• Similar to other companies, TAGO uses so-called cookies on its website, which are small text files stored on the user's computer, phone, tablet or other device. They can be read by our system and by systems of other entities whose services we use (e.g. Facebook, Google).
• Cookies perform many functions on the website, usually useful functionalities, which we attempted to describe below (if the information is insufficient, please contact us):
• providing security - cookies are used to authenticate users and prevent unauthorised use of the customer panel. Thus, they protect your personal data from unauthorised access;
• impact on the processes and the efficiency of website use - cookies are used to ensure that the website runs smoothly and that the available functions available can be used, which is possible i.e. thanks to remembering your settings between individual website visits. Thus, they enable smooth navigation of the website and its individual pages;
• session status - cookie files often store information about how visitors use the website, e.g. which pages they view most often. They also enable the identification of errors displayed on certain subpages. Cookies used to store the so-called “session status” therefore help us improve services and enhance the browsing experience;
• maintaining session status - if the customer logs in to their panel, cookies enable the session to be continued. This means that the user does not have to enter the login and the password again after visiting a different subpage. This enhances the comfort of using the website;
• statistics generation - cookies are used to analyse how users use the website (how many visit the website, how long they stay, which content is the most interesting, etc.). This allows the website to be continuously improved and adapted to user preferences. We use tools provided by Google, such as Google Analytics, to track the activity and generate statistics; in addition to statistic reporting for the use of the website, the pixel Google Analytics may also be used in combination with some of the cookie files described above to help displaying the user more accurate content in Google services (e.g. in the Google search engine) and throughout the network;
• use of social functionalities - we have a so-called Facebook pixel on the website, which allows the user to like our Facebook fanpage when using the website. We must use the cookies provided by Facebook to enable this, however.
• Your browser enables the use of cookies on your device by default; this is why we ask for the consent to use the cookies during the first website visit. However, if you do not wish to use cookies while browsing the website, you can change the settings of your browser - by completely blocking automatic handling of cookies or to request a notification each time cookies are saved on your devices. These settings can be changed at any time.
• We respect the autonomy of all visitors to the website, however, we feel obliged to forewarn that disabling or limiting the cookies may result in significant difficulties in using the website, e.g. in the need to log on every subpage, longer page loading times, limited functionalities, limitations in liking the page on Facebook, etc.

Right of consent withdrawal
If the processing of your personal data is based on your consent, you may withdraw this consent at any time.
If you would like to withdraw your consent to the processing of your personal data, please follow section 11, paragraph 5 to do so. If the processing of your personal data was carried out on the basis of your consent, the withdrawal of this consent does not render the processing of your personal data until that point unlawful. In other words, we have the right to process your personal data until the consent is withdrawn, and the withdrawal does not impact the legality of processing until this point.

Requirement to provide personal data
The provision of any personal data is voluntary and takes place at your discretion. However, in some cases, the provision of certain personal data is necessary in order to meet your expectations regarding the use of the services.
To make an order or enter a contract with TAGO, the provision of data indicated in point 3 A of this privacy policy is required.
To receive an invoice for services, you are required to provide all data required by the tax laws, without which we are unable to issue a correct invoice.
In order to be able to contact you by phone regarding the provision of services, we require you to provide your telephone number and e-mail address, without which we cannot contact you by phone or send a booking confirmation

Automated decision-making and profiling
We would like to advise that we do not carry out automated decision-making, including based on profiling.

Recipients of personal data
Like most businesses, we rely on the assistance of third parties in our operations, which sometimes involves the need to transfer personal data. We therefore transfer your personal data (where necessary) to our partner lawyers who provide the services, companies processing fast payments, an accounting company, a hosting company, a company responsible for sending text message notifications, and to an insurance company (if it is necessary to compensate for damages).
It may also be the case that we are obliged to provide your personal data to other entities and authorities, e.g. on the basis of the relevant legal regulation or a decision of a competent authority.
Transfer of personal data to third countries
Like most businesses, we use a variety of popular services and technologies, offered by companies such as Facebook, Microsoft, Google and Zendesk. These companies are based outside the European Union and are therefore treated as third countries under the provisions of the GDPR.
The GDPR introduces certain restrictions on the transfer of personal data to third countries, since European regulations generally do not apply there, and the protection of personal data of EU citizens may unfortunately be insufficient. Therefore, every personal data controller is required to establish the legal basis for such data transfers.
We ensure that while using such services and technology, we provide personal data only to companies from the United States, and only to companies which acceded to the Privacy Shield programme, according to the executive decision of the European Commission of 12 July 2016 - you can read more about it on the website of the European Commission available at https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/eu-us-privacy-shield_pl. Companies which acceded to the Privacy Shield programme represent that they observe high standards applicable to personal data protection effective in the European Union, thus the use of their services and offered technology used with personal data processing is legal.
We can provide you with further clarification on the transfer of personal data at any time, particularly if the issue concerns you.

