Gridaly Privacy Policy

1. Important information and who we are

Purpose of this privacy policy

This Privacy Policy contains information about how GRIDALY collects and processes personal data when you use the GRIDALY services, including any data you may provide through the GRIDALY services (applications, web platforms, registration gateways and other services) and on our websites. It also contains information about your rights, including your right to object to certain types of processing that we carry out.

The privacy policy also governs the processing of personal data on www.gridaly.com.

This privacy policy applies to all users of our applications, websites or other services (‘GRIDALY Services’) unless they are covered by a separate privacy policy.

Administrator/Processor
‍
Data protection law in some jurisdictions distinguishes between a ‘controller’ and a ‘processor’ of personal data.  ‘Data controller’ and “Data processor” are important concepts for understanding the responsibilities of different companies under the RODO. Depending on the situation, Gridaly may be a data controller, a data processor, or there may be a situation where Gridaly exchanges data with other companies and they act as independent controllers.

By Gridaly in this Policy is meant Gridaly sp. z o.o. with registered office in Warsaw, (02-014), 64/43 Nowogrodzka Street, KRS 0000893606, NIP 7011027905, REGON 38864004900000 District Court for the Capital City of Warsaw in Warsaw, XII Economic Division of the National Court Register, share capital: PLN 54,550.00, paid in full.Gridaly provides most of its services as a data controller. The following are examples of situations in which Gridaly acts as a data controller:
- the performance of contracts between Gridaly and its contractors,
- the processing of cookies,
- provision of the Gridaly platform access service, including account and event management services,
- the provision of newsletters,
- handling requests from contact forms on our website,
- fulfilling contracts between us and you - where you represent our contractors or act on their behalf,
- handling website visits.

The following are examples of situations where data is transferred between Gridaly and another third-party administrator:
- the organisation of events. With respect to the use of the GRIDALY platform, GRIDALY and our clients (e.g., Event Organisers), are independent controllers of certain types of personal data, such as certain information you provide when creating an account (e.g., your name and email address) and information about the Event in which you participate (e.g., the name of the Event and the date and time of the Event, your activity at the Event and the content generated by the Event).
- Third party advertising materials broadcast on Gridaly's websites and services.

Here are examples of situations in which Gridaly acts as a data processor:
- Event Organiser materials. The Event Organiser is the controller and GRIDALY is the processor in relation to materials submitted by the Event Organiser in the course of creating or during the Event, if they contain any personal data in such materials.
- Event participant data. The Event Organiser is the controller and GRIDALY is the processor vis-à-vis participant data if such data has been submitted to Gridaly and the participants have not become users of the Gridaly Platform (have not registered). Another possibility is if the data is collected by Gridaly additionally, only for the needs of the Event Organiser.

Changes to our privacy policy and obligation to inform us of changes to personal data
‍
We regularly review our privacy policy and it may be updated from time to time. Laws, regulations and industry standards evolve, which may necessitate these changes or we may make changes to our services. We will notify you by posting an updated, dated version of this privacy policy on our website. If we make changes that materially alter the privacy policy, we will notify users in accordance with applicable law. Notification may consist of posting a notice on our website, sending information to the email address that users have provided, or otherwise in accordance with applicable law. Accordingly, we ask users to keep their account information, including their email address, up to date.
Where other language versions of this GRIDALY Privacy Policy exist, the Polish version will prevail in the event of any conflict and/or confusion between the documents.

Access to and use of online resources or third-party services available through GRIDALY services
‍
The GRIDALY Services may contain links or references to third-party websites and applications, as well as links related to the Event, e.g. to Event organisers, their business partners or service providers.

Third party websites, applications and services
‍
Clicking on links to third party websites, content, applications, weob platforms or services may enable these third parties to collect or share your data. We do not look after these third-party websites or content made available to users and are not responsible for their privacy policies, nor do we oversee how they collect or use data.
When users access or use third-party services provided by an Event organiser, advertiser, sponsor or any other entity that participates in the Event, we encourage them to ask for details and read that entity's privacy policy. We do not look after these sites or the content provided to you by third parties and are not responsible for their privacy policies or oversee how they collect or use data.

