Privacy policy of the Mafelo platform
This Privacy Policy (hereinafter referred to as the: „ Policy”) contains information on the processing of your personal data in relation to the use of the online platform “Mafelo” operating on the following website: www.app.mafelo.com (hereinafter referred to as the: „Platform”).
Any capitalized terms that have not been defined otherwise in the Policy shall have the meaning assigned to them in the Terms and Conditions available here: https://www.mafelo.com/en/legal-documents/terms-and-conditions .
Personal data administrator
The administrator of your personal data shall be Michał Zalewski who conducts business activity under the name “Software Consulting Michał Zalewski” (permanent place of business: ul. Radosna 3, 55-200 Oława), entered in to the Central Registration and Information on Business managed by the competent minister of economy, holder of NIP (Tax ID no.): 9251878555, REGON (National Business Registry Number): 080321590 (hereinafter referred to as the: „ Administrator”).
Contact with the Administrator
For all matters related with the processing of personal data, you can contact the Administrator via electronic mail, e-mail address: mafelo@mafelo.com.
Personal data protection measures
The Administrator utilizes advanced organizational and technical safety measures in order to ensure the best possible protection of your personal data and hereby guarantees that the data is processed in accordance with the provisions of the Regulation of the European Parliament and the Council (EU) 2016/679 of 27 April 2016 on protection of individuals with regard to processing of personal details and on free movement of such data and repeal to Directive 95/46/EC (the General Data Protection Regulation) (hereinafter referred to as: “the GDPR”), the act of 10 May 2018 on personal data protection and other regulations regarding protection of personal data.
Information on the processing of personal data
The use of the Platform shall require the processing of your personal data. Below, you will find the detailed information on the purpose and legal basis of the processing as well as the period of the processing and the mandatory or voluntary provision thereof.
| Purpose of the processing | Processed personal data | Legal basis |
|---|---|---|
| The conclusion and performance of the Agreement for provision of the Photographer Account Service | address of electronic mail or personal data saved on the profile on the Facebook social network | Art. 6 section 1 letter b of the GDPR (the processing is required to perform the Agreement for provision of the Photographer Account Service concluded with the data subject or to take action in order to conclude it) |
| Provision of the a/m personal data is required to conclude and perform the Agreement for provision of the Photographer Account Service (the provision is voluntary but if not provided, the conclusion and performance of the a/m agreement will be impossible). The Administrator shall process the a/m personal data until the claims arising from the Agreement for provision of the Photographer Account Service become time-barred. | ||
| Purpose of the processing | Processed personal data | Legal basis |
|---|---|---|
| Conclusion and performance of the Agreement for provision of the Session Service |
| Art. 6 section 1 letter b of the GDPR (the processing is required to perform the Agreement for provision of the Session Service concluded with the data subject or to take action in order to conclude it) |
| Provision of the a/m personal data is required to conclude and perform the Agreement for provision of the Session Service (the provision is voluntary but if not provided, the conclusion and performance of the a/m agreement will be impossible). The Administrator shall process the a/m personal data until the claims arising from the Agreement for provision of the Session Service become time-barred. | ||
| Purpose of the processing | Processed personal data | Legal basis |
|---|---|---|
| Conclusions and performance of the Agreement for the Service to use the Platform | electronic mail address | Art. 6 section 1 letter b of the GDPR (the processing is required to perform the Agreement for provision of the Service to use the Platform concluded with the data subject or to take action in order to conclude it) |
| Provision of the a/m personal data is required to conclude and perform the Agreement for provision of the Service to use the Platform (the provision is voluntary but if not provided, the conclusion and performance of the a/m agreement will be impossible). The Administrator shall process the a/m personal data until the claims arising from the Agreement for provision of the Service to use the Platform become time-barred. | ||
| Purpose of the processing | Processed personal data | Legal basis |
|---|---|---|
| Purposes of the complaint handling procedure |
| Art. 6 section 1 letter c of the GDPR (the processing is necessary to fulfill the legal obligation imposed on the Administrator, in this case:
|
| Provision of the a/m personal data is necessary to receive a reply to the complaint or exercise the Customer's rights arising from the regulations on the Administrator's liability in case of the non-compliance of the Subject of digital service with the Agreement regarding it (the provision of the data is voluntary but if not provided, it is impossible to receive a reply to a complaint and exercise the a/m rights). The Administrator shall process the a/m personal data for the period of the complaint proceedings and in case of the implementation of the a/m rights of the Customer – until they become time-barred. | ||
| Purpose of the processing | Processed personal data | Legal basis |
|---|---|---|
| Sending e-mail notifications | electronic mail address | Art. 6 section 1 letter f of the GDPR (the processing is necessary to implement the legally justified interest of the Administrator, which in this case is to inform Recipients of Services about the actions taken in relation to provision of services) |
