Personal data processing policy

1. Whenever words or phrases written in capital letters are used in this personal data processing policy, they should be understood as such:

Dataall data of Client and Suppliers processed in the Software.
Suppliera sole proprietorship, a legal person or an organisational unit other than a legal person to whom the Act grants legal capacity, with whom the Client has separately concluded an agreement for the supply of goods or services.
Clienta sole proprietorship, a legal person or an organizational unit other than a legal person to whom the law grants legal capacity, using the Platform/Services on the basis of an Agreement or intending to use the Platform/Services on the basis of an Agreement.
Accounta set of resources and rights within the Platform assigned to a given Client or Supplier. Access to the Account within the functioning of the Platform is carried out respectively by the Client’s Panel or the Supplier’s Panel and requires the provision of an individual login/identifier and password. The main function of the Account is to manage information concerning the Client or the Supplier. Through the Account it is also possible to perform legal and factual actions. The Account can also be verified by checking the identity of the user, in particular by means of a verification transfer.
OperatorCashy Sp. z o.o., with its registered office in Warsaw, al. Jana Pawła II 27, entered in the Register of Entrepreneurs kept by the District Court for the capital city of Warsaw in Warsaw, XIV Commercial Division of the National Court Register, under the number KRS 0000751773, NIP 5322079926, with the share capital of PLN 5 000 (fully paid-up).
Softwaresoftware, which has been made available to the Client or the Supplier by the Operator, regardless of the method and form of making it available, in particular applications available to the Client or the Supplier remotely, via the Internet.
Supplier’s panelInternet tool available on the Platform and made available to the Supplier by the Operator, used for communication between the Supplier and the Client, as well as for performing transactions and other activities between the Client, the Supplier and the Operator, indicated in the Regulations or in the Service Specification.
Client’s PanelInternet tool available on the Platform and made available by the Operator to the Client, used to purchase or manage the Services, as well as to perform other activities between the Operator and the Client.
Platformwebsite and Software made available to the Client and Suppliers for use, used for communication (with the use of the Internet) between the Client and its Suppliers and conclusion by them of transactions.
Agreementagreement concluded between the Operator and a given Client for the provision by the Operator to the Client, by electronic means, of the Services specified in this agreement.
Servicesthe services described in the Agreement, provided or offered to be provided by the Operator to the Client.
User of the Supplier/Supplier’s Usera natural person authorized by the Supplier in the Supplier's Panel to use the Platform, communicate with the Client and perform legal or factual actions with the Client.
User of the Client/Client’s Usera natural person authorised by the Client in the Agreement or in the Client's Panel to use the Platform, communicate with Suppliers and perform with them legal or factual actions provided for in the Service Specification.

2. The Operator is the administrator of the personal data of the Client's User or the Supplier's User (entered and generated during the process of creating an Account and during the use of the Platform, including information on the activity of the Client's User or the Supplier's User within the Platform).

3. Personal data provided by the Client, Supplier, Users of the Client or Users of the Supplier in places designated for this purpose, the Operator processes in accordance with applicable laws, including the Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) ("GDPR") and in accordance with this Operator's privacy policy published on the Platform website.

4. The use of the Platform is possible only after reading the provisions of this personal data processing policy and the Regulations for the provision of services and use of the CASHY.PL platform.

5. The Client, Supplier and Users of the Client or Users of the Supplier are disclosed personal data of the Users of the Client or Users of the Supplier for the purposes related to the execution of transactions. The Client, Supplier, Client's Users or Users of the Supplier are obliged not to disclose to third parties information concerning Users of the Client or Users of the Supplier (in particular their personal data), which are made available to them via the Platform in connection with the provision of Services by the Operator, unless they obtained prior consent from the User of the Client or User of the Supplier to which such information relates.

6. The Operator may process personal data of the User of the Client or the User of the Supplier for the purpose of direct marketing of its own products and services, including the use of profiling operations, with the separate consent of the User of the Client or the User of the Supplier collected through the Platform.

7. Personal data of the User of the Client or the User of the Supplier are processed in order to conclude and execute transactions, including the provision of services constituting the subject of the Agreement, providing services for the Account opened on the Platform, creating and managing Accounts opened on the Platform, monitoring the activity of the Users of the Client or the Users of the Supplier, contacting the Users of the Client or the Users of the Supplier (in particular for purposes related to the provision of services via the Platform, service of the Client’s User or the Supplier’s User, permitted marketing activites via available channels of communication, in particular via e-mail or telephone) and also in order to ensure the safety of services provided via the Platform, the exercise of rights and obligations resulting from legal regulations, as well as for the purposes of conducting statistical, analytical and archiving research and - with the separate consent of the User of the Client or the User of the Supplier - the research of his satisfaction with the use of the Platform.

