Privacy Policy
This Privacy Policy sets out the rules governing the processing of personal data of Users who use the Website, as well as the rules governing the use of cookies and similar technologies on the Website.
In particular, this Privacy Policy specifies the purposes and legal bases for processing personal data, information about data recipients, data retention periods, and the rights of data subjects.
§1 DEFINITIONS
Website – the Square website available at https://square.pl
External Service – a website, application or service operated by partners, service providers or other entities cooperating with the Controller.
Website / Data Controller – the Controller of the Website and personal data (hereinafter: the “Controller”) is Square Enterprises Sp. z o.o., with its registered office at ul. Wielopole 7/6, 31-072 Kraków, Poland, NIP: 6751672921.
User – a natural person using the Website or contacting the Controller through the tools available on the Website.
Device – an electronic device together with software through which the User accesses the Website.
Cookies – small text files or similar information stored on or accessed from the User’s Device while using the Website.
GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016.
Personal Data – information relating to an identified or identifiable natural person.
Processing – any operation or set of operations performed on Personal Data or sets of Personal Data, whether or not by automated means, including in particular collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure, restriction, erasure or destruction.
Restriction of Processing – the marking of stored Personal Data with the aim of limiting its future processing.
Profiling – any form of automated processing of Personal Data consisting in the use of Personal Data to evaluate certain factors relating to a natural person.
Consent – a freely given, specific, informed and unambiguous indication of the data subject’s wishes by which they signify agreement to the processing of Personal Data concerning them.
Personal Data Breach – a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or unauthorised access to, Personal Data.
Pseudonymisation – the processing of Personal Data in such a manner that the Personal Data can no longer be attributed to a specific data subject without the use of additional information, provided that such additional information is kept separately and appropriately protected.
Anonymisation – a data processing process that permanently prevents data from being attributed to a specific natural person.
§2 DATA PROTECTION OFFICER
The Controller has not appointed a Data Protection Officer because, based on an assessment of the scope and nature of the processing of Personal Data, the circumstances set out in Article 37 of the GDPR that would require the Controller to appoint one do not apply.
For matters concerning the processing of Personal Data, the Controller may be contacted directly using the contact details specified in §14 of this Privacy Policy.
§3 COOKIES
The Website uses cookies and similar technologies to ensure the proper functioning of the Website, improve its functionality, collect statistics and, where appropriate consent has been provided, carry out analytical and marketing activities.
Cookies may include:
Necessary Cookies – cookies required for the proper functioning of the Website and the use of its basic features.
Analytics Cookies – cookies used to collect information about how the Website is used, including the number of visits, pages viewed and how Users navigate the Website.
Marketing Cookies – cookies used for advertising, remarketing and measuring the effectiveness of marketing activities.
First-party Cookies – cookies stored by the Website.
Third-party Cookies – cookies stored by external service providers whose services are used on the Website.
Session Cookies – cookies stored until the end of a session or until the browser is closed.
Persistent Cookies – cookies stored for a specified period or until they are deleted by the User.
Where the use of cookies requires the User’s consent, such consent is obtained through the consent management mechanism available on the Website.
The User may change or withdraw their consent at any time using the consent management mechanism available on the Website.
The rules concerning the storage of information on a User’s terminal device and access to such information are also governed by applicable law, including the Polish Act of 12 July 2024 – Electronic Communications Law.
§4 DATA SECURITY
The Controller implements appropriate technical and organisational measures to protect Personal Data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access.
The Controller takes measures to ensure that access to Personal Data is granted only to authorised persons and entities for whom access to such data is necessary to provide specific services.
The Controller applies appropriate technical safeguards in connection with the operation of the Website. However, the use of the Internet involves risks that cannot be completely eliminated by the Controller.
Users should also apply appropriate security measures on their side, including using up-to-date software and protecting their devices against unauthorised access.
§5 PURPOSES OF USING COOKIES
Cookies may be used in particular for the following purposes:
- ensuring the proper functioning of the Website;
- remembering selected User settings and preferences;
- analysing how the Website is used;
- generating statistics concerning the use of the Website;
- measuring the effectiveness of marketing activities;
- carrying out advertising and remarketing activities, where the User has provided the required consent.
For analytical purposes, the Controller uses, among others, Google Analytics 4 and Google Tag Manager.
For advertising and measuring the effectiveness of marketing activities, the Controller may use Google Ads and Meta Pixel.
