PRIVACY POLICY

of June 14, 2025

§ 1

Personal Data Controller

The controller of personal data collected on the Website is “Konrad Kwaśniewski StormMedia”, registered in Łosino 76-251, ul. Starowiejska 32, NIP: 8393205765, REGON: 380301690, hereinafter referred to as the “Controller.” For matters related to the Privacy Policy and personal data, contact can be made via e-mail at contact@stormmedia.gg, or by traditional mail sent to the Controller’s address indicated in this paragraph.

This Privacy Policy has been created based on the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter “GDPR.”

§ 2

Personal Data

The Controller may process the following personal data of Users of the Website:

identification data (e.g., first name, last name, or pseudonym, if voluntarily provided);
contact details (e.g., e-mail address, phone number – if provided, e.g., in a contact form or when subscribing to the newsletter);
technical data regarding the use of the Website (e.g., IP address, browser type, device type, operating system, approximate location, data collected via cookies and analytical tools);
data related to activity on the Website (clicks, visited subpages, time spent on the site, source of visits).

Personal data is collected:

directly from the User – when using the contact form or subscribing to the newsletter;
automatically – through cookies and tracking technologies (e.g., Google Analytics, Meta Pixel).

Providing personal data is voluntary, but in some cases it may be necessary to use certain Website functionalities (e.g., to respond to a submitted inquiry).

§ 3

Legal Basis

Users’ personal data may be processed by the Controller based on:

Art. 6(1)(a) GDPR – the consent of the data subject, e.g., when subscribing to the newsletter or agreeing to marketing activities;
Art. 6(1)(b) GDPR – the necessity of processing to take steps at the request of the data subject prior to entering into a contract (e.g., responding to an inquiry submitted via a contact form);
Art. 6(1)(c) GDPR – compliance with a legal obligation to which the Controller is subject, e.g., bookkeeping obligations;
Art. 6(1)(f) GDPR – legitimate interests pursued by the Controller, such as conducting statistical analyses, ensuring website security, and marketing its own services.

Where processing is based on consent, the User has the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

§ 4

User Rights

The User has the following rights regarding their personal data:

right of access to their personal data, including obtaining a copy (Art. 15 GDPR);
right to rectification of inaccurate or incomplete data (Art. 16 GDPR);
right to erasure of data in cases provided for by law (Art. 17 GDPR);
right to restriction of processing (Art. 18 GDPR);
right to data portability – to receive data in a structured, commonly used, machine-readable format and to transmit it to another controller (Art. 20 GDPR);
right to object to processing based on the Controller’s legitimate interests (Art. 21 GDPR);
right to withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal (Art. 7(3) GDPR);
right to lodge a complaint with a supervisory authority – the President of the Personal Data Protection Office (UODO) – if they consider that data processing infringes GDPR (Art. 77 GDPR).

To exercise these rights, the User may contact the Controller by e-mail at contact@stormmedia.gg or by post at the Controller’s registered address.

§ 5

Retention Period of Personal Data

The User’s personal data will be processed for as long as necessary to achieve the purposes for which it was collected, namely:

in the case of processing based on consent – until its withdrawal, restriction, or objection;
in the case of data processed for the performance of a contract or steps prior to its conclusion – for the time necessary to perform the contract and for the period required by tax and accounting obligations (typically 5 years);
in the case of processing based on the Controller’s legitimate interest – until a valid objection is lodged or the interest ceases (e.g., completion of statistical analyses or expiration of the need for legal defense).

After these periods, personal data will be deleted or anonymized, unless further storage is required by law.

§ 6

Security Measures

The Controller processes Users’ personal data in compliance with legal requirements, particularly GDPR, and applies appropriate technical and organizational measures to protect data against accidental or unlawful destruction, loss, alteration, disclosure, or unauthorized access.

Key measures include:

SSL/TLS encryption of the Website connection;
securing the server and database;
access control – access granted only to authorized persons;
regular updates of systems and software.

The Controller also takes steps to ensure business continuity and data protection in the event of security incidents.

§ 7

Cookies

The Website uses cookies – small text files stored on the User’s device – to ensure proper functioning of the site and for analytical and marketing purposes.

Cookies are used to:

ensure proper functioning and security of the Website;
tailor Website content to the User’s preferences;
conduct anonymous statistics and analyze usage of the Website (e.g., via Google Analytics);
carry out remarketing activities (e.g., via Meta Pixel, Google Ads).

On their first visit, Users are notified about the use of cookies and may:

consent to all cookies;
adjust cookie settings (e.g., select only necessary ones);
refuse optional cookies.

Users can also manage cookies via their browser settings, including deleting existing cookies or blocking them. Restricting cookies may affect some Website functionalities.

§ 8

Data Transfers Outside the EEA

In connection with the Controller’s use of certain third-party services (e.g., Google LLC, Meta Platforms Inc.), Users’ personal data may be transferred to countries outside the European Economic Area (in particular, the United States).

Such transfers are carried out only with appropriate safeguards in place, in compliance with GDPR, including:

European Commission adequacy decisions (where applicable);
standard contractual clauses adopted by the European Commission;
binding corporate rules or other mechanisms provided under Art. 46 GDPR.

The User has the right to obtain a copy of the safeguards used for such transfers by contacting the Controller.

§ 9

Changes to the Privacy Policy

The Controller reserves the right to amend this Privacy Policy, in particular in the event of:

changes in applicable law;
introduction of new functionalities on the Website;
changes in services or tools used for personal data processing.

Users will be informed of significant changes via a notice on the Website or by e-mail (for Users who have provided their e-mail address).

The current version of the Privacy Policy is always available on the Website in the “Privacy Policy” section, together with the date of its last update.