1. General provisions

1. This Privacy Policy sets out how personal data is processed for users of the website available at www.vergewave.com (the “Website”) and for people who contact the Company through it.
2. We process personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the “GDPR”), the Polish Personal Data Protection Act of 10 May 2018 and the Polish Electronic Communications Law of 12 July 2024 (the “ECL”).
3. Terms used in this Policy have the meaning given to them in the GDPR, unless stated otherwise.

2. Data controller

The controller of personal data is “IT Partners Telco” Spółka z ograniczoną odpowiedzialnością (limited liability company) with its registered office in Marki, Poland (the “Controller” or the “Company”).

You can contact the Controller on any matter concerning personal data in writing at the registered office address or by e-mail at recepcja@itpartners.com.pl.

3. Purposes, legal bases and scope of processing

We process only the data necessary for a given purpose. The scope of data depends on how you contact the Company or use the Website.

Where processing is based on consent, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before it.

4. Cookies and similar technologies

1. The Website uses cookies – small text files stored on the user’s device – and similar technologies.
2. We use the following categories of cookies:

3. Cookies other than strictly necessary ones are set only after you give consent in the cookie banner. You can change or withdraw your consent at any time in the cookie settings available in the Website footer.
4. You can also change cookie settings in your web browser, including blocking cookies or deleting stored files. Restricting strictly necessary cookies may affect how the Website works.
5. Session cookies are deleted when the browser is closed. Persistent cookies are stored for the period set in their parameters, or until deleted by the user.

5. Recipients of data

Personal data may be disclosed only to entities that need it to fulfil the purposes described above:

• providers of hosting, e-mail and IT infrastructure services;
• providers of CRM systems and communication tools used by the Company;
• providers of analytics and marketing tools – to the extent covered by consent;
• providers of accounting, legal, advisory and courier services;
• entities cooperating in the performance of contracts, e.g. subcontractors and equipment suppliers;
• public authorities and institutions where required by law, including institutions auditing projects co-financed from public funds.

Entities processing data on behalf of the Company do so under data processing agreements and only on the Controller’s instructions.

6. Transfers of data outside the European Economic Area

1. As a rule, we process data within the European Economic Area (EEA).
2. Some service providers (e.g. Google, Microsoft, LinkedIn) may process data in third countries, including the United States.
3. In such cases, transfers are based on a European Commission adequacy decision (including the EU–US Data Privacy Framework) or on standard contractual clauses approved by the European Commission.
4. You can obtain a copy of the safeguards applied by contacting the Controller.

7. Data retention

After these periods, data is deleted or anonymised.

8. Rights of data subjects

Every person whose data we process has the right to:

1. access their data and receive a copy of it (Art. 15 GDPR);
2. rectification of their data (Art. 16 GDPR);
3. erasure of their data (Art. 17 GDPR);
4. restriction of processing (Art. 18 GDPR);
5. data portability – where processing is based on consent or a contract and carried out by automated means (Art. 20 GDPR);
6. object to processing based on legitimate interest, including direct marketing (Art. 21 GDPR);
7. withdraw consent at any time, without affecting the lawfulness of prior processing;
8. lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland.

To exercise these rights, simply contact the Controller as described in section 2. We respond without undue delay and no later than one month after receiving the request.

9. Voluntary provision of data, profiling and security

1. Providing data is voluntary, but necessary to respond to an enquiry, prepare an offer or conclude a contract. Where required by law, providing data is mandatory.
2. We do not make decisions about users based solely on automated processing, including profiling, that produce legal effects or similarly significantly affect them.
3. We apply appropriate technical and organisational measures to protect data against unauthorised access, loss or destruction, including SSL/TLS encryption, access control and regular backups.
4. The Website may contain links to other websites. The Company is not responsible for the privacy practices of those websites.

10. Changes to this Privacy Policy

1. This Policy may be updated in the event of changes in the law, the scope of the Company’s business or the technologies used on the Website.
2. The current version is always available on the Website. We will announce material changes with a notice on the Website.
3. This Policy is effective as of 1 January 2025.