| Provision of the a/m personal data is voluntary but necessary in order to receive information on actions connected with provision of services (if not provided, it will be impossible to receive such information). The Administrator shall process the a/m personal data until an effective objection is submitted or the purpose of the processing is fulfilled. | ||
| Purpose of the processing | Processed personal data | Legal basis |
|---|---|---|
| Fulfillment of tax obligations (among others: issuing VAT invoices, storage of accounting records) |
| Art. 6 section 1 letter c of the GDPR (the processing is necessary for the fulfillment of the legal obligation imposed on the Administrator, in this case – the obligations arising from tax law) |
| Provision of the a/m personal data is voluntary but necessary for the Administrator to fulfill the tax obligations imposed on them (if the data is not provided, the Administrator cannot fulfill the a/m obligations). The Administrator shall process the a/m personal data for 5 years starting from the end of the year in which the deadline for payment of tax for the previous year expired. | ||
| Purpose of the processing | Processed personal data | Legal basis |
|---|---|---|
| Fulfillment of obligations connected with personal data protection |
| Art. 6 section 1 letter c of the GDPR (the processing is necessary for the fulfillment of the legal obligation imposed on the Administrator, in this case – the obligations arising from regulation on personal data protection) |
| Provision of the a/m personal data is voluntary but necessary for the purpose of correct performance of obligations arising from regulations on personal data protection, such as execution of rights granted to you under the GDPR, by the Administrator (if the a/m data is not provided, the execution of the a/m rights will be impossible). The Administrator shall process the a/m personal data until the claims resulting from the breach of regulations on personal data protection become time-barred. | ||
| Purpose of the processing | Processed personal data | Legal basis |
|---|---|---|
| Determination, pursuit of or protection against claims |
| Art. 6 section 1 letter f of the GDPR (the processing is required for the implementation of the legally justified interest of the Administrator, which in this case is to determine, pursue or protect against claims which might arise in relation to performance of the Agreements concluded with the Administrator) |
| Provision of the a/m personal data is voluntary but necessary in order to determine, pursue or protect against claims that might arise in relation to performance of the Agreements concluded with the Administrator (if the a/m data is not provided, the Administrator will be unable to undertake the a/m actions) The Administrator shall process the a/m personal data until the claims which might arise from performance of the agreements concluded with the Administrator become time-barred. | ||
| Purpose of the processing | Processed personal data | Legal basis |
|---|---|---|
| Analysis of your activity on the Platform |
| Art. 6 section 1 letter f of the GDPR (the processing is necessary in order to implement the legally justified interest of the Administrator, which in this case is to receive information on your activity on the Platform) |
| Provision of the a/m personal data is voluntary but necessary for the Administrator to obtain information about your activity on the Platform (if not provided, it will be impossible for the Administrator to obtain the a/m information). The Administrator shall process the a/m personal data until an effective objection is submitted or the purpose of the processing is fulfilled. | ||
| Purpose of the processing | Processed personal data | Legal basis |
|---|---|---|
| Platform management |
| Art. 6 section 1 letter f of the GDPR (the processing is necessary to implement the legally justified interest of the Administrator, which in this case is to ensure the proper functioning of the Platform) |
| Provision of the a/m personal data is voluntary but necessary in order to ensure the proper functioning of the Platform (if not provided, it will be impossible to ensure the proper functioning of the Platform). The Administrator shall process the a/m personal data until an effective objection is submitted or the purpose of the processing is fulfilled. | ||
Profiling
In order to create your profile for marketing purposes and send you direct marketing that is adjusted to your preferences, the Administrator shall process your personal data in an automated way, including profiling – however, it shall not result in any legal consequences for you nor significantly affect your situation in a similar manner.
The scope of profiling of personal data is identical as the scope indicated above with regard to the analysis of your activity on the Platform and the data that you will save on the Photographer Account.
The legal basis for the processing of personal data for the above-mentioned purpose is Art. 6 section 1 letter f of the GDPR which stipulates that the Administrator can process personal data in order to implement their legally justified interest, which in this case is to conduct marketing activities adjusted to the recipients' preferences. Provision of the a/m personal data is voluntary but necessary for the implementation of the a/m purpose (if not provided, the Administrator will be unable to conduct marketing activities adjusted to the preferences of the recipients).
The Administrator shall process personal data for their profiling, until an effective objection is submitted or the purpose of the processing is fulfilled.
Personal data recipients
The recipients of the personal data can include the following third-party entities cooperating with the Administrator:
- the hosting company;
- the domain provider;
- the provider of the mailing system;
- providers of online payment systems;
- provider of the Facebook social website;
- the companies providing tools used to analyze the activity on the Platform and addressing direct marketing to its users (such as Google Analytics);
- the accounting company.
Moreover, personal data can also be provided to public or private entities, if such an obligation results from the commonly applicable regulations of law, a binding court decision or a binding administrative decision.
