Privacy policy
and cookie policy

Controller: JUSTIDEA AGENCY sp. z o.o., ul. Olszańska 7, 31-513 Kraków, Poland. Contact for data protection matters: contact@justidea.agency. Last updated: 20 August 2026.

Personal data

1. Why is this document worth reading?

We understand that when you decide to provide us with information about yourself, you expect us to handle it responsibly. This Privacy Policy contains information about us, about how we collect, share and use your personal data and about how you can exercise your right to data protection. This policy applies both to the personal data we collect through the Website and to the data we receive from you when we have a relationship or potential relationship with you (or your organisation) as a supplier, customer or business partner. We are obliged to process your personal data in accordance with the applicable data protection legislation, including the GDPR - Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.

We also comply with the Act of 10 May 2018 on the protection of personal data and the Act of 21 February 2019 amending certain acts in connection with ensuring the application of the GDPR. In this document you will find useful information about the principles of collecting and using information about you and about your rights in relation to the processing of your personal data. You can also find basic information here about the cookies we use on justidea.agency ("Website").

2. Who processes your personal data?

The controller of the Website is JUSTIDEA AGENCY sp. z o.o. (a Polish limited liability company) with its registered office in Kraków, at ul. Olszańska 7, 31-513 Kraków, KRS: 0001019979, REGON: 524491475, NIP: 6762636797 ("Controller"). The principles described in this Policy apply to the personal data processing activities performed by the Controller. JustIdea is a leading company providing online marketing services, graphic design, online store and website development, support for international expansion and other services that provide a professional marketing background. In certain situations the Controller may receive personal data from business partners, in respect of which it will act as a processor. In such a situation, the data provided by Clients will be processed only on the basis of the instructions received from the controller, taking into account the applicable law. By providing us with other people's data, you confirm that you are authorised to act on their behalf, that you have informed them who we are and for what purposes we will process their data (as set out in this Policy) and that you have obtained the necessary consent to process their personal data. At first contact, we may inform such individuals where we obtained their data.

3. What data do we process?

In the course of our business, we collect personal data. The information that is provided to us directly (e.g. by concluding a contract or using a contact form) usually includes the personal data necessary for the performance of the contract. This includes in particular:

Data provided voluntarily

• In the case of commercial contracts - name, surname, identification numbers (NIP, PESEL, REGON) and contact details (address, telephone number, e-mail address).

• In the case of recruitment - the data necessary to conduct the recruitment, set out in detail in the applicable regulations (in particular in the Labour Code), which include: name and surname, date of birth, contact details, education, professional qualifications, employment history, and other data if you consent to this.

• In the case of employees of our Clients and Business Partners - contact details of the person responsible for contact with customers, contractors and business partners (including name and surname, business telephone numbers, place of business address, position).

• In the case of using our websites - you can visit our website without giving us any information about yourself. However, in some situations we may ask you to voluntarily provide us with certain personal data. For example, when you would like to contact us via the Website (in such cases we collect data such as your name and surname, e-mail address, organisation, country, postcode, position, telephone numbers, and information about your comments or enquiries).

Data collected automatically

In addition to the personal data we obtain directly, the applications of our website automatically collect a range of information about users of the Website. These are so-called "cookies", the detailed rules for which are described later in this Policy. Data collected automatically may include, in particular, IP address, device type, cookie identification number, browser type, geographical location (e.g. country or city) and other technical information.

We may also collect data about your use of our website on your device, including the pages you have visited and the links you have clicked.

Data obtained from external sources

In order to comply with various regulations or to verify information in accordance with our internal requirements (where permitted by and consistent with applicable law), we may sometimes receive personal data about you from external sources, such as credit databases, databases of politically exposed persons, lists of entities excluded by government authorities, sanctions lists and watch lists, your employer, as well as online databases and public registers. We will only obtain such data after verifying that you have consented to certain third parties disclosing your personal data or that such disclosure is lawful. The types of data we collect from third parties include, for example, information on whether you have been party to any particular regulatory action or legal proceedings.

Sensitive personal data

Some of the data that you provide or that we obtain from external sources (where permitted by and in compliance with applicable law) may be sensitive data, such as any criminal convictions or details of your political activities or religious affiliation. We need this information for "know your counterparty" checks and risk assessment in accordance with applicable law in the context of working with you or your organisation as a potential customer or supplier. You may also provide us with data about your health to help us make arrangements that give you access to premises or events.

4. On what basis and for what purpose do we process personal data?

We process your personal data for the following purposes:

• To enable you to use the services offered by us and by entities cooperating with us, in particular marketing services. The basis for this processing is that the personal data is necessary for the performance of a contract to which you are a party and/or to take steps at your request prior to entering into a contract (Article 6(1)(b) GDPR);

• To comply with the legal obligations of the Controller under specific laws, including but not limited to accounting, tax and social security regulations, analyses to assess the financial, insurance or reputational risk arising from a relationship or potential relationship with you or your organisation, or to take any action necessary to ensure compliance with mandatory provisions of law. The basis for this processing is that it is necessary to fulfil the legal obligations imposed on us as the Controller under specific laws (Article 6(1)(c) GDPR).

