Privacy Policy

Controller - Diamond Mateusz Orczykowski, Tax ID (NIP): 7262706070, REGON: 528970706.

User - any natural person whose personal data is processed by the Controller.

Personal data - any information relating to a natural person who is identified or identifiable by reference to one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity, as well as a device's IP address, location data, online identifiers and information collected through cookies and similar technologies.

GDPR - Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.

Website - the IT solution available at https://diamond-transfer.pl/, comprising, among other things, a range of services provided electronically to Users.

Processing of personal data - any operations performed on personal data, such as collection, recording, storage, organisation, alteration, disclosure and erasure, in particular operations carried out in IT systems.

Personal data breach - a breach of security leading to the accidental or unlawful destruction, loss, alteration, unauthorised disclosure of, or access to, personal data transmitted, stored or otherwise processed.

II. PROCESSING OF PERSONAL DATA AND INFORMATION ABOUT FORMS

1. The Controller may process Website Users' personal data in the following circumstances:
a) where the Website User gives consent through forms available on the Website, for the purpose of taking the actions to which those forms relate (Article 6(1)(a) GDPR);
b) where processing is necessary for the performance of a contract to which the Website User is a party (Article 6(1)(b) GDPR);
c) to handle complaints, on the legal basis that processing is necessary for the performance of a contract (Article 6(1)(b) GDPR);
d) to comply with a legal obligation to which the Controller is subject (Article 6(1)(c) GDPR);
e) to establish, exercise or defend legal claims, on the legal basis of the Controller's legitimate interest in protecting its rights (Article 6(1)(f) GDPR);
f) for the Controller's marketing purposes, namely to inform the User about current offers and new Website features, on the legal basis of consent (Article 6(1)(a) GDPR).

2. The Controller processes Website Users' personal data to the extent necessary for the purposes set out in point 1 above and for as long as necessary to fulfil those purposes, or until the Website User withdraws consent. In some cases, failure to provide data may make it impossible to fulfil the purposes for which that data is required.
3. The Controller may send commercial emails if the Website User has consented to receiving them.
4. The Controller uses technical and organisational measures to protect the personal data it processes.
5. The following personal data may be collected through forms on the Website or for the performance of contracts that may be concluded through the Website: first name, surname, email address and telephone number.
6. Data submitted by a Website User through forms may be shared by the Controller with third parties cooperating with the Controller in fulfilling the purposes set out in point 1.
7. A third party with access to personal data processes it solely under a data processing agreement and solely on the Controller's instructions.
8. Data provided through forms on the Website is processed for the purposes associated with each form. The Controller may also use it for archiving and statistical purposes. The data subject indicates consent using the relevant checkbox in the form.
9. Where this option is available on the Website, the User may refuse or give consent to receive commercial information by electronic means by selecting the relevant checkbox in the registration form, in accordance with the Polish Act of 18 July 2002 on the Provision of Services by Electronic Means (Journal of Laws of 2002, No. 144, item 1024, as amended). A Website User who has consented to receiving commercial information by electronic means may withdraw that consent at any time. Consent may be withdrawn by emailing a request to the Controller, in particular by clicking the unsubscribe link included in each email sent to the User as part of this service.
10. The Controller processes the personal data of Users who visit its social media profiles (Facebook, Instagram and LinkedIn). This data is processed to inform Users about the Controller's activities, offer services and communicate with Users through tools available on social media. The legal basis for this processing is the Controller's legitimate interest (Article 6(1)(f) GDPR) in promoting its brand and services and in building and maintaining a community around the brand.
11. The Controller may automatically tailor certain Website content to a User's needs, i.e. carry out profiling, using personal data provided by the User. This profiling primarily involves automatically assessing which products may interest the User based on their previous online activities, including activity on the Controller's websites, and displaying product advertisements tailored accordingly. Profiling carried out by the Controller does not result in decisions that produce legal effects concerning the User or similarly significantly affect them.

