Privacy Policy

Privacy Policy in compliance with the General Data Protection Regulation (RODO)

1. Information about the Data Controller

The data controller responsible for the processing of personal data in connection with this website, in accordance with Article 4(7) of the General Data Protection Regulation (GDPR), is:

CNC Biedermann
Email: biuro@cnc-mann.com
Website: https://jetskimann.com/

If you have any questions or concerns about the processing of your personal data, or if you wish to exercise your rights as described in this privacy policy, please contact us at the address indicated or by email.

2. Scope and Purposes of Data Processing

This privacy policy applies to all personal data collected and processed through this website, including but not limited to data obtained through forms, cookies and integration with third party services. The processing of personal data is carried out in accordance with the General Data Protection Regulation (GDPR) and relevant national laws, for the following purposes:

• Ensuring and optimising website functionality: To ensure the correct technical operation and security of the website, and to improve the user experience.
• Analysis of website traffic and user behaviour: To measure and analyse traffic and usage patterns of our website using analytical tools such as Google Analytics, Google Tag Manager and RankMath Analytics.
• Embedding and handling of external media: To deliver interactive content and functionality, including embedded Spotify players and YouTube videos, which may set cookies and process user data.
• Communication and responding to enquiries: If you contact us via email or contact forms, we process your data in order to respond to your queries and provide support.
• Compliance with legal obligations: In order to comply with our legal obligations regarding data protection, security and record keeping.

We only process data that is necessary for the above purposes and always in accordance with the principles of lawfulness, fairness, transparency, data minimisation, accuracy, restriction of storage, integrity and confidentiality, as defined by the RODO.

3. Types of Data Processed

In connection with your use of our website, we may process the following categories of personal data, depending on your interaction with the website:

• Usage data: Information about your visit to our website, such as the pages viewed, the time and length of your visit, navigation paths, referring page and interactions with elements of the website.
• Technical data: Information automatically collected by your browser or device, including IP address, browser type and version, operating system, device type, screen resolution, language preferences and information about cookies and similar technologies stored on your device.
• Data from Cookies and Tracking Technologies: Data collected through cookies and similar tracking technologies, including information related to your preferences, session IDs and analytics data (see separate section on cookies and tracking technologies).
• Communication data: If you contact us via email or contact forms on the website, we process the personal data you provide (such as your name, email address and the content of your message).
• Data from Inmate Services: When interacting with embedded third-party content, such as Spotify frames or YouTube videos, additional data may be collected and processed by these third-party providers (e.g. unique identifiers, session and usage data) in accordance with their own privacy policies.

We do not intentionally collect special categories of personal data (such as data revealing racial or ethnic origin, political opinions, religious beliefs, health data, etc.) through our website. Please refrain from submitting such sensitive information when using our services.

4. Cookies and Tracking Technologies

Our website uses cookies and similar tracking technologies to ensure that it functions properly, to improve user experience and to analyse website traffic. Cookies are small text files stored on your device that allow us or third-party providers to recognise your browser on subsequent visits. We distinguish between the following types of cookies used on our website:

• Essential Cookies: Te pliki cookie są niezbędne do prawidłowego funkcjonowania strony internetowej i nie mogą być wyłączone w naszych systemach. Umożliwiają podstawowe funkcje, takie jak nawigacja po stronie i dostęp do bezpiecznych obszarów. Niezbędne pliki cookie są również wymagane do prawidłowego działania osadzonych treści, takich jak ramki Spotify (np. sp_landing) i filmy YouTube (np. VISITOR_INFO1_LIVE, YSC). Wyłączenie tych plików cookie może skutkować ograniczoną funkcjonalnością strony internetowej.
• Analytical Cookies: These cookies help us understand how visitors interact with our website by collecting and reporting information anonymously. We use tools such as Google Analytics, Google Tag Manager and RankMath Analytics, which may set their own cookies to track user behaviour, collect statistics and generate aggregated reports. The data collected may include information about your visit, IP address (anonymised where possible), browser type, device information and pages visited.
• Third Party Cookies: When you access external media embedded on our website, such as Spotify players or YouTube videos, third-party providers may set additional cookies and process data in accordance with their own privacy policies. We recommend that you read the privacy policies of these providers for more information on their data processing practices.

When you first visit our website, you will be presented with a cookie banner that allows you to accept or manage your cookie preferences in accordance with current data protection legislation. You can withdraw your consent or adjust your cookie settings at any time using the options available in your browser or via the cookie management tool on our website.

5. Legal Basis for Processing

The processing of your personal data on this website is carried out in accordance with the provisions of the General Data Protection Regulation (GDPR) and other applicable data protection legislation. We process your data on the following legal bases, as applicable:

• Performance of a contract or taking action at your request prior to the conclusion of a contract (Article 6(1)(b) RODO): For example, when you contact us for information or support, we process your data in order to fulfil your request.
• Fulfilment of legal obligations (Article 6(1)(c) RODO): We may process your data in accordance with the requirements of applicable legislation, including obligations relating to data security, record keeping and cooperation with public authorities.
• Legitimate interests (Article 6(1)(f) RODO): We have a legitimate interest in ensuring the security and proper functioning of our website, analysing its use and optimising our services. Where possible, we rely on legitimate interests in processing technical and analytical data, provided that such processing does not infringe on your fundamental rights and freedoms.
• Consent (Article 6(1)(a) RODO): In cases where we use cookies and tracking technologies for analytical or marketing purposes, or where the processing is not strictly necessary for the operation of the website, we obtain your explicit consent before commencing such processing. You may withdraw your consent at any time with effect for the future.

Where processing is based on your consent, failure to provide it may limit the functionality of the website or certain services. We always strive to ensure that your rights and interests are respected and provide clear options for managing your data preferences.

6. Use of Third Party Services

In order to enhance the functionality of our website and to gain insight into user behaviour, we integrate several third party services that can process your personal data, mainly through the use of cookies and similar technologies. The main third-party services we use are:

1. a) Google Analytics
   We use Google Analytics, a web analytics service provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. Google Analytics helps us analyse website traffic and user behaviour by collecting and reporting information such as page views, time spent on pages and interactions with elements of the website. The data collected by Google Analytics may include your IP address (which is anonymised in accordance with the requirements of the DPA), browser type, operating system and usage data. