Legal

Privacy Policy for Solidstudio sp. z o.o.

Last updated: 22 September 2026

INTRODUCTION

This policy outlines the principles for processing personal data of users of the website located at https://solidstudio.io/ (the Site), operated by Solidstudio sp. z o.o. in Kraków (Solidstudio, Administrator, Controller). A user of the Site is anyone who uses it in any way (User). The Site provides information about Solidstudio, our products and services, industry and marketing materials, as well as our employment offers. It also facilitates contact with us and the receipt of the materials mentioned above.

This policy also covers the processing of personal data that we do not obtain from you, that is business contact details of persons performing professional roles, which we use for our outbound business correspondence. That part of the policy (section 13) constitutes the information required by Article 14 GDPR and is the document referred to in the notice included in the first message of each of our outbound sequences.

The policy further covers issues related to the processing of Users’ personal data in connection with our accounts on social media portals (the Portals), and includes information about the cookies and the analytical and marketing tools we use.

The processing of the personal data of candidates who apply to us through the Site is described in section 22 of this policy. Section 22 contains the full information we owe candidates under Article 13 GDPR.

BASIC INFORMATION

1. Identity and contact details of the personal data controller

The controller of your personal data is Solidstudio Limited Liability Company (Solidstudio spółka z ograniczoną odpowiedzialnością) with its registered office in Kraków, address: ul. Tarłowska 12/15, 31-102 Kraków, Poland, entered into the register of entrepreneurs, which is part of the National Court Register, maintained by the District Court for Kraków-Śródmieście in Kraków, XI Commercial Division of the National Court Register, under KRS number 0000638097, NIP 6762513853, REGON 365436200.

You can contact us in particular:

by email at gdpr@solidstudio.io or rodo@solidstudio.io,
by telephone at +48 795 149 398, between 9:00 and 17:00, Monday to Friday,
in writing, at the postal address given above.

We have not appointed a data protection officer, as we are not under an obligation to do so. Matters concerning information security and the protection of personal data are handled by our Information Security and Personal Data Protection Team (Zespół ds. bezpieczeństwa informacji, w tym Ochrony Danych Osobowych), which you can reach by telephone at +48 795 149 398 or by email at gdpr@solidstudio.io or rodo@solidstudio.io.

2. Where we obtain your data from

We obtain personal data from the following sources.

Directly from you:

Forms available on the Site. The contact form (first name, surname, email address, telephone number, which is optional, company, and the content of your message) and the form used to download gated materials such as ebooks and PDF documents (email address).
The recruitment form on the page of a job offer. Your email address, the content of your message and the documents you attach, in particular your CV. This source is described in section 22.
Incoming correspondence. You may simply write to us or call us, using the email addresses, postal addresses and telephone numbers provided on the Site or in this policy. Such correspondence is also a source of data for us.
Lead generation forms in advertising systems. Where we use lead generation forms in Google Ads or in LinkedIn Ads, the data you submit in such a form reaches us through the advertising system concerned.

From sources other than you:

Publicly available professional profiles and business contact data providers. We obtain the business contact details of persons performing professional roles from their publicly available professional profiles on LinkedIn, including LinkedIn Sales Navigator, and from providers of business contact data services, namely Surfe and Clay.com. This source is described in detail in section 13 of this policy.

From your use of the Site:

Analytical and marketing tools and their cookies, exclusively where you have given your consent in the consent manager on the Site. This is described in section 16.

3. How we protect your personal data

We ensure that the protection and security of your personal data are an important part of our business activities and are considered in the design of the procedures and solutions we use.

In implementing these assumptions, we have applied technical and organisational measures to ensure the protection of the processed data in accordance with the requirements set out in the data protection regulations, particularly the GDPR, which measures are adequate to the risk of infringement of your rights and freedoms.

Among other things, we have secured data against being shared with unauthorised persons, unauthorised removal or use, against processing in violation of the applicable legal regulations, and against change, loss, damage or destruction.

We share your data with third parties while observing legal regulations, when it is necessary from the perspective of our business activities, and access to your data among us is limited to employees and collaborators who have received the appropriate authorisations and have signed relevant commitments to protect personal data and maintain its confidentiality.

We respect your rights related to the protection of personal data, and our technical solutions are compliant with the current state of technology.

We have also implemented appropriate procedures for dealing with personal data breaches, as well as rules for reporting breaches to the supervisory authority, which in Poland is the President of the Office for Personal Data Protection.

4. Legal bases and purposes of processing personal data

Personal data are processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter: GDPR) and the Polish Act on Personal Data Protection of 10 May 2018.

