NOT LEGAL ADVICE. TwojStartUp's own template, filled in with your facts. The version they sent still contained another beneficiary's business ("Made in Block" / Barbara Naidzionau / Pinpinik Agency) — that has been replaced below with your details. Items I could not verify are marked [CONFIRM: ...].
The Controller of your personal data is Fundacja Rozwoju Przedsiębiorczości "Twój StartUp" with its registered office in Warsaw (registered office address: ul. Żurawia 6/12, lok. 766, 00-503 Warsaw).
This privacy policy applies to the Foundation's services provided by the organized part of the enterprise aiweblifting.com, contact details: phone +48 579 139 744, e-mail [CONFIRM contact email], carried out by Mohammad Parsa Rezaei (name and surname of the Beneficiary).
A. In connection with the services provided through aiweblifting.com, consisting of [CONFIRM — one-sentence description of your service, e.g. "AI-assisted website design, redesign and optimization"], i.e. for the purpose of concluding or performing a contract (Article 6(1)(b) GDPR). Your data will be stored until the contract is executed.
B. For marketing purposes and promotion of products offered by Fundacja Rozwoju Przedsiębiorczości "Twój StartUp," which is our legitimate interest (Article 6(1)(f) GDPR). Your data will be processed until you object. [CONFIRM — delete this point entirely if you do not send marketing/commercial content.]
C. Fulfilment of legal obligations related to our cooperation (Article 6(1)(c) GDPR), including the duty to keep certain documents for the time specified by law, e.g.:
D. For the possible establishment, exercise or defense of claims, which is our legitimate interest (Article 6(1)(f) GDPR). Data will be processed until claims are submitted.
E. Where you give consent, your data will be processed within the limits and for the purpose indicated in that consent (Article 6(1)(a) GDPR), until the consent is withdrawn.
To conclude the contract, we require the data on the contract/order form (without it, we cannot conclude the contract or complete the order). We may also ask for optional data that does not affect the contract's conclusion (e.g. a contact phone number).
During the contract term, while providing services, we may come into possession of other data as a consequence of the operation of the services you use.
A. Public authorities, to the extent required by law (e.g. anti-money-laundering proceedings).
B. Entities processing your data on the Foundation's behalf under a data-processing agreement (processors): Beneficiaries of the Foundation, IT specialists, archiving companies, hosting companies.
C. External data controllers (Parallel Controllers) to whom data is made available, e.g. legal advisers and lawyers, courier/postal service providers, debt-purchasing entities (in case of unpaid invoices).
D. Entities located outside the EEA, only if necessary and with an adequate level of protection, in particular via: (a) cooperation with entities in countries covered by an adequate European Commission decision; or (b) standard contractual clauses issued by the European Commission. You will always be informed at the collection stage of any intention to transfer data outside the EEA.
Your data will not be subject to profiling (automated analysis to predict preferences or future behavior).
A. Right of access to your personal data (Article 15 GDPR).
B. Right to rectify your data, including correction (Article 16 GDPR).
C. Right to erasure — the "right to be forgotten" — if you believe there are no grounds for us to process your data (Article 17 GDPR).
D. Right to restrict processing — e.g. if data is incorrect, unjustifiably processed, or you object to processing (Article 18 GDPR).
E. Right to data portability — to receive your data in a structured, commonly used, machine-readable format (e.g. .csv), where processed by contract or consent, and to have it transmitted directly to another entity (Article 20 GDPR).
F. Right to withdraw consent at any time — does not affect the lawfulness of processing carried out before withdrawal (Article 7(3) GDPR). Withdraw by e-mailing: [CONFIRM contact email].
G. Right to object to processing based on our legitimate interest (Article 21 GDPR); we will then stop processing unless we demonstrate overriding legitimate grounds.
H. Right to lodge a complaint with the President of the Personal Data Protection Office if you believe processing violates the GDPR.
For questions about personal-data processing or to exercise your rights: rodo@twojstartup.pl
(TwojStartUp's implementation guidance, kept as sent, entity name already correct.)
Immediately before placing the order, as a summary, the customer should see: a) the chosen product (goods/service) and its main features; b) total price/remuneration including taxes; c) the right to terminate the contract, or its absence; d) contract duration and termination method/reasons, if unspecified-term or auto-renewing; e) minimum duration of the Client's contractual obligations.
If selling Goods — consent requested before the order:
After ordering, send a distance-contract confirmation e-mail including the Terms and Conditions and the termination form, plus an invoice. Under the order button ("send"/"accept"/etc.), display: "The Controller of the data entered into the form is Fundacja Rozwoju Przedsiębiorczości "Twój StartUp." The data will be processed to provide the service and, with consent, for marketing purposes. You may withdraw consent at any time. For full information on data processing and your rights, see the [privacy policy — link here]."
If delivering digital content — consent requested before the order:
The "TERMS AND CONDITIONS" title should link to that document. Before the service starts, the consumer must be informed (e.g. by e-mail, sent after contract conclusion but before delivery) that requesting immediate performance removes their termination right — for example: "Due to your request for Fundacja Rozwoju Przedsiębiorczości "Twój StartUp" to perform the service within 14 days of the contract's conclusion, you do not have the right to terminate the contract." This can be combined with the distance-contract confirmation e-mail, which should also include an invoice.
Under the order button, display the same controller/data-processing notice as above, linking to your privacy policy.
If it's a Service (not digital content) — same structure as the digital-content case: consent checkboxes for immediate performance/loss of withdrawal right, T&C acceptance, and (unticked, optional) marketing content; confirmation e-mail with T&C, termination form and invoice; same controller notice under the order button.