GDPR notice

The controller of your personal data is Polish Developer Network sp. z o.o., ul. Słoneczna 32/9, 33-100 Tarnów, Poland, KRS 0000788468, NIP 8733271495, REGON 383458475 (‘PDN’, ‘we’). This notice gives the information required by Articles 13 and 14 of Regulation (EU) 2016/679 (the GDPR).

For anything concerning personal data, write to rodo@developernetwork.pl or by post to the address above. We have not appointed a data protection officer. Visits to developernetwork.pl are covered by the privacy policy.

This covers clients who are natural persons (for example sole traders or partners in a civil-law partnership) and the people who represent a client or whom a client names as contacts, such as its staff.

• Preparing an offer at your request, concluding and performing a contract (software, UniFi networks, KNX automation). Art. 6(1)(b) GDPR where you are a party to the contract; Art. 6(1)(f) GDPR where you act for a client: our legitimate interest in communicating with the client and performing the contract. Kept for the term of the contract.
• Invoicing, accounting and tax records. Art. 6(1)(c) GDPR, under the Accounting Act, the VAT Act and the Tax Ordinance. Accounting documents are kept for 5 years from the beginning of the year following the financial year in which the transactions were finally completed, settled or time-barred (Article 74 of the Accounting Act), and in any case until the related tax liability is time-barred (5 years from the end of the calendar year in which the tax payment deadline passed). Invoices issued in the National e-Invoicing System (KSeF) are kept there for the period set by the VAT Act.
• Establishing, exercising or defending legal claims. Art. 6(1)(f) GDPR: protecting our rights. Kept until the claims are time-barred.
• Telling existing clients about our services. Art. 6(1)(f) GDPR: marketing our own services. We send commercial information by e-mail, phone or messaging apps only with your prior consent (Article 398 of the Electronic Communications Law). Kept until you object or withdraw consent.

We process names, company details, addresses, NIP and REGON, e-mail addresses and phone numbers, positions or roles, correspondence, billing details (such as bank account numbers) and project materials. If you act for a client, we received your data from that client. Providing data is a condition of concluding and performing a contract, and the data needed for an invoice is required by tax law.

In software, UniFi network and KNX projects we may have access to personal data held in our clients’ systems, for example user accounts, device identifiers or logs. For that data the client is the controller: we process it only on the client’s behalf and instructions, as a processor under a data processing agreement. For questions about it, contact the client; if you contact us, we will pass your request on.

We also work with our partner ALM Agnieszka Makowej on website projects. Where we process personal data in those projects, we do so on ALM’s behalf: as its processor where ALM is the controller, or as a sub-processor where ALM processes the data on behalf of its own client, who is then the controller. ALM’s GDPR notice explains how ALM handles that data.

• Concluding and performing a contract. Art. 6(1)(b) GDPR, or Art. 6(1)(f) GDPR for people who act for a contractor: our legitimate interest in working with the contractor.
• Settlements and tax obligations. Art. 6(1)(c) GDPR.
• Establishing, exercising or defending legal claims. Art. 6(1)(f) GDPR.

We process identification and contact details, company registration details, billing details and correspondence, for the term of the contract and then until claims are time-barred and the retention periods for accounting and tax documents end.

When you contact us by e-mail, phone, messaging app or in person, we process your contact details and what you tell us, to deal with the matter: under Art. 6(1)(f) GDPR (answering correspondence), Art. 6(1)(b) GDPR where it concerns a contract with you, or Art. 6(1)(c) GDPR where you exercise your GDPR rights. We keep the data until the matter is closed and then until any claims arising from it are time-barred.

Under Article 118 of the Polish Civil Code, claims are as a rule time-barred after 6 years, and claims related to business activity after 3 years; the period ends on the last day of a calendar year.

We do not sell personal data. Where needed for a given purpose, the data may be received by:

• providers of the infrastructure and tools we use, such as Cloudflare, Inc. (hosting, e-mail forwarding), GitHub, Inc. (code repositories) and our e-mail provider;
• our partner ALM Agnieszka Makowej, in projects we carry out together;
• providers of accounting, legal and payment services, including banks;
• tax authorities, including through the National e-Invoicing System (KSeF), courts and other public authorities, where the law requires it.

Providers that process data on our behalf do so under data processing agreements and only on our instructions.

Cloudflare, Inc. and GitHub, Inc. are based in the United States, and our e-mail provider may also process data outside the European Economic Area. Transfers to organisations certified under the EU-U.S. Data Privacy Framework are based on the European Commission’s adequacy decision (Implementing Decision (EU) 2023/1795); other transfers are covered by standard contractual clauses approved by the European Commission (Art. 46(2)(c) GDPR). You can ask for a copy of these safeguards at rodo@developernetwork.pl.

Under the GDPR, you have the right to:

• access your data and receive a copy of it (Art. 15);
• have inaccurate data corrected (Art. 16);
• have your data erased (Art. 17);
• restrict processing (Art. 18);
• receive data processed under a contract or consent by automated means in a portable format (Art. 20);
• withdraw consent at any time where processing is based on it; this does not affect processing carried out before you withdrew it.

Right to object. You can object at any time, on grounds relating to your particular situation, to processing based on our legitimate interests (Art. 21(1) GDPR). An objection to direct marketing needs no reason and always takes effect (Art. 21(2) and (3) GDPR).

Send requests to rodo@developernetwork.pl or by post to our registered office. We reply within one month of receiving a request; in exceptional cases, which we will tell you about, this may be extended by two further months. We may ask for information to confirm your identity.

You also have the right to lodge a complaint with the supervisory authority: the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stanisława Moniuszki 1A, 00-014 Warszawa, Poland, uodo.gov.pl.

We do not make decisions based solely on automated processing, including profiling, within the meaning of Art. 22 GDPR.

We update this notice when the way we process data or the law changes. The date of the latest version is shown on this page.