrity. Security has guided the design of our IT infrastructure, our standards and our business practice. Our security procedures include in particular: access controls, backup systems, monitoring, review and maintenance, security incident management and risk analysis.

In securing the personal data we process, we undertake to uphold:

• confidentiality – we will protect data against accidental disclosure to third parties,
• integrity – we will protect data against unauthorised modification,
• availability – we will ensure authorised persons can access your data where needed.

Your personal data may be processed by third parties only where they undertake to apply appropriate technical and organisational measures securing the processing of personal data and to maintain the confidentiality of that data. Every PROMETEIA employee or partner with access to personal data holds the relevant authorisation and is bound by confidentiality.

§6. Processing of personal data

PROMETEIA processes your personal data only for specified, explicit and lawful purposes. We will not process your data in ways incompatible with those purposes. PROMETEIA informs Users of the purpose and legal basis of processing in each case, either in a separate notice or by reference to this Policy.

Consent as a legal basis (Article 6(1)(a) GDPR)

Consent may be given at the User’s own initiative (for example, by entering data and submitting a form). In every case the User may withdraw consent in the manner set out in the information on the processing of personal data and in §7. Consent is the legal basis where a User, among others:

1. voluntarily leaves their details and sends us a request for proposal or a contact request,
2. subscribes to the newsletter,
3. gives additional consents for future marketing, comprising: the sending of service offers or commercial information, including profiling for those marketing purposes, and the conduct and analysis of client satisfaction and service interest surveys,
4. takes part in a service satisfaction survey,
5. takes part in competitions.

Performance of a contract or steps prior to entering into a contract (Article 6(1)(b) GDPR)

The legal basis of a contract, or of steps taken prior to entering into one, applies among others where we provide access to our sites and to services delivered electronically or through them (for example, contact forms), or where we conduct email correspondence. Note also that when a specific service offer, offer information or service information is prepared and sent, the legal basis for processing personal data changes to steps prior to entering into a contract, or to the contract itself (Article 6(1)(b) GDPR).

Legitimate interests (Article 6(1)(f) GDPR)

We may process personal data on the basis of our legitimate interests, which include among others:

1. handling enquiries other than marketing communications;
2. assessing service quality;
3. evidential and archiving purposes, and securing information in case of a legal need to demonstrate facts or to establish, exercise or defend legal claims;
4. analytical and statistical purposes: maintaining service quality, better matching services to client needs, general optimisation of our services and service processes, building knowledge about our clients, carrying out sales and market analysis, and developing marketing or business strategy. The output of such processing is aggregate data;
5. providing services by electronic means and ensuring their security, and handling complaints;
6. giving effect to Users’ rights, in particular the right to accurate data and the right to withdraw consent, and retaining Users’ requests and records of how they were handled;
7. managing service delivery and client service, setting service standards, maintaining service quality, and keeping a client database, including prospective clients.

Where a User contacts PROMETEIA as an employee of a client on day-to-day matters, including the use of PROMETEIA services or interest in our offering for clients, their personal data is processed on the basis of our legitimate interest in maintaining day-to-day contact within that business relationship.

Protection of vital interests (Article 6(1)(d) GDPR) or legal obligation (Article 6(1)(c) GDPR)

In some cases the basis for processing personal data may be the protection of a person’s vital interests or compliance with a legal obligation to which the controller is subject. This applies in particular to obligations imposed on PROMETEIA by law, notably under tax and accounting legislation.

PROMETEIA collects Users’ personal data when they complete forms on our websites, contact us by telephone or email, or send questions or messages through our social media profiles. We may then retain the information Users voluntarily provided, together with data automatically captured in system logs and cookies (see the Cookie Policy).

The scope of personal data varies depending on the category of data subject, whether you are already our Client or a person potentially interested in our services, and the purpose for which the data is collected. In every case we will process only the data that is necessary.

We may process personal data such as: identification data (e.g. first name, surname), contact data (e.g. telephone number, email address, home address), location data (only with your consent), data relating to your enquiries, orders, instructions and complaints, data on the services you are interested in, information shared during conversations or contained in correspondence to or from PROMETEIA and, for business entities, the company name and VAT ID (NIP), together with contact person details (job title).

Providing personal data through the PROMETEIA website is voluntary, but often necessary for us to handle a User’s enquiry (such fields are marked with an asterisk *). If a User prefers not to leave personal data through the website, they may contact us by telephone, by email or in person at our office.

For business entities, data may come from publicly available registers (including the Polish business registers CEIDG and KRS), and the personal data of contact persons at corporate clients may also come from websites.

The forms collecting personal data on our website are intended for adults. PROMETEIA does not knowingly process the personal data of anyone under 16. If we learn that a person under 16 has provided us with personal data without verifiable parental consent, we will not process that data.

§7. Consent and its withdrawal

In our dealings with Users, including services offered through the website that involve providing commercial and marketing information, Users may be asked to consent to the processing of their personal data for marketing purposes relating to PROMETEIA services, including electronic marketing. Consent may also be given by a “clear affirmative action” – for example, by voluntarily leaving your details and asking us to get in touch.

