PRIVACY POLICY – INFORMATION ON THE PROCESSING OF PERSONAL DATA

The purpose of this Privacy Policy is to explain the rules under which the Administrator, within the Service, collects, uses and protects your personal data, and to present your rights in connection with the processing of your personal data by the Administrator.

Please read the information below.

I. Introduction and structure of the document

We, ConverterTec Poland Spółka z ograniczoną odpowiedzialnością with its registered office in Brzegi, ul. Trakt Ojca Św. Franciszka 1, 32-002 Brzegi, entered in the Register of Entrepreneurs of the National Court Register under KRS number: 0000740656, whose registration documentation is kept by the District Court for Kraków-Śródmieście in Kraków, 12th Commercial Division of the National Court Register, NIP: 7010832326, with share capital of PLN 1,500,000.00 (hereinafter also referred to as: “we/us/our”, “Administrator”, “Company”), thank you for visiting our website and for your interest in our company and our services. Your personal data will be processed only in accordance with the provisions of Polish and European data protection law.

In connection with the entry into force of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ EU L 2016 No. 119, p. 1, as amended) (hereinafter referred to as: “GDPR”), specific obligations have been imposed on entities processing personal data.

One of these obligations is to inform you transparently about the nature, scope, purpose, duration and legal basis of data processing (see Articles 13 and 14 GDPR). In the further part of this document, we refer to you, as data subjects, as “User”, “you” or “data subject”. In this Privacy Policy, we inform you how we process your personal data.

Our Privacy Policy has a modular structure. It consists of a general part, covering all cases of personal data processing and situations that may arise, and a specific part, the content of which applies only to the processing situations specified in that part. We may also use this online document to inform you about processing procedures that do not primarily take place on the website. These can be found in the specific section of the document.

II. Definitions

“Personal data” (Article 4(1) GDPR) means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is a person who can be identified, directly or indirectly, in particular by reference to an identifier such as a name and surname, an identification number, location data, an online identifier or to one or more specific factors determining the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. Identifiability may also result from the combination of such information or other additional data. The origin, form or format of the information is irrelevant (photographs, video or audio recordings may also contain personal data).

“Processing” (Article 4(2) GDPR) means any operation or set of operations performed on personal data or on sets of personal data, whether by automated or non-automated means, such as collection, recording, organisation, structuring, storage, adaptation or modification, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

“Administrator” means the controller within the meaning of Article 4(7) GDPR, i.e. a natural or legal person, public authority, agency or other body which, alone or jointly with others, determines the purposes and means of the processing of personal data.

“Third party” (Article 4(10) GDPR) means a natural or legal person, public authority, agency or body other than the data subject, the Administrator, the processor or persons who, under the authority of the Administrator or the processor, are authorised to process personal data.

“Processor” (Article 4(8) GDPR) means a natural or legal person, public authority, agency or other body which processes personal data on behalf of the Administrator.

“Consent” (Article 4(11) GDPR) of the data subject means any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which the data subject, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to them.

“Privacy Policy” means this document, available at: https://convertertec-oem.com/privacy-statement.

“Cookie Policy” means the document available at: https://convertertec-oem.com/cookies-policy.

“Service” means the website available at https://www.convertertec-oem.com.

III. Identity and contact details of the Administrator

The Administrator, i.e. the controller of your personal data within the meaning of Article 4(7) GDPR, is ConverterTec Poland Spółka z ograniczoną odpowiedzialnością with its registered office in Brzegi, ul. Trakt Ojca Św. Franciszka 1, 32-002 Brzegi, entered in the Register of Entrepreneurs of the National Court Register under KRS number: 0000740656, whose registration documentation is kept by the District Court for Kraków-Śródmieście in Kraków, 12th Commercial Division of the National Court Register, NIP: 7010832326, with share capital of PLN 1,500,000.00 (hereinafter also referred to as: “we/us/our”, “Administrator”, “Company”).

The Administrator selects and applies appropriate technical and organisational measures with due care to ensure the protection of the data being processed, including protecting the data against disclosure to unauthorised persons, as well as against other cases of disclosure or loss, destruction or unauthorised modification of the indicated data, and against their processing in breach of applicable law. The Administrator exercises ongoing control over the data processing process and restricts access to data to the greatest extent possible, granting relevant authorisations only where necessary.

