Privacy Policy
Rules for handling your personal data and cookies. So that you simply feel comfortable.
This Privacy Policy describes the rules under which we process information about you, including personal data and so-called cookies.
1. General information.
1.1. The website is provided by cyber_Folks S.A., with its registered office in Poznań, ul. Wierzbięcice 1B, 61-569 Poznań, entered in the National Court Register by the District Court Poznań – Nowe Miasto i Wilda in Poznań, VIII Commercial Division of the National Court Register, under KRS number 0000685595, REGON 367731587, NIP (tax identification number) 7792467259 (EU VAT number: PL7792467259), with share capital of PLN 370,591.30 fully paid up.
1.2. The Provider is the Controller of personal data provided voluntarily by Users when visiting the website, setting up services, using services or taking part in various marketing campaigns which may be run by the Provider (e.g. competitions, newsletters, etc.).
1.3. Data provided by Users in order to use the services are used in the process of activating and providing them. This includes, in particular, the following activities:
- technical activation of services,
- processing payments and invoicing,
- processing and storing financial documents on the basis of specific provisions: tax, financial and accounting, etc.,
- informing about service expiry dates and the possibility of renewal,
- informing about planned technical works and failures,
- informing about significant configuration changes,
- informing about changes to the terms and conditions,
- providing technical support, including answering Users’ questions,
- clarifications regarding billing,
- direct sales contact – if the User requests it,
- sending marketing information by e-mail, SMS, telephone and other communication channels – if the User consents to such forms of contact (e.g. by subscribing to the newsletter, ticking the relevant consent when registering a service, or in the Client Panel – the detailed rules and scope of consent, together with the relevant legal provisions, are then provided where consent is given),
1.4. As a hosting company, the Provider is also a processor of personal data – with respect to data of which clients are the controllers and which have been entrusted to it by concluding the relevant agreement in the Client Panel. The detailed processing rules are then set out in that agreement. This Policy does not apply to the use of such data. With respect to such data, the Provider is not a controller of personal data.
1.5. This Policy does not cover any information concerning services, goods or websites belonging to entities other than the Provider, except for the cooperating entities indicated.
1.6. The website collects information about Users and their behaviour in the following ways:
- through data voluntarily entered in forms, which are entered into the Provider’s systems,
- through the use of the Provider’s services,
- by storing cookies on terminal devices,
- by recording technical information in the logs of the Provider’s http, e-mail or other network services and applications (system logs).
2. Detailed information on the processing of personal data
Personal data are processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ EU L 119), hereinafter the GDPR, taking into account the provisions of the Polish Act of 18 July 2002 on the Provision of Services by Electronic Means, to which the Provider is subject as a service provider established in Poland, and other provisions of generally applicable law, including the provisions of the Person’s country of habitual residence supplementing the GDPR, to the extent applicable.
2.1. Controller of personal data
The controller of personal data (the Provider) is cyber_Folks S.A., with its registered office in Poznań, ul. Wierzbięcice 1B, 61-569 Poznań, entered in the National Court Register by the District Court Poznań – Nowe Miasto i Wilda in Poznań, VIII Commercial Division of the National Court Register, under KRS number 0000685595, REGON 367731587, NIP (tax identification number) 7792467259 (EU VAT number: PL7792467259), with share capital of PLN 370,591.30 fully paid up.
Controller’s contact details: ul. Wierzbięcice 1B, 61-569 Poznań, Poland, e-mail: iod@cyberfolks.pl, tel.: +48 (17) 787 69 67
2.2. Data protection officer
The Controller’s data protection officer is Paweł Szefler, who will provide further information on the Person’s rights and the processing of their personal data at the e-mail address: iod@cyberfolks.pl
2.3. Voluntary provision of personal data
The provision of personal data is voluntary; however, the Provider informs that, unless otherwise indicated in individual forms (e.g. that providing data is optional), the Provider’s services cannot be used anonymously or under a pseudonym. Accordingly, refusal to provide data may result in refusal to conclude the agreement and provide the ordered service.
