Privacy Policy

## I. General Provisions

1. This privacy policy defines how personal data of Users necessary for the provision of services electronically via the website www.gudi.studio (hereinafter: the Service) is collected, processed, and stored.

2. The Service collects only the personal data necessary to provide and develop the services offered within it.

3. Personal data collected through the Service are processed in accordance with the Regulation of the European Parliament and of the Council (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter GDPR) and the Polish Act on the Protection of Personal Data of 10 May 2018.

## II. Data Controller

1. The Data Controller of personal data collected through the Service is GUDI Sp. z o.o., address: ul. Mozarta 3 lok. 921, 02-736 Warsaw, Poland, KRS: 0001073639, NIP: 5214048030, REGON: 527132653, email address: hello@gudi.studio (hereinafter: the Administrator). The Service operates under the Incisive Studio brand.

## III. Purpose of Collecting Personal Data

1. Personal data is used for the purpose of:

- contacting the User and responding to enquiries submitted via the contact form or by email,
- preparing and presenting a commercial offer,
- concluding and performing contracts for services and e-services,
- fulfilling accounting and tax obligations related to a concluded contract,
- sending newsletters (after the User consents to receive them),
- promotion of the Administrator's offer,
- marketing, remarketing, affiliation,
- personalization of the Service for Users,
- analytical and statistical activities,
- debt collection,
- establishing and pursuing claims or defending against them.

2. Providing data is voluntary, but necessary to conclude a contract or use other functionalities of the Service.

## IV. Type of Personal Data Processed

1. The Administrator may process the following personal data of the User: first and last name, company name, registered office or correspondence address, email address, telephone number, NIP (tax identification number).

## V. Period of Personal Data Processing

1. Users' personal data will be processed for the period of:

- when the basis for data processing is the performance of the contract — until the expiration of claims after its execution,
- when the basis for data processing is consent — until its withdrawal, and after the withdrawal of consent until the expiration of claims.

2. In both cases, the limitation period is 6 years, and for claims for periodic benefits and claims related to business activities — 3 years (unless a specific provision states otherwise).

3. Data contained in accounting records is stored for the period required by tax and accounting law, i.e. 5 years counted from the end of the calendar year in which the tax payment deadline expired.

## VI. Sharing Personal Data

1. Users' personal data may be transferred to: entities associated with the Administrator, its subcontractors (including collaborators and freelancers performing commissioned work), entities cooperating with the Administrator, e.g., companies handling e-payments, hosting and email service providers, courier/postal service providers, accounting offices, law firms.

2. Users' personal data may be transferred outside the European Economic Area (EEA), in particular to the United States, in connection with the Administrator's use of analytics, hosting and email tools provided by entities established outside the EEA (including Google LLC). Such transfers take place on the basis of a European Commission adequacy decision (Data Privacy Framework) or on the basis of standard contractual clauses approved by the European Commission. The User has the right to obtain a copy of the safeguards applied to such transfers by contacting the Administrator.

## VII. User's Rights

1. The Service User has the right to: access the content of their personal data, rectification, deletion, restriction of processing, portability, object to processing, withdraw consent at any time (which does not affect the legality of the processing carried out on the basis of consent before its withdrawal).

2. To exercise the rights mentioned above, the User should send a request to the email address: hello@gudi.studio.

3. The Administrator shall fulfill or refuse to fulfill the request promptly, at the latest within one month of its receipt.

4. The User has the right to lodge a complaint with the President of the Personal Data Protection Office if they believe that the processing violates their rights and freedoms (GDPR).

## VIII. Cookies

1. The Service collects information using cookies — session, permanent, and from external entities.

2. Collecting cookies supports the correct provision of services in the Service and serves statistical purposes.

3. The Service uses Google Analytics, a tool provided by Google LLC, which uses cookies to analyse how Users interact with the Service. The information collected in this way is statistical in nature. The User may block Google Analytics by installing the browser add-on available at https://tools.google.com/dlpage/gaoptout.

4. Analytical and marketing cookies are installed only after the User has given consent via the cookie banner available in the Service. Consent may be withdrawn at any time by changing the settings in the banner or in the browser settings.

5. The User may determine the extent to which cookies can access their device in the browser settings.

## IX. Automated Decision Making and Profiling

1. Users' data cannot be processed in an automated way such that any decisions could be made against them as a result.

2. Users' data may be profiled to tailor content and personalize the offer after they consent.

## X. Final Provisions

1. The Administrator has the right to make changes to the Privacy Policy, provided that the rights of the Users are not limited.

2. Information about the changes will appear in the form of a notice available on the Service.

3. In matters not regulated in this Privacy Policy, the provisions of the GDPR and Polish law shall apply.