2. Data we collect

We may collect, use, store and transfer different types of your personal data, which we have grouped as follows:

• Identity data. This is data that includes your image or avatar and your first name, last name, username, job title, date of birth and gender. If required by applicable legislation, we may ask you in certain situations to show proof of identity in order to verify your identity. This data also includes the audiovisual content in which users appear when they participate in the Event.

• Contact data. This is data that includes the address, email address and telephone number(s) and other addresses provided by the user for specific purposes.

• Transaction Data. This is data that includes details of payments made and other details of products and services accessed or used by users through the GRIDALY services. We do not store card details on our server. Credit and debit card payments are processed by online payment platform providers on their secure payment server and all card details are fully encrypted and stored by them.

• Technical data. This is data that includes the Internet Protocol (IP) address, login data, browser type and version, hardware information, time zone settings and location, browser plug-in types and versions, operating system and website, and other technological data about the devices users use to access GRIDALY services.

• Profile data. This is data that includes username and password, avatar, purchase or order history, interests, history of actions performed during Events, preferences, feedback and survey responses.

• Usage data. This is data that includes information about how users use our services, as well as third party platforms that users have linked to their use of our services. Usage data includes metadata that provides additional context about how you use our services, such as length of visit, page views, navigation paths and site interaction information (such as scroll, clicks, mouseover and mouse tracking), as well as time, frequency and usage information.

• Marketing and communication data. This is data that includes your preferences about receiving marketing materials from us and our third party partners and your communication preferences.

• User-generated content. This is user-generated data, which includes data uploaded as part of an Event or as a result of interaction with GRIDALY services, such as Event materials, videos, chats, queries, messages, avatars.

• Additional data collected by Event Organisers. In some Events, the Organisers may collect additional data for their own purposes.

We may transfer certain categories of data to Event Organisers or potential Event Organisers, e.g. User Generated Content, Profile Data, Contact Data or certain Identity Data. Where this is not obvious, you will be informed of such transfer.

Consequences of not providing the required personal data 

‍The provision of certain information is a contractual requirement in order to use our services. These are appropriately marked during their collection as required information, in particular with an asterisk. For example, to access the GRIDALY platform, users must provide their name and email address. If users do not provide the required information, they will not be able to access our services or we will not be able to perform the contract we have or will not be able to conclude the contract.

‍Children's personal data

‍We do not knowingly collect or process personal data about children and no part of our services is directed at them. A ‘child’ is a person:

• under the age of 13 (for non-EEA residents, except the Republic of Korea); 

• under the age of 16 or the age appropriate to consent to the processing of personal data in their country of residence (for EEA residents); or

• under the age of 14 (for residents of the Republic of Korea).

If a parent or guardian and becomes aware that their child has provided us with personal information, please contact us. If we become aware that we have collected personal information from a child without verifying parental consent, we will take steps to remove this information from our systems.

3. How is personal data collected?

We collect data in a variety of ways, including:

• direct interactions. Users can provide us with their identity, contact details, profile data, marketing and communication data and other information by filling in forms or corresponding with us by email or otherwise. This includes personal data that you provide when you:creates an account on the platform;subscribes to our services; interacts or communicates with other users and the organiser during the Event; signs up for a mailing of marketing materials; participates in a promotion or survey;gives us feedback or contacts us;

  • creates an account on the platform;

  • subscribes to our services;

  • interacts or communicates with other users and the organiser during the Event; 

  • signs up for a mailing of marketing materials;

  • participates in a promotion or survey;

  • gives us feedback or contacts us;

• automated technologies or interactions. When you interact with the GRIDALY Services, we will automatically collect and populate profile data, user-generated content, transaction data, technical data about your equipment, activities and uses of the Services. We also collect usage data through cookies, server logs and other similar technologies that monitor your interaction with the GRIDALY Services;

• third parties. Depending on how you use the GRIDALY Services, we may collect data from third-party service providers that you have linked to your use of our Services (including social media accounts and single sign-on services), from your employer, from the organiser of the Event you are registering for or participating in, from publicly available sources, from data enrichment providers, payment providers, advertising networks, analytics providers (such as Google Analytics) and our business partners. The information we receive from third parties depends on the policy that the third party has in place and the relationship it has with you and us.

