Privacy and Cookie Policy of AGAP

1. Scope of the policy

This policy provides information on the processing of personal data by AGAP in connection with the use of our websites and contact with us. The policy applies to persons who use the Website, contact AGAP, and to current and prospective customers, to the extent described in this document. These persons are referred to below as “Users”.

By “Website” is meant the website operated by AGAP at www.agap.pl together with its subpages. Data is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) and the Act of 12 July 2024 – Electronic Communications Law, in particular Article 399 thereof concerning the storage of information on terminal equipment and access to such information.

2. Controller and contact details

For the purposes of this Policy, “AGAP” means “AGAP” spółka z ograniczoną odpowiedzialnością (a limited liability company) with its registered office in Warsaw, at ul. Jagiellońska 78, 03-301 Warsaw, entered in the register of entrepreneurs of the National Court Register under number KRS 0000025138, holding NIP 5272329716 and REGON 017207713, with share capital of PLN 120,000.00.

AGAP is the controller of personal data processed in connection with the use of the Website, contact with AGAP, and the servicing of current and prospective customers, to the extent described in this Policy.

AGAP can be contacted:

• by post – at: ul. Jagiellońska 78, 03-301 Warsaw
• by telephone – on: +48 22 334 64 64
• by email – at: agap@agap.pl

In all matters relating to personal data protection, including the exercise of rights, you may contact AGAP at iod@agap.pl or by post at the address given above.

3. Sources and scope of data

We obtain data directly from the User, in particular during telephone contact, email correspondence, use of forms, and the submission of orders, service requests and complaints. Technical data is collected when the Website is used, in server logs, and by means of cookies and the technologies described below, taking into account the choices made in the consent panel.

Personal data may include identification data, e.g. first and last name, contact details, e.g. telephone number and email address, and data relating to orders, service requests and complaints. In each case we process only the scope necessary to achieve the given purpose.

Technical data includes online identifiers, IP address, information about the device and browser, traffic source, subpages visited and activity on the Website. An IP address and online identifiers may constitute personal data. We do not treat data from cookies and server logs as anonymous by default.

Providing data in connection with optional cookies is voluntary. Refusing consent to statistics or marketing does not restrict use of the Website. Providing data when contacting us is voluntary, but data necessary to respond to or handle a particular matter is needed in order to deal with it. Data required to conclude and perform a contract is necessary for its performance.

4. Purposes and legal bases of processing

We process personal data for the following purposes. The legal basis for processing personal data and the requirement of consent to store or read optional cookies are separate matters.

The User gives consent to statistical and marketing cookies in the consent panel. Without this consent we do not store such files on the User’s device or access them (Art. 399 of the Electronic Communications Law). Consent may be withdrawn at any time.

5. Recipients of data

We share data to the extent necessary for the given purpose and on an appropriate legal basis. Providers acting on behalf of AGAP process data under data processing agreements; other recipients may act as separate controllers, depending on their role and applicable law. Data may be transferred to:

1. Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland – provider of Google Analytics 4, Google Ads and Google Tag Manager – the provider of Google Analytics, acting as a processor, which, as regards conversion measurement and audiences in Google Ads, may act as a separate controller (Google Ads Controller-Controller Data Protection Terms).
2. Usercentrics A/S, Havnegade 39, 1058 Copenhagen, Denmark – provider of the Cookiebot consent management tool. On behalf of AGAP it processes the consent ID, date and time, banner version and the choice made, relating to the giving, change and withdrawal of consent. It acts as a processor under a data processing agreement. This data is also processed where the User rejects optional cookies.

6. Transfers of data outside the EEA

Google Ireland Limited may transfer data to Google LLC in the United States, outside the European Economic Area. The transfer takes place on the basis of a European Commission decision finding an adequate level of data protection (EU-US Data Privacy Framework), where Google LLC participates in that framework, and otherwise on the basis of standard contractual clauses. A copy of the safeguards can be obtained by contacting AGAP at iod@agap.pl.

7. Data retention periods and cookies

Data retention periods depend on the purpose and legal basis of processing. We distinguish between how long cookies remain on the device and the period for which data is retained by AGAP and service providers. We retain correspondence data for as long as necessary to handle the enquiry or matter. Further retention requires a separate purpose and legal basis.

Withdrawal of consent ends processing based on it. Data may continue to be retained only to the extent that a separate legal basis exists, e.g. the obligation to demonstrate consent previously given.

Cookies may be either: session – stored until the end of the browser session, or persistent – remaining on the User’s device for a specified period or until deleted earlier. The period for which individual cookies remain active depends on their type, purpose, and the configuration of the Website and of third-party providers’ services.

8. User rights and profiling

Under the GDPR, the User has the right of access to data, rectification, erasure, restriction of processing and data portability, and the right to withdraw consent at any time. Where we process data on the basis of a legitimate interest, the User may object to such processing. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

The User has the right to lodge a complaint with the President of the Personal Data Protection Office (ul. Stanisława Moniuszki 1A, 00-014 Warsaw). Contact on personal data matters: iod@agap.pl. Providing data in connection with optional cookies is voluntary.

Where processing is based on a legitimate interest, the User may object on grounds relating to his or her particular situation. AGAP will cease processing unless it demonstrates compelling legitimate grounds that override the interests, rights and freedoms of the User, or grounds for the establishment, exercise or defence of legal claims. Where data is processed for direct marketing purposes, an objection results in the cessation of processing for those purposes, including profiling related to such marketing.

