Privacy Policy

1. Data controller

The controller of personal data collected through the mDiv.pl website is:

On any matters related to personal data protection, the controller can be contacted by email or by post at the address above.

2. Legal basis for processing

Personal data is processed on the basis of:

• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (GDPR),
• the Polish Act of 10 May 2018 on the protection of personal data (Journal of Laws 2018, item 1000, as amended),
• the Polish Act of 18 July 2002 on the provision of services by electronic means (Journal of Laws 2002, no. 144, item 1204, as amended),
• the Polish Act of 16 July 2004 - Telecommunications Law (Journal of Laws 2004, no. 171, item 1800, as amended).

3. Processing purposes and scope of data

The controller processes personal data for the following purposes:

4. Data retention period

Personal data is retained for the following periods:

• Contact form - for the time needed to respond to and handle the enquiry, no longer than 12 months from the last contact.
• Contract performance - for the duration of the contract and the limitation period for claims arising from the contract.
• Accounting documentation - for 5 years from the end of the calendar year in which the tax obligation arose, in accordance with applicable tax law.

5. Rights of the data subject

In connection with the processing of personal data, you have the following rights:

• Right of access to your data (Article 15 GDPR),
• Right to rectification of data (Article 16 GDPR),
• Right to erasure of data - the "right to be forgotten" (Article 17 GDPR),
• Right to restriction of processing (Article 18 GDPR),
• Right to data portability (Article 20 GDPR),
• Right to object to processing (Article 21 GDPR),
• Right to withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.

To exercise these rights, please contact the controller by email or in writing.

You also have the right to lodge a complaint with the supervisory authority - the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, uodo.gov.pl).

6. Data recipients

Personal data may be transferred to the following categories of recipients, only to the extent necessary to achieve the processing purposes:

• providers of hosting services and server infrastructure,
• email service providers,
• accounting office or accounting software,
• entities authorised to obtain data on the basis of applicable law.

The controller does not sell or share personal data with third parties for marketing purposes.

7. Transfer of data to third countries

As a rule, the controller does not transfer personal data outside the European Economic Area (EEA). Where tools from providers based outside the EEA are used, data may be transferred to third countries only on the basis of appropriate legal safeguards, such as standard contractual clauses approved by the European Commission or a decision confirming an adequate level of protection.

8. Cookies

The mDiv.pl website uses cookies to ensure that the website works correctly.

Types of cookies:

• Strictly necessary - required for the website to function properly (e.g. remembering the selected colour theme). They do not require user consent.
• Functional - allow user preferences to be remembered and the website interface to be personalised.

Managing cookies:

The user can change cookie settings in their web browser at any time, including blocking or deleting cookies. Detailed information is contained in the documentation of the browser provider. Restricting the use of cookies may affect some functionalities of the website.

Legal basis: Article 173 of the Polish Act of 16 July 2004 - Telecommunications Law.

9. Data security

The controller applies appropriate technical and organisational measures to protect the personal data processed, in particular:

• encryption of the connection using an SSL/TLS certificate,
• regular updates of software and systems,
• access control to personal data,
• regular creation of backups.

10. Changes to the Privacy Policy

The controller reserves the right to make changes to this Privacy Policy. Changes take effect on the date the updated version is published on the website. The last updated date is shown at the top of this document.