• To respond to enquiries submitted through the contact form or through other channels of communication, to personalise and improve the website, to protect against claims made by third parties and to process personal data in order to protect against claims. The basis for this processing is that it is necessary for the purposes of the legitimate interests pursued by us as the controller or by a third party (Article 6(1)(f) GDPR).

• To carry out marketing activities (directly or through our agents by post, telephone, fax, e-mail, text message or other electronic messages about offers of goods, services or information that may be of interest to you (including information about goods and services of other organisations)), to transfer your personal data to entities cooperating with us, and to offer our services and products or the services and products of entities cooperating with us. The basis for this processing is your explicit consent to the processing of your personal data for this specific purpose (Article 6(1)(a) GDPR).

5. How long do we keep your personal data?

Where we process your data on the basis of consent, we will store your personal data from the moment you give your consent until you withdraw it; this does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal, or the lawfulness of earlier and further processing on a basis other than consent. Where we process personal data on the basis of the legitimate interest of the controller, we will process it until you raise a justified objection to the processing. Otherwise, your personal data will be stored by us from the moment the actions referred to in the section above are taken until the expiry of any claims that may arise from those actions (usually 7 years after the end of those actions; for processing for the purpose of contacting you or responding to your enquiries - 1 year from the last contact), unless the law obliges or entitles us to store the data for a longer period. After the expiry of each of the periods described above, however, we retain personal data for the purpose of establishing, pursuing or defending claims that may arise from those actions, to the extent permitted by law.

Where we process personal data on the basis of a data processing (entrustment) agreement, the retention period will be limited to the instructions of the personal data controller.

6. What are your rights?

With regard to your personal data of which we are the Controller, you have the right to:

• access your personal data or receive a copy of your personal data, i.e. to obtain confirmation from us as to whether we are processing your personal data and, if so, to access it and to information about that processing; if you request a copy of your personal data, we are obliged to provide you with a copy of the personal data undergoing processing. If you ask us for a copy by electronic means and do not indicate otherwise, we will provide the information in a commonly used electronic form;

• rectify your personal data, i.e. to have inaccurate personal data about you corrected without delay and to request that incomplete personal data be completed;

• erasure of your personal data, i.e. to request that we delete your personal data without delay. We are obliged to delete your personal data when the conditions referred to in Article 17 GDPR are met (e.g. the personal data are no longer necessary for the purposes for which they were collected or otherwise processed; the personal data have been processed unlawfully);

• restrict processing, i.e. to have the stored personal data concerning you marked in order to limit its future processing. You may request restriction of processing when the conditions of Article 18 GDPR are met (e.g. when you contest the accuracy of your personal data);

• data portability, i.e. to receive the personal data you have provided to us in a structured, commonly used and machine-readable format, and to transmit that personal data to another controller without hindrance from us, where the processing is based on consent or on a contract, or is carried out by automated means;

• object to the processing of your personal data, i.e. to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on Article 6(1)(e) GDPR (necessity for the performance of a task carried out in the public interest or in the exercise of official authority vested in us as the controller) or Article 6(1)(f) (necessity for the purposes of the legitimate interests pursued by us as the controller or by a third party), including profiling based on those provisions;

• withdraw your consent to the processing of your personal data, which you can do at any time without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal, or the lawfulness of processing on a basis other than your consent;

• lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych) if you believe that the processing of personal data concerning you infringes data protection law, including the GDPR. You may submit the above requests in any form, including in writing (to our address) or electronically (contact@justidea.agency). Your request will be processed within 30 days of the Controller receiving the message, and we will send you our reply in a separate e-mail to the e-mail address given in the form.

7. Is it obligatory to give us your personal data?

You are not obliged to provide us with your personal data. However, providing your personal data may be necessary for the actions referred to above, and if you do not provide it, we will not be able to take them.

8. Who are the recipients of your personal data?

We keep the scope of data made available to recipients to a minimum. Whenever we transfer personal data to a third party, we make sure that it guarantees the same personal data safeguards that we require in this policy. The recipients of your personal data are in particular:

• external service providers and partners;

• entities that provide data processing services to us (for example, to operate our Website or other IT infrastructure, to ensure its functionality or to help improve its security, to support our due diligence checks, to carry out marketing, analysis or research on our behalf, or to support the provision of services to our customers in general or in connection with a particular relationship, in particular by providing the infrastructure necessary for the Controller to provide its services); these partners include in particular the following IT infrastructure providers and other operators: HubSpot, MailChimp, Google, Facebook, LinkedIn, ActiveCollab, PandaDoc, Traffit, Zadarma, 1Password, PayPal, Stripe

• entities with which we jointly organise promotional events (to ensure that you do not receive direct marketing information about the event from multiple sources);

• our customers, in relation to transactions in which you take part, provided that there are grounds for transferring the data;

• other persons, if you have consented to such disclosure of your data;