4. How is personal data used

We have set out below, in table form, a description of how and for what purposes we use personal data, the categories of data used for each purpose, the legal basis for processing and the length of time we process data for a particular purpose. Where relevant, we have also set out what our legitimate interests are. In the table we refer to the General Data Protection Regulation (EU) 2016/679 of 27 April 2016. (‘RODO’).

Purpose/activity | Type of data | Legal basis for processing, including legitimate interest | Period of processing

Registration on the Gridaly platform | (a) Identity data (b) Contact data | a) Performance of the contract (Art. 6(1)(b) RODO)(b) Necessary for our legitimate interests of protecting claims and fulfilling statistical purposes (Art. 6(1)(f) RODO) | until the expiry of the Contract, except that sometimes, the data may also be processed after the expiry of that Contract for statistical, billing or claims purposes, in which case the data shall be processed for a maximum period of 6 years from the end of the calendar year in which the event giving rise to the claim occurred

_______

Accounting for participation in the Event (as a participant or organiser), including:
(a) Payment management
(b) Verification of identity and details of payment method or credit card account
(c) Communication, such as sending confirmation of participation in the Event
(d) Maintaining statistics  
|
(a) Identity data
(b) Contact data
(c) Profile data
(d) Marketing and communication data
|
(a) Performance of the contract (Article 6(1)(b) RODO)
(b) Necessary for our legitimate interests of protecting claims and keeping statistics (Art. 6(1)(f) RODO)
(c) Fulfilment of billing and tax obligations (Article 6(1)(c) RODO)
|
until the expiry of the Contract, with the proviso that sometimes, the data may also be processed after the expiry of this Contract for statistical, billing or claim purposes, in which case the data shall be processed for a maximum period of 6 years from the end of the calendar year in which the event giving rise to the claim occurred, 5 years from the end of the calendar year in which the event giving rise to the tax obligations occurred.

_______
‍
To provide the service of participating in an Event:
(a) To communicate with users, such as sending confirmation of participation in the Event
(b) To keep statistics
|
(a) Identity data
(b) Contact data
(c) Profile data
(d) Marketing and communication data
(e) User-generated content
|
(a) Performance of a contract (Article 6(1)(b) RODO)
(b) Necessary for our legitimate interests of protecting claims, fulfilling statistical purposes and building a user profile (Article 6(1)(f) RODO)
|
until the expiry of the Contract, except that sometimes, this data may also be processed after the expiry of this Contract for statistical purposes or for the purpose of asserting claims, in which case this data is processed for a maximum period of 6 years from the end of the calendar year in which the event giving rise to the claim occurred.

______
‍
Marketing purposes of Gridaly | address, profile, identity, contact, marketing and communication purposes | Necessary for the legitimate interests of third parties to carry out marketing activities such as sending gadgets, presenting offers (Art. 6(1)(f) RODO)
The legitimate interest is pursued in connection with your consent under other laws (e.g. to receive commercial information)| until successful objection

______
‍
Third-party marketing purposes (e.g. Event Organisers and Partners) | address, profile, identity, contact, marketing and communication purposes | Necessary for the legitimate interests of third parties to carry out marketing activities such as sending gadgets, presenting offers (Art. 6(1)(f) RODO). The legitimate interest is pursued in connection with your consent under other laws (e.g. to receive commercial information) | until successful objection

