Privacy Policy and Cookie Policy – Klisza

Klisza

https://klisza.click/

I. Service Provider and Owner of the Klisza App:

Konrad Hopek Development

Świtezianki 2/32

31-563, Kraków, Poland

Tax ID (NIP): 9452234681

II. General Information

1. This document sets out the privacy rules of the Klisza App at https://klisza.click/ and in the mobile app, regarding the collection, processing, and use of personal data.

2. Personal data collected in the app is processed pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (hereinafter GDPR).

3. As a provider of cloud-based Software as a Service (SaaS), Klisza mainly acts as a processor within the meaning of Art. 4(8) GDPR. Independently of this, Klisza also processes personal data on its own account and therefore also acts as a data controller within the meaning of Art. 4(7) GDPR.

III. Principles of Personal Data Processing

1. Personal data is processed in accordance with the principles of Art. 5 GDPR, i.e.:

a) processed lawfully, fairly, and in a transparent manner in relation to the data subject ("lawfulness, fairness and transparency");

b) collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes ("purpose limitation");

c) adequate, relevant, and limited to what is necessary for the purposes for which they are processed ("data minimization");

d) accurate and kept up to date where necessary ("accuracy");

e) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data is processed ("storage limitation");

f) processed in a manner that ensures appropriate security of personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical or organizational measures ("integrity and confidentiality").

2. Klisza takes particular care to protect the privacy and information provided to it concerning commercial Customer-Users and other Users of the App. Klisza diligently selects and applies appropriate technical measures, including software and organizational measures, to ensure the protection of processed data — in particular protecting data from unauthorized access, disclosure, loss and destruction, unauthorized modification, as well as from processing in violation of applicable law.

IV. Legal Bases for Processing Personal Data and Categories of Data

1. The legal bases for processing personal data derive from GDPR (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016). When we inform you that we process personal data based on:

a) Art. 6(1)(a) GDPR – it means we process personal data based on consent obtained,

b) Art. 6(1)(b) GDPR – it means we process personal data because it is necessary to perform a contract or to take steps prior to entering into a contract, at your request,

c) Art. 6(1)(c) GDPR – it means we process personal data to fulfil a legal obligation,

d) Art. 6(1)(f) GDPR – it means we process personal data to pursue legitimate interests.

2. Klisza processes the following categories of personal data for the following purposes:

a) name, address, and contact details – to conclude and perform a contract or present an offer, at the data subject's request, pursuant to Art. 6(1)(b) GDPR;

b) name, address and contact details, tax ID number – to fulfil legal obligations, in particular regarding tax settlements, pursuant to Art. 6(1)(c) GDPR;

c) name, address, and contact details – to pursue legitimate interests, i.e. establishing and defending against claims and marketing our own products and services to customers, pursuant to Art. 6(1)(f) GDPR;

d) name, email address, and phone number, if provided via contact forms. Users provide this data voluntarily for the purpose of processing comments, questions or improvement suggestions for the app, and processing is based on their consent under Art. 6(1)(a) GDPR, which may be withdrawn at any time without affecting the lawfulness of processing based on consent prior to its withdrawal;

V. Purposes of Personal Data Processing

1. If you visit our website or mobile app without registering or providing additional information, we only process personal data transmitted by your device to our servers. This includes: IP addresses, technical data about your browser and operating system, approximate location, and notifications of potential errors (e.g. failures). The legal basis is our legitimate interest (Art. 6(1)(f) GDPR), in particular to analyze and ensure the functioning of our website and products. Providing this information is not a statutory obligation but is necessary for our website and products to function.

2. When a User creates a (trial) account to use our products, we process (i) information we assign to the User as the (trial) account owner and which is required to contact them. This includes: first name, last name, email address, phone number, and (ii) specialization.

3. For individual users of our products assigned to specific (trial) accounts, we process information required to establish contact and uniquely identify the user. This includes contact data such as first name, last name, email address, and phone numbers. We also process information about the user's activity within our products, in particular activity data such as the number of created projects, the number of created tasks, and the device used. The legal basis for processing this data is taking steps prior to signing a contract or performing obligations arising from a contract (Art. 6(1)(b) GDPR) and our legitimate interests (Art. 6(1)(f) GDPR), in particular to ensure the functioning of our websites and products, continuously improve our products, and optimize our marketing activities.

4. Upon activation of a paid account, in addition to the data mentioned above, we will also process data relating to the company (e.g. company name, company address, tax ID number, email addresses, phone numbers, contact persons, positions), (iii) information about the type and content of our contractual relationship (e.g. the number, type, and duration of activated licenses), and (iv) marketing-related information such as industry and target group, as well as information about the origin and history of (trial) accounts. We will also process data regarding the form of payment for subscription plans. The legal basis for processing this data is the performance of our contractual obligations (Art. 6(1)(b) GDPR), the performance of legal obligations (Art. 6(1)(c) GDPR) and our legitimate interests (Art. 6(1)(f) GDPR), in particular optimizing our accounting processes and managing liquidity.

