Privacy Policy.

1. General provisions

1.1. The controller of personal data is FlatHub Spółka z ograniczoną odpowiedzialnością (a Polish limited liability company) with its registered office in Kraków, at ul. Bronowicka 38/5, 30-091 Kraków, entered into the Register of Entrepreneurs of the National Court Register under number 0001009006, holding NIP (tax identification number) 6772488192.

1.2. Any questions or requests concerning the exercise of your rights should be sent to: rodo@gaius-lex.pl.

1.3. Your personal data are processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the "GDPR").

1.4. At FlatHub we respect your privacy and take measures to ensure the security of the information we obtain from you. This Privacy Policy has been introduced to protect the interests of the persons whose data we process. The Controller ensures that all personal data are processed lawfully, for the purposes set out in this Privacy Policy, and will not be processed in a manner incompatible with the purposes for which they were collected. This Privacy Policy sets out the actions we take regarding the personal data we receive from you when you use our website and receive services from us.

1.5. Capitalised terms used in this Privacy Policy have the following meanings:

• Controller or ADO – the controller of personal data, i.e. FlatHub Spółka z ograniczoną odpowiedzialnością with its registered office in Kraków, at ul. Bronowicka 38/5, 30-091 Kraków, entered into the Register of Entrepreneurs of the National Court Register under number 0001009006, holding NIP 6772488192;
• Recipients of data – entities entitled to receive personal data from the Controller under applicable provisions of law, or entities providing services to the Controller;
• Unregistered User – a person who visits and browses the Website without having registered in the Website;
• User – a person who uses the Website after registering and has access to the Website's functionality;
• Website – the organised IT and information platform enabling Users to use the services offered by the Controller and to access digital content prepared by the Controller, available at the gaius-lex.pl domain and its subdomains.

2. Scope of collected data

2.1. The Controller processes your personal data in connection with your use of the website operating at www.gaius-lex.pl.

2.2. The Controller collects personal data when an Unregistered User registers an account in the Website or initiates communication with the Controller.

2.3. The scope of personal data processed by the Controller depends on the type of activities undertaken in the Website. The Controller processes personal data to the following extent:

2.4. Irrespective of the personal data indicated in item 3 above, the Controller may collect personal data from other sources if such data are publicly available, in particular on the Internet, in order to develop and improve the language models that power the artificial intelligence through which we provide services to Users who have purchased a subscription in the Website. In particular, the Website uses publicly available sources of publications of judgments of common courts and of the National Appeals Chamber (KIO), including by processing personal data of the persons issuing rulings in specific cases, only to the extent that such data appear in the content of the judgments.

2.5. The Controller informs that personal data contained in documents added to the Website by the User will be encrypted in order to protect personal data. The User is entitled to provide the Controller exclusively with personal data concerning the User themselves. Providing the Controller with personal data of other persons by the User is possible only if the User processes those data in accordance with generally applicable law and after concluding with the Controller an agreement on entrusting the processing of personal data (if you wish to conclude one, please contact the Controller). By making personal data available in the Website (including by sharing documents or interacting with the artificial intelligence language model through which the Controller provides services), the User consents to the processing of those personal data and declares that they are authorised to provide those personal data to the Controller. Where the content or a document the User wishes to share in the Website contains personal data of other persons, the User is obliged to appropriately anonymise the document or content before sharing it in the Website if it contains personal data of third parties. The Controller is not liable for unlawful provision to it by the User of personal data of third parties.

2.6. The Controller informs that personal data made available by the User will be used to provide information by the artificial intelligence at the User's express instruction, or to analyse documents using OCR technology and the artificial intelligence language model in order to: (1) respond to the User's instruction, (2) develop the artificial intelligence language model through which the Controller provides services to the User.