The legal bases for the processing of your data, and the purposes pursued under each of them, are as follows.

Article 6(1)(b) GDPR: processing is necessary in order to take steps at your request before entering into a contract, or to perform a service you have requested. On this basis we:

deliver the industry and marketing materials you have requested (ebooks, PDF documents and similar gated content), for which your email address is necessary,
respond to the enquiry you have sent us through the contact form, through a lead generation form, or through the contact details available on the Site.

Article 6(1)(a) GDPR: your consent. On this basis we:

send you our newsletter and other marketing materials that are not a response to an individual request. This consent is collected through a separate checkbox that is not ticked by default, and is recorded together with the wording presented to you and a timestamp,
use analytical and marketing cookies and the related tools on the Site, as described in section 16.

Article 6(1)(f) GDPR: processing is necessary for the purposes of the legitimate interests pursued by the controller. The purposes of processing based on this ground are:

direct marketing of our own products and services, including outbound business correspondence addressed to persons performing professional roles at companies in our sector, as described in section 13,
conducting marketing activities and promoting us on the Portals,
obtaining aggregated and anonymised statistical data on the use of the Site, in order to improve the quality of the Site and its usability, and analysing the effectiveness of our marketing activities,
the establishment, exercise and defence of legal claims,
ensuring the safe operation of the Site and its functionality.

Where we rely on our legitimate interest for direct marketing, we have carried out a legitimate interest assessment (a balancing test). A copy of that assessment is available on request at the contact details given in section 1.

Article 6(1)(c) GDPR: compliance with a legal obligation to which we are subject. On this basis we maintain a suppression list, that is a record of persons who have objected to direct marketing. Keeping that record is how we comply with the obligation under Article 21(3) GDPR not to process personal data for direct marketing purposes any further. The suppression list is described in section 13.

Separate requirement: consent to marketing communication under the Electronic Communications Law. Independently of the GDPR grounds above, sending marketing communication to an email address or a telephone number requires a separate consent under Article 398 of the Act of 12 July 2024, the Electronic Communications Law (Prawo komunikacji elektronicznej, PKE). That Act replaced the Telecommunications Law and Article 10 of the Act on Providing Services by Electronic Means. Satisfying the GDPR does not remove that requirement, and satisfying that requirement does not remove the need for a GDPR basis: the two operate side by side.

The legal bases that apply to the processing of candidates’ data in recruitment are set out separately in section 22.

5. How long we keep your personal data

We keep personal data no longer than is necessary for the purposes for which they were collected. The periods applicable to each purpose are as follows.

What	How long
Enquiries sent through forms on the Site, and incoming correspondence	24 months from the last contact
Newsletter and other marketing materials sent on the basis of consent	Until you withdraw your consent; in the absence of any activity on your part, no longer than 24 months
Business contact details used for outbound correspondence, where you have not replied	12 months from the date we obtained them
Business contact details used for outbound correspondence, where contact has been established	24 months from the last contact
Suppression list (record of objections)	Indefinitely, because its sole purpose is to prevent us from contacting you again
Recruitment applications	Until the recruitment process concerned has been completed
Recruitment applications, where you have consented to take part in future recruitments	12 months from the date on which you gave that consent, and no longer than that consent lasts
Data necessary for the establishment, exercise or defence of legal claims	Until the applicable limitation periods expire
Aggregated statistics	Indefinitely, because after aggregation they are no longer personal data

Where a shorter period follows from your objection or from the withdrawal of your consent, we apply the shorter period. An objection to direct marketing is absolute and is implemented without weighing our interest against yours (see sections 8 and 9).

6. Recipients of your personal data

6.1 Processors acting on our behalf

The following entities process personal data on our behalf, under written data processing agreements, and only on our documented instructions:

Google Ireland Limited: Google Workspace (business email and office tools), Google Analytics 4 and Google Tag Manager (Site analytics and tag management), Google Ads (advertising),
LinkedIn Ireland Unlimited Company: LinkedIn Ads (advertising), the LinkedIn Conversions API (conversion measurement), and LinkedIn Sales Navigator,
Meta Platforms Ireland Limited: Meta Ads (advertising). Our Meta Ads campaigns direct traffic to the Site; we do not run lead generation forms in Meta and do not collect leads within Meta. We also use, or will use, the Meta Pixel, embedded through Google Tag Manager, exclusively where you have given the corresponding consent in the consent manager, as described in section 16,
HubSpot Ireland Limited: our CRM and marketing automation system; our data instance is located in the European Union (region eu1),
Overloop SRL, Rue des Pères Blancs 4, Brussels, Belgium: the system we use to send and manage outbound business correspondence,
Growster SAS (Surfe), RCS 882 838 295, 17 allée des Gassets, 77700 Serris, France: a provider of services establishing business contact details,
Clay Labs, Inc. (United States), the provider of the Clay.com service: a provider of services establishing business contact details,
Zapier, Inc. (United States): integrations between the systems listed here,
Slack Technologies Limited (Ireland): internal notifications about submissions of the contact form on the Site; the notification contains the first name, surname, email address, company and the content of the message,
Usercentrics A/S (Denmark): Cookiebot, the consent manager used on the Site,
hosting providers: OVH Sp. z o.o. (the Site) and Toya sp. z o.o. (our internal marketing systems), both established in Poland.

