§1. General provisions

1. The personal data controller is GenSearch Tomasz M. Jankowski, with registered office at ul. Damrota 39/12, 50-306 Wrocław, Poland, listed in the National Official Registry of National Economy Entities under the number 022390426, hereinafter “Contractor”.

2. The controller is the owner of the website indexingroots.com (IndexingRoots), hereinafter “Website”.

3. Personal data collected by the Contractor is processed in accordance with the Regulation of the European Parliament and of the Council (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, hereinafter “GDPR”.

4. Hereinafter, the term “User” has been replaced by “you”, “yours” and “your”.

5. The Contractor respects the privacy rights and takes responsibility for the data security. For this purpose, the Contractor uses inter alia the Secure Sockets Layer (SSL) encryption.

6. Personal data, including email addresses provided while registering, is treated by the Contractor as confidential and it is not visible to unauthorised persons.

§2. The grounds, purpose and scope of data processing

1. Personal data protection is carried out in accordance with the requirements of GDPR and the implemented Privacy Policy.Each time the purpose, legal grounds, period, extent and recipients of personal data depends on actions that you overtake on the Website.

2. The Contractor has right to process personal data in following purposes, legal grounds and extent.
     a) Purpose: to the extent and purpose necessary to establish and shape the content of the contract, amend or terminate it, and properly prepare and provide electronically supplied services. Provision of your personal data to that extent and for that purpose is voluntary but necessary. Provision of your personal data to that extent and for that purpose is voluntary but necessary.
         Legal grounds: Article 6(1), point (b) of GDPR.
         Period: for the period required to perform or terminate the contract.
         Extent: given name, last name, email address, phone number, street name, house number, apartment number, ZIP code, place of living (firm registration), state; for firms: tax number and firm name.
     b) Purpose: direct marketing.
         Legal grounds: Article 6(1), point (f) of GDPR.
         Period: for the period of legitimate interests of the Contractor, not longer than the time corresponding to the limitation period of claims, which the Contractor may raise and which may be raised against the Contractor (three years, unless the law states otherwise). The Contractor cannot process your personal data in purpose of direct marketing if you have objected its use in this purpose.
         Extent: e-mail address, first name, last name.
     c) Purpose: marketing.
         Legal grounds: Article 6(1), point (a) of GDPR.
         Period: Until withdrawal of your consent.
         Extent: e-mail address, first name, last name.
     d) Purpose: bookkeeping.
         Legal grounds: Article 6(1), point (c) of GDPR in accordance with Article 86(1) of the tax law of the Republic of Poland from 17 January 2017 (Dz.U. z 2017 r. poz. 201) and Article 74, point 2 of the bookkeeping law of the Republic of Poland from 30 January 2018 (Dz.U. z 2018 r. poz. 395).
         Period: for the period required by the law of the Republic of Poland to keep the tax (until limitation of tax liability, unless tax law states otherwise) and accounting books (5 years counting from the end of the beginning of the year following the fiscal year when a record was registered) records.
         Extent: given name, last name, address of living (firm), name of firm, tax number.
     e) Purpose: bringing, defining and defending claims, which the Contractor may raise and which may be raised against the Contractor.
         Legal grounds: Article 6(1), point (f) of GDPR.
         Period: for the period of legitimate interest of the Contractor, not longer than the period of limitation of the claims for the person whom personal data regards (three years unless the law states otherwise).
         Extent: given name, last name, email address, phone number, street name, house number, apartment number, ZIP code, place of living (firm registration), state; for firms: tax number and firm name, ethnicity (if consent provided).
     f) Purpose: to the extent and purpose necessary to establish and shape the content of the contract, amend or terminate it, and properly prepare and provide electronically supplied service of research on your personal family. Provision of your personal data to that extent and for that purpose is voluntary but necessary. Provision of your personal data to that extent and for that purpose is voluntary but necessary.
         Legal grounds: Article 6(1), point (a) and Article 7(4) of GDPR (voluntary, but necessary consent).
         Period: for the period required to perform or terminate the contract.
         Extent: your ethnicity.

§3. Your rights

1. You have the right to object, on grounds relating to your particular situation, at any time to processing of personal data concerning you which is based on a legitimate interest (point (e) or (f) of Article 6(1) of GDPR), including profiling based on those provisions. The Contractor shall no longer process the personal data unless the Contractor demonstrates compelling legitimate interests for the processing which override the interests, rights and freedoms of the data subject or for the establishment, exercise or defence of legal claims.

2. Where personal data are processed for direct marketing purposes, you shall have the right to object at any time to processing of personal data concerning him or her for such marketing, which includes profiling to the extent that it is related to such direct marketing.

3. You shall have the right to obtain from the Contractor restriction of processing where one of the following applies:
     a) the accuracy of the personal data is contested by you, for a period enabling the controller to verify the accuracy of the personal data;
     b) the processing is unlawful and you oppose the erasure of the personal data and requests the restriction of their use instead;
     c) the Contractor no longer needs the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defence of legal claims;
     d) you have objected to processing pursuant to Article 21(1) of GDPR pending the verification whether the legitimate grounds of the Contractor override those of you.

