§ 1. General provisions and data controller
This Privacy and Cookie Policy (hereinafter the ‘Policy’) sets out the rules for the processing and protection of personal data of Users of the website available at bulbree.com (hereinafter the ‘Website’) and the rules for the use of cookies and other similar technologies.
The controller of Users’ personal data is Bulbree Sp. z o.o., with its registered office at ul. Januszowicka 5, 53-135 Wrocław, NIP: 8993064327, REGON: 545329554 (hereinafter the ‘Controller’).
In all matters relating to the processing of personal data and the exercise of rights related to data processing, the Controller may be contacted by e-mail at kontakt@bulbree.com or in writing at the registered office address indicated above.
The Controller processes personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR) and the applicable provisions of Polish law.
§ 2. Definitions
Controller: the entity indicated in § 1(2) of the Policy, which determines the purposes and means of the processing of personal data.
Personal data: any information relating to an identified or identifiable natural person (User).
GDPR: Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation).
Website: the website available at bulbree.com.
User: any natural person visiting the Website or using the functionalities made available on it.
Cookies: small text files stored on the User’s terminal device while using the Website.
§ 3. Purposes, legal bases and period of data processing
The Controller processes Users’ personal data for the following purposes and on the following legal bases:
1. Handling enquiries submitted via the contact form
Scope of data: first name, e-mail address and the content of the message, as well as any other data voluntarily provided by the User in the message.
Purpose: responding to the enquiry and corresponding with the User.
Legal basis: Article 6(1)(f) GDPR, namely the Controller’s legitimate interest in handling enquiries and communicating with interested persons.
Retention period: for the time necessary to handle the enquiry, and thereafter until any claims become time-barred or until an effective objection is raised.
2. Statistics, analytics and marketing
Scope of data: data collected automatically by means of cookies and similar technologies, including IP address, device and browser identifiers, and data on activity on the Website (details in §§ 9 to 11).
Purpose: compiling traffic statistics, analysing how the Website is used, optimising content and conducting marketing and remarketing activities.
Legal basis: Article 6(1)(a) GDPR, namely the User’s consent given by means of browser settings or the cookie banner (with regard to analytical and marketing cookies).
Retention period: until consent is withdrawn or the individual cookies expire (in accordance with §§ 9 and 10).
3. Establishment, pursuit and defence of claims
Purpose: protecting the Controller’s interests in connection with any potential claims.
Legal basis: Article 6(1)(f) GDPR, namely the Controller’s legitimate interest.
Retention period: until the expiry of the limitation period for claims provided for by law.
§ 4. Recipients of personal data
Users’ personal data may be transferred to the following categories of recipients, solely to the extent necessary to achieve the purposes indicated in § 3:
- providers of hosting and e-mail services on whose servers the Website’s data is stored;
- providers of analytics and marketing tools, in particular Google LLC (Google Analytics) and Meta Platforms Ireland Limited / Meta Platforms, Inc. (Meta Pixel);
- entities providing IT, accounting, legal or advisory services to the Controller;
- state authorities or other entities authorised under the law.
Entities processing data on behalf of the Controller do so on the basis of data processing agreements concluded with the Controller and solely in accordance with its instructions.
§ 5. Transfer of data outside the European Economic Area (EEA)
In connection with the use of tools provided by Google and Meta, Users’ personal data may be transferred to countries outside the European Economic Area, including the United States.
Data is transferred with appropriate safeguards as referred to in Article 46 GDPR, in particular on the basis of standard contractual clauses approved by the European Commission or, in the case of certified entities, under the Data Privacy Framework (EU-US DPF). The User has the right to obtain a copy of the safeguards applied by contacting the Controller.
§ 6. Rights of data subjects
In connection with the processing of personal data, the User has the following rights:
- the right of access to their data and to obtain a copy of it;
- the right to rectification (correction) of data;
- the right to erasure of data (‘right to be forgotten’);
- the right to restriction of processing;
- the right to data portability;
- the right to object to the processing of data on the basis of the Controller’s legitimate interest;
- the right to withdraw consent at any time, in the case of data processed on the basis of consent, without affecting the lawfulness of processing carried out before its withdrawal;
- the right to lodge a complaint with the supervisory authority, the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warszawa), if the User considers that the processing of their data infringes the GDPR.
To exercise the above rights, please contact the Controller in the manner indicated in § 1(3) and § 13 of the Policy.
§ 7. Voluntary provision of data
Providing personal data is voluntary; however, in some cases it may be necessary in order to use certain functionalities of the Website. Failure to provide data in the contact form will make it impossible to respond to the enquiry.
§ 8. Data security
The Controller applies appropriate technical and organisational measures to protect the personal data processed, appropriate to the risks and the categories of data protected, including securing data against disclosure to unauthorised persons, loss, damage or destruction. The connection to the Website is encrypted using the SSL/TLS protocol.
§ 9. Cookies
The Website uses cookies, i.e. small text files stored on the User’s terminal device (computer, tablet, smartphone). Cookies make it possible to recognise the User’s device and to display the website appropriately, tailored to their individual needs.
In terms of storage duration, the Website uses:
- session cookies: temporary files stored until the User leaves the website or closes the browser;
- persistent cookies: stored for the period specified in the cookie parameters or until they are manually deleted by the User.
In terms of purpose and origin, the Website uses:
- necessary cookies: required for the Website to function properly; they do not require the User’s consent;
- functional cookies: used to remember selected settings and for personalisation;
- analytical cookies: used to compile statistics and analyse traffic on the Website;
- marketing cookies: used to conduct advertising and remarketing activities;
- third-party cookies: originating from external tool providers (e.g. Google, Meta).
Analytical and marketing cookies are used only after the User has given consent by means of the cookie banner displayed on the first visit to the Website. Consent may be changed or withdrawn at any time via the cookie settings or the browser settings.
§ 10. Analytics and marketing tools
Google Analytics
The Website uses the Google Analytics service provided by Google LLC in order to analyse how the Website is used and to compile statistics and reports on its functioning. Google Analytics uses cookies and collects data such as IP address (in anonymised form), information about the device and browser, and data on activity on the Website. Further information and the option to opt out are available at: https://policies.google.com/privacy and https://tools.google.com/dlpage/gaoptout.
Meta Pixel (Facebook Pixel)
The Website uses the Meta Pixel tool provided by Meta Platforms Ireland Limited in order to measure the effectiveness of advertising and to conduct remarketing activities on Meta services (Facebook, Instagram). The tool uses cookies and collects information about the User’s activity on the Website. Meta’s rules for processing data are available at: https://www.facebook.com/privacy/policy.
The above tools are used on the basis of the User’s consent (Article 6(1)(a) GDPR), given by means of the cookie banner.
§ 11. Managing cookies
The User may change their cookie settings at any time, specifying the conditions for storing cookies and accessing the device. Settings can be changed using the web browser settings or via the cookie consent management panel on the Website.
The User may block or delete cookies independently in their browser settings. Instructions are available on browser manufacturers’ websites (including Google Chrome, Mozilla Firefox, Microsoft Edge, Safari, Opera).
Restricting or disabling the use of cookies may affect certain functionalities of the Website and make it more difficult to use.
§ 12. Changes to the Policy
The Controller reserves the right to make changes to this Policy, in particular in the event of changes in legislation, in the technologies used on the Website or in the scope of services provided. The current version of the Policy is always available on the Website, together with the date of the last update.
§ 13. Contact
In all matters relating to the protection of personal data and this Policy, the Controller may be contacted at:
Controller: Bulbree Sp. z o.o.
Address: ul. Januszowicka 5, 53-135 Wrocław
E-mail: kontakt@bulbree.com