INTRODUCTION

  1. This Privacy Policy explains how personal data is processed and protected within the Website available at the electronic address www.fsv.pl 
  2. The controller of personal data  (hereinafter: the Controller) is FSV spółka z ograniczoną odpowiedzialnością with its registered office in Lublin, at ul. Frezerów 3, 20-209 Lublin, entered in the register of entrepreneurs maintained by the District Court Lublin–Wschód in Lublin, based in Świdnik, 6th Commercial Division of the National Court Register, under KRS number 0001027366, NIP 9462726782, REGON 524834716.
  3. Users may address any questions or concerns to the Controller, particularly those concerning personal data processing:
  1. by post - to the address of the Controller's registered office;
  2. by email to: info@fsv.pl
  3. through the website www.fsv.pl
  1. The Controller ensures that personal data entrusted to it is processed in compliance with the requirements of generally applicable law, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (OJ EU L 2016.119.1) - hereinafter referred to as GDPR.  
  2. The Controller's overriding objective is to ensure that Users of the Website receive privacy protection at least equivalent to the requirements of applicable law, particularly the GDPR.
  3. Any person using the Website in any way accepts all the rules contained in this Privacy Policy. 
  4. The Controller reserves the right to amend the Privacy Policy if required by law or by changes to the Website's functionality. 
  5. The Controller will notify all Users of the relevant changes and their effective date, in particular by posting an appropriate notice on the Website.

KEY TERMS

PURPOSES, LEGAL BASES, SCOPE OF DATA PROCESSING AND INFORMATION ABOUT FORMS

  1. The Controller processes personal data only where at least one of the following conditions is met:
  1. where the Website User gives consent in the forms provided on the Website, for the purpose of taking the actions to which those forms relate (Article 6(1)(a) GDPR);
  2. where processing is necessary for the performance of a contract to which the Website User is a party (Article 6(1)(b) GDPR);
  3. for handling complaints - the legal basis for processing is its necessity for the performance of a contract (Article 6(1)(b) GDPR);
  4. for compliance with a legal obligation to which the Controller is subject (Article 6(1)(c)),
  5. for the possible establishment, exercise or defence of claims - the legal basis for processing is the Controller's legitimate interest in protecting its rights (Article 6(1)(f) GDPR);
  6. for the Controller's marketing purposes, consisting of informing the User about the current offer and new Website functionalities - the legal basis for processing is consent (Article 6(1)(a) GDPR),
  1. The Controller processes Website Users' personal data to the extent necessary for the purposes specified in point 1 above and for the period necessary to achieve those purposes, or until the Website User withdraws consent. In some situations, failure by the Website User to provide data may make it impossible to achieve the purposes for which that data is necessary.
  2. The following personal data of the Website User may be collected through forms provided on the Website or for the performance of contracts that may be concluded through the Website: FIRST NAME, SURNAME, RESIDENTIAL ADDRESS, COUNTRY, EMAIL ADDRESS, TELEPHONE NUMBER. 
  3. Data entered in forms provided on the Website is processed for the purposes arising from the function of the particular form. The Controller may also use it for archival and statistical purposes. The data subject's consent is expressed by deselecting the appropriate box in the form.

DATA SECURITY 

  1. The Controller continually analyses risks to identify threats to secure data processing and implements appropriate technical and organisational measures to protect the personal data processed.
  2. The Controller ensures that only authorised persons have access to personal data, and only to the extent necessary for the tasks they perform.
  3. The Controller maintains a register of persons authorised to process personal data. These persons are required to keep personal data and the methods of protecting it strictly confidential.

DATA RECIPIENTS

  1. Recipients of Users' personal data may include entities to which the Controller outsources activities requiring the processing of that data, particularly email handling, ICT services, hosting, IT services, administrative support, legal services or advisory services. 
  2. A third party with access to personal data processes it solely on the basis of a personal data processing agreement and solely on the Controller's instructions.
  3. Recipients of Users' personal data may also include entities and authorities entitled to receive that data - only in justified cases and on the basis of generally applicable law.

