Privacy Policy

Security Policy

Encryption of data transmission

Communication between the user and the vibegroup.pl Website takes place using the secure, encrypted SSL/TLS protocol, which ensures the confidentiality and integrity of the transmitted data.

Technical maintenance

Maintenance activities are performed immediately whenever any irregularity in the operation of the server or network infrastructure is detected. We make every effort to carry out maintenance work during night hours (22:00–6:00) and on weekends, minimising the impact on the availability of our services.

Backups

Data backups are created regularly, ensuring that data can be restored in the event of a failure.

System updates

Our Website and the systems we build and maintain are kept up to date on an ongoing basis in order to ensure security, stability and compliance with applicable technical standards. In the event of changes to external systems with which our solutions are integrated, we adapt them to the current requirements as quickly as possible.

Server security

The servers used by Vibegroup are located in professional data centres monitored 24 hours a day, 7 days a week. Access to the servers is granted exclusively to authorised administrators. The server rooms are protected against fire and unauthorised access, and are equipped with emergency power supply independent of the municipal power grid.

User accounts

In the systems we make available, each user account is protected by a login and password. The password is stored in an encoded form (hash) — if it is lost, only a new password can be set. It is not possible to recover the password from its encoded form.

Data security in the network

Data is stored on secured servers, which means that in the event of a device failure or loss it remains accessible from any other device with Internet access.

Privacy Policy and cookie policy

Dear User,

We care about your privacy and want you to feel comfortable while using our services. Therefore, below we present information about the rules under which we process your personal data and about the cookies we use. This information has been prepared taking into account Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (the General Data Protection Regulation, hereinafter: “GDPR”).

Personal data controller

The controller, i.e. the entity deciding how the personal data of the users of the website https://vibegroup.pl/ (respectively, the “Website” and the “Users”) will be used, is Vibe Group sp. z o.o. (a limited liability company) with its registered office in Stalowa Wola, ul. Generała Leopolda Okulickiego 33a/9, 37-450 Stalowa Wola, entered in the register of entrepreneurs of the National Court Register kept by the District Court in Rzeszów, 12th Commercial Division of the National Court Register, under KRS 0001221366, NIP 8652592172, REGON 543878877, with a share capital of PLN 5,000.00 (hereinafter: “Vibegroup” or the “Controller”).

If you wish to contact us regarding the processing of your personal data, please write to the e-mail address: info@vibegroup.pl.

Personal data processor

Some of the services provided by Vibegroup consist of designing, building, deploying and maintaining software, as well as providing IT services to Clients. To the extent that — in performing an agreement — we process personal data entrusted to us by a Client, the Client remains the controller of that data, and Vibegroup processes it as a processor on the basis of a concluded personal data processing agreement.

We suggest that enquiries concerning data processed on behalf of a Client be directed to that Client directly (as the controller of such data), since it is the Client who decides on the purposes and means of its processing.

The further information contained in this Policy concerns cases in which we process data in our own name, within the framework of a direct relationship with the data subject.

Your rights

In the situations provided for by law, you have the right to:

• access your personal data, including obtaining a copy thereof (Art. 15 GDPR or — where applicable — Art. 13(1)(f) GDPR),
• rectify it (Art. 16 GDPR),
• erase it (Art. 17 GDPR),
• restrict its processing (Art. 18 GDPR),
• transfer the data to another controller (Art. 20 GDPR),
• withdraw consent at any time without affecting the lawfulness of the processing carried out on the basis of consent before its withdrawal (Art. 7(3) GDPR),

as well as the right to:

• object at any time to the processing of your data on grounds relating to your particular situation — with regard to processing based on Art. 6(1)(f) GDPR (i.e. on the legitimate interests pursued by us), including profiling (Art. 21(1) GDPR);
• object where personal data is processed for direct marketing purposes, including profiling, to the extent that the processing is related to such direct marketing (Art. 21(2) GDPR).

Contact us at info@vibegroup.pl if you wish to exercise your rights. You may express your objection to our use of cookies by means of the appropriate settings of your browser (which you can read about below).

If you consider that your data is being processed unlawfully, you may lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland, https://uodo.gov.pl/).

Personal data and privacy

We process your data for purposes related to Vibegroup’s business activity, the provision of the services we offer and the operation of the Website. Below you will find detailed information about the processing of your data depending on the actions you take.

1. Clients and persons using our services

For what purpose?

We process the data:

• in order to perform an agreement with the Client or to take steps prior to concluding an agreement, at the Client’s request, expressed in any manner, e.g. by completing the contact form on the website,
• in order to carry out settlements, accounting and financial reporting.

We also process the data in connection with the pursuit of Vibegroup’s legitimate interests, i.e. where this is appropriate:

• in order to establish, pursue and defend claims,
• for statistical purposes, related to improving work efficiency, the quality and security of the services provided and adapting them to their recipients.

