PRIVACY POLICY AND COOKIES

Dear Users.

We care about your privacy and want you to feel comfortable when using our services. Therefore, below we present the most important information:

about the rules of processing your personal data by us,

and

about the cookies we use.

Data Controller

The controller of your personal data is us, i.e. the West Pomeranian ICT Cluster with its registered office in Szczecin (ul. Niemierzyńska 17a, 71-441 Szczecin), KRS: 0000385020, NIP: 851-314-59-37, REGON: 320993252.

In the remainder of this Policy, for your convenience, we will refer to ourselves as “Controller” or “Cluster”.

If you have any questions regarding the processing of your personal data by us, please contact us at: biuro@klaster.it.

You can also send us a letter to the operational address: West Pomeranian ICT Cluster, Technopark Pomerania, building F3, ul. Cyfrowa 6, floor B.3.13, 71-441 Szczecin.

What personal data do we process, for what purposes and on what legal basis?

If you want to cooperate with us or use the functionalities of our website, we need to process your personal data. However, we ensure that we do so in compliance with personal data protection regulations, in particular the GDPR. If you are wondering which of your data we process, why we do it and whether we have the right to do so, please read the information below.

PROCESSING RELATED TO MEMBERSHIP IN THE ICT CLUSTER

Why do we process your data?	We process data in order to: handle membership matters (admitting members, maintaining a member list, ongoing communication, exercising rights and obligations arising from the statute and resolutions), calculate and settle membership fees, organise the Cluster’s activities and projects (invitations to meetings, events, consultations, information exchange within the Cluster’s activities), facilitate cooperation between companies (matchmaking / inquiries).
What data do we process?	In particular: first and last name of representatives and contact persons, contact details (e-mail, phone), company data (name, tax number, address, KRS/REGON – if applicable), position/role, billing/settlement data, content of correspondence.
On what legal basis?	Article 6(1)(c) GDPR This provision allows processing when necessary to comply with a legal obligation. We have a legal obligation to make appropriate tax settlements regarding membership fees, resulting, among others, from the Tax Ordinance or the CIT Act. Article 6(1)(b) GDPR This provision allows processing when necessary for the performance of a contract or to take steps to enter into it. Here, this concerns the membership relationship and cooperation with the Cluster. Article 6(1)(f) GDPR This provision allows processing when necessary for legitimate interests. Here, our legitimate interest is conducting statutory activity, communication, and organization of the Cluster’s activities.
Is providing these data necessary?	Providing these data is voluntary, but necessary to handle membership and cooperation with the Cluster. If you refuse, we will not be able to cooperate.
How long will we process these data?	The data will be processed for the period of membership in the Cluster or cooperation, and then until our and your claims become time-barred, but not earlier than required by our accounting and tax obligations.

PROCESSING IN CONNECTION WITH PROVIDING AND SETTLING SERVICES

Why do we process your data?	We process data in order to: settle payments with you, including issuing an invoice, fulfill our tax obligations.
What data do we process?	Business activity data, in particular: company/name/first and last name, NIP registered office address, other data disclosed in accounting documents or in an agreement concluded with ADO.
On what legal basis?	Article 6(1)(c) GDPR This provision allows processing where it is necessary for compliance with a legal obligation. We are obliged to make appropriate tax settlements arising, inter alia, from the Tax Ordinance or the Corporate Income Tax Act. Article 6(1)(b) GDPR This provision allows processing where it is necessary for the performance of a contract to which the data subject is party or in order to take steps prior to entering into a contract.
Is providing these data necessary?	Providing these data is voluntary, but necessary for providing our services to you and settling them in accordance with applicable regulations. If you refuse to provide these data, we will not be able to cooperate with you or provide services to you and then settle them.
How long will we process these data?	Data will be processed until limitation of our and your claims arising from the agreement concluded with you, but not earlier than required by our accounting and tax obligations.