If you have any questions regarding the processing of personal data, you may contact the Administrator by e-mail at: rodo-oem@convertertec.com, including “GDPR” in the subject line of the message.

IV. Information on the appointment of a Data Protection Officer

The Administrator has not appointed a Data Protection Officer.

V. Your rights in connection with the processing of your personal data

In connection with the processing of your personal data by the Administrator, you have the following rights:

Where the processing of personal data is based on consent (Article 6(1)(a) GDPR), you have the right to withdraw your consent at any time, without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal. Consent may be withdrawn via a link in the message sent to you, browser settings (for cookies), e-mail contact with the Administrator or other mechanisms made available.

To exercise your rights, you may contact the Administrator at the following e-mail address: rodo-oem@convertertec.com.

VI. Purpose and legal basis of data processing and the period of personal data processing

The purpose, legal basis, scope and period of personal data processing differ depending on the method of interaction with the Service chosen by you.

The Administrator processes personal data provided by you. In certain situations, your personal data may also be collected automatically by means of cookies, as described in the Cookie Policy available at: https://convertertec-oem.com/cookies-policy.

1) Contact form

a) Purpose of processing: the purpose of processing data (name, surname, telephone number, e-mail address) is to respond to your enquiry electronically (via e-mail) or by telephone (including by SMS).

b) Legal basis for processing: Article 6(1)(b) GDPR – processing necessary in order to take steps at the request of the data subject prior to entering into a contract.

c) Data processing period: up to 6 months from the end of the contact. After this period, the data are automatically deleted.

2) Partially completed contact forms

a) Purpose of processing: the purpose of processing data (name and surname, e-mail address, telephone number and other data voluntarily provided by you) is to improve the functionality of the Service and the experience of using the Service, prevent the loss of data entered by users, analyse the usefulness and functionality of forms on the website, and optimise the processes of submitting enquiries and requests.

b) Legal basis for processing: Article 6(1)(f) GDPR – the legitimate interest of the Administrator.

c) Data processing period: up to 60 days from the moment of entry. After this period, the data are automatically deleted.

3) Recruitment using forms or e-mail messages

a) Purpose of processing: the purpose of processing data (CVs, cover letters, additional information) is to review your application in the recruitment process.

b) Legal basis for processing: Article 6(1)(b) GDPR – in relation to the current recruitment process; Article 6(1)(a) GDPR – where consent has been given to participate in future recruitment processes (consent expressed in the CV; if you want your application to be used also in other recruitment processes, please state this in the clause).

c) Data processing period: up to 6 months (current recruitment) or 12 months (future recruitment processes). After this period, the data are automatically deleted

4) Newsletter distribution and marketing of the Administrator’s services

a) Purpose of processing: the purpose of processing data (CVs, cover letters, additional information) is to review your application in the recruitment process.

b) Legal basis for processing: Article 6(1)(b) GDPR – in relation to the current recruitment process; Article 6(1)(a) GDPR – where consent has been given to participate in future recruitment processes (consent expressed in the CV; if you want your application to be used also in other recruitment processes, please state this in the clause).

c) Data processing period: up to 6 months (current recruitment) or 12 months (future recruitment processes). After this period, the data are automatically deleted

4) Newsletter distribution and marketing of the Administrator’s services

a) Purpose of processing: the purpose of processing personal data (e.g. e-mail address) is to send commercial and marketing information, in particular newsletters, offers, articles or invitations to events.

b) Legal basis for processing: Article 6(1)(a) GDPR – your consent to the processing of data for marketing purposes; Article 10 of the Act on the provision of services by electronic means – consent to the sending of commercial information by electronic means.

c) Data processing period: until consent is withdrawn or for a maximum of 2 years from the last activity. After this period, the data are automatically deleted.

5) Profiling and creation of advertising groups

a) Purpose of processing: the purpose of processing personal data (e.g. e-mail address) is to analyse your activity in order to tailor marketing content, create personalised audience groups in advertising systems (such as Google Ads, LinkedIn Ads) and conduct remarketing activities.

b) Legal basis for processing: Article 6(1)(a) GDPR – consent to the processing of data for advertising profiling purposes.

c) Data processing period: until consent is withdrawn or for a maximum of 2 years from the last interaction. After this period, the data are automatically deleted.

6) Registration for a webinar or other online events

a) Purpose of processing: the purpose of processing data is to organise and conduct a webinar or another event.

b) Legal basis for processing: Article 6(1)(a) GDPR – consent to participate in the event and to receive information related to participation in the event.

c) Data processing period: until the event has been settled. After this period, the data are automatically deleted.

