PRIVACY POLICY OF THE LOCALZEN.COM SERVICE
This document describes the rules for processing personal data and other information about Users of the website available at localzen.com (hereinafter the Service). This document is informative in nature, meaning it is not a source of obligations for Users.
This document consists of two parts. Part I concerns the processing of personal data under “Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data” (referred to as “GDPR”). Part II concerns the rules for processing data collected from or placed on the user’s device through cookies and other operational data (data characterizing how the user uses the services provided on the Website, such as IP addresses, connection time and duration, system logs, etc.).
If the data specified in Part II qualifies as personal data within the meaning of the GDPR, these rules also apply to such data, without prejudice to the provisions of Part II.
Part I: Personal Data
Table of Contents:
- What principles do we apply when processing Users’ personal data?
- Who is the controller of Users’ personal data?
- How can you contact the Administrator?
- How do we collect Users’ personal data?
- Is providing personal data mandatory?
- What Users’ data do we process, on what legal basis, and for what purposes?
- To whom do we disclose Users’ personal data?
- For how long do we process Users’ personal data?
- What rights do Users have in relation to the processing of their personal data?
1. What principles do we apply when processing Users’ personal data?
Users’ personal data is processed in accordance with the GDPR and the national laws of general application regarding data protection, including the Act on Providing Services by Electronic Means of July 18, 2002 (Journal of Laws 2002, No. 144, item 1204, as amended, hereinafter UŚUDE)
The Administrator exercises particular care to protect the interests of the persons whose data is being processed and ensures that the data is:
- Processed lawfully, fairly, and transparently (“lawfulness, fairness, and transparency”);
- Collected for specific, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes (“purpose limitation”);
- Adequate, relevant, and limited to what is necessary for the purposes for which it is processed (“data minimization”);
- Accurate and kept up to date; the Administrator shall take every reasonable step to ensure that personal data that is inaccurate, having regard to the purposes for which it is processed, is erased or rectified without delay (“accuracy”);
- Stored in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the personal data is processed (“storage limitation”);
- Processed in a manner that ensures appropriate security of the personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, using appropriate technical or organizational measures (“integrity and confidentiality”).
2. Who is the controller of Users’ personal data?**
The controller of Users’ personal data is CENTER.AI spółka z ograniczoną odpowiedzialnością, ul. Głogowska 216, 60-104 Poznań, records maintained by the District Court of Poznań – Nowe Miasto and Wilda in Poznań, VIII Commercial Division of the National Court Register, KRS: 0000535162, REGON: 360316520, NIP: 7811904466 with a share capital of PLN 6,350.00 (hereinafter Administrator).
3. How to contact the Administrator?
You can contact the Administrator via email at [email protected] or by mail to the registered office address.
4. How do we collect Users’ personal data?
Users’ personal data:
- Is provided by them by filling out forms available on the Website or during contact with the Administrator in any form (e.g., correspondence, email, telephone);
- Is provided by the employer, contractor, or principal of the User, who has entered into an Agreement with the Administrator or uses free services during the Test Period in the Service, in order to grant the User appropriate rights to the Account in the Service;
- Is collected in connection with the User’s activity on the Website (regarding data described in Part II, which, in specific circumstances, may be associated with a particular individual and thereby constitute personal data).
5. Is providing personal data mandatory?
Providing personal data in the form of an email address is necessary to register a User Account, and additionally, providing the addresses of establishments (addresses and names) and the company name is required to fully use the Services offered on the Website. Failure to provide this data will result in the refusal to register the Account or the inability to use the full range of Services on the Website.
Providing personal data for Users who are natural persons (sole proprietors registered in CEIDG), in the form of:
- name, surname, and company,
- TAX ID,
- registered office address
is necessary to receive a TAX invoice for paid Services. Refusal to provide this data will result in the refusal of the paid Service.
Providing personal data such as email, company name, and first and last name is voluntary but necessary to arrange a meeting with the Administrator or to contact via the contact form on the Website. Refusal to provide the data will result in the inability to schedule a meeting through the Website or receive a response to questions submitted through the form.
Granting the Administrator access and permissions to the User’s Google My Business account is necessary to use Services involving the management of the User’s establishments on Google Maps. Failure to grant access may result in the refusal to provide the Service or a limitation of its functionality.
