Privacy Policy

PRIVACY POLICY FOR THE OOH.PL WEBSITE

1. GENERAL INFORMATION

  1. This privacy policy (“Privacy Policy”) applies to the website operating at the following URLs: ooh.pl and system.ooh.pl, hereinafter collectively referred to asthe (“Website”).
  2. The website operator and personal data controller is OOH.PL Sp. z o.o., with its registered office in Warsaw (03-904), address: ul. Berezyńska 2a/3, entered in the National Court Register (KRS) under KRS number: 0000853783, REGON: 386737804, NIP: 6631880829 (hereinafter referred toas the“Operator”or“Controller”).
  3. The Operator's email address: kontakt@ooh.pl
  4. The website is hosted (and technically maintained) on servers operated by cyberfolks.pl and ngroup.pl

2. INFORMATION NOTICE REGARDING THE PROTECTION OF PERSONAL DATA

In compliance with the obligation set forth in Article 13 of the General Data Protection Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of personal data (“GDPR”), with respect to users of the Website (hereinafter“User”), OOH.PL Sp. z o.o., with its registered office in Warsaw (03-904), address: ul. Berezyńska 2a/3, entered in the National Court Register (KRS) under KRS number: 0000853783, REGON: 386737804, NIP: 6631880829, hereby informs that:

  1. The controller of personal data within the meaning of Article 13 of the GDPR is the company OOH.PL, LLC with its registered office in Warsaw (03-904), address: 2a/3 Berezyńska St., entered in the KRS Business Register under KRS number: 0000853783, REGON: 386737804, NIP: 6631880829, (hereinafter “Administrator”). The Administrator processes the following types of Users’ personal data:
    • First Name
    • Last Name
    • Phone number
    • Email address
    • ZIP Code
    • Town
    • Address
    • Tax ID Number
    • REGON
  2. You may contact the Data Controller regarding matters related to the protection of personal data and the exercise of your rights by email at kontakt@ooh.pl or in writing at the Company’s registered office address.
  3. Users' personal data is processed for the following purposes:
    • processing by the Controller for the purpose of fulfilling orders, including inquiries and communications;
    • processing by the Controller for marketing purposes, including the distribution of a newsletter;
    • the processing of data by the Controller for marketing purposes undertaken by the Controller in cooperation with other entities, including the disclosure of personal data to other entities;
    • sharing Users' data with the Administrator's business partners for marketing purposes;
    • the processing by the Controller of data for the purposes of direct marketing regarding the Controller’s products and services and those of the Controller’s business partners, carried out using telecommunications terminal equipment and automated calling systems in accordance with Article 172 of the Telecommunications Law of July 16, 2004;
    • Processing by the Controller for the purpose of fulfilling orders.
    • the Controller’s processing of data for the purpose of fulfilling orders in cooperation with other entities, including the disclosure of personal data to other entities;
    • sharing Users' data with the Administrator's business partners for the purpose of fulfilling orders;
    – and consent for any of the above purposes is voluntary. Consent may be withdrawn at any time; such withdrawal does not affect the lawfulness of processing carried out prior to its withdrawal. A request to withdraw consent may be submitted using the contact information provided in paragraph 2.
  4. The legal basis for the processing of personal data under paragraph 3(b) above is Article 6(1)(b) of the GDPR, meaning that the processing is necessary for the performance of a contract.
  5. The legal basis for the processing of personal data under paragraph 3(b) above is Article 6(1)(f) of the GDPR, namely the Controller’s legitimate interest.
  6. The legal basis for the processing of personal data under paragraph 3(c) and (d) and as described above is Article 6(1)(a) of the GDPR, namely the User’s consent expressed through the forms posted on the Controller’s website.
  7. The Controller may disclose Users’ personal data to other entities with which it maintains ongoing business relationships. Any disclosure of Users’ personal data is made exclusively on the basis of a personal data processing agreement entered into with the Controller.
  8. The Administrator's list of business partners includes:
    • entities affiliated with the Administrator under cooperation agreements that provide advertising services: OOH advertising, large-format printing, online advertising, outdoor advertising, and indoor advertising.
    • Entities affiliated with the Controller under cooperation agreements that provide the following services: graphic design, printing, installation and maintenance of signs, and installation of advertising graphics.
  9. The data controller identifies the following categories of recipients of personal data:
    • Personal data may be transferred to entities that support the Controller’s business processes, such as providers of postal or courier services, as well as accounting, tax, and legal services;
    • Personal data may be disclosed for the purposes of audits, as part of advisory services, to ensure compliance with regulations, and to exercise corporate governance;
    • In the cases described in separate legal provisions and in accordance with the procedures set forth in those provisions, personal data may be disclosed to authorized state administrative authorities;
    • Personal data may be processed using external and internal IT infrastructure, including by hosting service providers, and may also be transferred to entities that operate the Controller’s information and communication technology systems or provide IT tools that meet the GDPR’s requirements regarding system security.
  10. The data will be retained for as long as necessary to fulfill the purposes for which it was collected, but no longer than 5 years or until the consent is withdrawn.
  11. In connection with the implementation of the provisions of the Agreement and the transfer of personal data to the Administrator, the User has the right to:
    • requests for access to your personal data;
    • the right to request the correction of your personal data;
    • the right to request the erasure or restriction of the processing of your personal data;
    • the transfer of personal data (the processing of which is based on the Agreement);
    • to object to the processing of personal data in the cases specified in Article 21 of the GDPR;
    • to file a complaint with the authority (the President of the Personal Data Protection Office).
  12. The administrator does not transfer personal data to third countries.
  13. To exercise the rights listed above, the User should submit a request by email to kontakt@ooh.pl or in writing to the Company’s registered office.

