Privacy Policy

Engave S.A. is a Polish IT consulting and technology company specializing in a holistic approach to enterprise digital transformation strategy.
‍
Engave shapes the digital future of its clients and makes digital transformation projects succeed, translating them into real business results. Thanks to comprehensive expertise, genuine passion, and a distinctive organizational culture, the company delivers effective change and a new, profitable growth path for its clients in the digital world. Fulfilling this mission is supported by the values that run through the company's everyday lifeblood.
‍
To assure Users of our website www.engave.pl (hereinafter: the "Website") that protecting the privacy of Website visitors is particularly important to us, and to provide Users with information about the personal data collected by the Website, the purpose of its collection and use, and the use of cookies - the personal data controller, Engave Spółka Akcyjna, with its registered office in Warsaw (03-116), at ul. Czarodzieja 16, entered in the Register of Entrepreneurs of the National Court Register kept by the District Court for the Capital City of Warsaw in Warsaw, 13th Commercial Division of the National Court Register, under number: 0000704729, NIP: 5223105508, share capital of PLN 100,000.00 (hereinafter: the "Controller"), presents this Privacy Policy (hereinafter: the "Policy").

We ensure privacy protection at a level at least equal to the standards set out in applicable legal regulations, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the "GDPR").

The Controller has appointed a Data Protection Officer, who can be contacted at iodo@engave.pl

‍Personal data processed on the Website
‍
When visiting our Website, data about the User may be shared by them in two ways: by connecting to the Website, and actively, by performing specific actions within the Website or through the Website.

‍1) Viewing the website www.engave.pl
‍Passively collected data is information automatically recorded by the Website: anonymous information about the User's visit time, IP address, URL address, browser type (so-called system logs), number of visits, device data, browser language, and operating system type. Automatically collected data is analyzed for statistical purposes using the standard Google Analytics solution. This tool operates based on so-called cookies and does not share data that would allow identification of the User. Google's privacy policy is available at https://www.google.com/intl/pl/policies/privacy/. Data collected in the manner described above is stored solely to support the administration of the Website, enabling it to function smoothly and to apply user-friendly solutions.

The legal basis for processing the IP address and other data indicated above is Article 6(1)(f) of the GDPR. Our legitimate interest arises from the purposes of data processing listed above. If the presentation serves to prepare a contract, the legal basis for processing is Article 6(1)(b) of the GDPR.

2) Data collected by the Website through User activity
a) Consultation or presentations, e-Guide
‍To use a consultation, a presentation, or to receive an e-Guide, the User may, on a one-time basis and without prior registration or login, complete a contact form by providing their first name, last name, email address, company name, and phone number.

The basis for processing your personal data is the necessity of processing for the purposes of our legitimate interest, namely the ability to provide consultations (Article 6(1)(f) of the GDPR).
‍
b) Contact form
‍The Website enables contact with the relevant Website departments via a contact form or by phone. By contacting us in one of the above ways, you provide your email address and/or phone number, first name, last name, company name, and position. This data is used solely for contact purposes, i.e., to prepare a response to the question asked by the User.

The basis for processing your personal data is the necessity of processing for the purposes of our legitimate interest, namely the ability to respond to the questions you ask (Article 6(1)(f) of the GDPR).

By checking the relevant checkboxes, you consent to receiving commercial information by electronic means of communication sent by www.engave.pl, and to the use of email or phone communication for marketing purposes. In that case, the User's personal data will also be processed by the Website for the purpose of providing offer information and delivering free newsletters containing offer information. Providing personal data is voluntary, but necessary to carry out specific marketing activities.

Additionally, we may contact you using personal data you have provided through social media platforms (e.g., LinkedIn). In the case of contact via social media platforms such as LinkedIn, the Controller obtains personal data in the form of the User's username or phone number/email address solely for contact purposes.

The legal basis for data processing is the necessity of processing for the purposes of the controller's legitimate interest in the form of direct marketing of services - Article 6(1)(f) of the GDPR in conjunction with Article 173 of the Telecommunications Law, or Article 6(1)(f) of the GDPR in conjunction with Article 10 of the Act on the Provision of Electronic Services, or Article 172 of the Telecommunications Law.

c) Job application and CV attachment
‍When you submit your interest in working with us and send in your documents, we gain the ability to consider your application in the recruitment process for the indicated position.

Providing your personal data is voluntary, but without it, it would not be possible to conduct a recruitment process involving you.

The legal basis for data processing is consent (Article 6(1)(a) of the GDPR) - by checking the relevant checkbox, or by otherwise sending a recruitment application to the Controller, you agree to the Controller processing the personal data contained in your recruitment application for the purpose of conducting recruitment for the position indicated in the job posting.

