Polish version

Information on the Processing of Personal Data by MAIN sp. z o.o.

Personal Data Controller

The controller of your personal data is MAIN sp. z o.o., with its registered office in Warsaw (postal code 01-211), at 7/9 Giełdowa Street, KRS: 0000560747, NIP: 5252620555, REGON: 361665837 (hereinafter: MAIN).

Data Protection Officer

For any questions or concerns regarding data security and personal data processing, you may contact our Data Protection Officer. The Data Protection Officer is available at: [email protected].

Purposes and Legal Bases for Personal Data Processing

Newsletter, the sending of commercial and marketing communications

What is the purpose of processing your personal data?
We process your personal data for marketing purposes, including sending you marketing information via email and analyzing whether you read our messages and which content interests you the most.

Is providing your data mandatory?
Providing your email address is voluntary, but without it, we will not be able to send you marketing messages.

What is the legal basis for processing your data?

1. Article 6(1)(a) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation – GDPR): the data subject has given consent to the processing of their personal data for one or more specific purposes;
2. Article 6(1)(f) GDPR: the processing is necessary for the purposes of our legitimate interests;
3. If you consent to receiving commercial information and marketing communications to the email address you have provided, the legal basis will also include Article 18(4) of the Act of 18 July 2002 on the provision of electronic services in connection with the provisions of the Act of 12 July 2024 – Electronic Communications Law.

Who will receive your data?
We will share your data with providers of newsletter distribution tools.

How long will we process your data?
For the duration of our marketing activities, but no longer than until you object to the processing for marketing purposes or withdraw your consent. Withdrawing your consent does not affect the legality of processing prior to withdrawal.

Can you object to the processing of your data?
Yes. You may do so at any time, and if we process your data for direct marketing, you do not need to justify your objection.

Contact Form

Information on the processing of personal data submitted electronically via contact forms on the website https://main.pl/ and its subpages.

By using the contact form on our website, you consent to the processing of your personal data – name, surname, email address, and any data provided voluntarily in the message – for the purpose of responding to your inquiry.

The personal data provided in the contact form will be processed for the time necessary to respond.

Your personal data may be disclosed and transferred to authorities if required by applicable law.

You have the right to:

• access your data and request its rectification, deletion, or restriction of processing;
• object to the processing of your data based on the controller’s legitimate interest, in particular profiling;
• withdraw consent at any time where consent is the basis for processing; withdrawal does not affect the lawfulness of prior processing;
• data portability;
• lodge a complaint with the President of the Personal Data Protection Office if you believe that your data is being processed in violation of the GDPR.

Providing personal data is voluntary but necessary to receive a response.

Contractors (suppliers, vendors, service providers)

The legal basis for processing personal data necessary for contract conclusion and performance is Article 6(1)(b) and 6(1)(c) of the GDPR.

Processing is also based on Article 6(1)(f) of the GDPR, i.e., the legitimate interest of the Controller in ensuring proper settlements and asserting claims.

Data will be processed for the purpose of:

1. concluding and performing the contract, and making necessary settlements – for the duration of the contract and afterwards for archiving purposes;
2. fulfilling legal obligations, in particular tax and reporting – until the expiry of relevant deadlines;
3. pursuing the legitimate interests of the Controller – until a valid objection is raised based on your particular situation.

Providing data is voluntary but necessary to conclude a contract.

Your data may be disclosed only to entities authorized by law, including:

1. public authorities or entities performing public tasks (e.g. Social Security Office, Tax Office, Police, courts);
2. entities providing services to the Company where processing is necessary (e.g. IT, legal, audit, accounting services).

You have the right to:

1. access, rectify, delete, restrict processing;
2. data portability;
3. object to processing;
4. withdraw consent at any time without affecting prior lawful processing;
5. lodge a complaint with the President of the Personal Data Protection Office.

Google Ads Contact Form

By using the contact form in the Google Ads network, you consent to the processing of your personal data – name, surname, phone number, email address, and company name – by MAIN sp. z o.o.

This data will only be used to contact you, present our offer, and discuss our services.

Data will be processed for the time necessary to establish contact.

You have the right to:

• access your data and request its rectification, deletion, or restriction of processing;
• object to processing based on legitimate interest, including profiling;
• withdraw consent at any time without affecting prior lawful processing;
• data portability;
• lodge a complaint with the President of the Personal Data Protection Office.

Providing data is voluntary but necessary to receive a response.