3. Legal bases and purposes of data collection

Your personal data will be processed by the Controller in order to:

• 3.1. perform the contract concluded by the User with the Controller on the terms described in the terms of service available in the Website, and to conclude with the User a contract for the provision of services by the Controller — on the basis of Article 6(1)(b) GDPR, i.e. processing necessary for the performance of a contract to which the User is a party (including: proper provision of the service in accordance with the terms of service accepted by the User, with appropriate quality, and handling complaints submitted by the User);
• 3.2. present a price offer for a subscription for the use of the Controller's services in response to a User's inquiry submitted via the contact form in the Website — on the basis of Article 6(1)(b) GDPR, i.e. processing necessary for the conclusion of a contract;
• 3.3. answer inquiries directed to the Controller via the contact form available in the Website, by e-mail or by phone — on the basis of Article 6(1)(f) GDPR, i.e. processing is a realisation of the Controller's legitimate interest related to developing relationships with clients or potential clients and pursuing the sale of goods and services offered by the Controller;
• 3.4. fulfil the Controller's legal obligations regarding tax obligations and obligations arising from the Accounting Act — on the basis of Article 6(1)(c) GDPR, i.e. compliance with the Controller's legal obligations arising from generally applicable provisions of law, in particular in the scope of tax law and obligations arising from the Accounting Act, in particular as regards storing accounting documentation and properly recording sales;
• 3.5. enable proper display of the Website on the end devices of Users and Unregistered Users, ensure the security and stability of the Website, and keep statistics and perform analyses for the purpose of developing and improving the quality of services offered by the Controller — on the basis of Article 6(1)(f) GDPR, i.e. processing is a realisation of the Controller's legitimate interest related to enabling proper display of the Website and increasing the quality of the services and of the Website offered by the Controller;
• 3.6. send marketing content via the communication channel to which the User has given voluntary consent, i.e. by electronic message to the indicated e-mail address, in order to present offers and commercial terms and information about changes in the Website — on the basis of Article 6(1)(a) GDPR, i.e. processing takes place on the basis of your voluntarily given consent; and pursuing and defending against potential claims — the processing is based on Article 6(1)(f) GDPR, i.e. a realisation of the Controller's legitimate interest in promoting the provision of its services and building relationships with clients;
• 3.7. pursue or defend against claims submitted by or against the Controller — on the basis of Article 6(1)(f) GDPR, i.e. processing is a realisation of the Controller's legitimate interest related to defending against claims submitted to the Controller or enabling the Controller to submit claims.

4. Retention period of personal data

4.1. Your personal data will be processed by the Controller only for the period necessary to achieve the purpose for which the personal data were collected by the Controller, i.e. for the period:

• 4.2. in the case of personal data processed in connection with the registration of an account in the Website and the performance of the contract concluded by the User with the Controller on the terms described in the terms of service available in the Website — for the entire period of providing services to the User, i.e. for as long as the User has an account in the Website, and after its deletion — for the period necessary for protection against claims, i.e. up to 6 years counted from the date of deletion of the account;
• 4.3. in the case of personal data processed in connection with presenting a price offer for a subscription in response to a User's inquiry submitted via the contact form in the Website — where:
  • the commercial inquiry resulted in the User concluding a contract for paid services within a subscription — for the period indicated in item 4.4 below;
  • the commercial inquiry did not result in the User concluding a contract for paid services within a subscription — personal data related to the commercial inquiry will be processed for a period of 1 year from the date of submission of the inquiry;
• 4.4. in the case of personal data processed in connection with the conclusion and performance of a contract for paid services (subscription) — for the entire period the User and the Controller are bound by the contract for paid services, and after its termination — for the period necessary for protection against claims and for fulfilling legal obligations in the scope of tax law and accounting (item 4.6 below);
• 4.5. in the case of personal data processed in order to answer inquiries directed to the Controller — for a period of 1 year from the last contact;
• 4.6. in the case of personal data processed in order to fulfil the Controller's legal obligations regarding tax obligations and obligations arising from the Accounting Act — for the period resulting from generally applicable provisions of law, i.e. for a period of 6 years from the date of the last settlement or the last action producing legal effects;
• 4.7. to enable proper display of the Website on the end devices of Unregistered Users, ensure the security and stability of the Website, and keep statistics and perform analyses for the purpose of developing and improving the quality of services offered by the Controller — for the period indicated in section 8 (Cookie policy) below;
• 4.8. to send marketing content via the communication channel to which the User has given voluntary consent — for the period needed to achieve the purpose for which the data were collected, no longer than until the day the User withdraws their consent. Withdrawal of consent does not affect the lawfulness of the processing of personal data carried out before the consent was withdrawn.