III. USERS' RIGHTS

1. Under Articles 15-22 GDPR, any person whose data is processed has the following rights:
a) the right to information about the processing of personal data: upon request, the Controller provides information about the processing, its purposes and legal bases, the scope of the data held, the entities to which personal data is disclosed and the planned date of its erasure;
b) the right to obtain a copy of the data: the Controller provides a copy of the personal data being processed that relates to the person making the request, where possible and without infringing the rights of third parties;
c) the right to rectification: the User may request the correction of inaccuracies or errors in the personal data being processed and its completion or updating if it is incomplete or has changed;
d) the right to erasure: the User may request the deletion of data that is no longer necessary for any of the purposes for which it was collected;
e) the right to restriction of processing: on this basis, the Controller may cease operations on personal data, except for operations to which the data subject has consented and storage in accordance with the applicable retention rules, or until the reasons for restricting processing no longer apply (for example, when the supervisory authority issues a decision permitting further processing);
f) the right to data portability: on this basis, to the extent that data is processed in connection with a contract or consent, the Controller may provide the data supplied by the data subject;
g) the right to object to processing for marketing purposes: the data subject may object to the processing of personal data for marketing purposes at any time, without having to give reasons;
h) the right to object to processing for other purposes: the data subject may object to the processing of personal data at any time. Such an objection should include reasons and is subject to assessment by the Controller;
i) the right to withdraw consent: where data is processed on the basis of consent, the data subject may withdraw that consent at any time. This does not affect the lawfulness of processing carried out before consent was withdrawn;
j) the right to lodge a complaint: if the data subject considers that the processing of personal data infringes the GDPR or other data protection provisions, they may lodge a complaint with the supervisory authority, the President of the Polish Personal Data Protection Office (https://uodo.gov.pl/pl/p/kontakt).

2. Requests to exercise data subject rights may be submitted by email to: kontakt@diamond-transfer.pl
3. A response will be provided within one month of receipt of the request. If this period needs to be extended, the Controller will inform the applicant of the reasons for the extension.
4. The response will be sent to the email address from which the request was submitted. For requests submitted by post, the response will be sent by registered post to the address provided by the applicant, unless the letter indicates a preference to receive a response by email, in which case an email address must be provided.

IV. COOKIES AND SIMILAR TECHNOLOGIES

1. The Website uses cookies.
2. Cookies are IT data, in particular text files, stored on the Website User's device and intended for use when visiting the Website. Cookies usually contain the name of the website from which they originate, their storage period on the device and a unique number.
3. Cookies are used, among other things, for:
a) compiling statistics that help us understand how Website Users use its pages;
b) maintaining the Website User's session so that the User does not have to re-enter their login and password on every page;
c) determining a User profile to display tailored content through advertising networks, in particular Google's network.
4. The Website uses two main types of cookies: session cookies and persistent cookies. Session cookies are temporary files stored on the User's device until the User logs out, leaves the website or closes the software (web browser). Persistent cookies are stored on the User's device for the period specified in the cookie settings or until the User deletes them.
5. Web browsing software (a web browser) usually allows cookies to be stored on the User's device by default. Website Users can change these settings. Web browsers allow cookies to be deleted and can also block them automatically. Detailed information is available in the browser's help section or documentation.
6. The Controller uses third-party services, the list of which changes over time. These providers may use cookies for purposes including:
- monitoring traffic on the Controller's websites;
- collecting anonymous, aggregated statistics to help understand how Users use the Controller's website;
- controlling how often selected content is shown to Users;
- monitoring how often Users select a particular service;
- analysing newsletter subscriptions;
- providing communication tools;
- integration with social media;
- online payments.
7. Users may manage cookies used by the Controller or any other external providers by changing their web browser settings.

V. SERVER LOGS

1. Using the Website involves sending requests to the server on which it is hosted. Each request sent to the server is recorded in server logs.
2. Logs include, among other things, the User's IP address, the server date and time, and information about the User's web browser and operating system. Logs are recorded and stored on the server.
3. Data recorded in server logs is not associated with specific individuals using the Website and is not used by the Controller to identify Users.
4. Server logs are used solely as supporting material for administering the Website. Their contents are disclosed only to persons authorised to administer the server.

VI. FINAL PROVISIONS

1. This Privacy Policy is reviewed regularly and updated as necessary.
2. This Privacy Policy is effective from 1 January 2026.