Privacy Policy (GDPR) π
We are committed to protecting your privacy. This policy explains how we collect, use, and protect your personal data in compliance with the General Data Protection Regulation (GDPR).
Table of Contentsβ
- Introduction
- Data Controller
- Data We Collect
- How We Use Your Data
- Legal Basis for Processing
- Data Sharing
- Data Transfers
- Data Retention
- Your Rights
- Data Security
- Cookies
- Children's Privacy
- Policy Changes
- Contact Us
Introductionβ
1it.pro ("we", "us", "our") respects your privacy and is committed to protecting your personal data. This privacy policy will inform you as to how we look after your personal data when you visit our website and tell you about your privacy rights and how the law protects you.
This policy applies to all services provided by 1it.pro including our website, CRM systems, automation tools, and all related services.
Data Controllerβ
Company Informationβ
π’ Data Controller Details:β
Company Name: 1it.pro Legal Form: Jednoosobowa dziaΕalnoΕΔ gospodarcza (JDG) Registration Number: [Your Registration Number] Address: [Your Address], Poland Contact Email: [email protected] Contact Phone: +48 571 314 537 Data Protection Officer: [email protected]
Our Roleβ
As data controller, we are responsible for deciding how your personal data is processed and for complying with GDPR requirements.
Data We Collectβ
Personal Dataβ
We collect various types of information about you:
Information You Provideβ
π Direct Collection:β
Account Information: β’ Name and surname β’ Email address β’ Phone number β’ Company name and position β’ Username and password β’ Billing information
Service Information: β’ Website content you create β’ CRM data (clients, deals) β’ Communication history β’ Documents and attachments β’ Configuration settings
Support Communications: β’ Messages and emails to support β’ Support tickets and history β’ Recorded calls (with consent) β’ Feedback and surveys
Information Automatically Collectedβ
π Automatic Collection:β
Technical Data: β’ IP address β’ Browser type and version β’ Operating system β’ Device information β’ Referring website β’ Pages visited and time spent
Usage Data: β’ Services used β’ Features accessed β’ Actions performed β’ Errors encountered β’ Performance data
Authentication Data: β’ Login times and locations β’ Failed login attempts β’ Security events β’ Session duration
Special Categories of Dataβ
We may process special categories of data with your explicit consent:
π Special Data (with consent):
β’ Biometric data (if using facial recognition)
β’ Health data (rarely, with explicit consent)
β’ Political opinions (rarely, if relevant to services)
β’ Religious beliefs (rarely, if relevant to services)
How We Use Your Dataβ
Primary Purposesβ
We use your personal data for specific purposes:
Service Provisionβ
πΌ Service Delivery:β
β’ Creating and managing your account β’ Providing website and CRM services β’ Setting up automation tools β’ Processing payments β’ Delivering support services β’ Providing backups and security
Communicationβ
π¬ Communication Purposes:β
β’ Responding to your inquiries β’ Sending service notifications β’ Providing updates about changes β’ Sending newsletters (with consent) β’ Marketing communications (with consent) β’ Security alerts and warnings
Improvement and Developmentβ
π Service Improvement:β
β’ Analyzing usage patterns β’ Identifying service issues β’ Testing new features β’ Improving user experience β’ Developing new services β’ Optimizing performance
Security and Complianceβ
π Security and Compliance:β
β’ Preventing fraud and abuse β’ Protecting against cyber attacks β’ Ensuring data security β’ Complying with legal obligations β’ Maintaining audit trails β’ Conducting security reviews
Automated Decision Makingβ
We may use automated processing for certain purposes:
π€ Automated Processing:
With Your Consent:
β’ Personalized service recommendations
β’ Content customization
β’ Relevant marketing offers
Without Explicit Consent:
β’ Spam and malware detection
β’ Security threat identification
β’ Service technical optimization
You have the right to object to automated decision making that significantly affects you.