7) Fulfilment of the Administrator’s legal obligations

a) Purpose of processing: the purpose of processing is to fulfil the legal obligations of the Administrator arising, among others, from tax, accounting and GDPR regulations.

b) Legal basis for processing: Article 6(1)(c) GDPR.

c) Data processing period: until the expiry of the period resulting from legal provisions imposing an obligation on the Administrator to store the data. After this period, the data are automatically deleted.

8) Legitimate interest of the Administrator

a) Purpose of processing: the purpose of processing the data is to ensure ICT security; statistical and analytical purposes (e.g. aggregated visit reports); the establishment, exercise and defence of claims; and the administration of fan pages on social media platforms.

b) Legal basis for processing: Article 6(1)(f) GDPR.

c) Data processing period: until the expiry of the limitation period for claims, generally 6 years. After this period, the data are automatically deleted.

9) Analytics and statistics

a) Purpose of processing: e.g. Google Analytics, LinkedIn Insight Tag – the purpose of processing data collected automatically when using the website, for example through cookies and other tracking technologies, is to analyse traffic and user behaviour in order to improve the operation of the Service and compile statistics. These tools may collect data such as IP address, device type, operating system, visited subpages and visit duration.

b) Legal basis for processing: Article 6(1)(a) GDPR – voluntary consent – in relation to analytical and marketing tools, for example Google Analytics cookies and LinkedIn Insight Tag; Article 6(1)(f) GDPR – the legitimate interest of the Administrator – in relation to necessary technical data and cookies required for the operation of the Service.

c) Data processing period: until consent is withdrawn or according to cookie settings, with technical data stored until the session is closed. After this period, the data are automatically deleted

The processing of data provided by you that are not mandatory, or of excessive data, takes place based on your decision. Accordingly, the legal basis for the processing of such data by the Administrator is your consent (Article 6(1)(a) GDPR).

VII. Obligation to provide personal data

Providing personal data is voluntary; however, providing certain personal data is necessary for us to be able to ensure that you have access to specific functionalities of the Service. Therefore, refusal to provide personal data cannot result in any negative consequences for you; however, without providing such data, the use of certain functionalities of the Service may become impossible.

VIII. Personal data security: Service and e-mail

The Administrator applies technical and organisational security measures to protect your data against accidental or intentional manipulation, partial or complete loss, destruction or unauthorised access by third parties, such as TLS encryption, taking into account the state of the art, implementation costs, the scope, context and purpose of processing, as well as the existing risk, including its likelihood and consequences, for the data subject.

Please note that the confidentiality of e-mail messages cannot be guaranteed. Although we offer transport encryption, TLS, via our mail servers, confidentiality may depend on various mail relay servers over which we have no control: we have no influence over whether those servers also use TLS or whether they evaluate e-mail messages.

IX. Recipients of your personal data – cooperation with processors

The recipients of your personal data may include authorised employees of the Administrator, entities providing legal services, external service providers, for example entities providing IT services, mailing services, accounting and tax services, and other entities processing data on behalf of the Administrator under a personal data processing agreement, as well as entities authorised under applicable law, in particular courts and state authorities.

Processors act solely in accordance with the instructions of the Administrator and are contractually obliged to comply with data protection regulations. Processors are not third parties.

X. Transfer of personal data to third countries and international organisations

As part of our business relationships, it may be necessary to transfer or disclose personal data to companies or service providers outside the European Economic Area (EEA), i.e. to so-called third countries. Such data transfers take place solely for the purpose of fulfilling contractual obligations, carrying out pre-contractual activities or on the basis of our legitimate interests related to the efficient processing of business data. The relevant recipients and purposes of data transfers are specified in other parts of this Privacy Policy. We also indicate there the registered office of the relevant service provider.

The European Commission has issued so-called adequacy decisions for certain third countries pursuant to Article 45 GDPR. These confirm an adequate level of data protection comparable to that in the EEA. The European Commission publishes the current list at: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en?prefLang=pl.

In other third countries to which personal data may be transferred, however, the level of data protection may not be consistently high due to the absence of legal provisions. In such cases, we ensure an appropriate guarantee of data protection. This can be achieved through binding corporate rules, the European Commission’s standard contractual clauses for the protection of personal data, certificates or recognised codes of conduct.