4. You shall have the right to obtain from the Contractor without undue delay the rectification of inaccurate personal data concerning him or her. Taking into account the purposes of the processing, the you shall have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

5. You shall have the right to obtain from the controller the erasure of personal data concerning you without undue delay and the controller shall have the obligation to erase personal data without undue delay where one of the following grounds applies:
     a) the personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
     b) you withdraw consent on which the processing is based, and where there is no other legal ground for the processing;
     c) you object to the personal data processing for direct marketing purposes;
     d) the personal data have been unlawfully processed;
     e) the personal data have to be erased for compliance with a legal obligation in the European Union or Polish law to which the Contractor is subject;
     f) the personal data have been collected in relation to the offer of information society services.

6. You shall have the right to withdraw your consent at any time. The withdrawal of consent shall not affect the lawfulness of processing based on consent before its withdrawal. Withdrawal of your consent does not result in negative effects. If you withdraw consent to process special categories of your personal data, your account on the Website is blocked.

7. You shall have the right to obtain from the Contractor confirmation as to whether or not personal data concerning you are being processed, and, where that is the case, access to the personal data and the following information:
     a) the purposes of the processing;
     b) the categories of personal data concerned;
     c) the recipients or categories of recipient to whom the personal data have been or will be disclosed;
     d) the envisaged period for which the personal data will be stored, or, if not possible, the criteria used to determine that period;
     e) the existence of the right to request from the controller rectification or erasure of personal data or restriction of processing of personal data concerning you or to object to such processing;
     f) the right to lodge a complaint with a supervisory authority;
     g) where the personal data are not collected from the data subject, any available information as to their source;
     h) the existence of automated decision-making, including profiling.

8. You have the right to receive the personal data concerning you, which he or she has provided to a controller, in a structured, commonly used and machine-readable format and have the right to transmit those data to another controller without hindrance from the Contractor to which the personal data have been provided, where:
     a) the processing is based on consent pursuant to point (a) of Article 6(1) or point (a) of Article 9(2) of GDPR or on a contract pursuant to point (b) of Article 6(1) of GDPR; and
     b) the processing is carried out by automated means; and
     c) the right shall not adversely affect the rights and freedoms of others. 9. In exercising your right to data portability, the you shall have the right to have the personal data transmitted directly from the Contractor to another controller, where technically feasible.

§4. Recipients of your personal data

1. The Contractor transfers your personal data to the recipients and service providers with whom the cooperation is necessary to run the Website, including:
     a) processors who process your personal data to the extent and purpose determined solely by us, e.g. hosting, accounting, marketing and analytical companies, institutions providing electronic payment services;
     b) in case you have provided consent to use your personal data for marketing purposes: controllers who set their own objectives and methods of using your personal data but who do not act on our sole order, e.g. banks.

2. The Contractor is eligible to provide your personal data to authorised entities upon request based on applicable laws, to governmental authorities, in particular police, the president of the National Data Protection Authority, prosecutors.

3. The recipients of your personal data are registered in the European Economic Area.

§5. Cookies

1. The Website uses cookies. These are small text files sent by a web server and stored on the device you use to visit the Website, if your web browser allows it.

2. When your web browser connects again to the site, the Website recognises the type of your device. The parameters allow to read the information included in them only to the server that created them. Therefore, cookies facilitate using the previously visited Website pages.

3. The Website uses the following cookies:
     a) “session cookies”, necessary to use the services available within the part of the Website that requires authorisation and your identification;
     b) “persistent cookies”, used for functional purposes, allowing to remember both your settings and the interface personalization, e.g. selected language or your region, font size, website presentation, etc.
     c) “third-party cookies”, allowing to collect information about the way the website is used. For that purpose, the Contractor uses cookies created by Matomo (a product of InnoCraft based in New Zealand) which records the your behaviour on the website.

4. The Website uses cookies for the purpose of:
     a) your identification and authorisation on the Website, which allows to ensure continuity of the session and to avoid logging into each of the subpages, to remember the most recently saved phrases in the forms.
     b) collecting information about your IP address, type of your web browser, language, type of your operating system, Internet service provider, information about time and date, localization, and information sent to the Website via forms. The personal data collected is used to improve the Website and increase the quality of the Contractor's services, Website administration, identification of the server workload and the automatic software used to read the Website content; monitor and check the way users use our Website in order to improve its functioning.

5. You may at any time disable or restore the option of collecting cookies by changing the web browser settings. Instructions for managing cookies are available on http://www.allaboutcookies.org/manage-cookies/

§6. Final provisions

1. The Contractor does not apply profiling on the Website.

2. The Contractor does not take any responsibility for privacy policies of third-party websites which are linked on the Website.

3. The Privacy Policy may be changed and the Contractor shall notify you 7 days in advance.

4. Contact with a person supervising processing of the personal data of the Contractor is available by sending an email to: research[ at ]indexingroots.com