Depending on the type of service, the Controller may process in particular identification and contact data, account data, order and payment data, billing data, the content of correspondence and technical data relating to the use of the Service. 

Data is obtained directly from users in connection with their use of the services and, where justified, also from payment operators, domain service providers or other entities involved in providing the services. 

Providing data may be voluntary, but certain data is necessary to create an account, conclude an agreement or provide a given service. Failure to provide such data may make it impossible to carry out these activities. 

4. Personal data processed via customers’ websites 

WebWave users may create websites and online stores through which they process the personal data of other persons, in particular store customers and persons who contact them via forms. 

With regard to such data, the user who determines the purposes and means of processing generally acts as the data controller, while WeNet Group S.A. processes the data on the user’s behalf, to the extent necessary to provide the services and in accordance with the Personal Data Processing Agreement (DPA). 

The rules, scope and conditions of entrusting data processing are set out in the DPA available in the Service. The user is responsible for the lawfulness of the data processing, including fulfilling information obligations towards data subjects. 

With regard to data processed by WeNet Group S.A. for its own purposes, in particular in connection with maintaining user accounts and handling agreements and settlements, WeNet Group S.A. acts as the data controller. 

5. Artificial intelligence-based solutions 

Certain WebWave features may use artificial intelligence-based solutions, in particular to support website creation or generate content. 

Insofar as the use of these features involves the processing of personal data, the data is processed in order to perform the given feature, in accordance with its intended purpose and applicable law. Where data is transferred to external AI technology providers, this takes place on the terms applicable to the given service and in compliance with data protection requirements. 

6. Data recipients 

Data may be disclosed to entities authorised under the law and to service providers supporting the Controller’s business, in particular hosting and IT infrastructure providers, payment operators, domain service providers, communication tool providers and entities providing accounting, legal and advisory services. 

Entities processing data on behalf of the Controller act based on appropriate agreements and in compliance with data protection legislation. 

Where the use of certain services involves the transfer of data outside the European Economic Area, the Controller applies the legally required mechanisms ensuring an adequate level of data protection. 

7. Data retention period 

Data is stored for the period necessary to achieve the purpose for which it was collected, and thereafter for the period required by law or necessary to establish, pursue or defend against legal claims. 

Data relating to an agreement is stored for the term of the agreement, and thereafter for the period necessary for settlements and the fulfilment of legal obligations. 

Data processed for marketing purposes based on consent is stored until the consent is withdrawn. Data processed for marketing purposes based on legitimate interest is stored until an effective objection is raised or the purpose of processing ceases to exist. 

Technical data and information relating to the use of the services is stored for the period necessary to ensure security, the proper functioning of the services and the pursuit of the Controller’s legitimate purposes. 

Data processed by WeNet Group S.A. on behalf of WebWave customers is stored and deleted in accordance with the DPA and the documented instructions of the controller of such data, taking into account obligations arising from applicable law. 
 

8. Rights of data subjects 

In the cases specified in the GDPR, the data subject has the right to access their data, to rectification, erasure, restriction of processing, data portability, to object, and to withdraw consent where processing is based on consent. 

To exercise these rights, you may contact the Controller or the Data Protection Officer at iod@wenet.pl. 

Where data is processed by WeNet Group S.A. on behalf of a WebWave customer, any request concerning such data should be addressed to the relevant data controller. WeNet Group S.A. assists the controller in fulfilling the rights of data subjects to the extent provided for in the DPA and applicable law. 

The data subject also has the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych). 

9. Cookies and security 

The Service uses cookies and similar technologies to ensure its proper functioning and security and – depending on the user’s settings and consents – to analyse the use of the Service and tailor its functionality. 

Detailed information on the cookies used, their purposes and how to manage them is made available in the Service. 

The Controller applies appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction or unlawful disclosure. 

10. Changes to the Privacy Policy 

This Privacy Policy may be updated in response to changes in legislation, services, technologies or methods of data processing. The current version of the document is available in the Service.