Where Users’ data is processed in connection with data provided in a request for proposal, Users may withdraw consent in that respect by telling us they do not wish to be contacted further.

Consents for future marketing may be withdrawn at any time by contacting PROMETEIA by telephone, email or in person. For newsletter subscriptions, consent may be withdrawn by sending notice of withdrawal to the email address given in the correspondence.

Withdrawing consent carries no negative consequences, though you should be aware that it may mean you can no longer use certain services, such as receiving the newsletter, receiving a reply, receiving offers or advertising, or invitations to events.

Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal. Where we hold User data for other purposes (such as performing a contract or service, evidential purposes or pursuing claims), we may continue to process it for those purposes on a different legal basis.

§8. Data retention

Data is retained for as long as necessary to achieve the purposes for which it was collected. Where processing is based on consent, data is retained for the period the consent remains valid, and no longer than 5 years from the date it was given, or until it is withdrawn.

The standard retention periods we apply to these processes are set out below:

1. request for proposal – for as long as needed to handle the enquiry, and no longer than 6 months, or earlier if you withdraw consent. If the service proceeds, retention is extended for the duration of the business relationship and the limitation period for claims;
2. contact request – for as long as needed to handle it (no longer than 6 months), or earlier if you withdraw consent;
3. newsletter sign-up – until you unsubscribe;
4. future marketing (additional consents) – no longer than 5 years from the last contact or, if you withdraw consent, until it is withdrawn;
5. provision of services by electronic means – for the duration of the contract;
6. other purposes based on legitimate interest – for as long as those purposes remain valid or until an objection is raised, and no longer than 5 years, unless longer retention is required by law or necessary to establish, defend or pursue claims.

§9. Joint controllership and data recipients

Users’ personal data may be transferred to entities that process it on behalf of PROMETEIA (processors), under data processing agreements and only to the extent necessary to provide their services, including:

• providers of hosting and server infrastructure on which the website runs and contact form messages are stored – [hosting provider, details to be completed];
• Microsoft Ireland Operations Ltd. – email services and the Microsoft 365 suite, through which we handle correspondence and contact form submissions; website behaviour analytics (Microsoft Clarity);
• Google Ireland Limited – visit statistics (Google Analytics 4), tag management (Google Tag Manager) and advertising performance measurement (Google Ads);
• entities providing accounting, legal, IT and advisory services to PROMETEIA – to the extent necessary to provide those services.

As regards the collection and transfer of data through Meta Pixel (Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland) and the LinkedIn Insight Tag (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland), PROMETEIA is a joint controller together with those entities within the meaning of Article 26 GDPR. Joint controllership covers only the stage of collecting data on our website and transferring it to Meta or LinkedIn; those entities are responsible for any further processing. We activate these tools only after you have consented to marketing cookies. The essence of the arrangements between the joint controllers is available at facebook.com/legal/controller_addendum and legal.linkedin.com/pages-joint-controller-addendum.

Personal data may also be disclosed to public authorities or other entities authorised by law, only where this results from a legal obligation.

§10. Transfers outside the EEA

Where Users’ personal data is transferred to recipients in third countries (outside the EEA), for example in the United States, such transfers may take place on the basis of an adequacy decision by the European Commission – in particular the decision of 10 July 2023 on the EU-US Data Privacy Framework – on the basis of standard contractual clauses approved by the European Commission, or on the basis of your explicit consent.

§11. Processing of data through cookies

When a User visits our website, PROMETEIA also collects data contained in system logs and cookies, and uses other similar web technologies (such as scripts, pixels, tags and plug-ins). Further information is set out in the Cookie Policy below.

§12. Changes to this Policy

PROMETEIA reserves the right to amend this Policy, whether to reflect changes in the law, prevailing privacy standards or an expansion of our services. PROMETEIA will announce any changes by a notice on its websites.

§13. Information published on the website

Information published on our websites, including any prices or promotional campaigns, does not constitute a commercial offer. All binding arrangements concerning offers and contracts are made in each case in an individual agreement between the parties.

LAST UPDATED: [PUBLICATION DATE]

---

Cookie Policy

§1

This Cookie Policy covers the use of cookies and other web technologies, and the processing of personal data through them, on the websites of Prometeia Capital sp. z o.o., with its registered office in Wrocław at ul. Strzegomska 138, entered in the Register of Entrepreneurs of the National Court Register (KRS) kept by the District Court for Wrocław-Fabryczna in Wrocław, 6th Commercial Division of the National Court Register, under number 0000346360; VAT ID (NIP): 8951963989; REGON: 021170310, at the website address prometeia.pl. This Cookie Policy supplements the Privacy Policy.

§2

Cookies are IT data, in particular text files, stored on your end device (such as a computer, tablet or smartphone) and used when browsing websites. Cookies are harmless to you and your devices and do not affect how they work. Nor do they change the configuration of your end devices or the software installed on them.

