Privacy policy of the “Strefa Tradingu” website

1. General provisions

1. This privacy policy (hereinafter: the “Policy”) sets out the rules for processing the personal data of Users of the Strefa Tradingu Website available at https://strefatradingu.pl/ (hereinafter: the “Website”).
2. The controller of Users’ personal data is Strefa Tradingu (hereinafter: the “Controller”).
3. Users’ personal data is processed in accordance with:
   1. Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR),
   2. the Polish Act of 10 May 2018 on the Protection of Personal Data,
   3. the Polish Act of 18 July 2002 on the Provision of Services by Electronic Means,
   4. other applicable provisions of law.

2. Scope of processed data

1. The Controller may process the following categories of Users’ personal data:
   1. Identification and contact data:
      • e-mail address,
      • login/nickname,
      • account identifier in external services (e.g. Discord ID),
      • in exceptional cases: first name and surname, if provided by the User.
   2. Data related to the Account and use of the Website:
      • information on holding an active account on the Partner Exchanges (e.g. exchange UID) – to the extent necessary to verify the conditions of access to the Materials,
      • login history, date of creation and deletion of the Account.
        
        2c) UGC and related data:
      • content published by the User (recordings, graphics, texts) – processed on the basis of the licence granted in accordance with Section VIIa of the Terms of Service,
      • data identifying the author of the content (e.g. Discord ID, nickname) – necessary for managing the licence and archiving.
      • Technical and usage data:
        • IP address,
        • device and browser data (type, version, language),
        • session data (time, subpages visited, entry source),
        • cookies and similar technologies (details in the Cookie Policy).
      • Communication data:
        • information contained in e-mail correspondence,
        • data provided voluntarily by the User when contacting the Controller.
2. As a rule, the Controller does not process special categories of personal data (so-called sensitive data).

3. Purposes and legal bases of processing

The Controller processes Users’ personal data for the following purposes and on the following legal bases:

1. Provision of services by electronic means within the Website
   • maintaining and operating the Account,
   • enabling access to the Materials, the Community and video courses.
     Legal basis: Article 6(1)(b) GDPR (necessity for the performance of the agreement for the provision of services by electronic means).
2. Ensuring the functioning and security of the Website
   • keeping server logs,
   • detecting abuse, analysing attempted security breaches,
   • monitoring the availability and performance of the Website.
     Legal basis: Article 6(1)(f) GDPR (the Controller’s legitimate interest in ensuring the security of the Website and Users).
3. Verification of fulfilment of the access conditions for certain Materials
   • verifying whether the User holds an account on a Partner Exchange opened using the Controller’s affiliate link,
   • verifying the exchange account UID provided by the User.
     Legal basis: Article 6(1)(b) GDPR (necessity for the performance of the agreement) and Article 6(1)(f) GDPR (the Controller’s legitimate interest – implementation of the affiliate-based business model).
     3a. Management of rights to UGC content:
   • storage, archiving and use of content published by Users on the basis of the licence granted.
     Legal basis: Article 6(1)(b) GDPR (performance of the agreement for the provision of services) and Article 6(1)(f) GDPR (legitimate interest – exercise of the UGC licence).
4. Conducting statistical analyses and improving the Website
   • analysing the manner in which the Website is used,
   • producing statistics, reports and summaries.
     Legal basis: Article 6(1)(f) GDPR (the Controller’s legitimate interest in developing the Website and adapting it to Users’ needs).
5. Responding to enquiries and conducting correspondence
   • handling enquiries addressed to the Controller by e-mail or other channels.
     Legal basis: Article 6(1)(f) GDPR (the Controller’s legitimate interest in conducting correspondence in connection with the Website).
6. Fulfilment of legal obligations
   • in particular those arising from accounting, tax and personal data protection regulations.
     Legal basis: Article 6(1)(c) GDPR.
7. Marketing of the Controller’s own services (without spamming)
   • informing about new materials, educational content and events in the Community.
     Legal basis: Article 6(1)(f) GDPR (the Controller’s legitimate interest in promoting its activities).
     Where electronic means of communication are used (e.g. a newsletter) in a manner requiring consent – additionally Article 6(1)(a) GDPR (consent).