5. We will also process data relating to individual packages (e.g. company name, number of tasks, and package conditions) and information from technical logs necessary for the App to function (e.g. construction log files, potential error notifications). The legal basis for processing this data is the performance of our contractual obligations (Art. 6(1)(b) GDPR), the performance of legal obligations (Art. 6(1)(c) GDPR) and our legitimate interests (Art. 6(1)(f) GDPR), in particular to analyze and ensure the functioning of our products.

6. When visiting our website, we use our own cookies as well as cookies from selected partners. We also use various analytics and optimization tools (e.g. monitoring of websites, apps, performance) when you visit our websites and use our products. Cookies and optimization/analytics tools are used only to the extent you have given consent, unless their use is necessary for the functioning and secure operation of our websites and products. If you have given consent, we also use these tools to process your IP address and technical data about your browser and operating system, your approximate location, demographic data, the source of visitors to our website, and activity data (i.e. clicks and page visits), to improve user experience and the scope of information we offer, as well as to analyze and optimize the operation of our websites and products, including optimizing our marketing activities. The legal basis for processing data in this regard is your explicit consent (Art. 6(1)(a) GDPR) and our legitimate interests (Art. 6(1)(f) GDPR), in particular to analyze and ensure the functioning of our websites and products. You may partially restrict or fully withdraw your consent to the use of cookies and the aforementioned analytics tools at any time.

7. For other purposes, the Customer's personal data may be processed based on:

a) applicable law – when processing is necessary to fulfil a legal obligation, e.g. when the Controller settles concluded sales contracts based on tax or accounting regulations (Art. 6(1)(c) GDPR);

b) the necessity for purposes other than those listed above arising from legitimate interests, in particular to establish, pursue, or defend claims, and for market and statistical analyses (Art. 6(1)(f) GDPR).

VI. Period of Personal Data Processing

1. Data processed to perform a contract is stored for the period necessary to perform, terminate, or otherwise expire the concluded Electronic Service Agreement.

2. Data processed under applicable law is stored for the period required by law, e.g. the retention of tax books (until the limitation period for the tax obligation expires, unless tax laws provide otherwise).

3. Data processed for purposes arising from legitimate interests will be stored for the duration of that legitimate interest, but no longer than the limitation period for claims.

4. Personal data processed for purposes covered by a consent statement will be processed until the consent is withdrawn.

VII. Recipients of Personal Data

1. Recipients of Customer or other users' data may include entities performing activities and services on behalf of Klisza: accounting firms, IT solution providers (Heroku, AWS), payment service providers, banks, marketing service providers, telecommunications service providers, law firms, and authorized state authorities.

2. Online payment processing is provided by:

a) Stripe – Stripe Payments Europe, Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin.

b) payments on iOS and Android are processed according to Apple Pay and Google Pay policies.

3. All entities to which we entrust the processing of personal data guarantee the application of appropriate data protection and security measures required by law.

4. Personal data is generally processed within the European Economic Area ("EEA"). However, due to Klisza's cooperation with third parties in connection with the App, personal data may be transferred to a country outside the EEA where a partner cooperating with Klisza maintains tools for processing personal data in connection with cooperation with Klisza. Any such data transfer will occur only to the extent necessary in connection with the services these entities provide to Klisza.

5. When personal data is transferred to entities established outside the EEA, Klisza ensures compliance with the requirements set out in Chapter V of GDPR, including the application of appropriate transfer safeguards in the form of standard contractual clauses adopted by decision of the European Commission.

VIII. Profiling

1. Klisza may use profiling in the App for direct marketing purposes, provided that decisions made by Klisza on this basis do not concern the conclusion or refusal to conclude a contract for the provision of electronic services.

2. Profiling involves the automated analysis or prediction of a person's behavior in the app. The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning them or similarly significantly affects them.

IX. Your Rights Regarding the Protection of Personal Data

1. Given the voluntary nature of providing your personal data, you have the right to:

a) access your personal data (Art. 15 GDPR);

b) rectify your personal data (Art. 16 GDPR);

c) erase your personal data ("right to be forgotten") (Art. 17 GDPR);

d) restrict the processing of your personal data (Art. 18 GDPR);

e) data portability (Art. 20 GDPR);

f) object (Art. 21 GDPR);

2. Right of access

You have the right to obtain from us confirmation as to whether we process personal data concerning you. If so, you have the right to access that data, as well as to receive additional information about: the purposes of processing, the categories of data concerned, the recipients or categories of recipients to whom the data has been or will be disclosed, in particular recipients in third countries or international organizations, the envisaged period for which the data will be stored, or, where not possible, the criteria used to determine that period, the right to request rectification, erasure, or restriction of processing, to object to such processing, and the right to lodge a complaint with a supervisory authority, the source of the data if it was not collected from you, and the existence of automated decision-making, including profiling, and the logic involved, as well as the significance and envisaged consequences of such processing for you. Upon receiving such a request, we are obliged to provide a copy of the personal data undergoing processing. If such a request is made electronically and unless you request otherwise, we will provide the information electronically as well.

3. Right to rectification

You have the right to request that we promptly rectify inaccurate personal data concerning you. Taking into account the purposes of processing, you have the right to request completion of incomplete personal data, including by providing a supplementary statement.

