Legal

PRIVACY POLICY

Your privacy matters to us. This policy explains what personal data we collect when you visit productbooster.com, create an account, use our services, contact us, subscribe to our newsletter or interact with us on social media — and what we do with it.

We process personal data in accordance with applicable law, including Regulation (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (the "GDPR"). Below you will find the key information: what data we collect, why and on what legal basis we process it, how long we keep it, who we share it with, and what rights you have.

WHO IS THE DATA CONTROLLER?

The controller of your personal data is SORVE spółka z ograniczoną odpowiedzialnością with its registered office in Warsaw, Poland, at al. „Solidarności" 68/121, 00-240 Warsaw, entered in the register of entrepreneurs of the National Court Register under KRS number 0001251512, NIP 5253096470, REGON 545200116, operating the service under the ProductBooster brand. If you have any questions or concerns, you can contact us at [email protected].

WHAT DATA DO WE COLLECT, AND HOW?

When you use productbooster.com (the "Website"), you may be asked to provide personal data. Providing it is voluntary, but in some situations necessary — for example, without your email address we cannot create your account, send you our newsletter, or reply to a message sent through the contact form.

Some data is collected automatically through cookies and similar technologies when you visit the Website — such as your IP address, browser type and operating system. We use it to administer and host the Website and to deliver relevant marketing content. You can block or limit cookies at any time in your browser settings or with freely available tools.

WHY DO WE PROCESS YOUR DATA, ON WHAT LEGAL BASIS, AND FOR HOW LONG?

We process your personal data for the following purposes:

  • To enter into and perform the service agreement — registering and maintaining your account, handling orders for free and paid services, and delivering the service. Legal basis: performance of a contract, or steps taken at your request before entering into one (Art. 6(1)(b) GDPR). We keep this data until the service ends — i.e. your account is deleted or the agreement is terminated.
  • To meet our tax and accounting obligations — issuing invoices and retaining accounting records. Legal basis: our legal obligations (Art. 6(1)(c) GDPR). We keep this data until the tax liabilities become time-barred.
  • To meet our data-protection obligations — legal basis: our legal obligations (Art. 6(1)(c) GDPR). We keep this data until claims for breaches of data-protection law become time-barred.
  • To establish, pursue or defend legal claims — legal basis: our legitimate interest (Art. 6(1)(f) GDPR) in protecting our rights before courts and public authorities. We keep this data until the relevant limitation periods expire.
  • To keep the Website running properly and analyse how it is used — including analytics and statistics on individual features (e.g. Google Analytics cookies, the Meta Pixel). Legal basis: our legitimate interest (Art. 6(1)(f) GDPR). We process this data until you effectively object or the purpose is achieved.
  • To run our social media pages and groups — and interact with users there, in order to promote the service and adapt it to current needs. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR). We keep this data until the relevant limitation periods expire.
  • To answer your questions — whether asked by phone, email, the contact form or live chat. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR) in communicating with customers and prospects. We keep this data until the relevant limitation periods expire.
  • For marketing — promoting our products and services, maintaining business relationships and measuring customer satisfaction. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR) or, where required, your consent (Art. 6(1)(a) GDPR). We process this data until you effectively object or the purpose is achieved — and where processing is based on consent, until you withdraw it (withdrawal does not affect the lawfulness of processing carried out beforehand).

In short: we keep personal data only as long as necessary to achieve the purposes above, unless you make a valid request for erasure. In some cases the retention period follows directly from the law — for example for financial records or limitation periods for claims.

WHO DO WE SHARE YOUR DATA WITH?

Where necessary, we rely on trusted third parties to help us deliver our services. Before any data is shared, we require each recipient to guarantee adequate protection and confidentiality. Recipients of your data may include:

  • providers involved in performing our agreements — such as our accounting office, IT service providers, hosting providers and payment providers;
  • providers whose tools we use in our business under separate agreements — such as website analytics and direct marketing tools, landing page and lead capture tools, office software, project management software and communication tools;
  • public authorities entitled to receive the data under applicable law;
  • other entities whose request for the data has a valid legal basis.

DO WE TRANSFER DATA OUTSIDE THE EEA?

As a rule, we do not transfer personal data outside the European Union or the European Economic Area (EEA). If a transfer becomes necessary in connection with our services, we will assess the circumstances and ensure an adequate level of protection so that the processing complies with applicable law.