XI. Profiling and automated decision-making

The Administrator does not make decisions that have legal effects or similarly significantly affect you. Your personal data may be processed in the form of profiling for the purpose of carrying out marketing activities by the Administrator.

Automated data processing allows selected behaviours to be assessed, future behaviours to be predicted and marketing content to be displayed. However, this does not affect your legal situation.

You have the right to object to profiling if it would have a negative impact on your rights and obligations.

XII. Legal obligation to disclose certain data

In certain circumstances, we may be subject to a specific legal or regulatory obligation to disclose lawfully processed personal data to third parties, in particular public authorities (Article 6(1)(c) GDPR).

XIII. Amendment of the Privacy Policy

The Administrator reserves the right to amend the Privacy Policy if required by applicable law, if the technological conditions of the Service change, or if the amendment introduces a standard higher than the minimum required by law. The Administrator will inform you of any amendment to the Privacy Policy, for example by means of a pop-up notification or by e-mail, at least 14 days in advance.

INFORMATION ON THE PROCESSING OF PERSONAL DATA AS PART OF SPECIFIC PROCESSING OPERATIONS

The sections below describe data processing procedures grouped according to different categories of persons whose data are processed (“data subjects”).

I. Visiting the websites of entities belonging to the group

Information about our companies and the services we offer can be found in particular on www.convertertec-service.com and related subpages (hereinafter collectively referred to as the “websites”).

When you visit our websites, your personal data are processed. Your data will be processed only for as long as is necessary to achieve the processing purposes referred to above; the legal bases set out in the context of the processing purposes apply accordingly.

Third parties engaged by us will store your data in their systems for as long as is necessary in connection with the provision of services to us in accordance with the relevant order.

The following categories of recipients, which are usually processors, may have access to your personal data: service providers responsible for operating our website and processing data stored or transmitted by systems, for example in data centre services, payment processing and IT security.

The legal basis for the transfer of data is then Article 6(1)(b) or (f) EU GDPR, unless the recipients are processors.

Government agencies/authorities, where necessary to fulfil a legal obligation. The legal basis for the transfer of data is then Article 6(1)(c) EU GDPR; persons engaged to conduct our business activities, for example auditors, banks, insurance companies, legal advisers, supervisory authorities, parties involved in business acquisitions or the creation of joint ventures. The legal basis for the transfer of data is then Article 6(1)(b) or (f) EU GDPR.

In addition, we disclose your personal data to third parties only where you have given your explicit consent pursuant to Article 6(1)(a) EU GDPR.

II. Hosting service: cyber folks

We use the cyber folks hosting service provided by cyber Folks S.A., Wierzbiecice 1B, 61-569 Poznań, Poland (hereinafter referred to as “cyber folks”).

The service provides the technical infrastructure necessary for the operation of our website, including server capacity, storage space, databases, security functions and other related services, to ensure the availability, stability and performance of our online offering.

As part of these services, cyber folks processes personal data of website visitors, in particular IP addresses, the time and duration of access, pages visited, the amount of data transferred, the browser used, the operating system and the referring URL.

These data are processed to make the website available, deliver it, optimise it technically and secure it. The legal basis for this processing is Article 6(1)(f) GDPR, as we have a legitimate interest in providing our online services securely, efficiently and reliably.

Where personal data are processed or transferred within or outside the European Economic Area in the context of using cyber folks, this is done by the hosting service provider in accordance with the requirements of the EU GDPR.

More information on data protection at cyber folks can be found in the provider’s privacy policy at: https://cyberfolks.com/privacy/.

III. Consent management tool / consent management service provider / cookie banner

We use services to obtain and manage consent for individual services.

This website uses Cookiebot™ CMP by Usercentrics, a consent management tool.

This service requires consent to be obtained so that certain services on the website may be used. This consent is obtained and documented.

The service is provided by Usercentrics A/S, registered at Havnegade 39, 1058 Copenhagen, Denmark, registered under number DK34624607. As this service is hosted locally on the web server, no data are transferred to third parties.

The service sets a necessary cookie. The following information is stored there:

When you visit our website, the following personal data are transmitted for consent management purposes: consent(s) or withdrawal of consent(s), IP address, browser and device information, and the time of the website visit. In addition, the consent management service stores a cookie to assign the consents granted or withdrawn.