Overloop SRL, Growster SAS, Usercentrics A/S, OVH Sp. z o.o. and Toya sp. z o.o. are established within the European Economic Area, and for that reason they do not appear in the table of transfers outside the EEA in section 12.

6.2 Independent controllers

The following recipients process your data as independent controllers, on their own legal bases: postal operators and courier companies, law firms, and our accounting office.

We act as joint controllers with the following entities, each time within a strictly limited scope:

Google (Google Ads) and LinkedIn (LinkedIn Ads), in respect of matching audiences on the basis of a hashed email address, as described in section 11,
Meta Platforms Ireland Limited (Meta Ads), in respect of the collection of events by the Meta Pixel on the Site, at the stage at which those events are gathered. This follows from the judgment of the Court of Justice of the European Union of 29 July 2019 in case C-40/17 (Fashion ID). Unlike the audience matching described in the previous point, we do not upload a hashed list of email addresses to Meta: the audiences described in section 11 are built from pixel events recorded on the Site. Further processing of that data on Meta’s own systems is carried out by Meta as an independent controller, on its own legal bases,
the operators of the Portals on which we maintain company accounts, that is LinkedIn, Facebook (Meta), YouTube (Google) and X, in respect of the statistics generated for those accounts. This follows from the judgment of the Court of Justice of the European Union of 5 June 2018 in case C-210/16 (Wirtschaftsakademie Schleswig-Holstein). The statistics that we receive are aggregated only, and we cannot link them to individual persons.

The essence of each of these arrangements is made available to data subjects by the operator concerned, as required by Article 26(2) GDPR, at the following addresses:

7. Information on the possible obligation to provide data and the consequences of not providing it

The provision of personal data is voluntary. However, in some cases providing certain data is necessary for us to act: without an email address we cannot deliver a requested material, and without contact details we cannot answer an enquiry. The position in recruitment, where the provision of certain data follows from the Labour Code, is described in section 22.

8. Information on the rights of the data subject

You have the following rights.

8.1 The right to object to direct marketing, at any time and without giving any reason. This right is absolute: we may not weigh it against our interests and we may not refuse it (Article 21(3) GDPR). You can exercise it in any of the following ways, and each of them is equally effective:

reply to any message you have received from us, including with the single word STOP,
use the unsubscribe link in the footer of any of our marketing messages,
write to gdpr@solidstudio.io,
tell us by any other channel, including a message on a Portal, the contact form on the Site, or by telephone.

You do not need to use any particular wording, and you do not need to justify your request. Once we receive your objection, we stop processing your data for direct marketing purposes immediately, and in any event within 72 hours, and we add your email address to our suppression list so that you are not contacted again. We confirm to you that your request has been carried out without undue delay and in any event within one month (Article 12(3) GDPR).

8.2 The right to withdraw consent at any time, where processing is based on your consent (Article 7(3) GDPR). The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of that consent before its withdrawal. For the newsletter, you can withdraw consent by clicking the unsubscribe link in any message. For cookies, you can withdraw consent using the “Change your cookie consent” link in our Cookies Policy at https://solidstudio.io/cookies-policy/, which reopens the consent banner.

8.3 The remaining rights. You also have the right to:

access your personal data and obtain a copy of them,
demand the rectification of inaccurate data and the completion of incomplete data,
demand the erasure of your data,
demand the restriction of processing,
data portability, that is the right to receive your data from us in a structured, commonly used and machine readable format, and to have them transmitted directly to another controller,
object to processing based on our legitimate interest for reasons related to your particular situation (see section 9),
not be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. As explained in section 11, we do not take such decisions,
lodge a complaint with a supervisory authority (see section 10).

To exercise any of these rights, please contact us at the addresses given in section 1 of this policy.