§6 PURPOSES OF PROCESSING PERSONAL DATA
Personal Data provided by Users through contact forms or other communication channels available on the Website may be processed for the following purposes:
- responding to enquiries;
- communicating with the User;
- providing information about the Controller’s services;
- taking steps at the User’s request prior to entering into a contract;
- entering into and performing a contract, if a contract is concluded;
- complying with legal obligations applicable to the Controller;
- establishing, pursuing or defending against potential claims;
- ensuring the security of the Website;
- carrying out analyses and statistics concerning the operation of the Website;
- carrying out marketing activities where the legal basis for such activities is the User’s consent or the Controller’s legitimate interest.
Technical data concerning the use of the Website may be processed to ensure the proper functioning of the Website, analyse its operation, ensure security and generate statistics.
§7 COOKIES AND THIRD-PARTY SERVICES
The Website uses services provided by third parties that may process information concerning the use of the Website and, depending on the configuration of a given service and the consents provided, store cookies on the User’s Device.
In particular, the Controller uses:
Google Analytics 4 – an analytics tool used to analyse how the Website is used and to generate statistics.
Google Tag Manager – a tool used to manage scripts and tags implemented on the Website.
Google Ads – a tool used to run advertising campaigns and measure their effectiveness.
Meta Pixel – a tool used to measure the effectiveness of advertising activities and, depending on its configuration, for remarketing purposes.
Third-party services may involve the processing of data by those providers in accordance with their own privacy policies and terms of service.
Depending on the service used and its configuration, data may be transferred to third countries. In such cases, the Controller applies the legally required mechanisms ensuring an appropriate level of protection of Personal Data.
§8 TYPES OF DATA COLLECTED
In connection with the use of the Website, the Controller may process the following categories of data:
Data voluntarily provided by the User:
- first and last name, if provided;
- email address;
- telephone number, if provided;
- content of the message or enquiry;
- other information provided by the User when contacting the Controller.
The scope of data depends on the information provided by the User.
Technical data and data concerning the use of the Website:
- IP address;
- device information;
- browser type and version;
- operating system;
- screen resolution;
- browser language;
- approximate location;
- pages visited;
- time spent on individual pages;
- source from which the User accessed the Website;
- information concerning interactions with the Website;
- information concerning how the Website is used;
- information stored in cookies and similar technologies.
The scope of technical data may vary depending on the User’s Device settings, browser settings and the consents provided for the use of specific technologies.
§9 ACCESS TO PERSONAL DATA BY THIRD PARTIES
As a general rule, the Controller does not sell Users’ Personal Data.
Data may be accessed by entities cooperating with the Controller where this is necessary for the proper functioning of the Website or for the fulfilment of specific processing purposes.
These may include, in particular:
- hosting service providers;
- IT and technical service providers;
- analytics tool providers;
- advertising and marketing tool providers;
- providers of tools for managing scripts and cookie consents;
- entities providing services related to contact forms and electronic communication;
- legal, accounting or advisory service providers, where necessary for the provision of their services.
Such entities may process data on the basis of agreements concluded with the Controller and only to the extent necessary to perform the tasks entrusted to them.
Hosting
The Controller uses the services of an external hosting provider – Hostline.pl.
Data related to the operation of the Website is stored within the infrastructure of the hosting service provider. The provider’s personnel may have access to data in connection with the provision of services, technical support or maintenance work.
§10 METHOD OF PROCESSING PERSONAL DATA
Personal Data is processed in accordance with applicable laws, in particular the GDPR.
The Controller does not use Personal Data for automated decision-making that produces legal effects concerning the User or similarly significantly affects the User.
Where the Controller uses analytics or marketing tools provided by third parties, data may be processed by those providers in accordance with the rules set out in their documentation and privacy policies.
Where services are provided by entities based or operating infrastructure outside the European Economic Area, Personal Data may be transferred to a third country. The Controller ensures that appropriate mechanisms provided for under the GDPR are applied to such transfers.
§11 LEGAL BASES FOR PROCESSING PERSONAL DATA
The Controller processes Personal Data on the following legal bases:
Article 6(1)(a) GDPR – Consent
Where the User has given consent to the processing of Personal Data for a specific purpose.
This applies in particular to the use of certain categories of cookies and similar technologies where consent is required.
The User may withdraw their consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
Article 6(1)(b) GDPR – Performance of a contract
Where the processing of data is necessary for the performance of a contract or for taking steps at the User’s request prior to entering into a contract.
Article 6(1)(c) GDPR – Legal obligation
Where the processing is necessary for compliance with a legal obligation to which the Controller is subject.
