Privacy and Cookie Policy

Rules for processing and protecting personal data at code quest sp. z o.o.

This English version is provided for convenience. In the event of any discrepancy between the English and the Polish version, the Polish version prevails.

In order to comply with the requirements of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter referred to as the “GDPR”, we inform you about the rules for processing your personal data and about the rights you have.

The rules below have applied since 25 May 2018.

The controller of your personal data

The controller of your personal data is code quest sp. z o.o., ul. Zamiany 8 LU 202, 02-786 Warszawa, REGON: 146176183, NIP: 9512357282, entered in the register of entrepreneurs of the National Court Register kept by the District Court for the Capital City of Warsaw in Warsaw, 13th Commercial Division of the National Court Register, under KRS number 0000424452, share capital (fully paid up) PLN 200,000 (hereinafter: “we”, “codequest”).

Contact details

codequest has designated a single point of contact for all matters relating to personal data. If you wish to contact us, send an email to hello@codequest.com or send a letter to: code quest sp. z o.o., ul. Zamiany 8 LU 202, 02-786 Warszawa, marked “Personal data”.

Where do we get your personal data from?

• We receive most of the data directly from you. You provide it to us:
  • by sending an email message or via social media;
  • during a conversation with a member of the codequest team.
• We may also hold your data from publicly available sources and from our partners, who collect personal data in the course of pursuing their own purposes and make it available to us as part of commercial cooperation, provided that you have consented to its disclosure.
• We also receive data about you indirectly — through the analysis of cookies and web server logs collected by the hosting operator of our website.

What is the scope of the data processed?

We process the following personal data:

• first name and surname;
• email addresses;
• telephone number (if you have provided it to us for contact purposes);
• the name and address of your business and your NIP (tax identification number) (if you are an entrepreneur or wish to receive a VAT invoice);
• additional information about yourself that you may have included in email correspondence or provided during a telephone conversation with our team (we do not record calls);
• information contained in an application form or provided during the recruitment process;
• your consent;
• data from the analysis of cookies and collected web server logs.

What are the purpose and legal basis for processing your personal data?

We process your personal data in order to present an offer and subsequently to provide our IT services, including those relating to programming, software development, consulting and the operation of websites (the “services”), as well as for recruitment purposes.

Accordingly, we process your personal data for the various purposes indicated below:

• to prepare a personalised offer of our services and then to perform the contract concluded with you, if you decide to become our client (Art. 6(1)(b) GDPR);
• recruitment, including:
  • establishing and maintaining contact with the Candidate regarding the application documents submitted — in accordance with Art. 6(1)(b) GDPR, i.e. in connection with taking steps at the request of the data subject prior to entering into a contract;
  • conducting and concluding the recruitment process — on the basis of Art. 6(1)(b) GDPR with regard to the data specified in Art. 22¹ § 1 of the Labour Code, and on the basis of the Candidate’s consent, i.e. Art. 6(1)(a) GDPR, with regard to data going beyond the catalogue specified in Art. 22¹ § 1 of the Labour Code;
  • taking the Candidate’s application documents into account in future recruitment processes — on the basis of the Candidate’s voluntary consent (Art. 6(1)(a) GDPR).
• the applicable provisions of law also require us to process your data for accounting and tax purposes (Art. 6(1)(c) GDPR);
• if you give us (separate) consent, we will process your data for our marketing purposes on the basis of the controller’s legitimate interest (Art. 6(1)(f) GDPR);
• if you subscribe to our newsletter, we process your data in order to provide the service you have ordered (Art. 6(1)(b) GDPR);
• your personal data is also processed for the purposes of debt collection, conducting court, arbitration and mediation proceedings, archiving, and ensuring accountability for the proper performance of obligations imposed by law, which constitutes the controller’s legitimate interest (Art. 6(1)(f) GDPR);
• data from the analysis of cookies and web server logs collected by the hosting operator of our website is processed in order to build anonymous statistics on visits to the website, useful inter alia for marketing purposes (including the analysis and profiling of data for marketing purposes) and in order to ensure the functionality of the website (e.g. logging in, presentation of content, handling of forms) (Art. 6(1)(f) GDPR).

How long do we process your personal data?

