Dear User and Customer,
We make every effort to ensure the security and confidentiality of your personal data. We take care of your privacy both when you visit our website, register an account on it and use our services, and when you contact us by telephone, by e-mail or through the online chat, sign up for the newsletter or visit our social media channels.
We act in accordance with the letter of the law, including Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (referred to as the “GDPR”).
In this document we want to present the most important information about the processing of your personal data. For simplicity we have set it out in the form of questions and answers. All of this so that you can find out for what purpose, on what basis and for how long we process your data, as well as who may have access to it and what rights you have.
How do we obtain your personal data?
When using the Senvio.ai website (hereinafter: the “Website”) you may be asked to provide your personal data. Providing data is voluntary, but in certain situations it may prove necessary. For example, without providing an e-mail address you will not receive our newsletter, we will not register your account, nor will we be able to answer by e-mail a question asked through the contact form.
Some data is collected automatically by means of cookies during your visit to the Website (e.g. IP address, browser type, type of operating system, etc.). It serves to administer the website, to provide hosting services and to create appropriate marketing content. You may, however, freely block and restrict the installation of cookies using your browser settings or with the help of other (free) solutions.
Who is the controller of your personal data?
The controller of your personal data is SORVE spółka z ograniczoną odpowiedzialnością, with its registered office in Warsaw, al. „Solidarności” 68/121, 00-240 Warszawa, entered in the register of entrepreneurs of the National Court Register kept by the District Court for the Capital City of Warsaw in Warsaw, 12th Commercial Division of the National Court Register, under KRS number 0001251512, NIP 5253096470, REGON 545200116, operating the website under the Senvio brand. Should you have any questions or doubts, you can contact us electronically at the following e-mail address: kontakt@senvio.ai
For what purpose, on what legal basis and for how long do we process your data?
We process your personal data for the purpose of:
1) concluding and performing a contract for the provision of services (registering and maintaining a customer account, placing orders for free and paid services, performance of the contract):
- the legal basis is that processing is necessary for the performance of a contract or in order to take steps at the request of the data subject prior to entering into a contract (Article 6(1)(b) GDPR),
- the data will be processed until the provision of the service ends (deletion of the customer account, termination of the contract for the provision of services);
2) fulfilling tax obligations (issuing invoices, retaining accounting records):
- the legal basis is a legal obligation to which we are subject (Article 6(1)(c) GDPR),
- the data will be processed until the limitation periods for tax liabilities have expired;
3) fulfilling obligations in the area of personal data protection:
- the legal basis is a legal obligation to which we are subject (Article 6(1)(c) GDPR),
- the data will be processed until the limitation periods for claims arising from a breach of personal data protection provisions have expired;
4) establishing, pursuing and defending any claims:
- the legal basis is our legitimate interest (Article 6(1)(f) GDPR), which we have in taking action aimed at protecting our rights in proceedings before courts and other state authorities,
- the data will be processed until the limitation periods for claims arising from the applicable law have expired;
5) ensuring the correct functioning of the Website and analysing the activity of Website users:
- the legal basis is our legitimate interest (Article 6(1)(f) GDPR), which we have in carrying out analyses and statistics on the use of individual features of the Website (e.g. Google Analytics cookies, the Facebook Pixel),
- the data will be processed until an objection is effectively raised or the purpose of the processing is achieved;
6) running a fanpage on Facebook and a group, and interacting with users of the aforementioned social media:
- the legal basis is our legitimate interest (Article 6(1)(f) GDPR), which we have in promoting the Website and adapting its features to current needs,
- the data will be processed until the limitation periods for claims arising from the applicable law have expired;
7) answering questions addressed to us by telephone or electronically, including through the form available on the Website and the online chat:
- the legal basis is our legitimate interest (Article 6(1)(f) GDPR), which we have in communicating with our customers and answering questions from our potential customers or other persons interested in our products and services,
- the data will be processed until the limitation periods for claims arising from the applicable law have expired;
8) marketing (promotion of our goods and services):
- the legal basis is our legitimate interest (Article 6(1)(f) GDPR), which we have in maintaining business relations with customers and surveying their satisfaction, in looking after our own interests and image, or, as the case may be, the voluntary consent of the person who gave it for a specified purpose (Article 6(1)(a) GDPR),
- the data will be processed until an objection is effectively raised or the purpose of the processing is achieved, and where the basis of processing is consent – until that consent is withdrawn (whereby the withdrawal of consent does not affect the lawfulness of the processing of data carried out before its withdrawal)
Who may be a recipient of your personal data?
In some situations, where it proves necessary to achieve the purposes of the processing, we use the support and assistance of external entities. In every case, however, before transferring personal data we require their recipients to guarantee appropriate protection and confidentiality.
The recipients of your personal data may be:
1) entities taking part in our performance of contracts, e.g.: the accounting office, IT service providers, hosting providers, payment system providers,
2) entities whose help and services we use in the course of our business activity on the basis of separate agreements, e.g.: providers of tools for analysing activity on the Website and for direct marketing, providers of tools for building landing pages and collecting leads, providers of office systems, providers of project management software, providers of communication software,
3) competent state authorities, pursuant to the applicable law,
4) other entities whose request for the transfer of data is justified under the applicable law.
Do we transfer personal data to third countries?