8. The legal basis for the processing of personal data of the User of the Client or the User of the Supplier are:
a) the necessity of processing in order to conclude and perform the Agreement or to operate the Platform (e.g. communication with the User of the Client or the User of the Supplier in order to send him commercial offers and other similar messages related to the functioning of the Platform),
b) fulfilment of legal obligations incumbent on the Operator, including those resulting from the Act on the provision of electronic services (e.g. handling complaints and reports of abuse within the Platform),
c) execution of legitimate interests of the Operator or third parties (e.g. in order to ensure the security of IT resources or the security of the Users of the Client and/or Users of the Supplier),
d) consent of the User of the Client or the User of the Supplier.

9. The Operator processes the following ordinary personal data of the Users of the Client or the Users of the Supplier: name and surname, contact telephone number and e-mail address.

10. Personal data of the Users of the Client or the User of the Supplier are not transferred by the Operator outside the European Economic Area.

11. Personal data of the User of the Client or the User of the Supplier are stored for the duration of the Agreement, and after its termination until the statute of limitations of claims related to the Agreement, possibly for another time necessary to achieve the purposes for which personal data are processed, or until the User of the Client or the User of the Supplier objects within the framework of the exercise of such user's rights. Personal data processed on the basis of the consent of the User of the Client or the User of the Supplier are processed for the period until the withdrawal of such consent.

12. Personal data of the Client’s User or the Supplier's User may be transferred:
a) entities acting on the basis of legal regulations (legal bodies - in connection with the performance of legal obligations incumbent on the Operator, cooperation with such bodies in cases of violation or suspicion of violation of law, etc.),
b) entities providing services to the Operator, e.g. within the scope of IT services (e.g. hosting disk space), accounting or legal services - to the extent necessary to provide these services.

13. The use of the Platform is voluntary, however, the provision of personal data in connection with the creation of an Account is necessary for the conclusion and subsequent performance of the Agreement - without the provision of personal data of at least one User of the Client or User of the Supplier it is not possible to conclude and perform this type of agreement.

14. In connection with the processing of personal data, the User of the Client or the User of the Supplier is entitled to the following rights:
a) the right to access personal data concerning the User of the Client or the User of the Supplier,
b) the right to rectify those data,
c) the right to erasure those data,
d) the right to limit the processing of such data,
e) the right to transfer the data,
f) the right to object to the processing of such data (in accordance with the principles described in the GDPR and to the extent that the processing of personal data is based on the fulfilment of the Operator's legitimate interests or the processing of personal data is carried out within the framework of profiling),
g) the right to withdraw consent at any time (to the extent that consent is the basis for the processing of personal data), in accordance with the principles laid down in the legislation on the protection of personal data, including the provisions of the GDPR, without prejudice to the lawfulness of the processing which was carried out on the basis of consent before its withdrawal.

15. In all matters concerning the processing of personal data, in particular the use of the rights vested in the User of the Client or the User of the Supplier related to the processing of his personal data, you can contact the Operator at the e-mail address info@cashy.pl or in writing to the address of the Operator's registered office with the note "GDPR".

16. The User of the Client or the User of the Supplier has the right to lodge a complaint to the body supervising the observance of the regulations on personal data protection.

17. The Client or the Supplier is obliged to fulfil all obligations, including information obligations, provided for in the regulations on personal data protection, including the provisions of the GDPR, with respect to persons whose personal data is processed - with the use of the Platform - as a data administrator independent of the Operator.

18. The Operator's platform uses "cookies" files. If the Client's User or the Supplier's User does not change the browser settings, it is equivalent to consent to their use.

19. The installation of cookies is necessary for the proper provision of services on the Platform. Cookies contain information necessary for the proper functioning of the Platform, in particular information that requires authorization.

20. The following types of cookies are used within the Platform:
a) Session - are temporary files, which are stored in the end device of the User of the Client and/or the User of the Supplier until the time of logging out (leaving the Platform),
b) Permanent - stored in the end device of the Client's User and/or the Supplier’s User for the time specified in the parameters of cookies or until they are deleted by the Client's User and/or the Supplier’s User.

21. Cookies used within the Platform are responsible for:
a) security - to protect against unauthorized use of the Data,
b) personalisation - they keep information about the appearance and settings of the Platform (e.g. language version),
c) functioning of the platform - allow the User of the Client or the User of the Supplier to use the Platform (e.g. cookies responsible for authentication of the User of the Client or the User of the Supplier),
d) advertising - allow to adjust the advertising content presented on the Platform to the interests of the User of the Client or the User of the Supplier,
e) service - collect information on the manner of using the Platform by the User of the Client and the User of the Supplier.

22. The User of the Client or the User of the Supplier has the right to decide on the access to "cookies" files to his computer through their prior selection in the window of his browser. Detailed information about the possibilities and ways of handling cookies are available in the software settings (web browser).

23. Any changes to this policy caused by changes in the law or related to changes in the offer of services available through the Platform or resulting from the development of the functionality of the Platform will be immediately communicated to the Users by announcement in the Client’s Panel or the Panel of the Supplier. The amendments set out above will apply within 7 (seven) days from the date of notification of the amendments in the manner set out above. Any changes shall enter into force not less than 7 (seven) days after notification of the planned changes in the manner indicated in the previous sentence.

Version_10_20190322