5. Recipients of data

5.1. Personal data may be transferred to Recipients of data processing data on behalf of the Controller. These are entities providing IT and new technology services, marketing, communication and analytical services (including organising satisfaction and preference research), electronic services, entities participating in the performance of contracts, entities providing settlement, payment and debt collection services, and entities providing advisory and legal services. Recipients of data may also include entities entitled to obtain data on the basis of legal provisions, including law enforcement authorities, tax authorities or other public authorities and institutions involved in the performance of contracts.

5.2. We inform that personal data processed by the Controller may be transferred to providers of services supplying the engines (API) powering the artificial intelligence developed by us, through which the Controller provides services to you, i.e. to Gladia SAS and RunPod Inc., in the scope of the queries you enter that are processed by the artificial intelligence through which the Controller provides its services within the Website, in order to process them. The indicated entities process personal data on the basis of agreements on the entrustment of personal data processing concluded with the Controller, which incorporate standard contractual clauses approved by the European Commission.

5.3. The Controller may transfer personal data to Recipients of data outside the EEA, Switzerland and the United Kingdom for the purposes that have been clearly described in this Privacy Policy. Such Recipients of data may not be subject to the provisions applicable in the territory of the EEA. If the Controller transfers data to entities having their registered office in countries located outside the EEA, it will require that:

• it complies with European Commission decisions regarding an adequate level of data protection in relation to certain countries;
• it relies on standard contractual clauses approved by the European Commission.

5.4. If you wish to obtain more information about the transfer of your personal data by the Controller, including about the entities to which your personal data have been transferred, and to obtain information about the forms of protection of your data applied by us in this respect, please contact us at: rodo@gaius-lex.pl.

6. Profiling

6.1. Users' data may be subject to profiling, i.e. automated processing of data through which the Controller evaluates selected factors in order to analyse your behaviour or make a prediction about the future. In this way the Controller creates personalised profiles of Users, which allows better tailoring of the content, proposals and advertisements transmitted to the individual preferences and interests of Users.

6.2. The profiling described above will not result in decisions producing legal effects or significantly affecting Users.

6.3. The legal basis for the processing of data mentioned above is Article 6(1)(f) GDPR, i.e. the Controller's legitimate interest consisting in acquiring customers and conducting ordinary business activity and increasing the attractiveness of the Website's offer both for potential customers and for Users who have purchased a subscription for paid use of the Website's services, including better tailoring of the content displayed in the Website.

6.4. You may at any time object to such a manner of processing your personal data. The data will be processed on this basis until an effective objection is raised or until the data are deleted for other reasons.

7. Requirement to provide personal data

7.1. The provision of any personal data is voluntary and depends on your decision. However, in certain cases the provision of specific personal data is necessary in order to enable the conclusion and performance of a contract with the Controller.

7.2. In order to register an account in the Website, the following data must be provided: e-mail address and phone number — without this information the Controller will not conclude a contract with you and you will not have access to the Website.

7.3. In order to purchase a subscription and use the services within the Website, the following data must be provided: name and surname, e-mail address, correspondence address, the business name under which the User operates their business, the business address, and NIP number. It is also necessary to provide the Controller with the data indicated in section 2 (item 3.3 of the table) of this Privacy Policy. Without the indicated data the Controller will not be able to conclude with you a contract for paid services, correctly issue accounting documents, or properly provide its services within the Website.

7.4. In order to answer your inquiries by phone or e-mail regarding the performance of the service, or inquiries about the subscription and the possibility of purchasing it, it is necessary to provide contact data — without this the Controller will not be able to contact you.

8. Cookie policy

8.1. The Website uses information stored by means of "cookies", understood as IT data stored on the end devices of persons using the Website (regardless of whether you use the Website as Users or Unregistered Users). These files are intended for use with websites and allow the user's device to be recognised and the website to be properly displayed, tailored to individual preferences. They usually consist of the name of the website they come from, the time they are stored on the end device, and a unique number.

8.2. The Website uses the following types of cookies:

• necessary — cookies required for the minimal operation of the Website, in order to display it properly;
• statistical — cookies enabling the collection of information about how you use the Website and the examination of your actions taken within the Website;
• functional — cookies that enable the "remembering" of the settings you have selected and the personalisation of the interface, e.g. in terms of the selected language, font size, or the appearance of the Website;
• marketing — session cookies; the Controller stores these data until you withdraw your consent. These data are processed until the data are deleted or until consent is withdrawn, which does not affect the processing carried out before the consent was withdrawn.