• public authorities (only to the extent that we are required to transfer such personal data by mandatory provisions of law), in particular competent law enforcement and regulatory authorities, courts or other third parties, where we believe disclosure is necessary (i) in accordance with applicable law, (ii) to exercise, establish and protect our rights or (iii) to protect your vital interests or those of other persons; Given that the Controller operates mainly online and uses electronic tools that are often supplied by service providers based in the United States, personal data may be transferred outside the European Economic Area. In such a situation, we will exercise the utmost care to ensure that the recipient of the personal data meets all the standards required by the GDPR. In addition, we will ensure that any transfer of data to third countries or international organisations under this article is possible only on condition that the Processor meets the requirements applicable to such transfers under Chapter V of the GDPR. In particular, for such transfers we will use the standard contractual clauses of the European Commission referred to in Article 46(2)(c) GDPR or apply other safeguards provided for in generally applicable law. Further information about the external service providers and partners that may process your personal data (and their locations) is available on request by contacting us using the details given in the section entitled "Contact" below.

9. Security

We have implemented internal procedures, safeguards and technical measures to protect the personal data under our control against unauthorised access, use or disclosure. We monitor their operation on an ongoing basis and ensure continuous compliance with data protection law and its implementing regulations. We follow strict security procedures to ensure that personal data is not damaged, destroyed or disclosed to an unauthorised third party. Devices that collect personal data are kept in a secure location with restricted physical access. We also use secure firewalls and other measures to restrict electronic access; however, no data security measures can guarantee 100% security.

10. Profiling and interest-based advertising

We cooperate with entities that provide interest-based advertising, which may be displayed on our website. Such advertising may process selected data by automated means, including profiling. The data used in this process are: cookies, pixel tags and other tools for collecting information about activity within the services we provide (as well as on third-party websites and services), as well as your IP address, device identifier, general location information and, with your consent, information about the geolocation of your device. The sole purpose of using this data is to provide you with more relevant advertising and content and to assess the effectiveness of such advertising and content.

11. Other

The Website is not intended for persons under 16 years of age. We do not knowingly collect information about persons under 16 years of age. If you believe that we have unintentionally collected such information, please let us know at contact@justidea.agency so that we can remove it from our servers. We reserve the right to make changes to the Policy that may result from the development of internet technology, possible changes in data protection law, and the development of the Website and the services provided by the Controller. The Controller will inform Users of any changes in a clear and understandable way. The date of the latest update of the Policy can be found at the top of this document.

Links to other websites may appear on our Website. Such websites operate independently of us and are not in any way supervised by the Controller. These websites may have their own privacy policies and rules, which we recommend that you read. We are not responsible for the content or privacy policies of these websites, or for the way they treat information about their users. In particular, unless expressly stated otherwise, we are not agents or advertisers of these websites, and we are not authorised to make representations on their behalf.

12. Contact

If you have received e-mails from the Controller that you no longer wish to receive, or if you have any questions or concerns about the use of your personal data, please contact us at contact@justidea.agency.

Cookies

1. What are cookies?

The website justidea.agency may use cookie files (so-called "cookies"). Cookies make it possible to adapt the operation of the website's pages to users' preferences. Cookies are IT data (in particular text files) that are stored on your terminal device (e.g. smartphone, tablet, computer) in connection with your use of the website.

2. Are cookies safe for you and your device?

Cookies are not harmful to your device and do not change its settings or the settings of its software. The cookies we use do not store any personal data or other information collected from you as a user that would allow you to be unambiguously identified as a User of justidea.agency.

3. What is our purpose in using cookies?

Cookies make it possible to analyse the most frequently visited pages of the website and the behaviour of users. Cookies are used to adapt the content displayed on the website to the preferences of the people using it, including by measuring the effectiveness of advertising and tailoring the message to a specific group of recipients. Thanks to cookies, we are able to develop and improve the website so that using it is easier and more convenient.

4. What types of cookies do we use?

We use "persistent" and "session" cookies. "Persistent" cookies remain in the web browser of your device until you delete them as a user or until a predetermined time specified in the parameters of the cookie. "Session" cookies remain in the web browser until you close it or leave or log out of the website on which they were placed. You can check the exact range of cookies we use at https://www.cookieserve.com/ by entering "justidea.agency" in the interactive field.

For more information about cookies and online advertising, and to opt out of interest-based advertising, visit:

• Canada: youradchoices.ca

• European Union: youronlinechoices.eu

• United States: aboutads.info

5. Can you refuse consent to the use of cookies?

If the browser settings of your device allow cookies to be stored, this means that you consent to cookies being stored on your terminal device. The default settings of web browsers usually allow both persistent and session cookies to be used and placed in them. If you do not agree to these files being stored, you can change your web browser settings at any time. These changes may include, among other things, not saving cookies or notifying you (through prompts) each time a file is saved on your device. You can also block cookies completely. However, this may completely or partly prevent the website justidea.agency from working properly. More information about cookies is available in the "Help" section of your web browser menu.