PICTOPLAN

Privacy Policy

DATA PROCESSING INFORMATION

PICTOPLAN Oliwia Chłopek

§ 1 Information on the processing of personal data contained in electronic correspondence

I [Data Controller]

Oliwia Chłopek, conducting business activity under the business name PICTOPLAN, registered in the Central Registration and Information on Business (CEIDG) kept by the minister responsible for economy, holding NIP (Tax Identification Number): 6322039494, REGON (National Business Registry Number): 540750562, is the data controller of the personal data of recipients and senders of electronic messages. The data controller can be contacted:

at the correspondence address: ul. Filomatów 15B, 43-600 Jaworzno, Poland
at the e-mail address: biuro@pictoplan.com.pl
by telephone: +48 792 805 800.

II [Purposes and period of processing personal data]

The controller processes contact information of senders and recipients of e-mail correspondence, contained within the content of such correspondence, for the purpose of:

enabling e-mail contact with the controller and initiating contact with recipients;
documenting arrangements made with clients, contractors, and other persons;
receiving letters, submissions, and requests in electronic form, e.g. complaints, claims, and other applications;
protecting against claims and pursuing potential claims.

Correspondence is stored for one year, unless the messages contain content relevant to pursuing claims or defending against claims, in which case selected messages will be stored for up to 3 years, i.e., until the expiry of the limitation period for claims in accordance with the Civil Code.

III [Legal basis for processing personal data]

The legal basis for processing data contained in e-mail correspondence is:

the legitimate interest of the data controller and the senders of electronic messages (Article 6(1)(f) GDPR) – in respect of incidental correspondence, consisting in enabling electronic contact with the controller;
the necessity for the performance of a contract concluded with our clients or contractors (Article 6(1)(b) GDPR) in respect of correspondence conducted for the purpose of contract performance;
freely given consent through a clear affirmative action – if the sender of a message requests information regarding the controller's brand, products, or services, the response provided to the sender will contain the information requested by the sender, and sending the enquiry will constitute consent to the controller sending commercial information to the e-mail address provided by the sender to the extent necessary to provide an answer (Article 398 of the Electronic Communications Law Act and Article 10 of the Act on Providing Services by Electronic Means); the consent granted may be withdrawn at any time without giving any reason;
freely given consent through a clear affirmative action – if the sender of a message requests information regarding the controller's brand, products, or services, the response provided to the sender will contain the information requested by the sender, and sending the enquiry will constitute consent to the controller sending commercial information to the e-mail address provided by the sender to the extent necessary to provide an answer (Article 10 of the Act on Providing Services by Electronic Means); the consent granted may be withdrawn at any time without giving any reason, but commercial information sent after the request for it but before the withdrawal of consent will be sent lawfully; withdrawal of consent may prevent a full answer to the question asked. Consent to the processing of special categories of data is therefore voluntary, explicit, and separate;
the legitimate interest of the controller consisting in pursuing claims or defending against claims, in accordance with generally applicable provisions of law, in particular the Civil Code (Article 6(1)(f) and Article 9(2)(f) GDPR).

IV [Recipients of personal data]

The controller may disclose the content of correspondence solely for the purpose of pursuing their claims within legal proceedings, as well as to entities cooperating with the controller on the basis of written personal data processing agreements (data processing addenda), for the purpose of performing tasks and services specified in the agreement for the controller, in particular in the field of e-mail or traditional mail management, hosting, IT services, debt collection, legal or advisory services, and administrative support.

V [Rights of data subjects]

Every data subject has the right to:

access – obtaining confirmation from the controller as to whether or not their personal data are being processed. If data concerning a person are processed, they are entitled to access them and obtain the following information: the purposes of the processing, the categories of personal data concerned, the recipients or categories of recipients to whom the personal data have been or will be disclosed, the period for which the personal data will be stored or the criteria used to determine that period, the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing (Article 15 GDPR);
receive a copy of data – obtaining a copy of the personal data undergoing processing, whereby the first copy is free of charge, and for any further copies the controller may charge a reasonable fee based on administrative costs (Article 15(3) GDPR);
rectification – requesting the rectification of inaccurate personal data concerning them or the completion of incomplete data (Article 16 GDPR);
erasure (right to be forgotten) – requesting the erasure of their personal data if the controller no longer has a legal basis for their processing or the data are no longer necessary in relation to the purposes for which they were collected (Article 17 GDPR);
restriction of processing – requesting the restriction of processing of personal data (Article 18 GDPR) when:
- the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data,
- the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead,
- the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims,
- the data subject has objected to processing – pending the verification whether the legitimate grounds of the controller override those of the data subject;
data portability – receiving the personal data concerning them, which they have provided to a controller, in a structured, commonly used and machine-readable format and requesting the transmission of those data to another controller, if the processing is based on the data subject's consent or on a contract and the processing is carried out by automated means (Article 20 GDPR);
object – objecting, on grounds relating to their particular situation, at any time to processing of their personal data based on the legitimate interests of the controller, including profiling. The controller shall then no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims. If, according to the assessment, the interests of the data subject override the interests of the controller, the controller shall be obliged to cease processing the data for these purposes (Article 21 GDPR);
withdraw consent at any time and without giving any reason, but the processing of personal data carried out before the withdrawal of consent will remain lawful. The withdrawal of consent will result in the controller ceasing to process personal data for the purpose for which the consent was given.
lodge a complaint – the data subject has the right to lodge a complaint with a supervisory authority, which in Poland is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych) with its registered office in Warsaw, ul. Stawki 2.