Legal Basis for Processingβ
GDPR Legal Basesβ
We process your data based on these legal grounds:
Contract Performanceβ
π Contract Necessity:
When Required: β’ Providing services you requested β’ Processing payments β’ Delivering agreed services β’ Managing your account
Examples: β’ Website hosting requires your account data β’ CRM services need your business data β’ Support communications require issue details
Legal Obligationβ
βοΈ Legal Requirement:
When Required: β’ Tax and accounting obligations β’ Anti-money laundering checks β’ Data retention laws β’ Security incident reporting
Examples: β’ Keeping financial records for required period β’ Reporting security breaches to authorities β’ Maintaining audit trails
Legitimate Interestsβ
π― Legitimate Interests:
When Used: β’ Network and information security β’ Fraud prevention β’ Direct marketing (limited) β’ Service improvement β’ Business analytics
Examples: β’ Monitoring for security threats β’ Preventing account abuse β’ Analyzing usage to improve services
Consentβ
β Consent-Based Processing:
When Required: β’ Marketing communications β’ Data analytics beyond service delivery β’ Personalization features β’ Special category data processing
Examples: β’ Sending newsletters (opt-in required) β’ Using cookies for analytics β’ Personalizing website content
We will always seek your explicit consent for processing that requires it under GDPR.
Data Sharingβ
Who We Share Data Withβ
We may share your data with specific categories of recipients:
Service Providersβ
π’ Third-Party Service Providers:
Hosting Providers:
β’ Data center operators (Hetzner, etc.)
β’ Cloud service providers
β’ Content delivery networks
Communication Services:
β’ Email service providers
β’ SMS gateways
β’ Telecommunication providers
Payment Processors:
β’ Payment gateways
β’ Banks and financial institutions
β’ Billing service providers
Technical Services:
β’ Security software providers
β’ Monitoring services
β’ Backup and storage providers
Legal Requirementsβ
βοΈ Legal Sharing:
When Required:
β’ Law enforcement authorities
β’ Regulatory bodies
β’ Tax authorities
β’ Court orders
Process:
β’ Verify legal basis
β’ Provide only required data
β’ Document disclosure
β’ Notify you (unless prohibited)
Business Transfersβ
π Business Changes:
Possible Scenarios:
β’ Sale of business unit
β’ Merger or acquisition
β’ Asset transfer
β’ Restructuring
Your Rights:
β’ Notified in advance
β’ Right to object
β’ Data protection maintained
β’ Choice of new controller
Data Transfersβ
Your data may be transferred outside the EU:
Transfer Mechanismsβ
π International Transfers:
Adequacy Decision:
β’ To countries with adequacy decision
β’ Recognized sufficient protection
Appropriate Safeguards:
β’ Standard Contractual Clauses (SCCs)
β’ Binding Corporate Rules (BCRs)
β’ EU-US Privacy Shield (if applicable)
β’ Your explicit consent
Transfers To:
β’ United States (with safeguards)
β’ Other countries with proper protections
β’ Limited transfers for specific purposes
Data Retentionβ
How Long We Keep Dataβ
We retain your data only as long as necessary:
Retention Periodsβ
β° Data Retention by Type:
Account Data:
β’ While account active: Indefinitely
β’ After account closure: 3 years
β’ Legal requirement: As required
Transaction Data:
β’ Financial records: 7 years (tax requirement)
β’ Payment data: 5 years
β’ Invoices: 7 years
Communications:
β’ Support tickets: 2 years
β’ Emails: 2 years
β’ Chat history: 1 year
Analytics Data:
β’ Usage statistics: 2 years
β’ Performance data: 1 year
β’ Security logs: 1 year
Special Cases:
β’ Legal holds: Until matter resolved
β’ Regulatory requirements: As specified
β’ Litigation: Until conclusion
Deletion Processβ
ποΈ Deletion Process:
Automatic Deletion:
β’ When retention period expires
β’ Account closure completed
β’ Service termination
Manual Deletion:
β’ Your deletion request
β’ Data no longer needed for purpose
β’ Duplicate or obsolete data
Verification:
β’ Confirm identity for deletion
β’ Verify account ownership
β’ Prevent accidental deletion
β’ Document deletion action
Your Rightsβ
GDPR Rightsβ
You have specific rights regarding your personal data:
Right to Accessβ
π Access Your Data:
What You Can Request:
β’ Confirmation if we process your data
β’ Copy of all your personal data
β’ Categories of data we process
β’ Purposes of processing
β’ Recipients of your data
How to Request:
β’ Through personal account
β’ Email to [email protected]
β’ Free of charge (unless excessive)
Response Time:
β’ Within 1 month (extendable by 2 months)
β’ Secure delivery method
β’ Data in common format
Right to Rectificationβ
βοΈ Correct Your Data:
When to Request:
β’ Data is inaccurate
β’ Data is incomplete
β’ Information needs updating
Our Response:
β’ Correct without undue delay
β’ Notify recipients of correction
β’ Inform of your right to rectify
β’ Confirm completion
Right to Erasureβ
ποΈ Delete Your Data:
When to Request:
β’ Data no longer needed for purpose
β’ Consent withdrawn (only if based on consent)
β’ Legitimate interest objection
β’ Unlawful processing
β’ Legal obligation requires deletion
Exceptions:
β’ Legal obligation to keep
β’ Exercise of legal rights
β’ Public interest task
β’ Public health purpose
β’ Archiving purpose
Right to Restrict Processingβ
βΈοΈ Restrict Data Use:
When to Request:
β’ Accuracy contested (during verification)
β’ Unlawful processing (but you want retention)
β’ No longer needed but you need retention
β’ Objection to processing (during verification)
During Restriction:
β’ Storage only
β’ No active processing
β’ With consent: other processing
β’ With agreement: certain processing
Right to Data Portabilityβ
π€ Move Your Data:
When to Request:
β’ Processing based on consent
β’ Automated processing
β’ Directly provided by you
What You Receive:
β’ Structured, common format
β’ Machine-readable format
β’ Transmission to another controller
β’ Where technically feasible
Format Options:
β’ CSV, JSON, XML
β’ Direct API access
β’ Physical media (if needed)
Right to Objectβ
π« Object to Processing:
Legitimate Interest Processing:
β’ At any time
β’ Specific reasons for objection
β’ Stop processing unless:
β’ Compelling legitimate grounds
β’ Legal claims exercise
Direct Marketing:
β’ Absolute right to object
β’ No costs or fees
β’ Simple method to object
β’ Immediate effect on marketing
Automated Decision Rightsβ
π€ Automated Decisions:
Your Rights:
β’ Not subject to solely automated decisions
β’ Express your point of view
β’ Request human intervention
β’ Challenge the decision
β’ Obtain explanation
Exceptions:
β’ Contract performance necessity
β’ Authorized by law
β’ With your explicit consent
Right to Withdraw Consentβ
β Withdraw Consent:
How to Withdraw:
β’ Any time, as easily as given
β’ In personal account settings
β’ By email to [email protected]
β’ Unsubscribe links in communications
Effect:
β’ Stops future processing
β’ Past processing legality unaffected
β’ Cannot retroactively delete all effects
β’ Alternative legal basis may exist
Exercising Your Rightsβ
How to Make Requestsβ
π Request Process:
Required Information:
β’ Your identity (name, email, account ID)
β’ Specific right being exercised
β’ Relevant details about your request
Submission Methods:
β’ Email: [email protected]
β’ Mail: [Company Address]
β’ Through personal account
β’ In-person appointment (by arrangement)
Response:
β’ Within 1 month typically
β’ Explanation if extension needed
β’ Action taken details
β’ Information about further rights
Data Securityβ
Security Measuresβ
We implement appropriate security measures:
Technical Securityβ
π Technical Protections:
Encryption:
β’ Data at rest: AES-256
β’ Data in transit: TLS 1.3
β’ Key management: HSM
β’ Regular key rotation
Access Control:
β’ Authentication required
β’ Multi-factor authentication
β’ Role-based permissions
β’ Principle of least privilege
β’ Regular access reviews
System Security:
β’ Regular updates and patching
β’ Security monitoring 24/7
β’ Intrusion detection/prevention
β’ Vulnerability scanning
β’ Penetration testing
Organizational Securityβ
π₯ Organizational Measures:
Policies and Procedures:
β’ Security policies documented
β’ Staff training programs
β’ Data handling procedures
β’ Incident response plans
β’ Compliance monitoring
Physical Security:
β’ Secure data center access
β’ Visitor controls
β’ Equipment security
β’ Environmental controls
β’ Surveillance systems
Security Breachesβ
Breach Notificationβ
π¨ Security Incident Response:
Detection:
β’ Immediate assessment
β’ Impact determination
β’ Affected individuals identification
Notification:
β’ Within 72 hours of awareness
β’ To you (if affected)
β’ To supervisory authority
β’ Clear description of breach
β’ Likely consequences
β’ Measures taken/proposed
What We Provide:
β’ Nature of breach
β’ Categories of data concerned
β’ Likely consequences
β’ Contact point for more info
β’ Measures to address risks
Cookiesβ
What Are Cookiesβ
Cookies are small text files stored on your device when you visit our website.