6. What Users’ data do we process, on what legal basis, and for what purposes?
The goals and legal basis for processing Users’ data by the Administrator are detailed in the table below
| Type of Data | Purpose | Legal Basis |
|---|---|---|
| Email, name, surname, company name, TAX ID, address, phone number, website URLs, business activities | Executing pre-contractual actions and performing the Agreement, maintaining Account access, and providing Services | Art. 6(1)(b) GDPR (performance of a contract) |
| Execution of tax obligations, including issuing a VAT invoice. | Art. 6(1)(c) GDPR (Legal obligation) | |
| Establishment, defense, or pursuit of claims. The Administrator may use the data in the event of a need to pursue claims related to the unlawful use of the Service by the user or to defend against claims made by the user. | Art. 6(1)(f) GDPR (Legitimate interest of the Administrator). | |
| Sending commercial information ordered by the User via electronic means (newsletter). The Administrator may send the user information about the current offer to the email address provided by the user. The condition for using the data in this way is the user’s consent. | Art. 6(1)(a) GDPR (Consent) in conjunction with Art. 10(1) and (2) of the Act on Providing Services by Electronic Means. | |
| Email address, name, surname, company, phone number | Responding to inquiries that you may submit to us via contact forms or chat available on the Website, or by email, to our email address – the contact forms and chats are designed to allow users of our Services to contact us; if you choose this form of contact, we will process your personal data in order to respond to your inquiry, question, or request for contact; the above also applies, as appropriate, to inquiries that you may send to us via our email address or by phone. | Art. 6(1)(f) GDPR (Legitimate interest) in conjunction with Art. 10(1) and (2) of the Act on Providing Services by Electronic Means. |
| User activity data | Direct marketing, including profiling. The Administrator may collect information about the user’s behavior on the Internet, including outside the Website or Administrator’s websites, through the use of cookies. This data may be used to create user profiles in order to personalize advertisements displayed on the user’s device. The data may also be shared or collected by entities cooperating with the Administrator. | Art. 6(1)(a) GDPR (User consent) |
| Data from accounts linked to the User’s Google My Business account, such as: Business name, Address, Description, Opening date, Website, Phone number, Opening hours, Categories, Services, Photos, Customer reviews, Average rating. Additionally, analytical data provided by Google will also be processed: information about the number and type of searches for the business on Google Search and Google Maps, the number of views of the business in search results, the number of customer actions on specific days (actions include: asking for directions, making a call to the business, visiting the business website), the number of photo views on specific days, and the number and type of photos in the business. | Execution of the concluded contract, provision of Services. | Art. 6(1)(b) GDPR (Performance of a contract) |
| Data on how the User uses the Service (visited screens, clicks) | Carrying out statistical analyses to improve the Service (interfaces, messages, graphic layout). Data transferred to third countries (USA) in connection with the use of Google Analytics services. | Art. 6(1)(f) GDPR (Legitimate interest of the Administrator) |
| All data processed in the Administrator’s IT systems related to maintaining the Service | Performing and storing backups, ensuring the ability to continuously guarantee confidentiality, integrity, availability, and resilience of processing systems and services; ensuring the ability to quickly restore the availability of personal data and access to it in the event of a physical or technical incident. | Art. 32(1)(b) and (c) GDPR |
| Anonymous statistical analyses. The Administrator may use data to create anonymous statistical analyses aimed at increasing the effectiveness of marketing and sales activities. | Art. 6(1)(f) GDPR (Legitimate interest of the Administrator) | |
| Name, surname, email address, phone number, organization associated with the candidate, professional experience, education, image, address, social media content (LinkedIn, Github, other portfolio sites), and all additional data provided by submitting your CV. | Conducting the recruitment process for the received application, as well as retaining submitted application documents for future applications, if additional consent is given. | Art. 6(1)(c) GDPR (if the provision of data results from generally applicable laws, including the Labor Code) and Art. 6(1)(a) GDPR (candidate’s consent, if additional data is provided or the application is submitted for future recruitment processes). |
7. To whom do we disclose Users’ personal data?
Users’ personal data may be disclosed to the following types of recipients:
- Entities processing data on behalf of the Administrator, particularly IT service providers, marketing agencies, entities providing customer support services, including call centers;
- Entities within the Administrator’s capital group;
- Advertising networks providing remarketing or behavioral marketing services, including Google Ads;
- Third parties, particularly authorized authorities, where such an obligation arises from generally applicable law;
- Trusted legal, tax, and accounting advisors;
- The Administrator’s collaborators;
- Archiving service providers;
- Banks and entities providing postal and courier services.
Among the entities through which we process personal data is Google LLC (Mountain View, California, USA). Therefore, the data is transferred to a third country (outside the European Economic Area), namely the United States of America (USA), where no adequate level of protection has been found. The transfer takes place in accordance with the provisions of the GDPR, particularly based on standard contractual clauses with appropriate safeguards applied. You have the right to obtain a copy of the data protection safeguards used for the transfer to a third country from the Administrator’s office.
8. For how long do we process Users’ personal data?
Users’ personal data is processed for the period necessary to achieve the intended purpose, including:
- Until the expiration of the limitation period for claims arising from the contracts concluded – in the case of processing for the purpose of contract performance, pursuing or defending claims, and fulfilling the legal obligations imposed on the Administrator, particularly in the tax and accounting area;
- Until the user exercises rights that exclude the processing of personal data, including the moment the user objects to the processing based on the Administrator’s legitimate interest or withdraws consent in cases where the processing is based on consent, but no longer than until the achievement of the processing purpose.