To exercise the aforementioned rights, the data subject should contact the controller using the provided contact details and inform them which right and to what extent they wish to exercise.

§ 2 Information on the processing of personal data for clients and contractors

I [Data Controller]

Oliwia Chłopek, conducting business activity under the business name PICTOPLAN, registered in the Central Registration and Information on Business (CEIDG) kept by the minister responsible for economy, holding NIP: 6322039494, REGON: 540750562, is the data controller of the personal data of contractors and clients. The data controller can be contacted:

at the correspondence address: ul. Filomatów 15B, 43-600 Jaworzno, Poland
at the e-mail address: biuro@pictoplan.com.pl
by telephone: +48 792 805 800.

II [Purposes, legal bases, and period of data processing]

Personal data of contractors will be processed by the controller for the following purposes:

performance of a contract – to the extent necessary to perform the contract (Article 6(1)(b) GDPR) – for the duration of the cooperation;
settlements of contract performance between the parties, including payment processing – to the extent necessary to perform the contract (Article 6(1)(b) GDPR) – for the duration of the cooperation;
fulfillment of obligations regarding enforcement of claims – in order to fulfill obligations regarding the enforcement of receivables resulting from the Code of Civil Procedure, the Act on Enforcement Proceedings in Administration, and the Act on Court Bailiffs (Article 6(1)(c) GDPR) – for 3 years from the last deduction;
fulfillment of accounting obligations – in order to fulfill obligations resulting from the Accounting Act (Article 6(1)(c) GDPR) – for 5 years from the end of the year in which the event occurred;
fulfillment of tax obligations – in order to fulfill obligations resulting from tax regulations, in particular the Tax Ordinance, the Corporate Income Tax Act, and the Goods and Services Tax Act (Article 6(1)(c) GDPR) – for 5 years from the end of the tax year;
pursuing claims or defending against claims – in order to pursue the legitimate interest of the controller consisting in enforcing their pecuniary or non-pecuniary rights or protecting against claims against the controller, in accordance with general regulations, in particular the Civil Code (Article 6(1)(f) GDPR) – for 3 years from the end of cooperation.

III [Recipients of data]

The controller discloses personal data of contractors and clients in the following cases:

when such an obligation results from the provisions of applicable law, including to the National Revenue Administration (KAS), court bailiffs, and other state authorities;
to postal operators and courier companies.

Furthermore, personal data of contractors and clients may be disclosed to processors acting on behalf and on account of the controller, on the basis of a concluded data processing agreement, in order to provide services specified in the agreement, e.g.:

ICT services such as hosting, provision, or maintenance of IT systems;
accounting services;
traditional mail management, reception services;
legal and advisory services.

IV [Rights of data subjects]

Every data subject has the right to:
- access – obtaining confirmation from the controller as to whether or not their personal data are being processed. If data concerning a person are processed, they are entitled to access them and obtain the following information: the purposes of the processing, the categories of personal data concerned, information on the recipients or categories of recipients to whom the personal data have been or will be disclosed, the period for which the personal data will be stored or the criteria used to determine that period, the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning the data subject or to object to such processing (Article 15 GDPR);
- receive a copy of data – obtaining a copy of the personal data undergoing processing, whereby the first copy is free of charge, and for any further copies the controller may charge a reasonable fee based on administrative costs (Article 15(3) GDPR);
- rectification – requesting the rectification of inaccurate personal data concerning them or the completion of incomplete data (Article 16 GDPR);
- erasure – requesting the erasure of their personal data if the controller no longer has a legal basis for their processing or the data are no longer necessary in relation to the purposes for which they were processed (Article 17 GDPR);
- restriction of processing – requesting the restriction of processing of personal data (Article 18 GDPR) when:
  - i. the accuracy of the personal data is contested by the data subject, for a period enabling the controller to verify the accuracy of the personal data,
  - ii. the processing is unlawful and the data subject opposes the erasure of the personal data and requests the restriction of their use instead,
  - iii. the controller no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims,
  - iv. the data subject has objected to processing – pending the verification whether the legitimate grounds of the controller override those of the data subject;
- data portability – receiving the personal data concerning them, which they have provided to a controller, in a structured, commonly used and machine-readable format and requesting the transmission of those data to another controller, if the processing is based on the data subject's consent or on a contract and the processing is carried out by automated means (Article 20 GDPR);
- object – objecting, on grounds relating to their particular situation, at any time to processing of their personal data based on the legitimate interests of the controller, including profiling. The controller shall then no longer process the personal data unless the controller demonstrates compelling legitimate grounds for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims. If, according to the assessment, the interests of the data subject override the interests of the controller, the controller shall be obliged to cease processing the data for these purposes (Article 21 GDPR).
- lodge a complaint – the data subject has the right to lodge a complaint with a supervisory authority, which in Poland is the President of the Personal Data Protection Office with its registered office in Warsaw, ul. Stawki 2.
To exercise the aforementioned rights, the data subject should contact the controller using the provided contact details and inform them which right and to what extent they wish to exercise.