Cookie Types We Useβ
πͺ Cookie Types:
Essential Cookies:
β’ Required for website to function
β’ Authentication
β’ Shopping cart (if applicable)
β’ Security features
Functional Cookies:
β’ Remember your preferences
β’ Language settings
β’ Display settings
β’ Saved forms
Analytical Cookies:
β’ Website analytics
β’ Usage statistics
β’ Performance monitoring
β’ Anonymized data collection
Marketing Cookies:
β’ Personalization
β’ Ad tracking (limited)
β’ Conversion tracking (with consent)
β’ Social media integration
Managing Cookiesβ
βοΈ Cookie Control:
Your Options:
β’ Accept all cookies
β’ Reject all cookies (limits functionality)
β’ Select by category
β’ Browser settings
β’ Cookie consent banner
Browser Management:
β’ Clear cookies anytime
β’ Block cookies from specific sites
β’ Private/incognito browsing
β’ Third-party cookie controls
Website Options:
β’ Cookie settings panel
β’ Consent management
β’ Opt-out of analytics
β’ Marketing preferences
Local Storageβ
We may use browser local storage for:
πΎ Local Storage Uses:
β’ User preferences
β’ Application state
β’ Session information
β’ Cached data
β’ Authentication tokens
Same privacy principles apply to local storage as cookies.
Children's Privacyβ
Our Policyβ
We do not knowingly collect personal data from children under 16 without parental consent.
What We Doβ
πΆ Children's Privacy:
β
DO:
β’ Implement age verification where appropriate
β’ Obtain parental consent when required
β’ Limit data collection from children
β’ Provide clear privacy notices
β’ Respond to parental requests
β DON'T:
β’ Target children in marketing
β’ Collect excessive data from children
β’ Share children's data without consent
β’ Track children across sites
Parental Rightsβ
π¨βπ©βπ§ Parental Rights:
If Child Data Collected:
β’ Review child's data
β’ Request deletion
β’ Object to processing
β’ Withdraw consent
β’ Additional information request
Policy Changesβ
Updates and Notificationsβ
We may update this privacy policy from time to time:
When Changes Occurβ
π Policy Updates:
Notification:
β’ Website notice
β’ Email to registered users
β’ Significant changes: 30 days notice
β’ Minor changes: Notice in reasonable time
What May Change:
β’ New services added
β’ Legal requirements change
β’ Technology improvements
β’ Business model changes
β’ Feedback from users
Continued Useβ
β
Your Choices:
After Changes:
β’ Review updated policy
β’ Continue use = acceptance
β’ Object to changes: Contact us
β’ Close account ifδΈεζ
β’ Export data before account closure
Contact Usβ
How to Reach Usβ
For questions about this privacy policy or your personal data:
Contact Informationβ
π§ Privacy Inquiries:
Email: [email protected]
Phone: +48 571 314 537
Mail: [Company Address]
Data Protection Officer: [email protected]
Response Time: Within 30 days
For Data Subject Requests:
Email: [email protected]
Subject: Data Subject Request - [Your Name]
Required: Identity verification
Complaintsβ
If you are not satisfied with our response:
βοΈ Supervisory Authority:
You Have the Right to:
β’ Complain to supervisory authority
β’ Seek judicial remedy
β’ Contact Polish Data Protection Authority (UODO)
β’ Contact relevant authority in your country
Polish Authority:
UODO (UrzΔ
d Ochrony Danych Osobowych)
Website: uodo.gov.pl
Effective Dateβ
This privacy policy is effective from: [Date]
This policy was last updated: [Date]
We reserve the right to update this policy at any time.
What Next?β
- π Terms of Service
- π Cookie Policy
- π How to Get Help
- π Contact Privacy Team