9. What rights do Users have in relation to the processing of their personal data?
Every individual whose personal data is processed by the Administrator has the rights described in the table below and in the further provisions of this Policy
| Right of access to data | Art. 15 GDPR Essence of the right: The data subject is entitled to obtain confirmation from the Administrator as to whether personal data concerning them is being processed, and if so, is entitled to access that data and the information specified in this provision. |
| Right to rectification and completion | Art. 16 GDPR Essence of the right: The data subject has the right to request the Administrator to immediately rectify any inaccurate personal data concerning them. Considering the purposes of processing, the data subject also has the right to request the completion of incomplete personal data, including by providing an additional statement. |
| Right to erasure | Art. 17 GDPR Essence of the right: The data subject has the right to request the Administrator to immediately delete their personal data, and the Administrator is obliged to delete the personal data without undue delay if one of the circumstances specified in this provision applies. |
| Right to restrict processing | Art. 18 GDPR Essence of the right: Restriction of processing means marking stored personal data to limit its future processing. Once the data is marked for restriction, its processing (apart from storage) is only possible with consent or for purposes specified in this provision. Restriction can be requested in cases defined in this provision. |
| Right to data portability | Art. 20 GDPR Essence of the right: The data subject has the right to receive personal data concerning them, which they have provided to the Administrator, in a structured, commonly used, and machine-readable format, and has the right to transmit this data to another controller without obstruction from the Administrator. |
| Right to object | Art. 21 GDPR Essence of the right: The data subject has the right to object at any time, on grounds relating to their particular situation, to the processing of their personal data based on legitimate interest. In particular, if personal data is processed for direct marketing purposes, the data subject has the right to object at any time to the processing of their personal data for such marketing, including profiling, to the extent that it is related to such direct marketing. |
If the Administrator processes the user’s personal data based on consent, the consent may be withdrawn at any time without affecting the lawfulness of processing carried out before the withdrawal of consent.
If the user believes that their personal data is being processed in violation of the law, they have the right to file a complaint with the President of the Office for Personal Data Protection.
II. Data from the user’s device and operational data
Table of Contents:
- What are cookies?
- For what purpose is data from cookies collected?
- How does the user give consent for the Administrator to process data through cookies?
- What are operational data and why are they processed?
1. What are cookies?
Cookies are small text files sent by a server and stored on the user’s end device. Detailed information about cookies and their history can be found on the website: https://en.wikipedia.org/wiki/HTTP_cookie. Cookies do not cause any configuration changes to the user’s device or the software installed on it.
2. For what purpose is data from cookies collected?
The Administrator may process data collected from cookies for the following purposes:
- Remembering the settings chosen by Users in the Service and optimizing the use of the Service for users;
- Customizing displayed offers to the individual preferences of Users;
- Conducting anonymous statistics showing how the Service is used;
- Analyzing user behavior through the study of their actions (repeated visits to pages, keywords, etc.) to create a profile and deliver advertisements tailored to their predicted interests, including based on actions taken on other websites.
The Service uses both persistent and session cookies. Persistent cookies will continue to exist after the current session ends and will remain in the user’s browser until they expire or are deleted by the user. Session cookies are valid only during the session (typically the duration of the current visit to the Service or browser session). Third parties, who are partners and service providers of the Administrator, may use cookies in connection with services available on the Service.
3. How does the user give consent for the Administrator to process data through cookies?
Internet browsers by default allow the placement of cookies on the user’s device. These settings can be changed to block the automatic handling of cookies in the browser settings or to inform the user each time cookies are sent to the user’s device. Cookie settings can be changed through browser settings. This means, for example, that users can partially limit (e.g., temporarily) or completely disable the ability to save cookies – however, in the latter case, this may affect certain functionalities of the Service or make it impossible to use the Service entirely.
On the user’s first visit to the Service’s website, a pop-up window explaining cookies will appear. When preferences are saved, the user consents to the use of the categories of cookies and plugins chosen by the user. Essential cookies are always active. Browser settings for cookies are relevant to consent for the Administrator’s use of cookies – such consent can also be given through browser settings. If consent is not provided, the appropriate browser settings should be changed to control cookies.
Detailed information on changing cookie settings and self-removal in the most popular web browsers is available in the help section of the internet browser.