Personal data processing period
In accordance with the applicable legislation, we do not process your personal data indefinitely, but for a period of time necessary to achieve the stated purpose. After this period, your personal data will be permanently deleted or destroyed.
Where we do not need to process your personal data other than storing it (e.g. when we store the contents of an order for the purpose of defence against claims), we additionally secure it by pseudonymisation - until it is permanently deleted or destroyed. Pseudonymisation involves the encryption of personal data, or a set of personal data, in such a way that it cannot be read without an additional key, and therefore such information becomes completely useless to an unauthorised person.
Regarding the specific periods of time for personal data processing, we would like to advise that we process the personal data for the following periods of time:

• contract duration - in the case of personal data processed for the purpose of contract conclusion and performance;
• 3 years or 10 years + 1 year - in the case of personal data processed for the purpose of establishing, asserting or defending claims (the period duration depends on whether both parties are businesses or not);
• 6 months - in the case of personal data collected during service valuation, when the contract was not concluded immediately;
• 5 years - in the case of personal data involving compliance with tax law obligations;
• until the consent is withdrawn or the purpose of the processing has been achieved, but no longer than 5 years - in the case of personal data processed on the basis of consent;
• until an effective objection is lodged or the purpose of the processing objective has been achieved, but no longer than 5 years - in the case of personal data processed on the basis of a legitimate interest of the Personal Data Controller or for marketing purposes;
• until the data becomes obsolete or no longer relevant, but no longer than 3 years - in the case of personal data processed primarily for analytical purposes, the use of cookies and website administration.
  We count the periods in years starting at the end of the year, during which we started the processing of personal data, to facilitate the process of destroying or deleting personal data. The separate counting of the deadline for each concluded contract would entail significant organisational and technical difficulties and significant expenses, thus setting a single date of deletion or destruction of personal data helps us facilitate the management of these processes. If you exercise your right to be forgotten, such situations are handled on a case-by-case basis, of course.
  The additional year related to the processing of personal data collected for the purpose of contract execution results from the fact that you can hypothetically raise a claim immediately before the expiry period ends, and the claim may be delivered with a significant delay or you may incorrectly set the expiry deadline for your claim.

  Rights of data subjects
  We kindly inform you that you have the right to:

• access your personal data;
• rectify personal data;
• delete personal data;
• restrict the processing of personal data;
• object to the processing of your personal data;
• the right to be forgotten if other legal provisions allow it;
• obtain a copy of the data;
• portability of personal data.
  We respect your rights under data protection legislation and strive to facilitate the exercise of these rights to the greatest extent possible.
  We would like to point out that the listed rights are not absolute and that we may therefore legitimately refuse the related requests in certain situations. However, if we refuse to grant a request, such a decision is made only after careful consideration and only if the refusal to grant the request is necessary.
  In regards to the right to object, we would like to explain that you can object to the processing of personal data on the basis of legally justified interest of the Personal Data Controller (which is listed in paragraph III) at any time, in relation to your special situation. You must remember, however, that we may refuse to acknowledge the objection legally, if we can prove that:
• there are legitimate grounds for the processing which override your interests, rights and freedoms, or
• there are grounds for the establishment, investigation or defence of and against claims.
  Furthermore, you may object to the processing of your personal data for marketing purposes at any time. In this situation, we shall cease the processing for this purpose upon the receipt of an objection.
  You can exercise your rights as follows:
  • by sending an e-mail to the Data Protection Officer at iod@golebiewski.pl.
  or by sending such a request to the Data Protection Officer at ul. Wołomińska 125 Ciemne 05-250 Radzymin.
  • Right to lodge a complaint
  If you believe that your personal data is being processed contrary to the applicable law, you may lodge a complaint with the President of the Data Protection Authority.

  Final provisions
  The data protection regulations shall apply to any matters not covered by this Privacy Policy.
  TAGO reserves the right to amend this Privacy Policy with the proviso that the version in force at the time of service booking shall apply to services provided prior to the amendment of the Privacy Policy.
  Changes to the Privacy Policy may not affect any acquired rights.
  Information about changes to the Privacy Policy will be published on TAGO's website: www.tago.com.pl 14 calendar days before the changes take effect.
  This Privacy Policy is effective as of 25 May 2018.