Since the data was collected via a Google form, we encourage you to review Google’s privacy policy:

https://policies.google.com/privacy?hl=

Job Applicants

Information on the processing of personal data of job applicants

The legal basis for processing your data to conduct recruitment and conclude a contract is Article 6(1)(b) and 6(1)(c) of the GDPR.

Where data is processed based on separate consent, you may withdraw your consent at any time. This will not affect the lawfulness of processing before withdrawal.

Your data will be processed until the end of the recruitment process. If you consent to future recruitment processes, your data will be processed for 12 months or until you withdraw your consent.

You have the right to:

1. access, rectify, delete, or restrict processing of your data;
2. data portability;
3. object to processing;
4. withdraw consent at any time without affecting prior lawful processing;
5. lodge a complaint with the President of the Personal Data Protection Office (Stawki 2, 00-193 Warsaw) if you believe your data is processed in violation of the GDPR.

Facebook Fanpage

The controller processes personal data of individuals who subscribe to the MAIN Data Center Facebook fanpage by clicking “Like” or “Follow”, post comments, share or like posts, share content from the fanpage on their profile, or send a private message via “Send Message”.

The following data categories are processed:

• Facebook username or nickname;
• profile photo;
• information provided via private message, post reactions, comment content.

Your data is processed:

• based on legitimate interest (Art. 6(1)(f) GDPR):
  • managing the fanpage and informing about the controller’s activities;
  • to establish, exercise, or defend legal claims;
  • for analytical purposes regarding the fanpage’s functioning and engagement;
• based on Art. 6(1)(a) GDPR – where you have given consent for specified purposes.

Your data may be disclosed to:

• authorized employees of the controller;
• other Facebook users;
• the owner of Facebook – according to its privacy policy: https://www.facebook.com/about/privacy.

Microsoft Bookings

Microsoft Bookings is used to schedule meetings and calls. When booking, users provide their contact details, email, and phone number.

Using Microsoft Bookings on our website is voluntary.

Your data may be disclosed to authorities if required by law.

Retention periods depend on the purpose and legal basis:

• Data based on consent will be stored until consent is withdrawn;
• Data processed based on legal obligations will be stored as long as required by law;
• Data based on legitimate interest will be stored until an effective objection is raised or the interest ceases, e.g. for claims – until the limitation period expires.

You have the right to:

• access, rectify, delete, or restrict processing of your data;
• object to processing based on legitimate interest, including profiling;
• withdraw consent at any time without affecting prior lawful processing;
• data portability;
• lodge a complaint with the President of the Personal Data Protection Office (Stawki 2, 00-193 Warsaw).

Callback24

Our company uses Callback24 to provide fast and convenient phone contact with our clients. The following personal data is collected:

• Phone number: provided by the client for the purpose of initiating a call.
• Call data: duration, date, time, and notes from the conversation.

Purposes and legal bases of data processing
Data collected through Callback24 is processed for:

• initiating phone contact with the client;
• analyzing and improving customer service quality;
• generating call statistics and reports.

The legal basis is the client’s consent when providing their phone number.

Data retention
Data is stored for the time necessary to achieve the processing purposes, in accordance with applicable law.

Client rights
The client has the right to:

• access their personal data;
• rectify, delete, or restrict data processing;
• object to data processing;
• data portability.

For questions about data processing, please contact our Data Protection Officer.

To ensure smooth use of our website, we use so-called cookies. Most large websites do the same. A “cookie” is a small text file that a website saves on a user’s computer or mobile device when they visit the site. This allows the site to remember the user’s actions and preferences over time.

What do we use cookies for?

The main.pl website uses cookies for the following purposes:

1. Tracking user activity by collecting anonymous statistics using tools such as: Google Analytics, Google Tag Manager, Microsoft Clarity
2. Optimizing website performance and content using tools such as: Google Optimize tags
3. Better ad targeting in the Google Ads network using tools such as: Google Ads remarketing code
4. Integrating with social media plugins: YouTube

Types of cookies

• Session cookies – Temporary information stored in the browser’s memory until the end of the session (browser closure). These are required for the proper functioning of the website.
• Persistent cookies – Information stored in the browser’s memory for a longer period (depending on browser settings) or until manually deleted by the user.

How to control cookies?

Cookies can be managed and deleted manually – details are available at wszystkoociasteczkach.pl. You can remove all cookies stored on your device, and most browsers allow you to block cookies entirely. If you do this, you may need to adjust certain preferences each time you visit a site, and some features or services may not be available.