§ 3 Information on the processing of personal data for the purpose of sending the Newsletter

I [Data Controller]

The controller of personal data provided for the purpose of subscribing to the newsletter is Oliwia Chłopek, conducting business activity under the business name PICTOPLAN (full registration and contact details are specified in § 1 section I and § 2 section I of this Policy).

II [Purposes, legal bases, and period of data processing]

Personal data in the form of an e-mail address (and name, if collected in the form) will be processed by the controller for the following purposes:

Sending the newsletter – i.e., information about news, products, services, promotional campaigns, and the controller's brands. The legal basis for processing is the user's voluntary consent expressed by entering the e-mail address in the sign-up form and confirming the subscription (Article 6(1)(a) GDPR in conjunction with Article 398 of the Act of 12 July 2024 – Electronic Communications Law and Article 10 of the Act on Providing Services by Electronic Means). Data will be processed for this purpose until the consent is withdrawn (unsubscribing from the newsletter).
Pursuing claims or defending against claims – in order to pursue the legitimate interest of the controller consisting in the ability to demonstrate that the user consented to the mailing (Article 6(1)(f) GDPR). Data will be processed for this purpose for the period necessary for the limitation of potential claims in accordance with the Civil Code.

III [Recipients of data]

Subscribers' personal data may be disclosed to entities supporting the controller in conducting business activities, on the basis of concluded data processing agreements, in particular IT service providers, newsletter distribution platform providers (e.g. GMAIL, etc.), and hosting service providers.

IV [Rights of data subjects]

Every person who has signed up for the newsletter is entitled to the rights specified in detail in § 1 section V of this Policy (including the right to access data, rectify them, erase them, restrict processing, and lodge a complaint with the President of the Personal Data Protection Office). Furthermore, the user has the right to withdraw consent at any time without giving any reason. The withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal. Withdrawal of consent to the newsletter may take place by clicking on the unsubscribe link found in the footer of every e-mail message or by directly contacting the controller.

GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 4.5.2016, p. 1, as amended).

Last update: 06.07.2026

Cookie Policy

COOKIE POLICY

§ 1 Cookies

The website pictoplan.com.pl uses cookies. These are small text files sent by the web server and stored by the browser software of the computer. When the browser reconnects with the site, the website recognises the type of device from which the user is connecting. The parameters allow the information contained therein to be read only by the server that created them. Cookies therefore facilitate the use of previously visited sites. Cookies other than strictly necessary cookies (e.g. analytical or marketing cookies) are saved on the User's device solely on the basis of their voluntary consent, in accordance with Article 399 of the Act – Electronic Communications Law and Article 6(1)(a) GDPR.

The collected information relates to the IP address, type of browser used, language, type of operating system, internet service provider, time and date information, location, and information sent to the website via the contact form.

The collected data are used to monitor and check how users utilise our websites in order to improve the functioning of the service, ensuring more effective and seamless navigation. We monitor user information using the Google Analytics tool, which records user behaviour on the website.

Cookies identify the user, which allows the content of the website they use to be tailored to their needs. By remembering their preferences, it enables targeted advertising to be appropriately adjusted. We use cookies to guarantee the highest standard of convenience for our service, and the collected data are used solely within PICTOPLAN for the purpose of optimising operations.

We use the following cookies on our website:

"strictly necessary" cookies, enabling the use of services available within the website, e.g. authentication cookies used for services requiring authentication within the website;
cookies used to ensure security, e.g. used to detect fraud in the field of authentication within the website;
"performance" cookies, enabling the collection of information on how the website's pages are used;
"functional" cookies, enabling the "remembering" of settings selected by the user and personalisation of the user interface, e.g. in terms of the selected language or region from which the user comes, font size, website appearance, etc.;
"advertising" cookies, enabling the delivery of advertising content more tailored to users' interests.

The user has the option to disable or restore the cookie collection option at any time by changing the settings in their web browser. They therefore have the right to withdraw consent at any time. Instructions for managing cookies are available at http://www.allaboutcookies.org/manage-cookies

Data collected in cookies are not used to directly identify the User's identity (such as first name and surname), and their processing serves the statistical, functional, and marketing purposes described above.

Last update: 06.07.2026