The data collected in this way are stored until we receive a request for their deletion, the Cookiebot™ CMP by Usercentrics cookies are deleted by the user, or the purpose of data storage no longer applies.

Data are processed to obtain the consent required by law and, where applicable, in the context of our legitimate interest in designing our website in a legally compliant and low-risk manner (legal basis: Article 6(1)(c) and, where applicable, Article 6(1)(f) EU GDPR).

IV. Google services, products and technologies (and, where applicable, Alphabet)

In this section, we have summarised the services offered by Alphabet Inc. (a public US holding company), and by Google, which forms part of that holding company.

The use of these services may result in data being transferred to a third country, namely the United States.

Regarding the United States, on 10 July 2023 the European Commission adopted an adequacy decision confirming an adequate level of data protection for transfers of data to companies participating in the EU-US Data Privacy Framework.

Data transfers to the United States are also based on the European Commission’s standard contractual clauses. Detailed information can be found here: https://policies.google.com/privacy/frameworks and https://privacy.google.com/businesses/controllerterms/mccs/.

V. Google Analytics

This website uses Google Analytics, a web analytics service operated by Google Ireland Limited, registration number: 368047, Gordon House, Barrow Street, Dublin 4, Ireland.

Data processing takes place only after consent has been given in accordance with Article 6(1)(a) EU GDPR. Additional information about this possible processing can be found in the consent request in the consent management tool.

If consent is given, analysis of your use of our websites and online services is enabled. Information about the use of these websites and online services is transmitted to Google servers in the United States and stored there.

Regarding the United States, there is a European Commission adequacy decision of 10 July 2023 establishing an adequate level of data protection for transfers of data to companies participating in the EU-US Data Privacy Framework.

Data transfers to the United States are also based on the European Commission’s standard contractual clauses. Google uses this information to evaluate your visits to the website, compile reports for us on website activity and provide other services relating to website activity and internet usage. Google may also transfer this information to third parties where this is required by law or where such third parties process this information on Google’s behalf.

VI. Google Web Fonts / external fonts

On our websites, we use the Google Web Fonts service operated by Google Ireland Limited, registration number: 368047, Gordon House, Barrow Street, Dublin 4, Ireland.

Data processing takes place only after consent has been given in accordance with Article 6(1)(a) EU GDPR. Additional information about this possible processing can be found in the consent request in the consent management tool.

If consent is given, Google Web Fonts may be used to ensure the uniform display of fonts. When a page is visited, your browser loads the required web fonts into the browser cache in order to display text and fonts correctly. For this purpose, the browser you use must connect to Google servers. This allows Google to know that our website has been accessed via your IP address.

VII. WPML

On our website, we use WPML, a language tool that enables the website to be displayed in different languages.

The provider of this service is OnTheGoSystems Ltd., 22/F 3 Lockhart Road, Wanchai, Hong Kong, China. This service may be hosted locally.

It is a language tool considered necessary. The legal basis is Article 6(1)(f) GDPR. Our legitimate interest is to present our website to visitors in their native language. If we use a consent management tool, we may decide to base the processing on consent in accordance with Article 6(1)(a) GDPR.

More details about consent can be found in the consent management tool. The use of the service may result in data being transferred to a third country (China). Data transfers to China are based on the European Commission’s standard contractual clauses. More information can be found in the provider’s data protection information at the following URL: https://wpml.org/documentation/privacy-policy-and-gdpr-compliance/.

PROCESSING OF PERSONAL DATA IN CONNECTION WITH THE ADMINISTRATOR’S PRESENCE ON SOCIAL MEDIA

The Administrator of personal data on the fan page (profile) on the LinkedIn and YouTube social media platforms is ConverterTec Poland Spółka z ograniczoną odpowiedzialnością with its registered office in Brzegi.

The Administrator processes the data of Users who:

The Administrator may process the following data:

Users’ personal data may be processed for the following purposes:

The recipients of Users’ personal data processed in connection with activity on the social media platform may include:

Users’ data have been obtained from LinkedIn and YouTube and from Users’ public profiles on the indicated online platforms.

Users’ personal data will be stored for the period necessary due to the Administrator’s business needs, for the period during which the fan page (profile) is maintained, or until the User objects to their processing, withdraws consent if the data were processed on the basis of consent, or the Administrator itself determines that the data have become outdated.

The User has the rights listed in this Privacy Policy.

This version (2.0) of the Privacy Policy applies from 9th of March 2026.