9. Right to object

To the extent that personal data are processed on the basis of Article 6(1)(f) GDPR, that is our legitimate interest, you have the right at any time to object to such processing, for reasons related to your particular situation. We may no longer process your data unless we can demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims.

However, to the extent that personal data are processed for direct marketing purposes as part of our legitimate interest, you have the right at any time to object to such processing. In that case, we may no longer process your data for such purposes. This objection is not weighed against our interests and cannot be refused. The practical instructions for exercising it are set out in section 8.1.

10. Right to lodge a complaint with a supervisory authority

You have the right to lodge a complaint with a supervisory authority, particularly in the European Union member state of your habitual residence, place of work or place of the alleged infringement, if you believe that the processing of your data infringes the GDPR.

In Poland, the supervisory authority’s responsibilities are carried out by the President of the Personal Data Protection Office (Urząd Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland).

11. Profiling and automated decision-making

We do not carry out profiling within the meaning of Article 4(4) GDPR. Profiling within the meaning of that provision means the automated processing of personal data to evaluate personal aspects relating to a natural person. Our activities do not meet that definition:

establishing a business email address for a person whose professional profile is publicly available is the collection of data, not the evaluation of that person,
the assessment of whether a given contact is relevant to our offer, that is lead qualification, is carried out by a person, not by an algorithm.

We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

What we do use are audiences and remarketing lists in advertising systems. In Google Ads and LinkedIn Ads we build audiences in two ways:

by uploading lists of contacts in which the email address is hashed using the SHA-256 algorithm before it leaves our systems; the advertising system matches the hash against its own users, and we do not receive information about which specific persons were matched,
on the basis of behaviour on the Site, exclusively where you have consented to marketing cookies.

In Meta Ads, we build audiences from events recorded by the Meta Pixel on the Site, exclusively where you have consented to marketing cookies, and not from uploaded lists of contacts. As with the audiences described above, this does not constitute profiling within the meaning of Article 4(4) GDPR.

Audiences are used to decide which group of people is shown an advertisement. They are not used to take any decision about you individually. In respect of the matching of these audiences we act as joint controllers with Google and with LinkedIn, and in respect of the collection of events by the Meta Pixel we act as a joint controller with Meta, all as described in section 6.3.

Separately, the Portals on which we maintain accounts carry out their own processing, including profiling, on the basis of their own policies and their own legal bases. Users of those Portals can adjust the extent of the information they receive through the privacy settings the Portal provides to them. More information about our accounts on the Portals is set out in sections 17 to 21.

12. Territorial scope of processing and transfers outside the EEA

Primarily, your data are processed within the European Economic Area (EEA), which includes EU Member States as well as Norway, Iceland and Liechtenstein. However, transfers of data outside the EEA occur in connection with the tools we use on the Site and in our marketing and sales systems, and in connection with our management of accounts on the Portals.

Such transfers take place on one of the following bases:

the EU-US Data Privacy Framework, where the recipient is an entity established in the United States and certified under that framework, covered by the adequacy decision of the European Commission of 10 July 2023,
standard contractual clauses adopted by the European Commission, together with additional technical and organisational safeguards, in all other cases.

The recipients concerned are:

Recipient	Country	Note
Google	United States	We contract with Google Ireland Limited; data may be transferred to the United States within the Google group
LinkedIn	United States	We contract with LinkedIn Ireland Unlimited Company; data may be transferred to the United States within the LinkedIn group
Meta	United States	We contract with Meta Platforms Ireland Limited; data may be transferred to Meta Platforms, Inc. in the United States
HubSpot	United States	We contract with HubSpot Ireland Limited; our data instance is located in the European Union (region eu1)
Slack	United States	We contract with Slack Technologies Limited (Ireland); data may be transferred to the United States within the Slack group
Zapier, Inc.	United States
Clay Labs, Inc. (Clay.com)	United States

Further information on the safeguards applied, including a copy of the relevant standard contractual clauses, can be obtained by contacting us at the addresses indicated in section 1 of this policy.

In the absence of a decision by the Commission confirming an adequate level of protection, the transfer of data to third countries is associated with certain risks for data subjects. In those countries, different data processing rules apply than in the EU, and as a result the range of rights available to those individuals in relation to their data may be reduced, or some rights may be unenforceable.

PERSONAL DATA WE DO NOT OBTAIN FROM YOU

13. Outbound business correspondence

This section constitutes the information required by Article 14 GDPR, that is the information we owe you where we have obtained your personal data from a source other than you. It is the document referred to in the notice included in the first message of every outbound sequence we send.