Below, we present the cookies used by the Administrator and third parties on the Service:
| Cookies File | Domain | Type | Description | Duration |
|---|---|---|---|---|
| _fbp | .localzen.com | advertising | This cookie is set by Facebook to display advertisement s after visiting the Facebook website or on a digital platform powered by Facebook ads. | 3 months |
| _gid | .localzen.com | Analytical | Installed by Google Analytics, this cookie stores information about how visitors use the website while also creating an analytical report on the website’s performance. Some of the data collected includes the number of visitors, their source, and the pages they visit anonymously. | 1 day |
| _gat_UA-1599 12446-3 | .localzen.com | Analytical | The _gat cookie variant isset by Google Analytics and Google Tag Manager to allow website owners to track visit or behavior and measure website performance. The template element in the name contains a unique account or website identification number it relates to. | 1 minute |
| ga_98EZ0KNBW3 | .localzen.com | Analytical | Installed by GoogleAnalytics. | 2 years |
| _ga | .localzen.com | Analytical | Installed by Google Analytics, it calculates data about visitors, sessions, and campaigns, and tracks website usage for the analytical report. The cookie stores information anonymously and assigns a randomly generated number to recognize unique visitors. | 2 years |
| pll_language | .localzen.com | Functional | Used by Polylang to remember the language selected by the user when returning to the website and also to obtain language information when it is not available in another way. | 1 year |
| UserMatch History | .linkedin.com | Functional | LinkedIn sets this cookie for LinkedIn Ads identifier synchronization. | 1 month |
| lang | .ads.linkedin.com | Functional | LinkedIn sets this cookie to remember the user’s language settings. | session |
| bcookie | .linkedin.com | Functional | LinkedIn sets this cookie from LinkedIn share buttons and ad tags to recognize the browser identifier. | 1 year |
| lidc | .linkedin.com | Functional | LinkedIn sets this cookie to facilitate data center selection. | 1 day |
| lang | .linkedin.com | Functional | LinkedIn sets this cookie to remember the user’s language settings. | session |
| bscookie | .linkedin.com | Functional | LinkedIn sets this cookie to store actions taken on the website. | 1 year |
| cookieyesID | .localzen.com | Necessary | A unique identifier for visitors based on their consent. | 1 year |
| cky-consent | .localzen.com | Necessary | Set by CookieYes to remember users’ consent settings, so the website recognizes users on their next visit. | 1 year |
| cookieyes-necessary | .localzen.com | Necessary | Set by CookieYes to remember users’ consent for the use of cookies in the “necessary” category. | 1 year |
| cookieyes-functional | .localzen.com | Necessary | Set by CookieYes to remember users’ consent for the use of cookies in the “functional” category. | 1 year |
| cookieyes-analytics | .localzen.com | Necessary | Set by CookieYes to remember users’ consent for the use of cookies in the “analytical” category. | 1 year |
| cookieyes-performance | .localzen.com | Necessary | Set by CookieYes to remember users’ consent for the use of cookies in the “performance” category. | 1 year |
| cookieyes-advertisement | .localzen.com | Necessary | Set by CookieYes to remember users’ consent for the use of cookies in the “advertising” category. | 1 year |
| cookieyes-other | .localzen.com | Necessary | Set by CookieYes to remember users’ consent for the use of cookies in the “other” category. | 1 year |
| AnalyticsSync History | .linkedin.com | Other | Used in connection with data synchronization with third-party analytical services. | 1 month |
| li_gc | .linkedin.com | Other | Allows storing guest consent for the use of cookies for optional purposes. | 5 months and 27 days |
| _ueuuid | .user.com | Other | Enables storing information about the user, their preferences for future visits, website traffic, and interaction with the website to offer better experiences and tools in the future. | 1 year, 1 month |
| __ca__chat | .localzen.com | Other | Allows storing information about the user, their preferences for future visits, website traffic, and interaction with the website to offer better experiences and tools in the future. | 1 year |
4. Third-party websites and plugins
We use hyperlinks and social media plugins (LinkedIn, Facebook) to third-party websites on the Service. When using plugins, your browser establishes a direct connection to the servers of the third party. The third party or its server may be located in a third country outside the EEA. The Administrator has no control over the extent of the data collected by social media providers through plugins.
The purpose and scope of data collection, further processing, and use of data by third parties, as well as the rights of users and possible settings to protect privacy, are described in the privacy policy of the respective third party. The Administrator has no control over the privacy policies and practices of third parties and assumes no responsibility for them.
If the user does not want third parties to receive, potentially store, or use their data, they should avoid using plugins and hyperlinks on the Service.
5. What are operational data, and why are they processed?
In addition to the data mentioned in the previous provisions of the Policy, every connection to the Service results in the collection and processing by the Administrator of connection data, such as:
- IP address,
- Date and time of access,
- Amount of data transmitted,
- Information about the device used, its parameters, and the operating system.
The above information is used for managing the Service, identifying issues with the servers supporting the Service, detecting, preventing, or prosecuting legal violations committed by users, as well as for statistical purposes.
The Administrator reserves the right to change this privacy and cookie policy. In the event of any changes, the date of the last update will be amended below.
This privacy policy was last updated on March 15, 2023.