The period for which data is processed depends on the purpose of processing. Accordingly:

• preparing a personalised offer of our services — we process your data for the duration of negotiations with you, but no longer than three years from the date it was obtained;
• performance of a contract concluded with you, if you decide to become our client — we process your data for the duration of the performance of the contract and, after its termination, until the mutual claims relating to the contract have expired;
• personal data collected for recruitment purposes will be processed for the duration of the recruitment process and, if the Candidate consents to the retention of the data for the purposes of future recruitment, until the consent is withdrawn, but no longer than 36 months from the date on which it was given;
• for accounting purposes — we will process your data for five years, counting from the beginning of the year following the financial year to which the accounting documents relate (Art. 74(2) and (3) of the Accounting Act). For tax purposes, the data will be processed for a period of 5 years, counting from the end of the calendar year in which the deadline for payment of the given tax expired (Art. 70 § 1 of the Tax Ordinance);
• sending you marketing communications other than the newsletter — we process your data until you object to such processing, but no longer than ten years from the date on which the data was obtained for this purpose;
• sending the newsletter — we process your data for as long as you are a subscriber of this service, or until you object to such processing, whichever occurs first;
• debt collection, conducting court, arbitration and mediation proceedings, archiving purposes and ensuring accountability — your data will be processed until the end of the limitation period (this period depends on the type of claim in accordance with the Civil Code or other legal acts governing the rules of liability) or the period during which we may incur another type of liability connected with the relationship established with you;
• building (anonymous) statistics on visits to our website, including for marketing purposes (in particular, tailoring messages and offers to your preferences) — we process the data for the entire period during which you use our website or services provided by electronic means (e.g. the newsletter), and then for a period of 5 years from the date you cease using them.

Who are the recipients of your personal data?

We may disclose your personal data to our contractors:

• service providers supplying codequest with technical and organisational solutions that enable the provision of services and the management of our organisation, such as:
  • companies providing services of delivering and maintaining database software, providers of management systems thanks to which we can run codequest, operate our website, send the newsletter and keep appropriate sales records, etc.;
  • entities providing hosting services;
  • marketing agencies (advertising agencies, entities supporting emailing services), which help us understand what our clients are interested in, create interesting offers and promotions, and support us in our ongoing communication with clients, including you;
  • providers of legal, accounting and advisory services;
• our subcontractors with whom we cooperate in providing services to our clients;
• our partners/contractors to whom we make data available as part of commercial cooperation, provided that we have asked for your consent for this purpose and you have given it.

For each of these purposes, we disclose only the data necessary to achieve it.

Do we process your data in an automated manner (including by profiling) in a way that affects your rights?

Your personal data may be processed in an automated manner (including in the form of profiling), but this will not produce any legal effects concerning you or affect your situation.

As part of our marketing, we want to be able to present to you information (offers, promotions) tailored to your interests. The profiling of personal data by codequest consists solely in processing your data (also in an automated manner) by using it to evaluate certain information about you, in particular to analyse or predict your personal preferences and interests.

How do we process your personal data?

We process personal data in accordance with applicable law, in particular the GDPR. When processing your personal data, we are guided by the following principles:

• The principle of adequacy. We process only the data that is necessary to achieve the given purpose of processing. We have analysed compliance with this principle for each business process;
• The principle of transparency. You should have full knowledge of what happens to your data. This document, in which we seek to give you complete information on the rules for processing your personal data, is an expression of this principle;
• The principle of accuracy. We strive to ensure that your personal data in our systems is up to date and accurate. If you find that in any respect your data has not been updated or is incorrect, please contact us at the email address hello@codequest.com;
• The principle of integrity and confidentiality. We apply the measures necessary to safeguard the confidentiality and integrity of your personal data. We continuously improve them in line with the changing environment and technological progress. The safeguards include physical and technological measures restricting access to your data, as well as appropriate measures protecting against its loss;
• The principle of accountability. We want to be able to account for every action we take on personal data, so that, should you make an enquiry, we can give you full and reliable information about the actions we have carried out on your data.

What rights do you have in connection with the processing of your personal data?

The law gives you a number of rights that you may exercise at any time. Provided that you do not abuse these rights (e.g. by making unjustified daily requests for information), exercising them is free of charge and should be easy to do.

Your rights include:

• The right of access to personal data. This means that you can ask us to export from our databases the information we hold about you and send it to you in one of the commonly used formats (e.g. XLSX, DOCX, etc.);
• The right to rectification of personal data. If you learn that the data we process is incorrect, you can ask us to correct it, and we will be obliged to do so. In such a case, we have the right to ask you to provide a document or other evidence of the change in the data;
• The right to restriction of processing of personal data. If, despite our compliance with the principle of adequacy, you consider that for a given purpose we process too broad a catalogue of your personal data, you have the right to demand that we restrict the scope of processing. If the request does not conflict with the requirements imposed on us by applicable law or is not necessary for the performance of a contract, we will comply with your request;
• The right to request erasure of personal data. This right, also known as the right to be forgotten, means that you can demand that we erase from our systems and any other registers all information containing your personal data. Please remember, however, that we will not be able to do so if we are obliged to process your data on the basis of provisions of law (e.g. transaction documents for tax purposes, the obligation to ensure accountability for our actions). In every case, however, we will erase your personal data to the fullest extent possible and, where this is not possible, we will ensure its pseudonymisation (which means that the data subject cannot be identified without the appropriate linking key). As a result, data that we are required to retain under applicable law will be accessible only to a very limited circle of persons in our organisation;
• The right to data portability. In accordance with the GDPR, you can ask us to transfer the data you have provided to us in the course of all our contacts and the entire cooperation to a separate file, for the purpose of further transferring it to another data controller;
• The right to withdraw consent. If we process your personal data on the basis of your consent, you may withdraw it at any time. The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of that consent before its withdrawal. Please note, however, that your data will cease to be processed solely for the purpose covered by the withdrawn consent. The data covered by the consent will continue to be processed in order to fulfil our obligations arising from provisions of law, including in particular the obligation of accountability for the lawfulness of personal data processing, or for purposes based on our legitimate interest.

You can exercise the above rights by contacting us at the email address hello@codequest.com or by post at code quest sp. z o.o., ul. Zamiany 8 LU 202, 02-786 Warszawa, marked “Personal data”.

In all matters relating to personal data you can always write to us — especially if any action or situation you encounter raises doubts as to its legality, or if you consider that your rights or freedoms may be infringed. In such a case, we will answer your questions and concerns and deal with the matter without delay.

If you consider that we have in any way infringed the rules on processing your personal data, you have the right to lodge a complaint directly with the supervisory authority (since 25 May 2018, this is the President of the Office for Personal Data Protection (Prezes Urzędu Ochrony Danych Osobowych, UODO)). In exercising this right, you should provide a full description of the situation and indicate which action you consider to infringe your rights or freedoms. The complaint must be lodged directly with the supervisory authority.

What does the right to object involve?

We separately inform you that you also have the right to object to the processing of your personal data.

You may object where you do not want us to process your personal data for a particular purpose (e.g. for marketing purposes).

You also have the right to object where the processing of your data is based on the controller’s legitimate interest or is carried out for statistical purposes, and the objection is justified by your particular situation. In such a case, we will continue to process your data within the other processes (for other purposes), but no longer for the purpose to which you have objected. You can exercise the right to object by sending a message to the email address hello@codequest.com or by post to code quest sp. z o.o., ul. Zamiany 8 LU 202, 02-786 Warszawa, marked “Personal data”.

Are you obliged to provide your data?

You have no legal obligation to provide us with your personal data. However, without obtaining it, we will not be able to provide our services to you.

Do we transfer your data outside the EU?

Yes, we may transfer your data to a third country or to international organisations. This possibility arises primarily where we use e-marketing platforms located on servers in the United States.

If we transfer your data to a third country or to international organisations, we always make sure that their recipients guarantee a high level of personal data protection.

What is our cookie policy?

• What are cookies?
  The use of cookies — small files downloaded to your computer to improve the comfort of using a website — is a common practice of almost all professional websites. We want to describe what information we collect using cookies, how we use it and why it is sometimes necessary to store them. We will also tell you how you can prevent cookies from being stored — please remember, however, that this may degrade or “break” some elements of the website’s functionality.
• How do we use cookies?
  We use cookies for various reasons. Unfortunately, in most cases there are no standard industry solutions that allow cookies to be disabled without completely disabling the functionality they add to the website. We recommend that you leave all cookies enabled if you are not sure whether you need them — in case they are used to provide a service you use.
• Disabling cookies
  You can prevent cookies from being stored by changing the settings of your browser (you will find out how to change them in your browser’s help). Please remember that disabling cookies will affect the functionality of this and many other websites you visit. We therefore recommend that you do not disable them.
• Cookies that we set:
  • Form-related cookies — when you submit data via a form, such as a contact form, cookies may be stored in order to remember your data for the purposes of future correspondence.
  • Preference-related cookies — to ensure the comfort of using the website, we provide a function for remembering your preferences regarding how it operates. To remember them, we must set cookies, thanks to which this information can be read at every interaction with the website.
  • Third-party cookies — in some specific cases, we also use cookies provided by trusted third parties, e.g. analytics tools that help us understand how you use the website and how we can improve your experience.
• More information
  We hope that the above information has explained the rules of our policy to you. As we mentioned earlier — if you are not sure whether given cookies are needed by you, it is safer to leave them enabled. If you are looking for further information, contact us by sending a message to the email address hello@codequest.com or by post to code quest sp. z o.o., ul. Zamiany 8 LU 202, 02-786 Warszawa, marked “Personal data”.