CONTACT DATA PROCESSING

Why do we process your data?	We process data in order to: contact you.
What data do we process?	First and last name, E-mail address, Phone number, Other data you provide in correspondence.
On what legal basis?	Article 6(1)(f) GDPR This provision allows processing where it is necessary for the purposes of legitimate interests pursued by the controller. In this case, our legitimate interest is responding to the message you send to us (e.g. via the contact form on our website).
Is providing these data necessary?	Providing these data is voluntary, but necessary to contact us and obtain our response. If you refuse to provide these data, we will not be able to respond to your message.
How long will we process these data?	Data will be processed until the processing purpose is achieved, but no later than until you successfully object to processing of these data.

PROCESSING OF DATA RELATED TO ANALYTICS

Why do we process your data?

We process data in order to:

analyse your activity on our website.

What data do we process?

Date and time of visits,
IP address,
Operating system type,
Approximate location (country),
Time spent on the website,
Actions taken on the website,
Visited subpages.

On what legal basis?

Article 6(1)(a) GDPR

This provision allows processing where you give appropriate consent. In this case, we collect consent for analytics cookies.

Article 6(1)(f) GDPR

This provision allows processing where it is necessary for legitimate interests pursued by the controller. In this case, our legitimate interest is obtaining information about your activity on our website, optimising it, and tailoring content to recipients.

Is providing these data necessary?

Providing these data is voluntary, but necessary to obtain information about your behaviour on our website. If you refuse to provide them, we will not be able to analyse your activity on the website.

How long will we process these data?

Data will be processed until the processing purpose is achieved, but no later than until you successfully object to processing of these data.

PROCESSING RELATED TO THE WEBSITE

Why do we process your data?	We process data in order to: manage our website.
What data do we process?	Data saved automatically in server logs when using the website: IP address, Behaviour on the website, Server date/time.
On what legal basis?	Article 6(1)(f) GDPR This provision allows processing where it is necessary for legitimate interests pursued by the controller. In this case, our legitimate interest is managing the website, optimising it and ensuring its proper operation.
Is providing these data necessary?	Providing these data is voluntary, but necessary to manage our website and enable its proper functioning. The consequence of not providing these data will be inability to take these actions.
How long will we process these data?	Data will be processed until the processing purpose is achieved, but no later than until you successfully object to processing of these data.

PROCESSING RELATED TO CLAIMS

Why do we process your data?	We process data in order to: establish, pursue or defend against claims.
What data do we process?	First and last name / Company / Business name, Contact details: e-mail address, home address, phone number, National ID number (PESEL) or KRS number, Tax number (NIP), Other data/information obtained during cooperation or performance of our services.
On what legal basis?	Article 6(1)(f) GDPR This provision allows processing where it is necessary for legitimate interests pursued by the controller. In this case, our legitimate interest is having data that enable us to establish claims, pursue them and defend against claims of others.
Is providing these data necessary?	Providing these data is voluntary, but necessary to establish, pursue and defend against claims. The consequence of not providing these data will be inability to take these actions.
How long will we process these data?	Data will be processed until limitation of our and your claims arising from the agreement concluded with you, i.e. 3 years (if you are an entrepreneur) or 6 years (if you are a consumer) from the date the agreement expires.

PROCESSING RELATED TO SOCIAL MEDIA

Why do we process your data?	We process data to manage our social media profiles such as Facebook, LinkedIn and YouTube.
What data do we process?	Your profile name, Your profile image made public by you, Data posted in comments under our posts or in private messages, Statistical and advertising data.
On what legal basis?	Article 6(1)(f) GDPR This provision allows processing where it is necessary for legitimate interests pursued by the controller. In this case, our legitimate interest is running and managing our social media profiles.
Is providing these data necessary?	Providing these data is voluntary, but necessary to interact with our social media profiles. The consequence of not providing these data will be inability to take these actions.
How long will we process these data?	Data will be processed until the processing purpose is achieved, but no later than until you successfully object to processing of these data.