Where you have given your consent — we process the data for the purposes indicated in the content of that consent.

Note: providing data other than that requested by Vibegroup, or data marked as optional, is an explicit action equivalent to giving consent to the processing of personal data for the purposes for which it was provided.

On what legal basis?

The basis for the processing of your personal data is:

• the performance of an agreement with the Client or taking steps prior to concluding an agreement at the Client’s request (Art. 6(1)(b) GDPR — if you are our Client; Art. 6(1)(f) GDPR — if you are a person cooperating with us on behalf of the Client);
• the fulfilment of legal obligations, in particular those related to accounting (Art. 6(1)(c) GDPR);
• Vibegroup’s legitimate interests in ensuring security, providing services tailored to the Clients’ needs and ensuring the functionality of the Website (Art. 6(1)(f) GDPR).

Data whose provision is optional is processed on the basis of consent — where such consent has been given (Art. 6(1)(a) or Art. 9(2)(a) GDPR).

For how long?

Your data will be processed for:

• the term of the agreement binding you with Vibegroup;
• the period required by law, in particular by accounting regulations;
• where justified — until the limitation periods for claims arising from the agreement expire, whichever of these periods is longer;
• until you object to processing based on Vibegroup’s legitimate interest — where there are grounds for doing so.

Where data is processed on the basis of consent, the data will be processed until such consent is withdrawn.

2. Contacting us (e.g. to obtain support or to ask a question about our services)

For what purpose?

Handling your enquiries or requests, or adapting our services to the Clients’ needs (including by recording and analysing correspondence with our team).

On what legal basis?

The basis for the processing of data is the performance of an agreement with the Client (Art. 6(1)(b) GDPR) — where your enquiry or request concerns the subject matter of an agreement to which we are a party.

We may also process your personal data on the basis of our legitimate interest consisting in conducting communication with you — if your enquiry or request is not related to an agreement — or in carrying out satisfaction surveys concerning our services, or for the purpose of establishing, pursuing and defending claims (Art. 6(1)(f) GDPR).

Where it has been given — we also process the data on the basis of consent (Art. 6(1)(a) or Art. 9(2)(a) GDPR).

For how long?

Your data will be processed for the term of the agreement binding you with Vibegroup. As for the scope in which we process your personal data on the basis of our legitimate interest:

• for 36 months or until we uphold your objection to the processing;
• until the period for pursuing claims expires;
• — whichever of these periods applies.

Where data is processed on the basis of consent, the data will be processed until such consent is withdrawn.

3. Carrying out analytical activities

For what purpose?

Analysis of the way in which you use and navigate the website, in order to adapt the site to the needs and behaviour of users (you can read more on this topic in the “Analytical activities” and “Cookies” sections of this Policy).

On what basis?

Our legitimate interest, consisting in processing data for the purpose indicated above (Art. 6(1)(f) GDPR).

For how long?

Until the analytical cookies expire or are deleted by you — whichever applies in a given case and whichever occurs first.

4. Carrying out marketing activities

For what purpose?

Direct marketing consisting in displaying personalised advertisements (you can read more on this topic in the “Profiling” and “Cookies” sections of this Policy). Carrying out other marketing activities, including sending information about Vibegroup’s services — where prior consent has been given — for the purpose indicated in the content of that consent.

On what basis?

Our legitimate interest, consisting in processing data for the purpose indicated above (Art. 6(1)(f) GDPR) and, where it has been given — also consent to the processing of personal data (Art. 6(1)(a) or Art. 9(2)(a) GDPR).

For how long?

Until consent is withdrawn or an objection is raised, and for cookies — until the marketing cookies expire or are deleted by you, whichever applies and whichever occurs first.

5. Prospective Clients, including recipients of marketing activities

For what purpose?

We process the data in order to present information about our services and the Website, using the following forms of communication: sending information about Vibegroup’s offer (e-mail messages). In addition, we process the data for the purposes indicated in the content of the consents to the processing of personal data — where such consents have been given — as well as, upon request, in order to take steps aimed at concluding an agreement, including by presenting Vibegroup’s offer.

On what legal basis?

Vibegroup’s legitimate interests consisting in processing data for the purpose indicated above (Art. 6(1)(f) GDPR) and taking steps aimed at concluding an agreement (Art. 6(1)(b) GDPR). To the remaining extent, we process the data on the basis of consent — where such consent has been given (Art. 6(1)(a) or Art. 9(2)(a) GDPR).

For how long?

Your personal data will be stored until consent is withdrawn or an objection is raised, i.e. until you demonstrate to us in any manner that you do not wish to remain in contact with us and to receive information about the activities we undertake.

6. Social media users

For what purpose?