2.4. To create a client account in order to order the Provider’s services, it is necessary to create a login and provide the Mandatory Data:
| Category | Mandatory Data |
|---|---|
| Persons not conducting business activity | first name and surname; residential address; e-mail address; telephone number |
| Businesses and organisations | first name and surname; name of the business or organisation; business address; e-mail address; telephone number; tax identification number (in the European Union — the EU VAT number or, failing that, the number in the national business register) |
Where required by the rules of the registry competent for the domain ordered or by law, in particular to verify the registrant’s data, the Provider may additionally request an identification number or identity document details to the extent provided for in those rules or that law.
2.5. Types of data processed, purposes, legal basis for processing by the Provider and envisaged retention period
| Type of data | Purpose of processing | Legal basis | Retention period |
|---|---|---|---|
| Mandatory Data (as indicated in the point above). Contact details of the client’s staff (in particular: first name, surname, e-mail address, telephone number). We obtain these data from the client, who designates these persons as contact persons. | Maintaining the client account on the website, providing the ordered services by electronic means, ensuring contact in connection with the performance of services. | Article 6(1)(b) GDPR (necessity for the performance of a contract) | Until the client account is deleted. |
| (as above) | Establishment, exercise or defence of possible claims. | Article 6(1)(f) GDPR (legitimate interest) | Until the limitation period for possible claims expires. |
| (as above) | Marketing and direct marketing of the Controller’s products or services, including sales analytics, customer satisfaction surveys and service quality improvement, etc. | Article 6(1)(f) GDPR (legitimate interest) | Until the Person objects, in accordance with Articles 21–22 GDPR. |
| (as above) | Sending commercial information by electronic means (advertising e-mails and text messages), making telephone calls to present promotional or personalised offers, analysing Users’ activity and preferences. | Article 6(1)(a) GDPR in conjunction with the electronic communications provisions implementing Articles 5(3) and 13 of Directive 2002/58/EC (Consent) | Until the Person withdraws consent or objects, in accordance with Articles 21–22 GDPR. |
| Data necessary for the chosen method of settling the services, in particular: data on the payment method or the bank account from which payment was made; data contained in issued bills (VAT invoices); data on services ordered and performed (order history). | Settlement of services performed. | Article 6(1)(b) GDPR (necessity for the performance of a contract) | For the term of the agreement and thereafter until the limitation period for possible claims expires or until the expiry of the obligation to retain accounting and tax documents. |
| (as above) | Compliance with legal obligations relating to bookkeeping, accounting and tax. | Article 6(1)(c) GDPR (compliance with legal obligations relating to accounting) | (as above) |
| (as above) | Establishment, exercise or defence of possible claims. | Article 6(1)(f) GDPR (legitimate interest) | (as above) |
| Data contained in correspondence with the Controller (e.g. in completed contact forms, the ticketing system, e-mail, chat application, traditional correspondence, etc.). Recordings of telephone calls. | Conducting correspondence, handling notifications, requests and enquiries or processing complaints. Demonstrating the content of statements or requests made by the Person. Establishment, exercise or defence of possible claims. | Article 6(1)(f) GDPR (legitimate interest); Article 6(1)(c) GDPR (compliance with legal obligations to respond to requests of data subjects) | Until the limitation period for possible claims expires. |
| (as above) | Establishment, exercise or defence of possible claims. | Article 6(1)(f) GDPR (legitimate interest) | (as above) |
| Data characterising the use of the service provided by electronic means (operational data): an identifier assigned to the Person on the basis of the data held; identifiers of the telecommunications network termination point or ICT system used by the Person; information on the start, end and scope of each use of the service provided by electronic means; information on the service recipient’s use of services provided by electronic means. | Ensuring and optimising the quality parameters of the service. Maintaining security measures. Identifying cases of unauthorised use of services. Establishment, exercise or defence of possible claims. | Article 6(1)(f) GDPR (legitimate interest) | Up to 6 months, and in the case of data relating to access to the client panel and the placing of orders, instructions or requests – for the duration of the service and thereafter until the limitation period for possible claims expires. |
| Data requested by public authorities or authorised entities on the basis of legal provisions. | In exceptional situations, disclosure of personal data at the request of public authorities or entities authorised by law. | Article 6(1)(c) GDPR (compliance with legal obligations) | Until the Controller’s legal obligations have been fulfilled. |
| All of the Person’s data described above processed by the Controller in IT systems. | Making and storing backup copies. Maintaining the ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services. Ensuring the ability to restore the availability of and access to personal data in a timely manner in the event of a physical or technical incident. Regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of processing. | Article 6(1)(c) in conjunction with Article 32(1) GDPR (compliance with legal obligations to ensure the security, integrity and availability of data) | In accordance with the internal backup schedule. |
2.6. Right to withdraw consent
Where the Controller processes personal data on the basis of consent, the Person may withdraw such consent at any time. This may, however, result in loss of access to a service provided on the basis of the consent previously given. Withdrawal of consent does not affect the lawfulness of processing carried out by the Controller before its withdrawal.