Transfer of personal data to a third country
In connection with the Administrator's use of the services provided by Google LLC, your personal data can be transferred to the following third countries: Great Britain, Canada, USA, Chile, Brazil, Israel, Saudi Arabia, Qatar, India, China, South Korea, Japan, Singapore, Taiwan (the Chinese Republic), Indonesia and Australia. The basis for the transfer of the data to the a/m countries is as follows:
- in the case of Great Britain, Canada, Israel and Japan - the decision of the European Commission on the relevant level of personal data protection in each of the a/m third countries;
- in the case of the USA, Chile, Brazil, Saudi Arabia, Qatar, India, China, South Korea, Singapore, Taiwan (the Chinese Republic), Indonesia and Australia - the contractual clauses ensuring the proper level of protection, according to standard contractual clauses provided for in the Implementing Decision of the Commission (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries under the Regulation of the European Parliament and the Council (EU) 2016/679.
Rights
In connection with the processing of personal data, you shall have the following rights:
- right to information on the type your personal data processed by the Administrator and the right to receive a copy of such data (the so-called access right). The issue of the first copy is free of charge. The Administrator may charge a fee for further copies;
- if the processed data is outdated or incomplete (or incorrect in another way), you shall have the right to rectify it;
- in some situations, you can contact the Administrator with a request to have your personal data removed e.g., when:
- the data is no longer needed by the Administrator for the purposes that they informed on;
- you effectively revoked the consent to data processing - provided that the Administrator does not have the right to process the data under a different legal basis;
- the processing is illegal;
- the removal of data results from the legal obligation imposed on the Administrator;
- in the case when personal data is processed by the Administrator under a given consent to the processing or for the purpose of performance of the Agreement concluded with the Administrator, you shall have the right to transfer your data to a different administrator;
- in the case when personal data is processed by the Administrator under your consent to the processing, you shall have the right to revoke the consent at any time (revocation of the consent will not affect the lawfulness of the processing that was performed under the consent prior to its revocation);
- if you decide that the processing of personal data is improper, its processing is illegal or that the Administrator no longer needs the specific data, you can demand from the Administrator to cease any operations on the data for a specific, necessary period (e.g. needed to verify the correctness of data or pursue claims) and only to store the said data;
- you shall have the right to raise an objection to the processing of personal data that is processed under a legally justified interest of the Administrator. In case of an effectively submitted objection, the Administrator shall stop the processing of personal data for the a/m purpose;
- should you decide that the processing of personal data infringes the provisions of the GDPR, you shall have the right to submit a complaint to the President of the Office of Personal Data Protection.
Cookie files
- The Administrator would like to inform that the Platform uses “cookie” files that are installed on your end device. Cookie files are small text files that can be read by the Administrator's system as well as systems of other entities whose services are used by the Administrator (e.g. Facebook, Google).
- The Administrator uses cookie files for the following purposes:
- to ensure the proper functioning of the Platform – cookie files allow for proper functioning of the Platform, the use of its features and convenient switching between individual subpages;
- to increase the comfort of browsing the Platform – thanks to cookie files, it is possible to detect errors on some subpages and to continuously improve them;
- to generate statistics – cookie files are used to analyze the manner in which the Recipients of Services use the Platform. This allows for continuous improvements of the Platform and adjusting it to the preferences of the Recipients of Services.
- to carry out marketing activity – thanks to cookie files, the Administrator can send the Recipients of Services advertisement that is adjusted to their preferences.
- The Administrator may store on your device both permanent as well as temporary (session) files. Session files are usually removed when the browser is closed. However, closing the browser will not erase the permanent files.
- The information on cookie files used by the Administrator is displayed in the panel in the bottom part of the website of the Platform. Depending on your decision, you may switch individual categories of cookie files on and off (except for the necessary cookie files) and change those settings at any time.
- The Administrator is unable to identify you based on the data collected through cookie files.
- The Administrator uses the following cookie files and tools which utilize them:
TOOL PROVIDER FUNCTION AND RANGE OF COLLECTED DATA PERIOD OF OPERATION Necessary cookie files Administrator The operation of those files is required for the proper functioning of the website of the Platform. That is why it is impossible to switch them off. Thanks to those files (that gather information such as the IP of your device), it is possible, among others, to inform you about the cookie files used on the website of the Platform Most of the necessary cookie files are session files. Some of them however will remain on your end device for the period of 12 months or until removed; Google Analytics Google This tool collects statistical data on the way in which the Platform is used by the Recipients of Services, among others: the number of visits, duration of the visits, the used web browser, location. The collected data help in improving the Platform or making it more convenient for the Users. up to 2 years or until removed (depending on which of those events occurs first) Facebook Pixel Facebook Thanks to this tool, it is possible to determine that you visited the Platform as well as to provide you with advertisement on Facebook and Instagram and to measure their efficiency. up to 3 months or until removed (depending on which of those events occurs first) - By using most of the common web browsers, you can check whether there have been any cookie files installed on your device as well as remove the installed cookie files or block their installation by the Platform in the future. However, turning off or limiting the operation of cookie files can cause serious difficulties in using the Platform e.g., the need to log in on every sub-page, longer loading times of pages of the Platform, limited use of some of the features.
Final Provisions
For matters not regulated by the Policy, the commonly applicable regulations on protection of personal data shall apply.
The Policy shall be valid from 3 March 2023.