RECEIVING COMMERCIAL INFORMATION

  1. Where the Website provides for this, the Website User may consent to receiving commercial information by electronic means, in accordance with the Act of 18 July 2002 on the Provision of Services by Electronic Means.
  2. Where the Website User has consented to receiving commercial information by electronic means, they have the right to withdraw that consent at any time. 
  3. The right to withdraw consent to receiving commercial information is exercised by sending an appropriate request to the Controller's email address, including the Website User's first name and surname.

USERS' RIGHTS

  1. Every person whose data is processed has the following rights:
  1. the right of access to data and to information about personal data processing (Article 15 GDPR) - the Controller provides the person making such a request with access to their data and information about personal data processing, the purposes and legal bases of processing, the scope of data held, the entities to which personal data is disclosed and the planned date of its deletion;
  2. the right to obtain a copy of the data (Article 15(3) GDPR) - the Controller provides a copy of the data being processed concerning the person making the request, provided this is possible and does not infringe the rights of third parties;
  3. the right to rectification (Article 16 GDPR) - the User has the right to request the correction of inaccuracies or errors in personal data being processed, and its completion or updating if it is incomplete or has changed;
  4. the right to erasure (Article 17 GDPR) - the User may request the deletion of data whose processing is no longer necessary for any of the purposes for which it was collected;
  5. the right to restriction of processing (Article 18 GDPR) - on this basis, the Controller may cease operations on personal data, except operations to which the data subject has consented and storage in accordance with the adopted retention rules, or until the reasons for restricting data processing cease to apply (e.g. a supervisory authority issues a decision allowing further processing);
  6. the right to data portability (Article 20 GDPR) - on this basis, to the extent that data is processed in connection with a concluded contract or consent given, the Controller may provide the data supplied by the data subject;
  7. the right to object to other purposes of data processing (Article 21 GDPR) - the data subject may object to the processing of personal data at any time. An objection in this respect should include grounds and is subject to assessment by the Controller;
  8. the right to object to data processing for marketing purposes (Article 21(2) GDPR) - the data subject may object to personal data processing for marketing purposes at any time, without having to justify that objection;
  9. the right to withdraw consent (Article 7(3) GDPR) - where data is processed on the basis of consent, the data subject has the right to withdraw it at any time, but this does not affect the lawfulness of processing carried out before consent was withdrawn;
  10. the right to lodge a complaint (Article 77 GDPR) - if the data subject considers that personal data processing infringes the GDPR or other personal data protection provisions, they may lodge a complaint with the supervisory authority - the President of the Personal Data Protection Office (https://uodo.gov.pl/pl/p/kontakt  ).
  11. A request to exercise data subjects' rights may be submitted:
  1. in writing to the address of the Controller's registered office;
  2. by email to: info@fsv.pl;
  1. A response to a request will be provided within one month of its receipt. If this period needs to be extended, the Controller will inform the applicant of the reasons for the extension.
  2. The response will be sent to the email address from which the request was submitted or, for requests sent by post, by registered letter to the address provided by the applicant, unless the letter indicates a wish to receive the response by email (in which case an email address must be provided).

COOKIES AND SIMILAR TECHNOLOGY

The website uses Google Tag Manager (GTM-P9J3XMVW) to manage Google Analytics 4, Google Ads and Ahrefs Web Analytics. Cloudflare delivers and protects the website and measures its performance.

The Cookie settings panel lets you accept all cookies, reject optional cookies or choose analytics, functional and advertising categories separately. Optional consent is denied by default. The essential coksima_consent_status cookie stores your choice for 365 days. You can reopen and change your preferences using the Cookie settings button, without reloading the page. If your browser does not allow this cookie to be saved, optional cookie consent remains denied on the current page and the panel reports the storage problem. You may need to set your choice again on subsequent pages.