We respond to a request to exercise rights without undue delay and in any event within one month of receiving it. Where necessary, this period may be extended by a further two months, taking into account the complexity or number of requests. We inform the User of any extension and the reasons for it within one month of receiving the request. If we do not take action, we inform the User within the same period of the reasons and of the possibility of lodging a complaint and seeking a judicial remedy.

Remarketing and building audiences constitute profiling. It does not lead to decisions being made about the User solely by automated means that produce legal effects or similarly significantly affect the User.

9. Cookies and similar technologies

9.1 Nature of the technologies

The Website uses cookies to store information on the User’s terminal equipment and to access information already stored there. The scope of use of other similar technologies requires confirmation, as marked below. Cookies are small text files saved on the User’s device when using the Website. They make it possible, in particular, to ensure the Website functions correctly, remember the User’s selected settings, analyse how the Website is used, measure the effectiveness of marketing activities and – with appropriate consent – tailor advertising.

On the Website we use first-party cookies, stored in the agap.pl domain, including _ga and _ga_<ID>, whose data is processed by Google, and third-party cookies, e.g. IDE and test_cookie in the Google/DoubleClick domains.

9.2 Categories of cookies

We use the following categories of cookies on the Website:

1. Necessary cookies
   They are required for the correct and secure functioning of the Website and use of its basic functionalities. They may serve, among other things, to ensure security, correct display of the page, session handling, or remembering the User’s privacy and consent choices. The use of necessary cookies does not require the User’s consent where their use is necessary to provide a service requested by the User.
2. Statistical (analytical) cookies
   They allow AGAP to obtain information on how the Website is used, in particular the number and sources of visits, subpages viewed, time spent on the Website, device type and how Users navigate the Website. This information is used to compile statistics, analyse how the Website functions and improve it.
3. Marketing and advertising cookies
   They are used to measure the effectiveness of advertising campaigns and conversions, to determine whether the User performed a particular action after an advertisement was displayed or clicked, for remarketing, and to build audiences based on activity on the Website, including using data from Google Analytics 4, within the scope of the marketing consent given.

9.3 Google Analytics 4

After the User consents to statistical cookies, the Website uses Google Analytics 4 – an analytics tool provided by Google. Google Analytics enables AGAP to analyse how the Website is used, including determining the number of users and sessions, traffic sources, the popularity of individual subpages, basic parameters of the devices used to access the Website, and Users’ interactions with the Website. Information obtained through Google Analytics is used primarily for the purposes of:

• keeping statistics on use of the Website
• analysing traffic sources
• assessing the functioning and usability of the Website
• optimising the content and functionality of the Website
• assessing the effectiveness of marketing activities

Google Analytics 4 uses cookies named _ga and _ga_<ID>. These are first-party cookies. Google Analytics is activated only after the User has consented to the use of analytical cookies.

9.4 Google Ads

Where the User has given consent to marketing cookies, AGAP uses Google Ads services. Within Google Ads we use technologies that allow us, in particular, to:

• measure the effectiveness of advertising campaigns
• determine whether a visit to the page or a particular action took place in connection with the display or click of an advertisement, including submission of a contact form or a click on a telephone number or email address
• measure conversions
• optimise advertising campaigns
• build audiences based on activity on the Website, including using data from Google Analytics 4
• carry out remarketing activities
• tailor advertisements to Users – where the User has given consent permitting such use of data

Depending on the configuration of Google services and the choices made by the User, information about activity on the Website may be combined by Google with other information held by Google, in particular where the User uses a Google account and has allowed Google to carry out such processing. Without consent for marketing purposes, Google Ads tags are not triggered.

9.5 Google Tag Manager

The Website uses Google Tag Manager – a system for managing the tags and scripts used on the Website. Google Tag Manager is used for the technical deployment and management of Google Analytics 4 and Google Ads. Its configuration takes into account the User’s cookie choices. Through it, Google Analytics 4 and Google Ads tags are not triggered before consent for the relevant purpose has been obtained.

9.6 Consent and Google Consent Mode v2

On the first visit to the Website, the User is shown the Cookiebot consent panel, which allows the User to make choices regarding the use of cookies and similar technologies. In particular, the User may: accept all optional cookies, reject optional cookies, or make an individual choice of categories: statistical and marketing. Consent is voluntary and may be withdrawn at any time. Withdrawal of consent does not affect the lawfulness of actions taken before its withdrawal.

Consent expires after 12 months, after which the panel appears again. To change or withdraw consent, select “Cookie settings” in the page footer, change your choice and save the settings.

9.7 Browser settings and Google tools

Regardless of the settings available on the Website, the User may also manage cookies using the settings of their web browser. In particular, it is possible to delete stored cookies, block them from being stored, or configure the browser to notify of attempts to store cookies. However, blocking cookies completely in the browser may affect the correct functioning of some features of the Website.

10. Principles of processing and security

We collect personal data only to the minimum extent necessary to achieve the purposes for which it is collected. The purposes are clearly defined and have a basis in law. We take care to keep data up to date and accurate and respond to requests for its rectification or updating.

AGAP takes appropriate technical and organisational measures to protect data against unlawful or unauthorised access and use, and against accidental destruction, loss or compromise of integrity. Entities processing data on behalf of AGAP are required to ensure appropriate security measures and to maintain confidentiality.

Every AGAP employee with access to personal data holds appropriate authorisation and is bound to confidentiality.

11. Updates to the policy

AGAP updates this Policy in connection with changes in law, in the way data is processed, in its offer, and in the tools used on the Website. We announce changes by a notice on the Website. The current version of the document states the version number and the date of the update.