If you agree to participate in future recruitment processes, the legal basis for data processing is consent (Article 6(1)(a) of the GDPR). If you would like us to keep your CV in our database, please include the following consent statement in your CV: "I consent to Engave S.A., based in Warsaw, processing the personal data contained in my recruitment application for the purposes of future recruitment for similar positions."

‍d) Performance of sales contracts
‍The Controller's business activities include, among other things, offering services and goods that can be ordered remotely, outside the Controller's office. In connection with this, we process data necessary to conclude and perform the contract. This includes, in particular: first name, last name, billing and delivery address, email address, payment details, and phone number.

The legal basis for the processing described above is Article 6(1)(b) of the GDPR (and may additionally be linked to consent for a specific communication channel, e.g., shipping goods to a designated delivery address), meaning that you provide us with data in order to conclude and perform the contract.

‍e) Processing of data for advertising purposes, including through cookies
‍If you give the appropriate consent to the storage of cookies and similar technology on your device and to accessing it, we are entitled to process your personal data, such as information about your activity on the website (e.g., which areas of the site are visited, which links you use, etc.) for advertising purposes. This data may be used to build profiles of you for the purposes of our Website. This means that, through automated data processing, we evaluate selected elements in order to analyze your behavior, which can help, for example, in preparing forecasts for the future. This allows us to better tailor the displayed content to your individual needs and preferences. How the data is used depends on the specific content of the marketing consent you have given.

You have the right to withdraw your consent to our use of the data at any time, with respect to each communication channel. Withdrawing consent will take effect going forward, from the date the relevant request is submitted, meaning it will not affect the lawfulness of any processing of personal data carried out by us before the withdrawal. You also have the right, at any time and free of charge, to object to the processing of personal data for the purposes listed above. To withdraw consent or raise an objection, it is enough to, for example, send an email to the address given at the end of the Privacy Policy.

By checking the relevant checkboxes, you consent to receiving commercial information by electronic means of communication sent by www.engave.pl, and to the use of email or phone communication for marketing purposes. The User's personal data will also be processed by the Website for the purpose of providing offer information and delivering free newsletters containing offer information. Providing personal data is voluntary, but necessary to carry out specific marketing activities.

The legal basis for processing data is the necessity of processing for the purposes of the legitimate interest pursued by the controller, namely direct marketing of services, under Article 6(1)(f) GDPR in conjunction with Article 173 of the Telecommunications Law, or Article 6(1)(f) GDPR in conjunction with Article 10 of the Act on the Provision of Electronic Services or Article 172 of the Telecommunications Law; where appropriate consent has been obtained, the basis is Article 6(1)(a) GDPR. Processing customer data for our own advertising purposes is treated as a legitimate interest.

‍f) Pursuing claims
We may process data in order to pursue our claims or to defend ourselves against claims brought by the other party. The legal basis for processing the data is the necessity of processing for the purposes of the legitimate interest pursued by the controller (Article 6(1)(f) GDPR); the controller's legitimate interest is protection against claims related to the use of the website www.engave.pl.

‍g) Contests
Users may take part in various competitions on our website or on our social media profiles. Unless otherwise stated in the rules of a given competition, or unless you have given us further explicit consent, the personal data you provide as part of your participation in a competition is used solely to run the competition (e.g. selecting winners, notifying winners, sending prizes). The legal basis for processing data within competitions is Article 6(1)(b) GDPR. Where a consent statement is made as part of a competition, the legal basis for processing based on that consent is Article 6(1)(a) GDPR. If you have given consent as part of a competition, you may withdraw that consent at any time, with effect for the future.

‍h) Newsletter
Personal data is also processed if you wish to receive the newsletter offered by the controller. To provide the newsletter, we need your email address and information that allows us to confirm that you are the owner of the email address provided and that you agree to receive the newsletter.

You may unsubscribe from the newsletter at any time via the email address provided at the end of this Privacy Policy.

The legal basis for this processing of personal data under Article 6(1)(a) GDPR is your consent. Unsubscribing from the newsletter will be treated as withdrawal of consent to the processing of personal data in this respect. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

‍Entities to which the Controller transfers data
‍We transfer your personal data to:

a) to entities processing data on behalf of the controller, in particular service providers (such as IT, insurance, legal and tax advisors, entities providing accounting services, marketing agencies – such entities process data under an agreement with the controller and solely in accordance with the controller's instructions). For processing data via cookies and similar technologies used to process usage data, we work with specialized service providers, particularly from the online marketing sector. Payments are handled by payment service providers who process the data necessary to carry out the transaction. More information on data processing by payment service providers and their contact details can be found in the information texts on the data-entry screen or on the payment service provider's website.

All our service providers process your data on our behalf as processors; in each case they are carefully selected and bound by appropriate contractual obligations in accordance with Article 28 GDPR.

b) third parties, in particular authorized bodies, if such an obligation results from mandatory legal provisions or from the rules of cooperation between the parties, but in that case only with your consent.