______
‍
User profiling (customising and presenting an offer of Events, services or content that may be of interest to the User tailored to the User's preferences)
|
(a) Identity data
(b) Contact data
(c) Profile data
(d) Marketing and communication data
(e) User generated content
(f) Technical Data
|
Necessary for the legitimate interests of third parties to carry out marketing activities such as sending gadgets, presenting offers (Art. 6(1)(f) RODO)
The legitimate interest is pursued in connection with your consent under other laws (e.g. to receive commercial information)
|
until successful objection

______
‍
To manage our relationship with you, which will include:
(a) Providing you with access to Platform services, Apps or other technologies
(b) Notifying you of changes to our terms and conditions or privacy policy
(c) Managing reviews
(d) Handling complaints
(e) Providing relevant training services related to the use of the Platform
|
(a) Identity data
(b) Contact data
(c) Technical data
(d) Marketing and communication data
|
(a) Necessary for our legitimate interests (for the operation of our business, administration of our CRM, provision of administrative and IT services, network security, to prevent fraud and in the context of business reorganisation or group restructuring) (Article 6(1)(f) RODO)
(b) Necessary to comply with a legal obligation (Article 6(1)(c) RODO)
|
until such time as an effective objection is lodged, 5 years from the end of the calendar year in which the event giving rise to the legal obligations occurred or until such obligations expire.

______
‍
To send the newsletter
|
(a) Identity data
(b) Contact data
(c) Profile data
(d) Usage data
(e) Marketing and communication data
|
With consent (Article 6(1)(a) RODO)
|
until consent is revoked

______

To enable users to enter a competition or complete a survey
|
(a) Identity data
(b) Contact data
(c) Profile data
(d) Usage data
(e) Marketing and communication data
|
Necessary for our legitimate interests (to study how users use the GRIDALY platform and to develop and expand our business) (Art. 6(1)(f) RODO)
|
until successful objection

______
‍
Issue advertisements and customised content and measure the effectiveness of the advertisements we show
|
(a) Identity data
(b) Contact data
(c) Profile data
(d) Usage data
(e) Marketing and communication data
(f) Technical data
|
Necessary for our legitimate interests (researching how users use the GRIDALY platform and developing our business and informing our marketing and development strategy), in relation to consent to the processing of cookies (Article 6(1)(f) RODO)
|
until successful objection is made and consent to cookies is revoked

______
‍
Compilation of business and web traffic statistics for the services provided
|
(a) Technical Data
(b) Usage data
|
Necessary for our legitimate interests (identifying the types of users of certain Platform services and keeping our services and website up to date and relevant, developing our business and informing our marketing strategy), in relation to consent to the processing of cookies (Article 6(1)(f) RODO)
|
until successful objection is made and consent to cookies is revoked

______
‍
To provide suggestions and recommendations regarding Events or other services available through the Platform, the App or other services that may be of interest to users
|
a) Identity Data
(b) Contact data
(c) Technical data
(d) Usage data
(e) Profile data
(f) Marketing and Communication Data
|
Necessary for our legitimate interests (developing the products and services available through the GRIDALY Platform) (Article 6(1)(f) RODO)
|
until successful objection

______
‍
To respond to a user's enquiry sent via a contact form
|
(a) Identity data
(b) Contact data
(c) Technical data
|
(a) Necessary for the fulfilment of the user's enquiry (Article 6(1)(b) RODO)
(b) Necessary for our legitimate interests of protecting claims and for statistical purposes (Article 6(1)(f) RODO)
|
until we have responded to the enquiry, with the proviso that sometimes the data may also be processed after the enquiry has been made - for statistical purposes or for the purpose of claiming, in which case the data are processed for a maximum period of 6 years from the end of the calendar year in which the event giving rise to the claim occurred.  

______
‍
To comply with the legal and regulatory obligations we have entered into. | In accordance with the scope set out in the applicable legislation | Necessary to comply with a legal obligation (Article 6(1)(c) of the RODO) | 5 years from the end of the calendar year in which the event giving rise to the legal obligation took place or until it expires.