Privacy Policy

1. General provisions

This document sets out the rules for processing the personal data of users of the website available at faeo.pl (the “Website”) and of persons who contact us via forms, e-mail or other channels.

The Controller makes every effort to ensure that personal data is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council (GDPR), the Personal Data Protection Act and the Polish Electronic Communications Law.

2. Data controller

The controller of your personal data is LIC COMPANY Sp. z o.o. (operating under the FAEO brand), with its registered office in Kielce, Poland.

• Name: LIC COMPANY Sp. z o.o.
• Registered office: ul. Klonowa 105/81, 25-553 Kielce, Świętokrzyskie Voivodeship, Poland
• KRS: 0001207472, District Court in Kielce, 10th Commercial Division of the National Court Register
• NIP: 9592088245, REGON: 543333184
• Share capital: PLN 5,000.00
• Contact e-mail for data protection matters: kontakt@faeo.pl

3. Contact for data protection matters

For any matters concerning the processing of personal data and the exercise of your rights, you may contact the Controller by e-mail at kontakt@faeo.pl or in writing at the registered office address.

The Controller has not appointed a Data Protection Officer (DPO), as it is not obliged to do so under Art. 37 GDPR. The e-mail address above serves as the point of contact for all data protection matters.

4. Definitions

• GDPR — Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data.
• Personal data — any information relating to an identified or identifiable natural person.
• Processing — any operation performed on personal data, e.g. collection, storage, use or deletion.
• Controller — the entity that determines the purposes and means of processing data, i.e. LIC COMPANY Sp. z o.o.
• Profiling — automated processing of data to evaluate certain characteristics of a person, e.g. preferences or interests.

5. Purposes, legal bases and retention periods

We process your data for the purposes listed below, on the indicated legal bases and for the indicated periods. Each purpose is pursued independently.

• Handling enquiries from the contact form, the quiz or the free audit form — basis: Art. 6(1)(f) GDPR (legitimate interest in providing a response and preparing an offer), and where the enquiry aims to conclude a contract — Art. 6(1)(b) GDPR. Period: for the duration of the correspondence and up to 12 months after it ends; if no cooperation follows, the data is deleted.
• Conclusion and performance of a contract with a client — basis: Art. 6(1)(b) GDPR. Period: for the duration of the contract.
• Fulfilment of tax and accounting obligations — basis: Art. 6(1)(c) GDPR. Period: 5 years from the end of the year in which the tax obligation arose.
• Direct marketing of our own services (e.g. profiling for offers, contacting existing clients) — basis: Art. 6(1)(f) GDPR (legitimate interest). Contact for this purpose by electronic mail (e-mail) takes place only after obtaining your prior consent in accordance with Article 398 of the Polish Electronic Communications Law. Period: until an objection is raised or consent is withdrawn.
• Acquiring business clients (prospecting, B2B direct marketing) — basis: Art. 6(1)(f) GDPR for obtaining and processing business data from public sources, and your prior consent to electronic contact (e-mail) in accordance with Article 398 of the Polish Electronic Communications Law. Period: until an objection is raised or consent is withdrawn, no longer than 12 months from the last contact.
• Sending the newsletter and commercial information by electronic means (e-mail) — basis: Art. 6(1)(a) GDPR (consent) and a separate consent to the use of the indicated communication channel in accordance with Article 398 of the Polish Electronic Communications Law. Period: until consent is withdrawn or the subscription is cancelled.
• Analytics and traffic measurement on the Website (Google Analytics 4) — basis: Art. 6(1)(a) GDPR (consent given in the cookie settings). Period: until consent is withdrawn, no longer than 14 months (in accordance with the data retention settings in GA4).
• Remarketing and personalised advertising (Google Ads) — basis: Art. 6(1)(a) GDPR (consent given in the cookie settings). Period: until consent is withdrawn, in accordance with the cookie settings.
• Establishing, pursuing or defending claims — basis: Art. 6(1)(f) GDPR. Period: until the limitation period for claims expires.

6. Sources of data

In most cases we obtain personal data directly from you — when you fill in a form, write to us or subscribe to the newsletter.