User data may be disclosed by the controller only to entities that provide it with technical and IT support (hosting services, maintenance and servicing of IT systems), including entities from countries outside the European Economic Area – in particular the United States of America. These entities are bound by binding corporate rules in accordance with Article 47 GDPR; standard data protection clauses adopted by the Commission; standard data protection clauses adopted by a supervisory authority and approved by the Commission pursuant to the examination procedure; an approved code of conduct together with binding and enforceable commitments of the controller or processor in the third country to apply appropriate safeguards, including with regard to data subjects' rights; or an approved certification mechanism together with binding and enforceable commitments of the controller or processor in the third country to apply appropriate safeguards, including with regard to data subjects' rights. In other cases, no transfer of personal data outside the European Economic Area is envisaged.

Rights of individuals regarding the personal data provided
You are entitled to the rights guaranteed by the EU GDPR, the conditions for which should be verified on a case-by-case basis:
- the right to information about the processing of your personal data (Article 15 GDPR)
- the right to rectify inaccurate data or complete incomplete data (Article 16 GDPR)
- the right to have your data erased (Article 17 GDPR)
- the right to restrict the processing of your data (Article 18 GDPR)
- the right to receive the data you have provided in a structured, commonly used, machine-readable format (Article 20 GDPR)

In addition, you may withdraw any consent given at any time. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

To exercise these rights, please send a message by post or email to: biuro@engave.pl. When responding to an information request, we may, if necessary, ask you for proof confirming that you are the person you claim to be.

Providing your data is voluntary; however, failure to provide it may prevent you from contacting the controller, subscribing to the newsletter, or using the services offered by the controller via the website.

If you believe that the controller's processing of your personal data violates GDPR provisions, you have the right to lodge a complaint with the supervisory authority – the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych).

You also have the right to object to all the processing purposes described in this Privacy Policy where the processing is based on Article 6(1)(f) GDPR.

Data retention period. We will process your personal data:
a) if a contract is concluded with the User, the data will generally be processed by the controller for the duration of that contract, and after its termination – for the period in which any related claims may arise.
‍
b) in the event of pursuing claims, your data will be stored for the duration of the court proceedings, including the period of enforcement of the judgment.

c) until you object, to the extent that the legal basis for processing the data is the necessity of processing for the purposes of the legitimate interest pursued by the controller (Article 6(1)(f) GDPR),

d) until you withdraw your consent to processing, if consent was given. Withdrawal of consent will take effect for the future, meaning it will not affect the lawfulness of any actions taken by us before its withdrawal.

e) session cookies are retained for up to 2 years or until deleted from the web browser, while persistent cookies remain in the browser until their expiration date or until deleted by the user from the browser; once the IP address has been anonymized, it can no longer be linked to you.

f) after the competition ends and the winners are selected, participants' personal data is deleted, unless its retention is required by other legal provisions (e.g. tax regulations).

g) for the purposes of ensuring accountability – such data may generally be stored indefinitely. We inform you, however, that this will only occur in exceptional cases – e.g. where you have objected to the processing.

h) after our website is closed, geolocation data is deleted.

This website is not intended for persons under the age of 18
The website is not intended for persons who have not reached the age of 18, and therefore engave.pl does not collect or store information relating to individuals known to be minors.

Use of cookies and pixels (plugins)
To ensure you can comfortably use our website, we use so-called cookies. In addition, the Service contains plugins, so-called pixels, enabling connections to social media platforms or other websites managed by other controllers. A detailed description of the rules and types of cookie and pixel processing is provided in the Cookie Policy, which forms an integral part of this Privacy Policy.

We emphasize that the controller of this Service has no influence over the privacy policies or cookie policies of the above-mentioned controllers and bears no responsibility for them. We therefore encourage Users to review the privacy policies and cookie policies of those services.

Google Analytics
Our Service uses Google Analytics, a web analytics service provided by Google Inc., 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA ("Google"). Google Analytics uses cookies, and the information generated by cookies about your use of this website is generally transferred to a Google server in the USA and stored there. Detailed information on this matter is available in our Cookie Policy.

By installing a browser plugin, users can prevent information collected by cookies (including the IP address) from being sent to Google. You can download and install the relevant plugin from the following website: https://tools.google.com/dlpage/gaoptout?hl=pl. Further information on data usage by Google Inc. is available at: https://support.google.com/analytics/answer/6004245?hl=pl

Changes to the privacy policy
Changes to the privacy policy will only be made to raise privacy protection standards or to bring the policy into line with legal requirements. The User will be informed of any change every time via a notice sent to their email address, provided the User has consented to being contacted in this way.
‍
The controller is not responsible for actions or omissions by Users as a result of which the controller processes the personal data provided by them in the manner described in this Privacy Policy.
‍
Contacting the Controller
Please send any reports of irregularities, comments, or requests regarding the Privacy Policy to the following correspondence address: Engave Spółka Akcyjna, ul. Czarodzieja 16, 03-116 Warszawa, or by email: biuro@engave.pl.
We guarantee that every report will be reviewed by us, and we will respond to the email address provided in the report.