Our websites use both session and persistent cookies. Among them, we use the following:

• strictly necessary – enabling use of the services available on the website, navigation and access to its features; without these cookies the site may not display correctly; you cannot disable these cookies, as they are essential to the site working properly;
• analytics (statistics) – collecting information about how you use the website, which pages you visit most often, how you move around the site and whether you encounter errors. This data is pseudonymised and used to improve how the site works and its content;
• functional – remembering the settings you choose and personalising the interface, for example your language, typeface or site appearance;
• marketing – enabling us to measure the effectiveness of our campaigns and to display advertising tailored to your interests, including for remarketing purposes, on Google, Meta (Facebook, Instagram) and LinkedIn.

Through cookies and similar web technologies we may process, among others, the following data:

• device data (hardware model, unique device identifiers, MAC address, IP address, operating system version and device settings);
• log data (time spent on our website, search data and other information stored in cookies that uniquely identifies a browser or device);
• location data (obtained through positioning technologies such as GPS, Wi-Fi access points or other sensors – subject to your consent to location access);
• other data concerning your use of our website.

§3

Cookies other than strictly necessary ones (functional, analytics and marketing) are used only after you give explicit consent through the consent banner shown on your first visit to the site. Until consent is given, scripts requiring consent are blocked. Simply browsing the site is not treated as consent.

You can change or withdraw your consent at any time by clicking Change cookie settings or the consent settings icon in the bottom left corner of the page. Withdrawal does not affect the lawfulness of processing carried out before it.

Most browsers accept all cookies by default. You can change your browser settings so that it asks for approval before accepting cookies, accepts or rejects only certain types of cookies, or rejects all cookies. Some cookies are essential to our websites working, and removing or disabling them may reduce their functionality.

Cookies and other technologies operate automatically. That does not mean they are used on our websites for automated decision-making or to produce a similar legal effect. You can delete cookies after they have been stored, using your browser’s functions or the tools available in your operating system.

§4

We use cookies and similar web technologies to:

• tailor website content to your preferences and optimise your use of the websites;
• ensure the security and reliability of our websites;
• analyse use and compile statistics that help us understand how you use our websites, so we can improve their structure and content;
• maintain your session state on the website;
• display behavioural advertising matched to Users’ interests, including outside our own websites.

Where an anonymised or pseudonymised user profile is built from your activity on our websites for behavioural advertising purposes, identifying data or attributes are replaced with artificial identifiers – pseudonyms. In its behavioural advertising, PROMETEIA does not use personal data that would identify a specific individual user.

§5

We use the services of the following providers on our website:

• Google Analytics 4 (via Google Tag Manager) – collects information about visits to the site, such as the pages viewed, the time spent on them and the traffic source, in order to compile statistics; IP addresses are not stored in reports; analytics cookies;
• Microsoft Clarity – records how the site is used (clicks, scrolling, cursor movement) and creates heatmaps and anonymised session recordings that help us improve the site; text entered into forms is masked and not recorded; analytics cookies;
• Google Ads – measures the effectiveness of our advertising in Google Search and on the Google Display Network, and allows us to show ads to people who have visited our site (remarketing); marketing cookies;
• Meta Pixel – measures the effectiveness of advertising on Facebook and Instagram and enables remarketing; marketing cookies;
• LinkedIn Insight Tag – measures the effectiveness of campaigns on LinkedIn, provides aggregate demographic data about visitors (e.g. industry, job title) and enables remarketing; marketing cookies;
• Complianz – a consent management plug-in running on our server; it stores your choice in a cookie and keeps a register of consents given; strictly necessary cookies;
• Contact form – runs on our server; messages are stored in the website database and forwarded to our Microsoft 365 mailbox; the form does not set any cookies.

We activate all analytics and marketing tools only after you have given consent in the cookie banner (including through the Google Consent Mode mechanism). The typefaces used on the site are hosted on our own server, so displaying them does not involve transferring data to external providers.

Our site also contains links to PROMETEIA profiles on social networks such as LinkedIn. When you click such a link, you leave our website, and the processing of data on those networks is governed by the rules set by their operators.

Details of third-party providers:

• Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (affiliate: Google LLC, USA) – policies.google.com/privacy
• Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland (affiliate: Microsoft Corporation, USA) – privacy.microsoft.com
• Meta Platforms Ireland Ltd., Merrion Road, Dublin 4, Ireland (affiliate: Meta Platforms, Inc., USA) – facebook.com/privacy/policy
• LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland (affiliate: LinkedIn Corporation, USA) – linkedin.com/legal/privacy-policy

In connection with the use of these providers’ services, some data may be transferred outside the European Economic Area, in particular to the United States. Such transfers take place on the basis of the European Commission implementing decision of 10 July 2023 finding an adequate level of data protection under the EU-US Data Privacy Framework (Google LLC, Microsoft Corporation, Meta Platforms, Inc. and LinkedIn Corporation participate in that framework) or on the basis of standard contractual clauses approved by the European Commission.

List of cookies in use

Below is a list of the cookies used on prometeia.pl, together with their provider, purpose and retention period. The list is kept up to date by the consent management tool.

§6

Any further questions or requests concerning this Cookie Policy may be sent to our email address biuro@prometeia.pl or by post to the address given at the beginning of this Policy. PROMETEIA reserves the right to amend this Policy.

LAST UPDATED: [PUBLICATION DATE]