2.7. The Person’s rights regarding the processing of their personal data
The Person has the following rights regarding their personal data:
| Right | Basis and essence of the right |
|---|---|
| Right of access | Article 15 GDPR. The data subject is entitled to obtain from the Controller confirmation as to whether personal data concerning them are being processed and, where that is the case, access to the data and the information specified in that provision. |
| Right to rectification and completion | Article 16 GDPR. The data subject has the right to obtain from the Controller without undue delay the rectification of inaccurate personal data concerning them. Taking into account the purposes of the processing, the data subject has the right to have incomplete personal data completed, including by means of providing a supplementary statement. |
| Right to erasure | Article 17 GDPR. The data subject has the right to obtain from the Controller the erasure of personal data concerning them without undue delay, and the Controller has the obligation to erase personal data without undue delay where one of the grounds set out in that provision applies. |
| Right to restriction of processing | Article 18 GDPR. Restriction of processing involves the Controller marking stored personal data with the aim of limiting their processing in the future. Once data have been so marked, they may, with the exception of storage, only be processed with consent or for the purposes listed in that provision. Restriction may be requested in the cases specified in that provision. |
| Right to data portability | Article 20 GDPR. The data subject has the right to receive the personal data concerning them, which they have provided to the Controller, in a structured, commonly used and machine-readable format, and has the right to transmit those data to another entity without hindrance from the Controller. |
| Right to object | Article 21 GDPR. Where personal data are processed for direct marketing purposes, the data subject has the right to object at any time to processing of personal data concerning them for such marketing, including profiling to the extent that it is related to such direct marketing. The right to object also applies in other cases specified in Articles 21–22 GDPR. |
The Person may exercise the above rights by contacting the Controller in any of the ways specified at the beginning. This also applies to the withdrawal of consents previously given. When contact takes place remotely, the Controller may, pursuant to Article 12(6) GDPR, request personal data in order to verify identity.
Where the law of the Person’s country of habitual residence so provides, the Person may also give instructions regarding the retention, erasure and communication of their personal data after their death.
2.8. Recipients of data
Depending on the situation, personal data will be transferred to entities acting exclusively on behalf of the Controller or providing services to the Controller, in particular:
- in the case of registration of an internet domain ordered by the Person – to entities operating registers of domains and domain registrants or intermediaries registering the given domain extension in Poland and abroad;
- in the case of registration of a cryptographic certificate ordered by the Person – to entities operating certification authorities, within the certificate ordered by the Person, or intermediaries in this respect in Poland and abroad;
- to businesses in the advertising and marketing sector (advertising agencies, call centres, software platforms for marketing automation and analytics, and platforms for sending e-mails or text messages and for chat communication);
- to businesses providing services related to the establishment or defence of claims and legal and accounting services (debt collection, law or tax firms, accounting offices);
- to data centres, subcontractors and service technicians;
- to postal operators and courier companies.
Personal data may also be disclosed to:
- auditors;
- authorities entitled under applicable law to request their disclosure, including in particular courts, public prosecutors, the police, tax and customs administration;
- other entities entitled to access the data under the law.