4. Right to erasure ("right to be forgotten")

You have the right to request that we promptly erase personal data concerning you. We are then obliged to erase personal data without undue delay if one of the following circumstances applies: you have withdrawn consent to the processing of your personal data and we have no other legal basis for processing, you have successfully objected to the processing of data concerning you, your personal data has been processed unlawfully, your personal data must be erased to comply with a legal obligation, or your data was collected in connection with the offer of information society services.

5. Right to restriction of processing

You have the right to request that we restrict processing in the following cases: when you contest the accuracy of the data — for a period enabling us to verify its accuracy; the processing is unlawful and you oppose the erasure of the data, requesting the restriction of its use instead; we no longer need the personal data for processing purposes, but you need it to establish, exercise, or defend legal claims; or you have objected to processing — pending verification of whether our legitimate grounds override those of your objection.

6. Automated decisions, including profiling

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you.

7. This right does not apply if the decision:

is necessary for entering into or performing a contract between you and us,

is authorized by Union law or Polish law, which also lays down suitable measures to safeguard your rights, freedoms, and legitimate interests, or

is based on your explicit consent.

8. Right to lodge a complaint

You have the right to lodge a complaint regarding the processing of your personal data with the supervisory authority:

Personal Data Protection Office (Urząd Ochrony Danych Osobowych)

ul. Stanisława Moniuszki 1A, 00-014 Warsaw, Poland

+48 22 531-03-00

fax +48 22 243-05-69

office hours: 8:00 AM–4:00 PM

Helpline: +48 606-950-000

open on business days: 10:00 AM–2:00 PM

9. Consent to the processing of personal data may be withdrawn at any time. Withdrawal of consent does not affect the lawfulness of processing carried out by the Controller based on consent before its withdrawal.

COOKIE POLICY

1. Klisza uses cookies.

2. Cookies are computer data, in particular text files, stored on Users' devices and intended for use with websites.

3. The cookies used are safe for Users' devices. In particular, they do not allow viruses or other unwanted or malicious software to enter Users' devices. These files allow us to identify the software used by the User and tailor Services to each User individually. Cookies typically contain the name of the domain they come from, the length of time they are stored on the device, and an assigned value.

4. Due to the purpose of collection, we distinguish the following types of Cookies:

a) necessary: required for the proper functioning of the service – processed based on the administrator's legitimate interest (Art. 6(1)(f) GDPR);

b) statistical: allow us to study traffic on the website, learn about our users' preferences, analyze their behavior on the service, and enable interaction with external networks and platforms – processed based on the user's voluntary consent (Art. 6(1)(a) GDPR);

c) marketing: allow us to tailor displayed ads and content to our users' preferences and to run personalized marketing campaigns – processed based on the user's voluntary consent (Art. 6(1)(a) GDPR).

5. In terms of validity period, we distinguish two categories of cookies:

a) session cookies – existing until the end of a given session,

b) persistent cookies – existing after the session has ended.

6. In terms of the entity administering the cookies, we distinguish:

a) our own cookies,

b) third-party cookies.

7. Cookies may be used by advertising networks, in particular the Google network, to display ads tailored to how the Customer uses the Online Store. For this purpose, information about the Customer's navigation path or time spent on a given page may be retained.

8. Regarding information about Customer preferences collected by the Google advertising network, the Customer may view and edit information resulting from cookies using the tool: https://www.google.com/ads/preferences/.

9. Users may independently and at any time change their cookie settings, determining the conditions for storing and accessing cookies on their device. Changes to these settings can be made via web browser settings or service configuration. These settings can be changed in particular to block automatic cookie handling in browser settings or to notify you each time cookies are placed on your device. Detailed information on the possibilities and methods of handling cookies is available in your software (browser) settings.

10. To learn how to manage cookies, including how to disable their handling in your browser, you can use your browser's help file. You can find information on this by pressing F1 in your browser. You can also find relevant guidance on the following pages, depending on the browser you use: Firefox, Chrome, Safari, Internet Explorer / Microsoft Edge.

11. Restricting the use of cookies may affect some of the functionalities available on the service's website.

12. The service also collects external cookies, so-called third-party cookies, which originate from external servers.

13. Because Klisza cooperates with other entities as part of the App, for the purposes of this cooperation your browser also stores cookies originating from partners with which Klisza cooperates. This is used to collect, among other things, information about Products viewed. Cookies sent by these entities are intended in particular to ensure the proper functioning of the App and to improve the effectiveness of displaying ads that correspond to your online activity. Your data in this regard will be processed to the extent of the consent you have given, among other things to ensure the accuracy and attractiveness of displayed product and service ads, or to make appropriate settlements for the publication of these ads. If you do not want the above partner to process your data collected on our pages to ensure the accuracy and attractiveness of the product and service ads displayed to you, you may withdraw your consent. (Google Analytics, Google Ads, Meta Pixel, YouTube).

Klisza reserves the right to change this privacy and cookie policy. The new version will be posted on the App's website or in the mobile App.

Privacy policy