Article 6(1)(f) GDPR – Legitimate interests of the Controller
Where the processing is necessary for the purposes of the legitimate interests pursued by the Controller, in particular:
- ensuring the security of the Website;
- preventing abuse;
- establishing, pursuing or defending against claims;
- carrying out basic statistics and analyses of the Website’s operation, where permitted by applicable law;
- marketing the Controller’s own services, to the extent permitted by applicable law.
Processing based on legitimate interests is carried out with due regard to the rights and freedoms of the data subject.
The legal basis for the use of cookies and similar technologies is also Article 399 of the Polish Act of 12 July 2024 – Electronic Communications Law, to the extent applicable.
§12 RETENTION PERIODS FOR PERSONAL DATA
Personal Data is stored for no longer than is necessary to fulfil the purpose for which it was collected, taking into account the Controller’s legal obligations and the possibility of establishing, pursuing or defending against claims.
In particular:
Data provided when contacting the Controller – for the period necessary to handle the enquiry and conduct the correspondence, and subsequently for the period necessary to protect against potential claims.
Data related to entering into and performing a contract – for the duration of the contract and subsequently for the period required by law or necessary to protect against claims.
Data processed on the basis of consent – until the consent is withdrawn or the purpose for which it was given ceases to exist, taking into account the need to demonstrate that valid consent was obtained.
Data processed for marketing purposes – until an effective objection is made, consent is withdrawn or the processing purpose ceases to exist, depending on the applicable legal basis.
Technical and analytics data – for the period resulting from the configuration of the tools used and applicable legal requirements.
After the relevant retention period has expired, data is deleted or anonymised unless further storage is required by law or is necessary to establish, pursue or defend against claims.
§13 RIGHTS OF USERS REGARDING THE PROCESSING OF PERSONAL DATA
The data subject has, where provided for by the GDPR, the following rights:
Right of access
The right to obtain confirmation as to whether Personal Data is being processed and, where this is the case, to access such data and information concerning its processing.
Right to rectification
The right to request the rectification of inaccurate Personal Data or the completion of incomplete data.
Right to erasure
The right to request the erasure of Personal Data in the cases specified in Article 17 of the GDPR.
This right is not absolute and may be subject to limitations arising from applicable law.
Right to restriction of processing
The right to request restriction of the processing of Personal Data in the cases specified in Article 18 of the GDPR.
Right to data portability
Where provided for by the GDPR, the right to receive Personal Data in a structured, commonly used and machine-readable format and to transmit such data to another controller.
Right to object
The right to object to the processing of Personal Data based on Article 6(1)(e) or (f) of the GDPR, on grounds relating to the data subject’s particular situation.
Where Personal Data is processed for direct marketing purposes, the data subject has the right to object to such processing at any time.
Right to withdraw consent
Where processing is based on consent, the User has the right to withdraw that consent at any time.
Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.
Right to lodge a complaint
The data subject has the right to lodge a complaint with the supervisory authority competent for matters concerning the protection of Personal Data, i.e. the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych) in Poland.
To exercise their rights, the User may contact the Controller using the contact details provided in §14.
§14 CONTACT WITH THE CONTROLLER
The Controller may be contacted using one of the following methods:
Postal address:
Square Enterprises Sp. z o.o.
ul. Wielopole 7/6
31-072 Kraków
Poland
Email address:
hello@square.pl
Telephone:
+48 533 378 405
§15 WEBSITE REQUIREMENTS
Restricting or blocking certain cookies may affect the proper functioning of selected features of the Website.
Cookies necessary for the operation of the Website may be used without the User’s consent where this is necessary to provide a service requested by the User or to ensure the proper functioning of the Website.
The use of other categories of cookies may be subject to the User’s consent, in accordance with applicable law.
§16 EXTERNAL LINKS
The Website may contain links to websites or services operated by third parties.
The Controller is not responsible for the privacy practices or content of third-party websites.
After visiting an external website, the User should review the privacy policy and cookie policy applicable to that website.
§17 CHANGES TO THE PRIVACY POLICY
The Controller may update this Privacy Policy in particular in the event of:
- changes to applicable laws;
- changes to the way the Website operates;
- introduction of new functionalities or services;
- changes to the tools or service providers used;
- changes to the way Personal Data is processed.
The current version of the Privacy Policy is published on the Website.
In the event of material changes concerning the processing of Personal Data, the Controller will take the steps required by applicable law, in particular with regard to informing data subjects.
Changes to this Privacy Policy shall take effect upon publication on the Website, unless the amended provisions or applicable law provide for a different effective date.
Last updated: 29 September 2026