2.9. Transfers of data to third countries where the GDPR does not apply
As a rule, the Controller does not transfer personal data to a third country or an international organisation outside the European Economic Area (EEA). Such a transfer may, however, take place in the exceptional situations described below:
Registration of domains and SSL certificates. Data will be transferred outside the EEA only where the data subject orders a service requiring the transfer of personal data to a third country or international organisation, i.e. in particular registration of an internet domain whose registry is operated by an entity established outside the EEA, or issuance of an SSL certificate handled by such an entity. In such cases personal data will be transferred in accordance with Chapter V GDPR, subject to the following rules:
a) Adequacy decisions: first, it is verified whether the European Commission has adopted a decision finding an adequate level of protection of personal data in the given third country (Article 45 GDPR). The current list of decisions (countries) is available on the European Commission’s website.
b) Appropriate safeguards: in the absence of an adequacy decision, data may be transferred if the controller has provided appropriate safeguards and has ensured that enforceable data subject rights and effective legal remedies are available (Article 46 GDPR). Such safeguards may include the Standard Contractual Clauses (SCC) approved by the European Commission (the current version being Commission Implementing Decision (EU) 2021/914 of 4 June 2021) and, where data are transferred within a group of undertakings, Binding Corporate Rules (BCR) approved by the competent supervisory authority.
c) In specific situations: where none of the above legal bases can be applied, data may be transferred where the transfer is necessary for the performance of a contract between the data subject and the Controller or for the implementation of pre-contractual measures taken at the data subject’s request and for the provision of a service individually ordered by the Person, pursuant to Article 49 GDPR.
Information on domain registries and SSL certificate providers. Owing to the dynamic nature of the domain and SSL certificate market and the large number of entities involved, the controller is unable to include in this document an exhaustive list of all registries and providers. Information on domain registry operators, including their registered office, can be found on the website of IANA (Internet Assigned Numbers Authority): http://www.iana.org/domains/root/db. Information on SSL certificate providers is usually available on those entities’ websites and on the Controller’s website, in the section on SSL certificates.
Analytics and advertising services. The Controller uses analytics and advertising services provided by entities established in the EEA. Accordingly, as a rule, data are not transferred to third countries. In exceptional situations, should such a transfer take place (e.g. in connection with the use of global subcontractors), the controller will provide appropriate safeguards, in particular by applying Standard Contractual Clauses. We currently use the services of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) for Google Analytics and Google Ads, and Meta Platforms Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland) for Facebook and Instagram.
Transfers of personal data to the USA. Since 10 July 2023, transfers of data to organisations in the USA certified under the EU-US Data Privacy Framework comply with EU law without additional formalities. The list of certified organisations is published by the US Department of Commerce at https://www.dataprivacyframework.gov/. In the case of transfers to entities in the USA not covered by that framework, the Controller, where possible, applies the Standard Contractual Clauses (SCC) referred to above. These clauses introduce additional safeguards.
Risk of transferring data to third countries. The Controller makes every effort to minimise the risks associated with transfers of data outside the European Economic Area. However, despite the Controller’s efforts and the application of a range of security measures, the additional risk of such transfers of personal data must be taken into account. The laws of third countries outside the EEA, in particular those concerning government surveillance, may affect the protection of personal data in a manner inconsistent with EU privacy standards. This may also concern the enforcement of the Person’s rights regarding the processing of their personal data described in point 2.7 above.
2.10. Profiling
Automated decision-making, including profiling, may be carried out with respect to the Person for the purpose of providing services under the concluded agreement and for the Controller’s direct marketing and sales analysis. Profiling consists in the automatic identification of the Person’s interests and is aimed solely at better matching the services provided to the needs of the specific client. Profiling affects the advertisements offered to the Person but does not produce legal effects, nor is it based on so-called sensitive data (special categories of data).
2.11. Right to lodge a complaint
Every Person using the Controller’s services is entitled to appropriate explanations regarding the processing of their personal data from the data protection officer at the e-mail address: iod@cyberfolks.pl. The Person also has the right to lodge a complaint with the supervisory authority, which is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stanisława Moniuszki 1A, 00-014 Warsaw, Poland, e.g. where they consider that their personal data are processed in breach of the applicable law. The Person may also lodge a complaint with the supervisory authority in the Member State of their habitual residence, place of work or place of the alleged infringement.