In running the Website we use services and technologies provided by companies such as Meta, Microsoft and Google, which are headquartered in the United States and may process some data on servers located outside the EEA. Under the GDPR these are entities located in third countries, for which an adequate level of protection or appropriate safeguards must be demonstrated. These providers rely on compliance mechanisms provided for by the GDPR (such as certifications) or the standard contractual clauses adopted by the European Commission (Art. 46(2)(c) GDPR). More information about how they process data is available on their websites.

DO WE PROFILE YOUR DATA?

The Website and the technologies we use may involve profiling — using data such as gender, age, interests, approximate location and behaviour on the Website to assess activity and potential interest in our services. Profiling allows us to personalise offers and adverts; it has no effect on the terms of any agreement you conclude with us. The information processed for this purpose is anonymous and is not linked to identified users ordering our services. We do not make any automated decisions that would produce legal effects for individuals or similarly significantly affect them.

WHAT DATA DO WE PROCESS AS A PROCESSOR?

Where we act as a processor, we process personal data solely on the documented instructions of the relevant controller (under a data processing agreement). We commit to protecting that data with appropriate technical and organisational measures and to ensuring a level of security appropriate to the risk (in line with Art. 32 GDPR). Everyone we authorise to process such data is bound by confidentiality. Once the services involving the entrusted data end, we return all of it to the controller (our customer) and delete existing copies, unless applicable law requires us to retain it.

DO WE USE COOKIES?

Yes. The Website uses cookies — small text files stored on your computer, phone, tablet or other device, which can be read by our systems and by systems of the providers we work with, such as Meta and Google.

Cookies let us collect anonymous data about visits to the Website, which we use to improve its features, identify errors and support marketing activities.

Most browsers allow cookies by default. You can block or limit them at any time in your browser settings or with other freely available tools. On your first visit we display a notice about our use of cookies; if you do not change your browser settings, you consent to their use. Details on managing cookies are available on your browser provider's website.

Please note that disabling or limiting cookies may make the Website harder to use — for example pages may load more slowly, and some features (such as liking our page on Facebook) may be unavailable.

HOW DO WE PROTECT YOUR DATA?

To ensure a consistently high level of protection, we apply safeguards appropriate to the processing, including:

  • TLS encryption of data in transit;
  • regular backups;
  • data centres equipped with data-protection mechanisms;
  • regular security testing;
  • monitoring of personal data security;
  • minimising the risk of abuse and responding quickly if it occurs;
  • implementing data-protection policies;
  • ensuring the ongoing confidentiality, integrity, availability and resilience of our processing systems and services;
  • granting access to personal data only to authorised persons;
  • creating and regularly rotating passwords to systems in which personal data is processed.

WHAT ARE YOUR RIGHTS?

If we process your personal data, you have the right to:

  • access your data;
  • have it rectified;
  • have it erased;
  • restrict its processing;
  • object to its processing;
  • data portability;
  • withdraw your consent (where consent is the basis for processing).

These rights are not absolute — in some situations, after assessing the request, we may lawfully decline to fulfil it. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

If you exercise any of these rights, we will respond without undue delay and no later than within one month of receiving your request. If, due to the complexity or number of requests, we cannot respond within a month, we will do so within a further two months — after first informing you of the extension.

HOW CAN YOU COMPLAIN ABOUT OUR HANDLING OF YOUR DATA?

If you believe we process your personal data unlawfully, you can lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), the Polish supervisory authority.

DOES USING THE WEBSITE INVOLVE SERVER LOGS?

Using the Website involves sending requests to the server hosting it. Each request is recorded in the server logs, which include, among other things, the IP address, server date and time, and information about the browser and operating system used.

Data recorded in server logs is not linked to specific individuals using the Website and is not used to identify you. The logs serve only as auxiliary material for administering the Website, and their contents are disclosed to no one other than persons authorised to administer the server.

CAN WE CHANGE THIS PRIVACY POLICY?

Yes. Data protection is an ongoing process that we adapt to current needs and evolving technology. This Privacy Policy may therefore be supplemented or amended. We will inform you of changes by posting a notice on the Website and — in the case of material changes — by sending registered users a separate notification by email.