Processing of personal data in the course of our business activities – information for Business Partners

As the controller processes personal data in connection with establishing business contacts, developing cooperation with business partners, conducting contract negotiations, and concluding and performing contracts, the controller provides you, as Business Partners, with the following information. It also applies to the processing of data of contact persons responsible for pursuing the above purposes within your companies, who do not themselves need to be a party to the contract.

The specific scope of personal data processed depends on the business relationship we have with you and the scope of services provided.

As a rule, the data we process is obtained from the data subjects themselves. However, in certain situations, in order to ensure legal compliance or to pursue legitimate interests (e.g. as part of business partner verification), it may be necessary to process data obtained from third parties. These may be other companies, state authorities, public offices, or business intelligence agencies. Data may also be obtained from public registers or other publicly available sources (e.g. through internet searches). In addition, we obtain data on your employees or associates from you, and the purpose of processing it is the controller's legitimate interest in performing services, a contract, or other activities on your behalf, and in maintaining and developing cooperation with you.

The scope of personal data processed may include: basic data (e.g. first and last name, address and other contact details, date and place of birth, and nationality), identification and authentication data (e.g. excerpts/copies from public registers, ID card number, signature specimen), employment-related data (e.g. position held, department, supervisor), data relating to our business relationship (e.g. payment details or details relating to an order), username and user ID, compliance-related data (e.g. information on references, insolvency proceedings, or proceedings related to the subject matter of the cooperation), as well as other categories of data comparable to those listed above.

I. Purposes of data processing / legal basis
Performance of contractual obligations (Article 6(1)(b) GDPR)
The purposes of data processing arise from actions leading to the conclusion of a contract, the conduct of a business relationship based on the concluded contract, and the performance of contractual obligations.

If you have concluded a contract with us that was signed with an electronic signature, the related data is processed, in particular the email address, IP address, and timestamps relating to changes made to documents.

Fulfillment of legal obligations (Article 6(1)(c) GDPR)
In some cases, the purposes of data processing arise from legal requirements. These include, among others, fulfilling archiving and identification obligations, e.g. under anti-money laundering regulations, tax audit obligations, or other reporting obligations, as well as processing data in order to respond to inquiries from authorized state authorities.

Pursuit of legitimate interests (Article 6(1)(f) GDPR)
In order to properly perform the contract, it may be necessary to further process your personal data. Legitimate interests here include, in particular: selecting an appropriate business partner, conducting compliance audits, carrying out verifications for financial assessment purposes, processing data of contact persons, attributing work results to individual business partners, maintaining financial reporting, and conducting business negotiations with contact persons on behalf of current and future business partners.

II. Categories of recipients
Access to your personal data is granted only to those entities for which it is necessary to fulfill contractual obligations, pursue legitimate interests, or comply with legal obligations. For the purposes indicated above, access to your personal data may also be granted to entities processing data on our behalf, public authorities, and other service providers.

III. Retention period
Personal data will be stored for as long as necessary to achieve the processing purposes indicated above. This period may vary depending on the purpose of processing, as well as legal requirements regarding the retention of a given type of data. Examples include the limitation period for claims arising from business activity and the limitation period for tax liabilities, amounting to 3 and 5 years respectively from the end of the calendar year in which the claim became due or in which the tax payment deadline expired. In special cases, the retention period may extend beyond that specified above (need for accountability, archival purposes, construction documentation, etc.).

IV. Obligation to provide data
In order for our business relationship to be established, conducted, and concluded, and for the related obligations to be fulfilled, you are required to provide the personal data that is necessary for this purpose and which we are obliged to collect under applicable law or entitled to collect due to legitimate interests. Without this data, we will generally not be able to enter into a business relationship with you.

V. Transfer of data to third countries
If it becomes necessary to transfer personal data to recipients outside the European Economic Area, this will only take place where the European Commission has determined that an adequate level of data protection applies in the given third country. In the absence of such a decision, transfer may take place provided a level of protection at least equal to that applicable within the EU is ensured (e.g. through EU standard contractual clauses), or where you have given us your consent to do so.

VI. Contact details of the data controller
The controller of personal data is Engave Spółka Akcyjna, with its registered office in Warsaw (03-116), at ul. Czarodzieja 16.

If you have any questions regarding the processing of your personal data, please contact the controller at the correspondence address indicated above, or the Data Protection Officer appointed by the controller, at: iodo@engave.pl