13.1 Who we write to. We address our business correspondence to persons performing professional roles at companies operating in the electromobility sector, in particular to persons whose role covers the purchase or the evaluation of software of the kind we supply. We write to those persons in their professional capacity, and not as private individuals.

13.2 What data we process. First name and surname, job title, the name and size of the employing company, the address of the professional profile, the business email address, and optionally the business telephone number. We do not collect private contact details and we do not collect any special categories of data.

13.3 Where the data come from. From your publicly available professional profile on LinkedIn, including LinkedIn Sales Navigator, and from providers of business contact data services, namely Surfe and Clay.com.

13.4 Purpose and legal basis. Direct marketing of our own products and services, on the basis of our legitimate interest, Article 6(1)(f) GDPR, read in the light of recital 47 GDPR, which expressly recognises direct marketing as a legitimate interest. We have carried out a legitimate interest assessment (a balancing test) documenting that our interest is not overridden by your interests, rights and freedoms, and we make that assessment available on request at the contact details in section 1.

13.5 Information at first contact. The first message of every sequence contains full information under Article 14 GDPR: who the controller is, what data we hold, where we obtained them, the purpose and legal basis, the retention period, the categories of recipients including recipients outside the EEA, your rights, and a one word way of putting an end to the correspondence. We do not repeat that notice in the subsequent messages of the same sequence, as the information has already been provided.

13.6 The limits we impose on ourselves. In order to keep our correspondence from becoming intrusive, we apply the following rules:

a single sequence consists of no more than 5 messages, spread over no more than 4 weeks,
a further sequence to the same person may not start earlier than 3 months after the previous one has ended, and only where there is a new, documented reason (for example a new product or feature relevant to that person’s segment, a new case study from their segment, or an event on their side such as a procurement notice, a change of role, a press release or entry into a new market). The passage of time alone is not a reason,
no more than 3 sequences to the same person within 12 months.

13.7 A refusal ends the contact permanently. A reply refusing further contact, in any form and in any wording, including a single word such as STOP, ends our correspondence for good. We stop immediately, and in any event within 72 hours, and we do not return to that person later, even if a compelling new reason arises. The absence of a reply is not an objection: a person who has not replied has not exercised any right, and we do not treat silence as a refusal.

13.8 The suppression list. In order to make sure that a person who has objected is not found again by our tools and contacted a second time, we keep a suppression list. It holds only a hash of the email address and the date of the objection, and nothing else. It is kept indefinitely, because deleting it would defeat its purpose. Every new recipient list, regardless of its source, is filtered against the suppression list before use. The basis for keeping this record is Article 6(1)(c) GDPR, as it serves to comply with our obligation under Article 21(3) GDPR.

13.9 How long we keep the data. 12 months from the date we obtained them where you have not replied, and 24 months from the last contact where contact has been established.

13.10 Recipients and transfers. The recipients of these data are the providers of the systems we use, listed in section 6, including entities outside the European Economic Area. Transfers are carried out on the bases described in section 12.

13.11 No profiling. We do not profile the recipients of our correspondence within the meaning of Article 4(4) GDPR, and we do not take any automated decisions about them. Whether a given contact is relevant to our offer is assessed by a person. See section 11.

13.12 Your rights. All the rights listed in section 8 apply here in full, in particular the absolute right to object to direct marketing described in section 8.1. You may also request information about the specific source from which we obtained your data.

WEBSITE FUNCTIONALITIES COLLECTING DATA

14. Contact form on the Site, and contact through the addresses available on the Site

You can contact us through the contact form available on the Site, or by writing or calling us using the addresses provided on the Site under the Contact tab.

The data we collect in the form: first name, surname, email address, telephone number (optional), company, and the content of your message.

Legal basis and purpose: Article 6(1)(b) GDPR. We process the data you provide in order to answer the enquiry you have sent us, which is an action taken at your request. No consent is required for us to answer you, and sending us an enquiry does not amount to consent to any marketing communication.

Sending an enquiry is not a subscription to the newsletter. If you also wish to receive our newsletter, you need to give a separate consent, as described in section 15.

Internal notification. A submission of the contact form generates an internal notification in our Slack workspace, containing the first name, surname, email address, company and the content of the message, so that the enquiry reaches the right person quickly. Slack acts as our processor, as described in section 6.1.

Retention: 24 months from the last contact, as set out in section 5.

Where we later wish to contact you with marketing communication that is not a response to your enquiry, we rely on our legitimate interest under Article 6(1)(f) GDPR together with the separate consent required by Article 398 of the Electronic Communications Law, and you may object at any time as described in section 8.1.