8.3. Most web browsers accept the saving of cookies by default.

8.4. In accordance with the law, the Controller may store cookies on your end device if this is necessary for the functioning of the Website (i.e. necessary, analytical and functional cookies). For the use of other types of cookies (marketing cookies) the Controller needs your permission. By using the Website, and by appropriately configuring the settings of your browser or end device, you consent to the use of cookies and other similar technologies in accordance with this Cookie Policy and the Privacy Policy.

8.5. Within our Website the following types of cookies are used: "session" cookies (session cookies) and "persistent" or "temporary" cookies (persistent cookies). "Session" cookies are temporary files stored on your end device until you leave the website or switch off the web browser. "Persistent" cookies are stored on the end device for the time specified in the cookie parameters or until you delete them. They are used to ensure your comfortable use of the Website. If you visit the Website again, these files are automatically recognised and allow the Website to establish that you have already visited the Website before and what actions you took, so that these actions do not have to be performed again.

8.6. The User and the Unregistered User have the option of determining the conditions of storing cookies:

• by setting their preferences in the panel available after the Website is loaded, which appears after the first load;
• by manually setting preferences within the web browser used, including partially or completely disabling the possibility of saving cookies on the end device.

8.7. If the User or Unregistered User disables the possibility of saving cookies on the end device (see item 8.6 above), in particular with regard to necessary cookies, the Website may not function properly and some of the Website's functionalities may be unavailable or work incorrectly.

8.8. The legal basis for the processing of data resulting from the use of necessary, statistical and functional cookies is Article 6(1)(f) GDPR, i.e. a legitimate interest manifested in the purposes of processing described in section 8.2 of this Privacy Policy. These data are processed until a justified objection is raised or until the data are deleted. The legal basis for the processing of data resulting from the use of marketing cookies is Article 6(1)(a) GDPR, i.e. your consent expressed by configuring the end device in a way that allows these cookies to be saved on it.

8.9. Gaius-Lex uses Google Analytics, Facebook Conversion Pixel and Microsoft Clarity.

9. Rights of persons whose data are processed

9.1. In connection with the processing by the Controller of your personal data, you have the following rights in respect of those data:

• the right to access the processed personal data and to receive a copy of those data;
• the right to request the rectification (correction, completion) of the data, the restriction of their processing or their erasure;
• the right to request the transfer of the data processed by the Controller, i.e. you may receive them in a structured, commonly used, machine-readable format, if the processing takes place on the basis of consent pursuant to Article 6(1)(a) GDPR or on the basis of a contract pursuant to Article 6(1)(b) GDPR and at the same time the processing takes place using automated methods. When exercising the right to data portability you have the option of deciding that the personal data will be transferred by the Controller directly to another controller of data, if this is technically feasible;
• you may withdraw your consent at any time in the case of the processing of data: (1) for marketing purposes, based on your consent, (2) via cookies based on your consent, and (3) in any other case where you have given explicit consent to the processing of your data. Withdrawal will not affect the lawfulness of the processing of data prior to the withdrawal of your consent;
• the right to object to the use of the data for the purpose of establishing, pursuing or defending claims — where this is justified by your particular situation;
• the right to object to the processing of personal data for the purposes of direct marketing, including profiling, to the extent that the processing is related to such direct marketing — you have this right at any time and for any reason, and lodging the objection is free of charge;
• the right to lodge a complaint with the President of the Personal Data Protection Office if you consider that the processing of your personal data violates the provisions on the protection of personal data.

9.2. In order to exercise your rights indicated above, you may submit your requests to the Controller at: rodo@gaius-lex.pl or in writing, to the Controller's address indicated in section 1.1 of this Privacy Policy.

10. Changes to the Privacy Policy

10.1. This Privacy Policy may be changed by the Controller. Each time the Controller changes the Privacy Policy, it will publish the new, amended content of the Privacy Policy in the Website and will inform Users of this fact by e-mail, to the address indicated at registration in the Website.