As part of our B2B sales activities, we also obtain contact data of company representatives from publicly available sources. In accordance with Article 14 GDPR, we inform you of the details of such processing:

• Sources of data: the CEIDG and KRS registers, official company websites, industry portals and the LinkedIn service.
• Categories of data: business data only — first and last name, position, business e-mail and phone number, and the company name.
• Purpose and basis: establishing business contact and presenting a cooperation offer (prospecting). The basis for processing the data is our legitimate interest (Art. 6(1)(f) GDPR), while contact by electronic mail takes place only after obtaining your prior consent in accordance with Article 398 of the Polish Electronic Communications Law.
• Retention period: until an objection is raised or consent is withdrawn, no longer than 12 months from the last contact.
• Your rights: you may object to the processing of your data for direct marketing purposes at any time — once you do so, we will cease contact immediately. We fulfil the information obligation no later than upon our first contact with you.

7. Categories of data processed

• Contact form: name, e-mail address, phone number, website/store address, budget, subject and content of the message.
• Quiz and free audit form: name, e-mail address, phone number, website address and information about your business provided in the form.
• Newsletter: e-mail address (optionally name).
• Technical data collected automatically (after consent is given): IP address, cookie identifiers, information about the device and browser, and data on activity on the Website.

8. Data recipients

We may share your data with trusted entities that support us in running our business, solely to the extent necessary and on the basis of data processing agreements.

• Hosting and IT infrastructure provider.
• Providers of analytics and advertising tools: Google Ireland Limited / Google LLC (Google Analytics 4, Google Ads, Google Tag Manager).
• Providers of e-mail, CRM and newsletter delivery systems.
• Accounting office and legal and tax advisors.
• Authorised public authorities, where the obligation to disclose data results from legal provisions.

9. Transfers of data outside the EEA (to the USA)

The use of Google tools (Google Analytics 4, Google Ads, Google Tag Manager) may involve the transfer of data to the United States, i.e. outside the European Economic Area (EEA).

The transfer takes place on the basis of the European Commission implementing decision of 10 July 2023 establishing an adequate level of protection (the EU-U.S. Data Privacy Framework) — Google LLC is on the list of certified entities — and is additionally safeguarded by standard contractual clauses (SCC) as well as supplementary technical and organisational measures.

Please note that the Data Privacy Framework may be subject to legal proceedings, and U.S. law may, in certain situations, allow state authorities to access data. You may obtain a copy of the safeguards applied by contacting the Controller.

10. Profiling and automated decision-making

As part of our analytics and advertising activities (after you have given consent to the relevant cookies), your data may be subject to profiling, e.g. to tailor the ads displayed (remarketing) or to analyse behaviour on the Website.

Such profiling does not produce legal effects concerning you or similarly significantly affect you — we do not make decisions about you based solely on automated processing within the meaning of Article 22 GDPR, and therefore the right under Article 22 GDPR does not apply here. You may object to profiling for direct marketing purposes at any time (Article 21(2) GDPR), and you may withdraw your consent to marketing and analytics cookies at any time.

11. Cookies and tracking technologies

The Website uses cookies and similar technologies. Cookies other than strictly necessary ones (analytics, marketing, personalisation, functional) are installed only after you have given consent in the consent banner.

Detailed information about the cookies used, their purposes and retention periods can be found in the Cookie Policy. You can change your settings at any time using the “Manage preferences” button on the Cookie Policy page.

12. Rights of the data subject

In connection with the processing of your data, you have the following rights:

• the right of access to your data and to obtain a copy of it,
• the right to rectification (correction) of your data,
• the right to erasure of your data (the “right to be forgotten”),
• the right to restriction of processing,
• the right to data portability (where processing is based on consent or a contract),
• the right to object to processing based on legitimate interest, including direct marketing,
• the right to withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.
• To exercise the above rights, contact us at kontakt@faeo.pl. We respond without undue delay, no later than within one month.

13. Right to lodge a complaint

If you believe that the processing of your data infringes the provisions of the GDPR, you have the right to lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office (UODO; ul. Stawki 2, 00-193 Warsaw, Poland; uodo.gov.pl).

14. Voluntary provision of data

Providing data is voluntary, although in some cases it is necessary to achieve a specific purpose. Failure to provide contact data will prevent us from responding to an enquiry or preparing an offer. Providing data for accounting purposes is a statutory requirement when concluding a contract.

15. Data security

We apply appropriate technical and organisational measures to ensure the security of personal data, including protection against unauthorised access, loss or destruction, proportionate to the risk and the nature of the data processed (including connection encryption and access control).

16. Changes to the Privacy Policy

This Privacy Policy may be updated periodically, e.g. due to changes in the law or in the scope of our activities. The current version is always available on this page, and the date of the last update is indicated at the beginning.