On the Site you can download free materials (ebooks, PDF documents) containing industry and marketing information prepared by us. We also offer a free newsletter containing information about our offers, products and services, as well as industry news.

These are two separate matters, with two separate legal bases.

15.1 Downloading a material. To receive a material, you provide your email address and click the download button. We use that address to deliver the material you have asked for. Legal basis: Article 6(1)(b) GDPR, as delivering the material is an action taken at your request. Downloading a material does not subscribe you to the newsletter, and the material is delivered to you regardless of whether you also consent to the newsletter.

15.2 The newsletter. Subscription to the newsletter requires a separate consent, given through a checkbox that is not ticked by default, placed next to the form. The checkbox reads:

I would like to receive the Solidstudio newsletter with information about products, services and expert content. I can withdraw this consent at any time using the link in the footer of any message.

We record that consent together with the exact wording presented to you and a timestamp, so that we are able to demonstrate it as required by Article 7(1) GDPR. Legal basis: Article 6(1)(a) GDPR, together with the separate consent required by Article 398 of the Electronic Communications Law.

Together with your submission we also record the notice displayed with the form, which states that Solidstudio processes the contact details provided in order to send the requested material and to make contact about our products and services.

15.3 Withdrawing consent. You can withdraw your consent to the newsletter at any time, in particular by clicking the unsubscribe link, which appears in the footer of every message. The withdrawal of consent does not affect the lawfulness of processing carried out on the basis of that consent before its withdrawal.

15.4 Retention. Data processed for the purpose of the newsletter are kept until you withdraw your consent and, in the absence of any activity on your part, for no longer than 24 months. Data processed in order to deliver a requested material are kept for 24 months from the last contact.

15.5 The state of the forms. The separation described in this section is in place on the Site. The change that separated the delivery of a gated material from the newsletter consent, and that introduced the recording of the consent together with its wording and a timestamp, went live on 21 September 2026. The same rule applies to the contact form: sending an enquiry is not a newsletter subscription.

16. Cookies and the tools used on the Site

While you are using the Site, so-called cookies are placed on your device. Cookies should be understood as short items of information, in particular text files, placed on end users’ devices while they are using the Site. Cookies usually contain the name of the website from which they originate, the duration of their storage on the end device, and a unique number.

16.1 The categories we use.

Strictly necessary cookies, which enable the safe use of the Site and access to its functionalities, and which include the cookies of the consent manager itself. These are activated automatically when you enter the Site, and their operation does not require your consent.
Analytical cookies and tools, which give us statistics on the use of the Site so that we can improve its quality and usability. These require your consent.
Marketing cookies and tools, which serve to measure the effectiveness of our advertising and to build audiences for it, including the advertising tags of Google, LinkedIn and Meta, and the HubSpot tracking script that links a form submission on the Site to a record in our CRM. These require your consent. The Meta Pixel registers your visits and events on the Site, for the purpose of measuring the effectiveness of our advertising on Meta and building audiences for it, as described in sections 6.3, 11 and 12.

16.2 The consent manager. Consent is collected, recorded and managed through Cookiebot by Usercentrics, the consent manager operating on the Site. You can accept all cookies in the banner, refuse all cookies other than the strictly necessary ones, or open the banner’s settings and give or refuse consent to analytical and to marketing cookies separately.

16.3 Nothing beyond the strictly necessary cookies is loaded before you consent. Analytical and marketing tools are fired only after you have given the corresponding consent in the consent manager. The Site also does not use any tool whose purpose is to identify, by name or by company, visitors who have not themselves provided us with their data.

16.4 The detailed list. The full list of the cookies and tools operating on the Site, with their providers, purposes and storage times, is set out in our Cookies Policy at https://solidstudio.io/cookies-policy/, which we keep up to date alongside this policy. By storage time, cookies divide into session cookies, that is temporary files stored on your end device until you log out, leave the website, or change your browser settings, and persistent cookies, that is files stored on your end device for the period specified in the cookie’s parameters, or until you delete them. The maximum storage time for cookies used on the Site is up to 2 years.

16.5 Giving and withdrawing consent. Analytical and marketing cookies are not activated until you consent to their use under Article 399 of the Act of 12 July 2024, the Electronic Communications Law (PKE), which governs the storage of information on, and access to information stored in, your terminal equipment.

Consent is voluntary, and you can withdraw it at any time by using the “Change your cookie consent” link in our Cookies Policy at https://solidstudio.io/cookies-policy/, which reopens the consent banner, or by clearing the cookies on your device, which reverts you to the original settings. Withdrawing consent does not affect the lawfulness of actions taken on the basis of consent before its withdrawal.

