Privacy Policy

The following Privacy Policy defines the rules for storing and accessing data on Users’ Devices using the Service for the purpose of providing electronic services by the Administrator, as well as the principles of collecting and processing Users’ personal data provided voluntarily through tools available on the Service.

This Privacy Policy is an integral part of the Service Terms and Conditions, which define the rules, rights, and obligations of Users using the Service.

§1 Definitions

• Service – the online service “questrooms.pl” operating at https://questrooms.pl/

• External Service – online services of partners, service providers, or clients cooperating with the Administrator

• Service/Data Administrator – the Administrator of the Service and Data (hereinafter the Administrator) is the company “Questrooms z.o.o”, operating at ul. Startowa 4a, 80-461 Gdansk, with Tax ID (NIP): 8891520566, KRS number: 0000863313, providing electronic services through the Service

• User – a natural person for whom the Administrator provides electronic services via the Service.

• Device – an electronic device with software through which the User accesses the Service

• Cookies – text data stored in files on the User’s Device

• GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)

• Personal Data – information about an identified or identifiable natural person (“data subject”); an identifiable natural person is someone who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, identification number, location data, online identifier, or one or more factors specific to their physical, physiological, genetic, mental, economic, cultural, or social identity

• Processing – any operation or set of operations performed on personal data or sets of personal data, whether automated or not, such as collection, recording, organization, structuring, storage, adaptation or modification, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction

• Restriction of processing – marking stored personal data to limit their future processing

• Profiling – any form of automated processing of personal data to evaluate certain personal aspects of a natural person, in particular to analyze or predict aspects concerning that person’s work performance, economic situation, health, personal preferences, interests, reliability, behavior, location, or movements

• Consent – the data subject’s voluntary, specific, informed, and unambiguous indication of their wishes by statement or clear affirmative action, allowing the processing of personal data relating to them

• Personal data breach – a breach of security leading to accidental or unlawful destruction, loss, alteration, unauthorized disclosure, or access to personal data transmitted, stored, or otherwise processed

• Pseudonymization – processing personal data in a way that it can no longer be attributed to a specific data subject without the use of additional information, provided such information is kept separately and subject to technical and organizational measures to prevent attribution to an identified or identifiable person

• Anonymization – an irreversible process of modifying data that destroys or overwrites “personal data,” making it impossible to identify or link the record to a specific user or individual.

§2 Data Protection Officer

Pursuant to Art. 37 GDPR, the Administrator has not appointed a Data Protection Officer.

For matters concerning data processing, including personal data, please contact the Administrator directly.

§3 Types of Cookies

• Internal Cookies – files placed and read from the User’s Device by the Service’s IT system

• External Cookies – files placed and read from the User’s Device by external services. Scripts from external services that may place cookies on the User’s Device have been consciously implemented in the Service through installed scripts and services.

• Session Cookies – files placed and read from the User’s Device by the Service or external services during a single session. They are removed from the Device after the session ends.

• Persistent Cookies – files placed and read from the User’s Device by the Service or external services until manually deleted. They are not removed automatically unless the User’s Device is configured to delete cookies at the end of the session.