Your consent choices are passed to Google through Consent Mode v2. Rejecting advertising cookies prevents their storage, but Google tags may send cookieless measurements. Ahrefs Web Analytics and Cloudflare Web Analytics also use cookieless measurement; rejecting cookies does not disable these measurements.

For forms with sending enabled, Cloudflare Turnstile checks whether an enquiry comes from a person and helps protect against spam and abuse. It processes technical signals for this purpose, including the IP address and browser information. This protection operates independently of optional cookie consent.

Information about how these tools work: Google Consent Mode, Ahrefs Web Analytics, Cloudflare Web Analytics, Cloudflare Turnstile.

  1. The Website uses cookies.
  2. Cookies are computer data, in particular text files, stored on the Website User's terminal device and intended for using the Website's pages. Cookies usually contain the name of the website they originate from, their storage period on the terminal device and a unique number.
  3. The Controller is the entity that places cookies on the Website User's terminal device and accesses them.
  4. Cookies are used, among other things, for:
  1. creating statistics that help understand how Website Users use its pages;
  2. maintaining the Website User's session after logging in, so the User does not have to re-enter their login and password on every page of the Website;
  3. establishing a user profile in order to display tailored materials in advertising networks, particularly the Google network.
  1. The Website uses two main types of cookies: session cookies and persistent cookies. Session cookies are temporary files stored on the User's terminal device until the User logs out, leaves the website or closes the software (web browser). Persistent cookies are stored on the User's terminal device for the period specified in the cookie parameters or until the User deletes them.
  2. Web browsing software (a web browser) usually allows cookies to be stored on the User's terminal device by default. Website Users can change these settings. A web browser allows cookies to be deleted. Cookies can also be blocked automatically. Detailed information is available in the web browser's help section or documentation.
  3. The Controller uses the services of third parties, whose list changes over time, and which may use cookies for purposes including:
  1. You manage consent for optional cookies through the Cookie settings panel on the website. You can also change your browser settings and delete stored cookies. Further information is available in the Cookie Policy.
  2. Restricting the use of cookies may affect certain functionalities available on the Website's pages.
  3. The Controller uses Google Analytics 4 to collect statistics. In this case, the data of the User visiting the Website is received by Google, 1600 Amphitheatre Parkway Mountain View, CA 94043 United States. Your consent to analytics cookies is passed to Google through the Cookie settings panel. You can withdraw it in that panel or use the browser add-on: https://tools.google.com/dlpage/gaoptout/
  4. The Controller encourages Users to read Google's detailed explanations of data processing within Google Analytics, available at: https://policies.google.com/privacy?hl=pl.
  5. The Controller may also use marketing tools available through the Facebook social network owned by Meta Platforms. These tools may be used to deliver advertisements on Facebook. Activities in this area are based on the Controller's legitimate interest in marketing its own products or services (Article 6(1)(a) GDPR). 
  6. To target personalised advertising based on the behaviour of Users visiting the website www.fsv.pl a Meta Pixel may be implemented on it, automatically collecting information about Website use. Information collected in this way may be transmitted to a Facebook social network server in the United States and stored there. 
  7. Information collected through the Meta Pixel is anonymous, meaning it does not allow the User to be identified. The Controller is only informed of the actions the User took on its website. However, Meta Platforms may combine this information with other information about the User collected through their use of Facebook and use it for its own purposes, including marketing. Such Facebook activities are beyond the Controller's control, and information about them is provided in Facebook's privacy policy: https://www.facebook.com/privacy/explanation. The User can also manage their privacy settings from their Facebook account. Meta Platforms is based in the United States and uses technical infrastructure located, among other places, in the United States. 