16.6 Browser settings. Regardless of the cookie management options available on the Site, you can change your cookie settings by specifying the conditions of their storage or access through your web browser software, including disabling the option of accepting cookies so as to block their automatic handling, requiring notification each time a cookie is transferred to your end device, or changing their storage time. Please remember, however, that since some cookies are necessary for the operation of the Site, disabling all cookies may disable some functionalities available on the Site (for example sending a contact form or a recruitment form).

Detailed information about managing cookies is available in the settings of the respective web browsers:

17. Rules common to all Portals

We maintain company accounts on the following social media portals (the Portals):

LinkedIn: https://www.linkedin.com/company/11377983/
Facebook: https://www.facebook.com/solidstudiosoftwarehouse/
YouTube: https://www.youtube.com/@SolidstudioSoftware

We also have an account on X, which we do not currently use. It is described in section 21.

The following rules apply to all of them.

17.1 Joint control over statistics. In respect of the statistics generated for our company account, we act as joint controllers with the operator of the Portal concerned, within the meaning of Article 26 GDPR. This follows from the judgment of the Court of Justice of the European Union of 5 June 2018 in case C-210/16 (Wirtschaftsakademie Schleswig-Holstein). The statistics we receive are aggregated only. We see, for example, how many people saw a post and the general characteristics of the audience; we cannot link those statistics to individual persons, and we cannot switch that measurement off.

17.2 The Portal’s own rules apply. The operator of each Portal processes the data of its users as an independent controller, on the basis of its own terms of service and its own privacy policy, over which we have no influence. This concerns in particular the creation of the account, the operation of the Portal itself, advertising within the Portal, and the profiling carried out by the Portal. If you comment on our content, send us a message on a Portal, or follow our account, that activity takes place within the Portal and is subject to the Portal’s rules, including its rules on the visibility of your data to other users.

17.3 What we do with your data on the Portals. Where you contact us through a Portal, we process the data contained in your message in order to answer it, on the basis of Article 6(1)(f) GDPR, our legitimate interest in maintaining contact with persons interested in our activities, and where relevant Article 6(1)(b) GDPR where your message is a request addressed to us. We may also moderate and remove content published on our accounts where it infringes the law or the rules of the Portal. Data contained in correspondence conducted through a Portal are kept for 24 months from the last contact.

17.4 Contacting us through a Portal is not marketing consent. Following our account, reacting to a post, commenting or sending us a message does not constitute consent to receive marketing communication. If we wish to send you such communication, we need a separate basis, as described in sections 4 and 15.

17.5 Your rights. The rights listed in section 8 apply to the data we process. In respect of data processed by the Portal as its own controller, and in respect of your account on the Portal, those rights are exercised against the operator of the Portal, through the settings the Portal provides and through the contact details published in the Portal’s own privacy policy.

18. LinkedIn

We maintain a company account on LinkedIn, operated by LinkedIn, at https://www.linkedin.com/company/11377983/. We use it to publish information about our products and services, industry content and our employment offers, to build professional contacts, and to respond to messages sent to us there.

In respect of the statistics generated for our company page we are joint controllers with LinkedIn, as described in section 17.1. LinkedIn provides those statistics in an aggregated form.

LinkedIn also carries out profiling of its users on the basis of its own policy. Users can adjust the extent of the information they receive to their own criteria and preferences, through the privacy settings that LinkedIn provides to them.

We also use LinkedIn Sales Navigator to find persons performing professional roles in our sector, and LinkedIn Ads together with the LinkedIn Conversions API and the LinkedIn Insight Tag for our advertising. Those uses are described in sections 13, 11 and 16 respectively.

Where we send a first message through LinkedIn to a person we have found through Sales Navigator, that message contains a short notice explaining where we obtained the data and linking to this policy. Section 13 applies to such correspondence in full.

LinkedIn’s privacy policy: https://www.linkedin.com/legal/privacy-policy

19. Facebook (Meta)

We maintain a company account on Facebook, operated by Meta, at https://www.facebook.com/solidstudiosoftwarehouse/. We use it to publish information about our activities and to respond to messages sent to us there.

In respect of the statistics generated for our page we are joint controllers with Meta, as described in section 17.1. The statistics we receive are aggregated only.

Meta’s privacy policy: https://www.facebook.com/privacy/policy

20. YouTube (Google)

We maintain a company account on YouTube, operated by Google, at https://www.youtube.com/@SolidstudioSoftware. We use it to publish video materials about our products, services and activities, and to respond to messages and comments left there.