3. INFORMATION IN FORMS

  1. The website may store information about connection parameters (timestamps, IP address).
  2. In some cases, the website may store information that makes it easier to link the data in the form to the email address of the user filling out the form. In such cases, the user’s email address appears within the URL of the page containing the form.
  3. The data provided in the form is processed for the purpose specified by the form in question, such as to handle a service request or a sales inquiry, to register for services, etc. In each case, the context and description of the form clearly explain its purpose.
  4. Providing personal data is voluntary; however, failure to provide such data will prevent you from registering on the website, receiving an offer, or being contacted by the Administrator or another designated entity.

4. SELECTED DATA PROTECTION METHODS USED BY THE OPERATOR

  1. The login pages and areas where personal information is entered are protected at the transmission layer (SSL certificate). As a result, personal information and login credentials entered on the website are encrypted on the User’s computer and can only be decrypted on the destination server.
  2. The personal data stored in the database is encrypted in such a way that only the Operator, who possesses the key, can read it. This ensures that the data is protected in the event that the database is stolen from the server.
  3. User passwords are stored in hashed form. The hashing function is one-way—it cannot be reversed—which is currently the industry standard for storing user passwords.
  4. The operator periodically changes his administrative passwords.
  5. To protect data, the Operator regularly creates backup copies.
  6. An essential element of data protection is the regular updating of all software used by the Operator to process personal data, which specifically means regular updates to software components.

5. HOW COOKIES WORK

  1. This website uses cookies.
  2. Cookies are IT data—specifically, text files—that are stored on a Website User’s end device and are intended for use on the Website’s web pages. Cookies typically contain the name of the website from which they originate, the duration for which they are stored on the end device, and a unique number.
  3. The entity that places cookies on the Website User’s device and accesses them is the Website Operator, i.e., OOH.PL Sp. z o.o., with its registered office in Warsaw (03-904), address: ul. Berezyńska 2a/3, entered in the KRS business register under KRS number: 0000853783, REGON: 386737804, NIP: 6631880829.
  4. Cookies are used for the following purposes:
    • maintaining the user’s session on the Website (after logging in), so that the user does not have to re-enter their username and password on every subpage of the Website;
    • achieving the objectives set forth in the “Key Marketing Techniques” section;
  5. The Website uses two main types of cookies: “session” cookies and “persistent” cookies. “Session” cookies are temporary files that are stored on the User’s device until the User logs out, leaves the website, or closes the (web browser). “Persistent” cookies are stored on the User’s device for the duration specified in the cookie settings or until the User deletes them.
  6. Web browsing software (a web browser) typically allows cookies to be stored on the User’s device by default. Users of the Website may change their settings in this regard. The web browser allows you to delete cookies. It is also possible to automatically block cookies. Detailed information on this topic can be found in the web browser’s help section or documentation.
  7. Restrictions on the use of cookies may affect certain features available on the Website.
  8. Cookies stored on a Website User’s device may also be used by entities that collaborate with the Website operator; this applies in particular to the following companies: Google (Google Inc., based in the U.S.), Facebook (Facebook Inc., based in the U.S.), and Twitter (Twitter Inc., based in the U.S.).
  9. In order to carry out marketing activities, the Operator may use tools that enable the creation and presentation of personalized offers targeted at specific groups, such as those defined by age or geographic location. For this purpose, the Operator may use purchase history data obtained through cookies or similar technologies, which contain information about the User’s browsing history on other websites or the User’s activity on the Operator’s website. Processing such information allows for the analysis of the behavior of specific groups of users who use the Operator’s services and the creation of content that better aligns with their preferences and interests, without, however, significantly influencing their choices. Offers targeted at the user may be displayed both on the Website and on the websites of other entities.
  10. If you do not wish to receive cookies, you can change your browser settings. Please note that disabling cookies that are necessary for authentication, security, and the retention of your preferences may make it difficult—and in extreme cases, impossible—to use the Website.
  11. To manage your cookie settings, select the web browser you use from the list below and follow the instructions:
    1. Edge
    2. Internet Explorer
    3. Chrome
    4. Safari
    5. Firefox
    6. Opera
    Mobile devices:
    1. Android
    2. Safari (iOS)
    3. Windows Phone

6. KEY MARKETING TECHNIQUES

  1. The operator uses Google Analytics (Google Inc., based in the U.S.) to analyze website traffic. The operator does not transmit personal data to the service provider; only anonymized information is shared. The service relies on the use of cookies on the user’s device. With regard to information about user preferences collected by the Google advertising network, users can view and edit information derived from cookies using the following tool: https://www.google.com/ads/preferences/.
  2. The Operator uses remarketing techniques that allow advertising messages to be tailored to a user’s behavior on the website, which may give the impression that the user’s personal data is being used to track them; however, in practice, no personal data is transferred from the Operator to advertisers. Cookies must be enabled for these activities to work.

7. CHANGES TO THE PRIVACY POLICY

  1. The Operator reserves the right to make changes to the Privacy Policy if required by law or due to changes made to the Website. The Operator will notify the User of any planned changes and their effective date via the Website; for registered Users, this information will also be posted via the User’s account.
  2. Users of the Website are subject to the current Privacy Policy provided by the Operator
  3. The date listed below is the effective date of the latest version of the Privacy Policy. Date: August 20, 2021