3. Selected data protection methods.
3.1. The Provider applies various protection mechanisms to personal data, in particular: protection against unauthorised access, protection against data loss, protection against accidental or unauthorised modification of data.
3.2. Users’ passwords are not stored in the systems in plain text or encrypted in a reversible manner.
3.3. Login pages and places where data, including personal data, are entered are protected by encryption during data transmission between the User’s device and the Provider’s server (SSL certificate).
3.4. The Provider applies measures to protect against data loss (e.g. disk arrays, regular backups).
3.5. The Provider applies adequate measures to protect processing locations in the event of fire (e.g. alarm systems, special fire-extinguishing systems).
3.6. The Provider applies adequate measures to protect processing systems in the event of a sudden power failure (e.g. dual power lines, generators, UPS systems).
3.7. The Provider applies measures to physically protect access to data processing locations (e.g. access control, video surveillance, alarm systems).
3.8. The Provider applies measures to ensure appropriate environmental conditions for server systems as components of the data processing system (e.g. environmental monitoring, specialised air-conditioning systems).
3.9. The Provider applies organisational solutions to ensure the highest possible level of protection and confidentiality (training, internal regulations, codes of conduct, password policies, etc.).
3.10. The Provider has appointed a Data Protection Officer.
4. Information in forms.
4.1. The website collects information provided voluntarily by the User, including personal data, if provided.
4.2. The website records information on connection parameters (time stamp, IP address).
4.3. In some cases, the website may record information facilitating the linking of data in the form with the e-mail address of the User completing the form. In such a case, the User’s e-mail address appears in the URL of the page containing the form.
4.4. Data provided in a form are processed for the purpose resulting from the function of the specific form, e.g. to handle a service request or sales contact, register services, etc. In each case the context and description of the form clearly indicate its purpose.
5. System logs.
5.1. The Provider automatically creates security logs (system logs) and website usage statistics, which contain information on certain User behaviour. These data are used to administer the website and to ensure the most efficient handling of the hosting services provided.
5.2. The following are recorded: resources identified by URL (addresses of requested resources – pages, files); time of arrival of the User’s request; time of sending the response to the User; client device identifier – identification performed by the HTTP protocol; information on errors that occurred during HTTP transactions; URL of the page previously visited by the User (referrer link) – where the User reached the website via a link on another website; information on the User’s browser (name, version); information on the public IP address; diagnostic information related to self-service ordering via order forms on the website, in order to assess the correct layout of page elements; information related to e-mail handling, if the User uses the e-mail service provided by the Provider.
6. Information on cookies.
6.1. The website uses cookies.
6.2. Cookies are IT data, in particular text files, which are stored on the terminal device of the website User and are intended for use of the website’s pages. Cookies usually contain the name of the website they come from, their storage time on the terminal device and a unique number.
6.3. The entity placing cookies on the User’s terminal device and accessing them is the Provider and, as regards the cookies of the cooperating entities referred to in point 6.8, also those entities.
6.4. Two main types of cookies are used on the website: session cookies and persistent cookies. Session cookies are temporary files stored on the User’s terminal device until logging out, leaving the website or closing the software (web browser). Persistent cookies are stored on the User’s terminal device for the time specified in the cookie parameters or until deleted by the User.