In respect of the statistics generated for our channel we are joint controllers with Google, as described in section 17.1. The statistics we receive are aggregated only.

Google’s privacy policy: https://policies.google.com/privacy

21. X

Our account on X, operated by X, is not currently in use: we do not publish content there and we do not use it to contact anyone. The account remains in existence, so a user may still view it or write to us through it, and any such message is handled under the rules set out in section 17. Should we resume using the account, those rules will apply to it in full, including the joint controllership over the statistics generated for the account described in section 17.1.

X’s privacy policy: https://x.com/en/privacy

RECRUITMENT

22. Recruitment

This section is the information we owe candidates under Article 13 GDPR. It applies to every recruitment process we conduct through the Site.

22.1 How you apply and what data we receive. You apply through the recruitment form placed on the page of the specific job offer on the Site, or through any other channel indicated in the advertisement for that position. In the form you provide your email address, which is required, optionally the content of your message, and the documents you attach, in particular your CV.

22.2 Purposes and legal bases. We process your data in order to carry out the recruitment process for the position you have applied for, and to select the person with whom we will conclude a contract. The bases are as follows:

where the recruitment concerns an employment contract, we process the data listed in Article 22(1) of the Polish Labour Code (Kodeks pracy), that is your first name and surname, date of birth, the contact details you have indicated, and, where this is necessary for performing work of the kind concerned, your education, professional qualifications and employment history. Legal basis: Article 6(1)(c) GDPR, as the processing of those data is required of us by law,
where the recruitment concerns a civil law contract, including cooperation on a business to business basis, we process the data necessary to take steps at your request before entering into that contract, and subsequently to conclude it. Legal basis: Article 6(1)(b) GDPR,
any additional data you provide voluntarily in your CV or in your message, beyond the data indicated above, are processed on the basis of your consent, Article 6(1)(a) GDPR, which you give by sending us documents containing those data. You may withdraw that consent at any time, and the withdrawal does not affect the lawfulness of the processing carried out before it,
taking part in our future recruitment processes requires a separate consent, given through a separate checkbox on the form that is not ticked by default. Legal basis: Article 6(1)(a) GDPR. You may withdraw that consent at any time, with the same effect as above,
after the recruitment process has ended, we may process your data for the establishment, exercise or defence of legal claims connected with the process, on the basis of Article 6(1)(f) GDPR, our legitimate interest.

We ask you not to include in your application data that go beyond the scope described above, in particular special categories of personal data within the meaning of Article 9(1) GDPR. If you do include them, we treat them as data provided voluntarily and we ask you to consider whether you wish to do so.

22.3 Whether providing data is obligatory. Providing the data listed in Article 22(1) of the Labour Code is a statutory requirement where the recruitment concerns an employment contract, and providing the data necessary to conclude a civil law contract follows from that contract: without them we cannot consider your application. All other data are provided voluntarily, and not providing them has no negative consequences for you and does not affect the assessment of your application.

22.4 How long we keep your data. Where you have not consented to take part in our future recruitment processes, we delete your data once the recruitment process for which you applied has been completed. Where you have given that consent, we keep your data for 12 months from the date on which you gave it. If you withdraw your consent earlier, we delete the data. Data kept for the establishment, exercise or defence of legal claims are kept until the applicable limitation periods expire.

22.5 Recipients of your data. Your application is available to the persons involved in the recruitment process on our side. The recipients of your data are also the providers listed in section 6.1, to the extent of the business email and office tools we use and the hosting of the Site and of our internal systems. We do not transfer applications to any other recruiter or job portal. To the extent that any of those providers transfers data outside the European Economic Area, section 12 applies.

22.6 No automated decision-making. We do not take decisions about candidates based solely on automated processing, and we do not profile candidates within the meaning of Article 4(4) GDPR. Applications are assessed by a person.

22.7 Your rights. All the rights listed in section 8 apply to you in full, in particular the right of access to your data, the right to rectification and erasure, and the right to withdraw consent at any time. You also have the right to lodge a complaint with the supervisory authority, as described in section 10. To exercise your rights, or to ask any question about the processing of your application, contact us at the addresses given in section 1.

FINAL PROVISIONS

23. Changes to this policy

We may amend this policy, in particular where the scope of the data we process changes, where we start or stop using a tool or a service provider, or where the applicable law changes.

The current version of the policy is always available on the Site, and the date of the last update is given at the top of this document. Where a change concerns processing based on your consent, or where it materially affects your rights, we will inform you of it separately, by the channel through which we ordinarily communicate with you.

This policy does not limit any rights you have under the GDPR or under any other applicable law.