We process the data in order to run accounts on social media platforms, including promoting the Vibegroup brand, moderating comments and messages, receiving requests and compiling statistics.

Where, for certain processing purposes, our organisation is a controller jointly with another entity, information in this respect will be provided separately, including under the terms of use of the Facebook social media platform available at: https://www.facebook.com/legal/terms/page_controller_addendum.

On what legal basis?

Vibegroup’s legitimate interests, consisting in processing data for the purpose indicated above (Art. 6(1)(f) GDPR). To the remaining extent, we process the data on the basis of consent — where such consent has been given (Art. 6(1)(a) GDPR).

For how long?

Your personal data will be stored until consent is withdrawn or an objection is raised. Where justified, after the withdrawal of consent or the raising of an objection, the personal data may be stored until the limitation periods for claims expire.

7. Partners, suppliers and persons designated to perform an agreement

For what purpose?

We process the data:

• in order to perform an agreement concluded with a partner or to take steps prior to concluding an agreement, at the partner’s request;
• in order to carry out settlements, accounting and financial reporting;
• in order to fulfil other obligations arising from the provisions of law.

As well as in connection with the pursuit of Vibegroup’s other legitimate interests:

• in order to establish, pursue and defend claims;
• for statistical purposes, related to improving work efficiency, the quality of the services provided and adapting them to their recipients.

On what basis?

The performance of an agreement with a partner or taking steps prior to concluding an agreement at the partner’s request (Art. 6(1)(b) GDPR — if you are our partner; Art. 6(1)(f) GDPR — if you are a person cooperating with us on behalf of a partner); the fulfilment of legal obligations (Art. 6(1)(c) GDPR); Vibegroup’s legitimate interests (Art. 6(1)(f) GDPR).

For how long?

As a rule, the data will be processed for the term of the agreement binding the partner with Vibegroup. The data will also be stored for the period required by law, in particular by accounting regulations, and — where justified — until the limitation periods for claims arising from the agreement expire, whichever period is longer.

Cookies

The vibegroup.pl website, like most websites, uses so-called cookies. These files:

• are saved in the memory of your device (computer, phone, tablet, etc.),
• do not cause changes to the settings of your device.

On the vibegroup.pl website, cookies are used for the purposes of:

• remembering your session,
• analytics,
• marketing,
• providing the functions of the Website.

By using the appropriate options of your browser, you can at any time:

• delete cookies,
• block the use of cookies in the future.

In such cases we will no longer process them.

To learn how to manage cookies, including how to block them, you can use the help file of your browser — you will usually find information on this topic after pressing the F1 key. You will also find appropriate guidance in the documentation of the browser you use (Firefox, Chrome, Safari, Microsoft Edge).

Automated decision-making

As a rule, your personal data will not be processed in an automated manner (including in the form of profiling) in such a way that, as a result of such automated processing, any decisions could be made, other legal effects could be produced or it could otherwise significantly affect our Clients, contractors and their employees or associates.

Should we intend to carry out automated decision-making, we will provide separate information in advance, also stating details concerning the rules for making such decisions and the consequences of such processing. In cases of automated decision-making, you have the right to contest the decision and to obtain human intervention on the part of the Controller.

Profiling

Within the Website we may carry out profiling — with regard to you, this will take place if you allow (e.g. through the appropriate settings of your browser) such activities. Profiling consists in the automatic assessment of which services you may be interested in, using information about the content you view. As a result, the advertisements of services displayed within the online services you use will be better tailored to you and your needs.

The profiling we carry out does not result in decisions producing legal effects concerning you or similarly significantly affecting you.

Analytical activities

Within the Website we carry out analytical activities aimed at making it more intuitive and accessible — with regard to you, this will take place if you allow (e.g. through the appropriate settings of your browser) such activities. As part of the analysis, we will take into account the way you navigate the Website — e.g. how much time you spend on a given subpage and where you click. This allows us to adapt the layout, appearance and content of the Website to the needs of the Users.

Google Analytics

The vibegroup.pl website may use Google Analytics, a web analytics service provided by Google Ireland Limited (“Google”). Google Analytics uses cookies. The information generated by the cookie about your use of the website is usually transmitted to a Google server in the USA and stored there. Due to the activation of IP anonymisation, your IP address will first be truncated by Google within the member states of the European Union or in other states party to the Agreement on the European Economic Area. Only in exceptional cases will the full IP address be sent to a Google server in the USA and truncated there. On our behalf, Google will use this information to evaluate your use of the website, to compile reports on website activity and to provide other services related to website traffic and Internet use. The IP address provided by Google Analytics will not be combined with other data held by Google.

The purpose of the data processing is to evaluate the use of the website and to compile reports on activity on the website. The processing is based on our legitimate interest.