PROCESSING RELATED TO EVENT ORGANISATION

Why do we process your data?	We process data in order to: organise events and enable you to participate in them; take photos and video recordings and then disseminate them in order to prepare event coverage and promote the Cluster’s activities.
What data do we process?	Data included in the registration form, in particular: First and last name, Contact details: e-mail, phone number, Name of the organisation you belong to; Attendance list at the event, Your image contained in: reportage shots (e.g. the venue, audience as part of a larger whole), close-up/portrait shots where you are the main subject.
On what legal basis?	Article 6(1)(b) GDPR This provision allows processing where it is necessary for the performance of a contract with the data subject or in order to take steps prior to entering into a contract. In this case, it concerns the agreement to participate in an event organised by us. Article 6(1)(a) GDPR This provision allows processing where you give appropriate consent. In this case, it concerns consent to disseminate your image contained in close-up/portrait shots where you are the main subject. Article 6(1)(f) GDPR This provision allows processing where it is necessary for legitimate interests pursued by the controller. In this case, our legitimate interest is fulfilling contractual and settlement obligations related to event organisation (in particular with our partners), as well as preparing and disseminating event coverage and promoting the Cluster’s activities (this concerns images contained in reportage shots).
Is providing these data necessary?	Providing the data included in the registration form and the attendance list is voluntary, but necessary to participate in an event organised by us. The consequence of not providing these data will be inability to take these actions. Providing image data is voluntary and refusal to provide them does not entail any consequences.
How long will we process these data?	Data related to event registration and the attendance list will be processed until limitation of our and your claims arising from the agreement concluded with you, i.e. 3 years (if you are an entrepreneur) or 6 years (if you are a consumer) from the date the agreement expires. Image data contained in: a) reportage shots will be processed until the processing purpose is achieved, but no later than until an objection to processing is raised; b) close-up/portrait shots will be processed until the processing purpose is achieved, but no later than until the consent is withdrawn.

PROCESSING RELATED TO RECRUITMENT TO THE CLUSTER (EMPLOYMENT)

Why do we process your data?	We process your personal data in order to: conduct recruitment and employ you in our organisation.
What data do we process?	First and last name, Date of birth, Contact details provided by you, Education, Professional qualifications, Employment history, Other personal data you provide in your application.
On what legal basis?	Article 6(1)(c) GDPR This provision allows processing where we comply with a legal obligation. When you apply for employment with us, we are obliged to collect certain personal data. This obligation arises from Article 22(1) § 1 of the Polish Labour Code. Article 6(1)(a) GDPR This provision allows processing where you give consent. You may give consent if you want us to use your application for potential future recruitment or to process personal data other than those required under the Labour Code (e.g. your image in a CV photo).
Is providing these data necessary?	Providing the data required by the Labour Code is mandatory and necessary for recruitment. If you refuse to provide these data, we will not be able to consider your application. Providing other data is voluntary and refusal does not affect recruitment.
How long will we process these data?	Data will be processed until the current recruitment is completed or until consent is withdrawn (only for data other than those required by the Labour Code). Further processing is possible if you consent to processing for future recruitment.

PROCESSING RELATED TO “CAREER IN IT” (CV / INTERNSHIPS / TRAINEESHIPS / SHARING APPLICATIONS WITH MEMBER COMPANIES)

Why do we process your data?	We process your personal data in order to: receive and handle your application for employment, internship or traineeship with Cluster members (sending a CV / submitting via a form), share your application with companies affiliated with the Cluster that may be interested in cooperation (recruitment to member companies).
What data do we process?	Data you provide in the form and in the submitted CV, in particular: first and last name, e-mail, phone number, information about competences/experience, links to portfolio, CV content (including data voluntarily included in your CV).
On what legal basis?	Article 6(1)(a) GDPR This provision allows processing where you give consent. You may give this consent if you want us to share your application with interested Cluster members.
Is providing these data necessary?	Providing data is voluntary, but necessary to handle the application and share it with member companies. If you refuse to provide these data, we will not be able to share your application with member companies.
How long will we process these data?	Data will be processed until the handling of the application is completed, no longer than necessary to match your application with an interested company, and until consent is withdrawn.

Recipients of personal data

Recipients of your personal data may include external service providers, e.g. IT service providers, marketing agencies, hosting providers, subcontractors and other entities processing data on our behalf under a data processing agreement, as well as accountants, lawyers, public authorities, state services and courts.

Depending on the purpose of processing, recipients of your data may also include:

companies affiliated with the ICT Cluster, where you submit an application or CV using forms on our website under “Career in IT”,
event partners and public entities within the scope of attendance lists/settlements (e.g. marshal’s office/organisational unit), acting as separate controllers,
IT and hosting service providers (website maintenance, e-mail, cloud tools), including providers of form and analytics tools.