As a rule, we do not transfer personal data to countries outside the European Union and the European Economic Area (EEA). If, however, such a need arises in connection with the provision of services, we will assess the circumstances and make sure an appropriate level of data security is ensured, so that the processing takes place in accordance with the applicable legal regulations.
In operating the Website we use services and technologies offered by entities such as Facebook, Microsoft and Google, which have their registered offices in the United States and may partly process personal data using servers located outside the European Economic Area (EEA). In the light of the GDPR these are so-called entities located in third countries, in respect of which it is necessary to demonstrate that an adequate level of protection is ensured or to make reference to appropriate safeguards.
We confirm that the aforementioned entities apply the compliance mechanisms provided for by the GDPR (e.g. certifications) or standard contractual clauses adopted by the European Commission (Article 46(2)(c) GDPR). You will find more information on the data processing rules of the aforementioned entities on the websites of those service providers.
Do we profile your personal data?
Within the Website and the technologies used, we may carry out profiling. It consists in using a user's data (i.e. gender, age, interests, approximate location, behaviour on the Website) to assess their activity and potential interest in the services. Profiling makes it possible to personalise the offer and the advertising directed at users; it does not, however, affect the rules and conditions of the contracts for the provision of services that are concluded. The information processed is anonymous in nature and is not associated with the user ordering the services. We therefore do not take any automated decisions which could produce legal effects concerning natural persons or similarly significantly affect them.
What personal data do we process as a processor and how do we obtain it?
As a processor we process data solely on the documented instructions of the controller of that data (on the basis of a data processing agreement), undertaking to secure it properly by applying appropriate technical and organisational measures and ensuring an adequate level of security corresponding to the risk associated with the processing of personal data (in accordance with Article 32 GDPR). We also confirm that the persons we have authorised to carry out processing have committed themselves to confidentiality. After the end of the provision of services relating to the processing of the personal data entrusted to us, we will return all of it to the controller of that data (the customer) and delete any existing copies, unless the applicable law requires us to store the personal data.
Do we use so-called cookies?
On the Website we use so-called cookies, that is short pieces of text information saved on a user's computer, telephone, tablet or other device, which can be read by our system and also by systems belonging to other entities whose services we use: Facebook, Google.
Thanks to cookies we collect anonymous data about users' visits to the Website, which we may use to improve the Website's functionality, to identify errors or for marketing activities.
Web browsers usually allow the use of cookies on the end device by default. Users may, however, block and restrict the installation of cookies at their own discretion using their browser settings or with the help of other (free) solutions. During your first visit to the Website we will display information about the use of cookies. If you do not change your browser settings, you consent to their use. You will find more information on how to change cookie settings on the website of your web browser.
Please note that disabling or restricting the handling of cookies may cause difficulties in using the website, for example it may result in a longer page loading time or restrictions in using features or in liking the page on Facebook.
How do we protect your data?
In order to ensure a high and consistent level of protection, we apply safeguards for the IT environment appropriate to the processing, as well as technical and organisational measures, among which are:
1) encryption using the TLS protocol,
2) creating backup copies,
3) equipping data centres with data protection mechanisms,
4) carrying out regular security level tests,
5) monitoring the security of personal data,
6) minimising the risk of potential abuse and reacting quickly should it occur,
7) implementing a data protection policy,
8) ensuring the ongoing confidentiality, integrity, availability and resilience of processing systems and services,
9) allowing access to personal data solely to authorised persons,
10) creating and regularly changing passwords for access to the systems in which personal data is processed.
What rights do the persons whose data we process have?
The persons whose data we process have the right to:
1) access their personal data;
2) rectification of their personal data;
3) erasure of their personal data;
4) restriction of the processing of their personal data;
5) object to the processing of their personal data;
6) data portability;
7) withdraw consent to the processing of data (insofar as the basis of the processing is consent).
The rights listed above are not, however, absolute in nature and in some situations, after carrying out an analysis, we may lawfully refuse to fulfil them.
We also inform you that the withdrawal of consent to the processing of data will not affect the lawfulness of the processing of data which took place on the basis of the consent given before its withdrawal.
If you approach us with a request to exercise any of the above rights, we will respond to it without undue delay, but no later than within one month of the date it is received. If, owing to the complex nature of the request or the number of requests, we are unable to fulfil your request within one month, we will fulfil it within the following two months. We will, however, inform you beforehand of the intended extension of the deadline.
How can irregularities in the processing of personal data be challenged?
If you consider that your personal data is being processed by us contrary to the applicable law, you may lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych).
Does using the website involve sending logs to the server?
Using the Website involves sending requests to the server on which the site is stored. Every request addressed to the server is recorded in the server logs and stored on the server.
The logs include, among other things, the IP address, the server date and time, and information about the web browser and operating system.
The data recorded in the server logs is not associated with specific persons using the site and is not used by us in order to identify you.
The server logs constitute solely auxiliary material used to administer the site, and their content is not disclosed to anyone other than the persons authorised to administer the server.
Can we change our privacy policy?
Yes. The protection of personal data is a process which we adapt to current needs and changing technology. For that reason our Privacy Policy may be supplemented or amended, of which we will inform you by posting information on the Website, and in the case of significant changes we will send registered customers separate notifications by electronic means.