SOCIAL MEDIA

  1. The Controller processes the personal data of Users visiting the Controller's social media profiles (e.g. Facebook and Instagram). 
  2. This data is processed to inform Users about the Controller's activities, offer services and communicate with Users through tools available on social media. The legal basis for processing personal data for this purpose is the Controller's legitimate interest (Article 6(1)(f) GDPR) in promoting its own brand and services and building and maintaining a community associated with the brand. Further information is provided in the Privacy Notice for Facebook Fan Page Visitors.
  3. The Website contains links to the Controller's social media profiles, which have separate privacy policies. These can be read by visiting the relevant page through the link marked with the appropriate icon. 
  4. For any websites linked from the Website that are not owned or controlled by the Controller, the Controller accepts no responsibility for their content or for the information confidentiality rules applicable to Users. When displaying a webpage containing such a link, the User's browser establishes a direct connection to the servers of the social network operators (service providers). The plugin's content is transmitted directly by the relevant service provider to the User's browser and integrated into the page. Through this integration, service providers are informed that the User's browser has displayed the Controller's page, even if the User does not have a profile with that provider or is not currently logged in. This information, together with the IP address, is transmitted directly by the User's browser to the relevant service provider's server (some servers are located in the United States) and stored there. If the User has logged in to a social network, that service provider can directly associate the visit to the Controller's website with the User's profile on that social network. If the User uses a plugin, for example by clicking "Like" or "Share", the relevant information will also be transmitted directly to the service provider's server and stored there. In addition, this information will be published on the relevant social network and shown to people added as the User's contacts. 
  5. The purpose and scope of data collection and its further processing and use by service providers, as well as contact options, the User's rights in this respect and settings available to protect privacy, are described in each service provider's privacy policy. The Controller encourages Users to read them. 
  6. If the User does not want social networks to associate data collected during a visit to the Controller's website directly with their profile on a particular service, they should log out of that service before visiting the website.
  7. The User can also prevent plugins from loading on the page entirely by using suitable browser extensions, such as script blockers.

SERVER LOGS

  1. Using the website involves sending requests to the server on which the Website is hosted. Each request sent to the server is recorded in server logs.
  2. Logs include, among other things, the User's IP address, server date and time, and information about the web browser and operating system used. Logs are saved and stored on the server.
  3. Data recorded in server logs is not associated with specific people using the website and is not used by the Controller to identify the User.
  4. Server logs serve solely as supporting material for website administration, and their content is not disclosed to anyone other than persons authorised to administer the server.

TRANSFERRING DATA OUTSIDE THE EEA

  1. The Controller may transfer Users' personal data to third countries, meaning countries outside the European Economic Area. Your data may be transferred only to third countries or entities for which the European Commission has determined, by decision, that an adequate level of data protection is ensured. 
  2. The list of countries for which the European Commission has issued a decision confirming that the third country ensures an adequate level of protection is available at https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/adequacy-decisions_en#relatedlinks.
  3. Where there is no European Commission adequacy decision under Article 45(3) GDPR, Users' personal data may be transferred to a third country only on the basis of binding corporate rules, standard data protection clauses adopted by the European Commission, standard data protection clauses adopted by the Polish supervisory authority and approved by the Commission, an approved code of conduct or an approved certification mechanism (Article 46 GDPR).
  1. Where there is no European Commission adequacy decision under Article 45(3) GDPR or no appropriate safeguards under Article 46 GDPR, including binding corporate rules, the Controller will ask the User for explicit consent to such a transfer to a third country or international organisation, first informing the User of the risks associated with that transfer under Article 49(1)(a) GDPR.
  2. In connection with the transfer of data outside the EEA, Users may request information from the Controller about the relevant safeguards, obtain a copy of those safeguards or information about where they are available.

INFORMATION ABOUT AUTOMATED DECISION-MAKING

  1. Within the Website, the Controller may automatically adapt certain content to the User's needs, i.e. carry out profiling, using the personal data they have provided. This profiling primarily involves automatically assessing which products the User may be interested in, based on their previous online activity, including on the Controller's websites, and displaying product advertisements profiled in this way. 
  2. Profiling carried out by the Controller does not result in decisions producing adverse legal effects concerning the User or otherwise significantly affecting them

The current version of the Privacy Policy has been effective since 23 April 2023.