Privacy Policy

§1. General information

1. Privacy policy outlines the rules for processing and protection of personal data of Users when using Administrators websites
2. A User, for the needs of this policy is defined as a person contacting and/or ordering services provided by the Administrator.
3. Palapa sp z o.o., NIP: 5272934529, REGON: 38683067900000, based in Warsaw 01-171, Młynarska 42/115, e-mail: hello@palapa.tech is an Administrator of Personal Data according to the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/WE (General Data Protection Regulation)L 119/40 PL Dziennik Urzędowy Unii Europejskiej 4.5.2016.
4. Contact regarding the processing of personal data by the Administrator: hello@palapa.tech
5. The scope, purpose and period of data processing is outlined in further parts of this Privacy Policy

§2. The purpose of collecting and processing of personal data by the Administrator

1. The user entrusts the Administrator with the processing of personal data in order to use the WWW services and for the processing of User`s queries and orders made using Administrator`s contact form, including sending of personalised business information to the User.
2. The user providing a contact phone number agrees to be contacted by Administrator by phone in order to enable the Administrator to provide services outlined in point 1 above.
3. The User providing an email address agrees to be contacted by Administrator by email in order to enable the Administrator to provide services outlined in point 1 above.
4. User's consent by providing the information is voluntary whereas lack of such consent may cause the Administrator to not be able to process queries/ orders placed using the contact form.
5. In an event of establishing cooperation between User and Administrator access to personal data may need to be granted to sub-contractors and affiliated partners of the Administrator. This will be clearly communicated to the User and access granted only with User's permission.

§3. The scope of data processing by Administrator

1. Data gathered based on this Privacy Policy consist of all or some of the following:
   User data:
   • Name and surname
   • Phone number
   • Email address
2. The processing of above data includes creating of backup copies of data.
3. The website runs an automated system allowing monitoring of user's behavior and adjusting of presented content to user's interests. The system is integrated in the service and each user can opt out or voice their reservations at any time.
4. The Administrator uses cookies files in order to ensure the proper working of the service, adjusting content to User's preferences, and optimising the use of service's websites. The cookies files allow the identification of the basic parameters of the user's device (e.g. device type, screen resolution, location by country) and proper viewing of the website according to user's requirements.
5. The Administrator uses PostHog (PostHog, Inc.) for website analytics and session recording. Data is processed on PostHog's EU infrastructure and is not transferred outside the European Economic Area. Analytics cookies and session recording are only used after the User accepts them in the consent banner shown on first visit. Until a choice is made, and also if the User declines, the service still counts the visit, but without analytics cookies and without session recording; the visit is identified only by a temporary value derived on the server, which changes daily, so it cannot be linked to any identifiable person or followed across days.
6. Independently of the above, the service stores in the browser's local storage a record of how the User reached the website (the referring website address and any campaign parameters in the link, together with the first page opened and the date). The record is kept for up to 90 days, contains no identifier and no personal data, and is used so that an enquiry sent through a form on the website can be attributed to the channel it came from. It can be removed at any time by clearing the website's data in the browser.
7. Session recording captures interactions with the website (pages viewed, clicks, scrolling and mouse movement) in order to diagnose errors and improve the website. The contents of every form field are masked before the recording leaves the User's browser, so text typed into forms, including e-mail addresses and messages, is never recorded.
8. Where the User voluntarily provides an e-mail address through a form on the website, and has accepted analytics cookies, that address may be used to associate the User's earlier activity on the website with their enquiry, so that it can be answered in context.
9. Analytics and session recording are consented to separately: the User may accept analytics while refusing session recording. Both can be changed at any time through the "Cookie preferences" link in the footer of the website, which is also available at the bottom of this page. Withdrawal of consent does not affect the lawfulness of processing carried out before it.
10. The User can change the settings of cookies files by setting conditions of access and keeping of cookies files data in browser settings. The settings may be adjusted in such way as to block automatic processing of cookies by the browser or/and notifying the user each time cookies are placed on User's device. Detailed information on use and processing of cookies is available in program (browser) settings.
11. The User can delete cookies using browser functions at any time.
12. Restricting the use of cookies may impact the functionality of the service's website.
13. The will notify of the gathering of personal data of Users for registration in scope and under conditions stated in GDPR and all other regulations.

§4. The rights of Users whose data is processed

1. The Users have the right to:
   
   1. Access their personal data
   2. Change their personal data
   3. Remove their personal data
   4. Restrict the rights to process personal data
   5. Move personal data
   6. File complaints regarding personal data processing
2. In order to exercise above rights the User should contact the Administrator at hello@palapa.tech
3. The Administrator will address User's reservations/ complaints without delay noting that removal,restriction,moving or complaints regarding data processing may impact the ability to provide relevant business information regarding User's query/order.

§5. Timeframes for keeping and processing of personal data by Administrator

The Administrator keeps User's provided personal data no longer then it is required to accurately service the User's query/order, including preparation of personalised business offer and fulfillment of Administrators obligations. After that period data is stored only to secure fulfillment of User's obligations to Administrator. Users can at any time request removal of personal data.

§6. Administrator's obligations

The Administrator of personal data is obliged to process personal data in a safe and secure manner as per Regulation, especially with regard to:

1. Securing the data from unauthorised access, obtaining, changing or destruction.
2. Allow only Administrator authorised access to processed data
3. Ensuring appropriate control of processed data
4. Keeping record of persons authorised to access and process personal data with particular care that persons authorised keep the data confidential during and after Administrator's use of them. This will be done by signing appropriate NDA and training in keeping data confidentiality
5. Keeping records of the methods and technologies used to ensure data confidentiality.
6. Ensuring that all electronic systems and devices used to store and process personal data comply with Internal Affairs and Administration Regulation dated 29th of April 2004 regarding personal data documentation as well as technical and organisational conditions for systems and devices processing such data.