4. Recipients of data

1. Users’ personal data may be transferred to the following categories of recipients:
   1. entities providing hosting and IT infrastructure maintenance services to the Controller,
   2. providers of analytical and marketing tools (e.g. Google Analytics – with respect to anonymous/pseudonymised data),
   3. providers of communication services (e.g. mailing platforms),
   4. entities providing advisory, legal and accounting services – to a justified extent,
   5. public authorities entitled to receive the data under provisions of law.
2. As a rule, the User’s data is not transferred to the Partner Exchanges – the User independently concludes an agreement with the Partner Exchange and provides it with data in their own name.

5. Transfer of data outside the European Economic Area

1. In connection with the use of the services of third parties (e.g. Google LLC, Discord Inc., providers of analytical and communication tools), Users’ personal data may be transferred to countries outside the European Economic Area (EEA), in particular to the United States of America.
2. In such cases, the Controller ensures the application of the mechanisms required by the GDPR, in particular:
   1. European Commission adequacy decisions (e.g. the EU–US Data Privacy Framework, where applicable), or
   2. standard contractual clauses approved by the European Commission, or
   3. other appropriate safeguards provided for in the GDPR.
3. The User has the right to obtain a copy of the safeguards applied to the transfer of data outside the EEA by contacting the Controller.

6. Data retention period

1. Personal data will be processed for the period necessary to achieve the purposes referred to in point 3, i.e.:
   1. data related to the Account – until its deletion and for the period necessary to pursue or defend claims (as a rule, up to 6 years from the end of the year in which the Account was deleted),
   2. technical data (logs, traffic data) – as a rule, up to 24 months from the date of its recording,
   3. correspondence data – up to 36 months from the end of the correspondence, unless a longer period results from the need to pursue or defend claims,
   4. data processed on the basis of consent – until the consent is withdrawn.
2. After the periods indicated above have elapsed, the data is deleted or anonymised.

7. User’s rights

1. The User has the following rights in connection with the processing of personal data:
   1. the right of access to personal data,
   2. the right to rectification (correction) of data,
   3. the right to erasure of data (the “right to be forgotten”) – in the cases provided for in the GDPR,
   4. the right to restriction of processing,
   5. the right to data portability – with respect to data processed on the basis of an agreement or consent,
   6. the right to object to the processing of personal data based on the Controller’s legitimate interest,
   7. the right to withdraw consent at any time (to the extent that consent is the basis for processing),
   8. the right to lodge a complaint with the supervisory authority – the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych).
2. In order to exercise their rights, the User may contact the Controller at the e-mail address: support@strefatradingu.pl.

8. Voluntary provision of data

1. The provision of personal data by the User is, as a rule, voluntary, but it may be:
   1. necessary to create and operate an Account,
   2. necessary to obtain access to certain Materials or functionalities of the Website,
   3. necessary to respond to enquiries.
2. Failure to provide data may result in the Controller being unable to provide certain services.

9. Security measures

1. The Controller applies appropriate technical and organisational measures to ensure the protection of the personal data processed, in particular:
   1. encryption of data transmission (SSL/TLS),
   2. the use of server and database security measures,
   3. systematic updating of the software used,
   4. restricting access to data to authorised persons.

10. Cookies and similar technologies

1. The Website uses cookies and other similar tracking technologies for the purposes described in detail in the Cookie Policy available on the Website.
2. The User may manage cookie settings via the relevant functions of their web browser and via the settings available within the cookie banner on the Website.

11. Amendments to the Policy

In particular in connection with changes to the provisions of law or changes to the functionalities of the Website, the Controller will inform about an amendment to the Policy by publishing its new version on the Website together with the current date.

The Controller reserves the right to amend the Policy for important reasons, in particular related to changes to the provisions of law or changes to the functionalities of the Website.