Privacy Policy

1. Data Controller

The controller of your personal data is Incite Sp. z o.o., with its registered office in Warsaw at Rondo Ignacego Daszyńskiego 2B, 00-843 Warsaw, Poland, entered in the Register of Entrepreneurs of the National Court Register (KRS) under number 0000983382, NIP (tax ID) 5252916758, REGON 522659605 (the “Controller”).

For all matters concerning personal data protection, you may contact us at office@incite.pl, by phone at +48 517 026 850, or in writing at the registered office address.

2. Scope and Purposes of Processing

The Controller processes personal data for the following purposes:

• Handling enquiries and contact forms – data provided in a form (name, e-mail address, phone number, company name, message content) is processed to respond to the enquiry, prepare a proposal or arrange a consultation.
• Conclusion and performance of contracts – data necessary for the provision of services, settlements and ongoing client communication.
• Compliance with legal obligations – in particular obligations arising from tax and accounting regulations and anti-money laundering and counter-terrorist financing legislation.
• Direct marketing – sending commercial information by electronic means solely upon consent required under the Polish Electronic Communications Law of 12 July 2024, or on the basis of legitimate interest in existing B2B relationships.
• Website operation – automatic collection of technical data (IP address, browser and device type, pages visited) to maintain, secure and improve the website and to analyse traffic in aggregated form.
• Establishment, exercise or defence of legal claims – archiving of data to the extent necessary to protect the Controller’s legal interests.

Providing personal data is voluntary but necessary for the above purposes – in particular to respond to an enquiry or conclude a contract. The Controller does not make decisions based solely on automated processing, including profiling, that produce legal effects concerning data subjects.

3. Legal Bases

Processing is carried out on the basis of Article 6(1) of the GDPR:

• point (b) – performance of a contract or taking steps at the request of the data subject prior to entering into a contract;
• point (c) – compliance with a legal obligation to which the Controller is subject;
• point (f) – the Controller’s legitimate interests, including direct marketing of its own services, website administration, ensuring the security of IT systems, and the establishment, exercise or defence of legal claims;
• point (a) – consent, in particular to receive commercial information. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out before its withdrawal.

4. Retention Period

Personal data is retained for the period necessary to achieve the purpose of processing: data related to contracts – for the duration of the contract and until the expiry of limitation periods for claims and statutory archiving periods (tax and accounting records – as a rule, 5 years from the end of the year to which they relate); data from contact forms – for the duration of the correspondence and the period necessary to defend against potential claims; data processed on the basis of consent – until its withdrawal; data processed for marketing purposes on the basis of legitimate interest – until an objection is raised. Upon expiry of the relevant period, data is erased or anonymised.

5. Recipients of Data

The Controller does not sell personal data or share it with third parties for their own marketing purposes. Data may be disclosed solely to:

• IT service providers (hosting, e-mail, CRM systems, analytics tools) – under data processing agreements;
• advisers and specialists cooperating with the Controller – to the extent necessary for the provision of services;
• public authorities and institutions authorised under applicable law.

Data is processed, as a rule, within the European Economic Area. Any transfer of data outside the EEA takes place solely with the safeguards provided for in Chapter V of the GDPR, in particular standard contractual clauses adopted by the European Commission or an adequacy decision.

6. Rights of Data Subjects

Every person whose data is processed by the Controller has the right to:

• access their data (Art. 15 GDPR) – obtain confirmation of processing, a copy of the data and information on the purposes, categories, recipients and retention period;
• rectification (Art. 16 GDPR) – have inaccurate data corrected and incomplete data completed;
• erasure (Art. 17 GDPR) – in the cases provided for by law; the request may be refused where further processing is necessary to comply with a legal obligation or to establish, exercise or defend legal claims;
• restriction of processing (Art. 18 GDPR);
• data portability (Art. 20 GDPR) – with respect to data provided to the Controller and processed by automated means on the basis of consent or a contract;
• object (Art. 21 GDPR) – to processing based on legitimate interest; an objection to direct marketing is always honoured unconditionally;
• withdraw consent – at any time, without affecting prior processing;
• lodge a complaint with the supervisory authority – the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland (www.uodo.gov.pl).

Requests should be sent to office@incite.pl or in writing to the registered office address. The Controller responds without undue delay and no later than within one month of receiving the request; in complex cases this period may be extended by a further two months, of which the applicant will be informed together with the reasons. The Controller may request additional information to verify the identity of the applicant.

7. Cookies

The Controller’s website uses cookies – text files stored on the user’s device. Both session cookies (deleted when the browser is closed) and persistent cookies (stored for a defined period or until deleted) are used.

Cookies necessary for the operation and security of the website are used without the user’s consent. All other categories – analytics, functional and marketing cookies – are activated only upon consent given via the consent management banner. Consent may be changed or withdrawn at any time in the banner settings or browser settings. Blocking non-essential cookies does not limit the use of the website; disabling essential cookies may impair certain functionalities.

8. Security and External Links

The Controller applies technical and organisational measures appropriate to the risk, including encryption of data transmission. Links to third-party websites available on the website lead to sites whose privacy practices are beyond the Controller’s responsibility.

9. Changes to this Policy

This Policy is subject to periodic review and may be updated, in particular in the event of changes in the law or in the operation of the website. The current version, together with its effective date, is available on the Controller’s website.

10. Contact

Questions concerning the processing of personal data and requests to exercise data subject rights should be addressed to office@incite.pl, by phone at +48 517 026 850, or by post to: Incite Sp. z o.o., Rondo Ignacego Daszyńskiego 2B, 00-843 Warsaw, Poland.