6.5. Cookies are used for the following purposes:
| Type and legal basis | Purpose and detailed description |
|---|---|
| Functional – always active (the Controller’s legitimate interest) | These cookies are strictly necessary for the website to function. For example, the cookie that records the User’s consent or objection is needed so that we know whether the User has consented to certain activities on the website. These cookies also make it possible to log in to the Client Panel, add a product to the basket or place an order, as they maintain the User’s session so that the User does not have to re-enter the login and password on every subpage of the website. |
| Analytics and performance (User’s consent) | They make it possible to collect information on how the website is used. These files allow us to count visits and traffic sources on our website, so that we can measure and improve its performance, find out which pages are the most and least popular, and understand how visitors move around our website. They help us analyse website performance and collect aggregate information. For example, we can create heat maps, so that we know which content is readable and which is not, which allows us to design the website better. They also show us which blog posts were read more or less often, which allows us to develop more interesting content. |
| Social media (User’s consent) | These are cookies relating to social platforms which enable the User to be linked to their social media accounts. The User may share content from our website on them. Social network cookies (coming from third parties, e.g. Facebook) collect information in order to provide personalised advertising content. For example, advertisements on the social media used by the User are better matched to the User and reduce the chance of displaying advertisements for services or products already purchased. |
| Marketing (User’s consent) | These are files related to the operation of marketing automation systems and advertising accountability. They allow us, for example, to limit the number of times a given advertisement is displayed. They also allow us to carry out comparative tests through which we continuously improve our website. By testing many page layouts we can more easily find the one that provides the best readability for the User. Communication also becomes more personalised. For example, we can suggest to the User an article on how to find a domain name when we see that the User is looking for a domain and finding it difficult to find a suitable name. We can also, for example, display a login hint if we see several failed attempts in a row. On the basis of information from these cookies and activity on other websites, a profile of the User’s interests is built. We also use this type of cookie to keep information on service referrals for the purposes of the referral program. |
6.6. Web browsing software (web browser) usually allows cookies to be stored on the User’s terminal device by default. Website Users may change their settings in this respect. The web browser allows cookies to be deleted. Cookies can also be blocked automatically. Detailed information on this is available in the help or documentation of the web browser.
6.7. Restricting the use of cookies may affect some of the functionalities available on the website.
6.8. Cookies placed on the User’s terminal device with the User’s consent may also be used by entities cooperating with the Provider, in particular Google Ireland Limited, for Google Ads and Google Analytics, and Meta Platforms Ireland Limited, for Facebook and Instagram.
6.9. The Provider uses Google Analytics to analyse website traffic.
6.10. The Provider uses remarketing, i.e. activities enabling advertising networks to display to the User advertising messages tailored to the User’s behaviour on the website. The technical precondition for such activities is that cookies are enabled.
6.11. As regards information on the User’s preferences collected by the Google, Facebook and Instagram advertising networks, the User may view and edit information derived from cookies using the tools: https://www.google.com/ads/preferences/; https://www.facebook.com/help/109378269482053; https://help.instagram.com/478880589321969
6.12. How Google, Facebook and Instagram use personal data after consent has been given can be found in their privacy policies and terms of use: https://policies.google.com/technologies/partner-sites?hl=en; https://www.facebook.com/help/336858938174917; https://help.instagram.com/1896641480634370
7. Managing cookies – how to give and withdraw consent in practice?
7.1. If the User does not wish to receive cookies, they may change the browser settings or disable cookies by clicking the “Cookie settings” link in the footer of the website. It should be noted that disabling cookies necessary for authentication, security and maintaining the User’s preferences may hinder and, in extreme cases, prevent the use of the Provider’s websites. Cookies other than those necessary for the website to function are placed only after consent has been given in the cookie settings window. Consent may be changed or withdrawn at any time, as easily as it was given, via the “Cookie settings” link.
7.2. To manage cookie settings in your browser, select the web browser you use from the list below and follow the instructions: Microsoft Edge, Microsoft Internet Explorer, Google Chrome, Mozilla Firefox, Safari (macOS), Opera, Brave.
7.3. Mobile devices: Google Chrome (Android), Google Chrome (iOS iPhone), Mozilla Firefox Mobile (Android), Apple Safari (iOS iPhone), Samsung Internet (Mobile), Brave Mobile (Android), Windows Phone 7.
8. Changes to the Privacy Policy
8.1. The Provider reserves the right to amend the Privacy Policy if required by law or by changes made to the Provider’s websites, and in order to improve the operation of the Provider’s website.
8.2. The date indicated below is the effective date of the latest version of the Privacy Policy. Date of last changes: 7 June 2022.