PRIVACY POLICY

1. Data Controller

The controller of your personal data is:

• D ONE BRAND CONSULTING&DESIGN Sp. z o. o.
• Tax ID (NIP): 7011055735
• Business No. (REGON): 520224636
• Address: ul. ks. I. J. Skorupki 5, 00-546 Warszawa, Mazowieckie Voivodeship, Poland
• E-mail: hello@done-waw.com
• Phone: (+48) 501 268 268

‍

2. Scope and source of data

In connection with your use of the Website, we may process in particular:

• technical data and online identifiers (e.g. cookie identifiers, browser and device identifiers, approximate region-level location, campaign parameters),
• data about your activity on the Website (e.g. subpages visited, events and clicks, time of visit, entry source),
• logs and technical events related to the security and correct operation of the Website (e.g. date and time of the request, information about the device and browser).

If you contact us directly by e-mail or phone, we process the data provided in that correspondence (e.g. e-mail address, phone number, name, message content).

If you fill in the contact form available on the Website (e.g. on the „Contact” page), we process the data provided in the form (e.g. first and last name, e-mail address, phone number, company name, message content).

If you apply for a job through the recruitment form on the „Jobs” page, we process the data provided in the application: first and last name, contact details (e-mail, phone), information contained in your CV and any cover letter (education, professional experience, competencies), an optional portfolio, and other data you provide voluntarily.

Providing data in the contact or recruitment form is voluntary but necessary to, respectively, respond to your enquiry or consider your application.

‍

3. Purposes and legal bases of processing

We process data for the following purposes:

• Ensuring the operation, security and correct display of the Website (diagnostics, prevention of abuse). Legal basis: Art. 6(1)(f) GDPR (the Controller’s legitimate interest).
• Contact and handling of enquiries sent by e-mail or phone. Legal basis: Art. 6(1)(f) GDPR, and where the contact concerns steps prior to entering into a contract – Art. 6(1)(b) GDPR.
• Analytics and statistics (Google Analytics 4 – GA4) to measure traffic and improve the Website. Legal basis: Art. 6(1)(a) GDPR (consent), insofar as analytics relies on cookies or identifiers.
• Marketing and measuring advertising effectiveness (Meta Pixel) – conversion measurement, creating audiences (e.g. remarketing), campaign optimisation. Legal basis: Art. 6(1)(a) GDPR (consent) with respect to marketing cookies and identifiers.
• Handling enquiries sent via the contact form. Legal basis: Art. 6(1)(f) GDPR (the Controller’s legitimate interest in communicating with persons interested in our offer), and where the contact concerns steps prior to entering into a contract – Art. 6(1)(b) GDPR.
• Recruitment processes – considering the application for the position the candidate is applying for. Legal basis: Art. 6(1)(b) GDPR (steps aimed at concluding an employment or cooperation contract) and Art. 6(1)(c) GDPR in conjunction with Art. 22¹ of the Polish Labour Code (as regards data required by law). For data going beyond what is required by law (e.g. a photograph, interests, data provided voluntarily in the CV) – Art. 6(1)(a) GDPR (the candidate’s consent given by submitting the application). If the candidate gives separate consent to take part in future recruitment processes – Art. 6(1)(a) GDPR (consent).

‍

4. Cookies and similar technologies

The Website uses cookies and similar technologies (e.g. identifiers) that may store or read information on your device.

Necessary cookies may be used to the extent required for the correct operation of the Website and to save your choices (including your consent choices). As a rule, we activate analytics and marketing cookies only after obtaining your consent.

Categories of cookies on the Website:

• Necessary – ensure the operation of the Website and save preferences (including cookie settings).
• Analytics – related to Google Analytics 4 (GA4).
• Marketing – related to Meta Pixel.

Cookie consent is collected and managed using the CookieHub tool. You can change your preferences at any time using the „Manage cookies” link in the Website footer and in your browser settings.

Withdrawing consent does not affect the lawfulness of processing carried out before its withdrawal.

‍

5. Google Analytics 4 (GA4)

The Website uses Google Analytics 4 to analyse traffic and improve the Website. GA4 may use cookies or identifiers (depending on the configuration and consents).

In analytics reports we do not identify users directly. The data is used to create statistics and improve the quality of the Website.

‍

6. Meta Pixel (Meta Platforms)

The Website uses Meta Pixel to measure advertising effectiveness, create audiences and carry out remarketing – only after obtaining consent for marketing cookies.

To a certain extent (in particular as regards the collection and transfer of data to Meta as a result of embedding the tool), the Controller may be regarded as a joint controller together with Meta.

‍

7. Data recipients

Data may be transferred to the following categories of recipients:

• Webflow – provider of the hosting and platform for the Website.
• CookieHub – provider of the cookie consent management tool.
• Google – provider of analytics tools (GA4).
• Meta Platforms – provider of marketing tools (Meta Pixel).
• Entities authorised under the law – if they submit a binding request.

‍

8. Transfers of data outside the EEA

In connection with the use of tool providers’ services (e.g. Google, Meta, Webflow), data may be processed outside the European Economic Area (e.g. in the USA), depending on the infrastructure and configuration of the services.

In such cases, data transfers take place using the mechanisms provided for by the GDPR, such as an adequacy decision (e.g. the EU–US Data Privacy Framework – where applicable) or standard contractual clauses.

‍

9. Data retention period

• Technical data and logs – for the period necessary to ensure security and diagnostics, as a rule no longer than 90 days, unless longer storage is necessary to establish, pursue or defend claims.
• Analytics data in GA4 – in accordance with the retention settings on the Controller’s side (typically 2 or 14 months for event data).
• Marketing data related to Meta Pixel – in accordance with the rules and settings of Meta’s tools and until consent is withdrawn (where processing is based on consent).
• Contact form data – for the time necessary to respond and conduct correspondence, and thereafter for the limitation period of any claims.
• Recruitment data – until the completion of the recruitment process for the given position, and where consent is given to take part in future recruitment – for the period indicated in the consent (typically up to 12 months) or until it is withdrawn.

‍

10. Your rights

Within the limits of the GDPR, you have the right to:

• access your data and obtain a copy of it,
• rectify your data,
• erase your data,
• restrict processing,
• data portability (where applicable),
• object (where we process data on the basis of Art. 6(1)(f) GDPR),
• withdraw consent at any time (where processing is based on consent).

You have the right to lodge a complaint with the supervisory authority: the President of the Personal Data Protection Office (PUODO).

‍

11. Automated decision-making and profiling

Within the marketing tools (Meta), profiling may take place in order to tailor ads and create audiences. This happens only if you consent to marketing cookies. The Controller does not make automated decisions concerning users that produce legal effects concerning them or similarly significantly affect them (Art. 22 GDPR).

‍

12. Changes to the Privacy Policy

This Policy may be updated in particular in the event of changes to the Website, the tools (GA4, Meta Pixel, CookieHub, Webflow) or the law. The current version is always available on the Website.