Google Analytics collects data concerning IP addresses, network location, the date of the visit, the operating system and the browser type. You can prevent the storage of cookies by means of the appropriate setting of your browser; please note, however, that if you do so, you may not be able to use all the functions of this website to the fullest extent possible. You can also prevent Google from collecting and processing the data generated by cookies and related to your use of the website (including your IP address) by installing the Google Analytics Opt-out browser add-on.

Facebook Pixel (Meta Pixel)

We may use a “user activity pixel” called “Facebook Pixel” (currently: “Meta Pixel”) — a service provided by Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (“Meta”). With its help, we can track the actions of users after they view or click on an advertisement on Facebook or Instagram. This allows us to measure the effectiveness of the advertisements we use for statistical and market research purposes. The data collected in this way is anonymous to us, i.e. we do not see the personal data of individual users. This data is, however, stored and processed by Meta. Meta may link this data to a Facebook account, as well as use it for its own advertising purposes, in accordance with Meta’s data use policy.

The processing is based on our legitimate interest consisting in the analysis, optimisation and economic operation of our online offer (Art. 6(1)(f) GDPR).

If you are a Facebook user and do not want Meta to collect data about you via our website and link it to your data stored on Facebook, log out of Facebook and delete the cookies before using our website. Changes to the settings concerning the use of data for advertising purposes are possible in the Facebook profile settings.

Data security

When processing your personal data, we apply organisational and technical measures in accordance with the relevant provisions of law, including encryption of the connection by means of an SSL/TLS certificate. Access to personal data is granted exclusively to authorised persons who are obliged to maintain confidentiality.

Voluntariness of providing personal data

Providing data is necessary in order to conclude agreements and settle the activity conducted, as well as for Vibegroup to comply with legal requirements. To the remaining extent (in particular for the purpose of Vibegroup processing data for particular marketing purposes), providing data is voluntary.

Source and categories of processed data

As a rule, we process data obtained directly from you. If you have not provided us with your personal data, we obtained it from our Client, contractor or from another entity that had a valid legal basis for disclosing it (e.g. from your representative or from an entity holding your consent to disclose the data to us).

We obtain personal data to the extent necessary to achieve the purposes of the processing. Where data is obtained in order to conclude and perform an agreement, it is most often: first name, surname, identification data (including NIP), postal address, e-mail address, telephone number, order data, invoicing data and the history of contact with Vibegroup. In the case of using the systems we make available — also the login, password and activity history.

Data recipients

To the extent necessary to achieve the purposes of the processing, the recipients of your personal data may be external entities — on the basis of a concluded personal data processing agreement or for the purpose of providing services specified in the agreement to Vibegroup. The recipients may be:

• entities providing accounting, audit and legal services;
• entities providing IT services, in particular hosting, server administration and the supply or maintenance of IT systems, providers of cloud computing services and providers of software used by Vibegroup in the ordinary course of business;
• Stripe, Inc. and Stripe Payments Europe, Ltd. — as the provider of payment services;
• Google Ireland Limited — within the Google Analytics service;
• Meta Platforms Ireland Limited — within the Facebook Pixel (Meta Pixel) service;
• users of the website and social media, such as Facebook, Instagram, LinkedIn;
• clients and contractors, including subcontractors and suppliers;
• companies carrying out marketing activities and promotional campaigns;
• providers of postal or courier services — where there is a need to exchange correspondence via such a channel;
• third parties supporting Vibegroup’s activity, including associates;
• banks and other financial and payment institutions;
• law enforcement and state authorities — in the cases required by the provisions of law.

Transfer of personal data to third countries

As a rule, your personal data will not be transferred outside the European Economic Area (“EEA”). However, having regard to the services provided by Vibegroup’s subcontractors in providing support for ICT services and IT infrastructure, Vibegroup may commission specific IT activities or tasks to reputable subcontractors operating outside the EEA, which may result in your data being transferred outside the EEA. This applies in particular to the services provided by:

• Google LLC (USA) — within Google Analytics;
• Meta Platforms, Inc. (USA) — within Facebook Pixel (Meta Pixel);
• Stripe, Inc. (USA) — within payment processing.

The countries of the recipients outside the EEA, in accordance with the decision of the European Commission, ensure an adequate level of personal data protection consistent with EEA standards (including the United States under the EU-US Data Privacy Framework). In the case of recipients in the territory of countries not covered by a European Commission decision, in order to ensure an adequate level of protection, Vibegroup concludes agreements with the recipients based on the standard contractual clauses issued by the European Commission in accordance with Art. 46(2)(c) GDPR.

A copy of the standard contractual clauses may be obtained from Vibegroup by contacting the contact details provided above. The method used by Vibegroup to safeguard your data is consistent with the principles provided for in Chapter V of the GDPR. You may request further information about the safeguards applied, obtain a copy thereof and information about where they are made available.