We have profiles on Facebook, LinkedIn and YouTube. Information about arrangements regarding processing of your personal data on our social media profiles is available in the privacy policies and other documents published by the services operating these social media.

For analytics of traffic and your activity on our website, we use Google Analytics and statistical data. The tool provider (Google) processes data on our behalf as a processor based on a data processing agreement (DPA) or other service terms.

Transfers to third countries (outside the European Economic Area)

Due to our use of tools such as Google Analytics, your personal data may be transferred to third countries such as the USA or the United Kingdom.

The basis for transfers to:

the United Kingdom and the USA is a European Commission adequacy decision. In the case of the USA, this concerns entities included in the list of organisations providing an adequate level of protection. The list is maintained by the U.S. Department of Commerce and is available at: https://www.dataprivacyframework.gov/list
More information about: Standard Contractual Clauses is available at:
- countries ensuring an adequate level of protection is available at: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en?prefLang=pl;
Standard Contractual Clauses is available at:

https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en

Your rights

Because we process your personal data, you have the following rights:

the right to obtain confirmation from us as to whether your personal data are being processed and, if so, access to the data and a copy of them (right of access);
the right to request rectification of incorrect or incomplete data;
the right to request erasure of your personal data if we no longer have a legal basis for processing or the data are no longer necessary (right to be forgotten);
the right to restriction of processing, e.g. if you believe data are inaccurate, processing is unlawful, or we no longer need the data (we may then only store them);
the right to data portability if we process data on the basis of your consent or a contract and processing is carried out by automated means;
the right to object to processing of your personal data based on legitimate interests, for reasons related to your particular situation, including profiling. We will then assess whether there are compelling legitimate grounds overriding your interests, rights and freedoms, or grounds for establishing, pursuing or defending claims;
the right to withdraw consent at any time without giving reasons, which does not affect the lawfulness of processing before withdrawal;
the right to lodge a complaint with the President of the Personal Data Protection Office (UODO) if you believe processing violates the GDPR: https://uodo.gov.pl/pl/83/155.

Profiling

We do not make decisions about you based solely on automated processing that would produce legal effects concerning you or similarly significantly affect you.

We may use statistical data concerning website use (e.g. within Google Analytics) to analyse traffic and improve the service. If such data are collected using analytics cookies, the legal basis is your consent to analytics cookies, which you can withdraw at any time in the cookie settings.

Cookie Policy

Our website uses cookies, i.e. small text files containing IT data. These files are stored on your device from which you browse our website. Cookies allow, inter alia, displaying websites adjusted to individual user preferences and most often contain:

the website address,
the time the cookie is stored on the user’s device,
a unique identifier.

We use cookies that are necessary for the basic functions of the website, as well as third-party cookies thanks to which we analyse traffic on our website. Non-essential cookies are stored in your browser only with your consent and you may withdraw it at any time. The consequence of withdrawing consent may be improper operation of our website.

The following types of cookies are used on our website:

	NECESSARY (including WordPress sessions, form security) and remembering your settings in the consent banner (CookieYes). These cookies may be used without your consent and remain on your device for up to 1 year.
	FUNCTIONAL, i.e. cookies that provide certain functions such as sharing content placed on the website or on social media profiles. They remain on your device for up to 1 year.
	ANALYTICS, which indicate the number of visitors, where visitors come from, and track your activity on our website. We also use these data to optimise the website. For this purpose we use Google Analytics. These cookies are launched only after you give consent in the CookieYes banner.

You can change cookie settings and delete cookies manually in your browser. Detailed information on handling cookies and configuration options for a given browser can be found in the browser’s help section.

Final provisions

We reserve the right to introduce changes to this Privacy Policy, which may be affected by the development of Internet technology, possible changes in personal data protection law and the development of our website. We will inform you of any changes in a visible and understandable manner.

Our website may contain links to other websites. Such websites operate independently of us and are not supervised by us in any way. These websites may have their own privacy policies and terms and conditions, which we recommend you review.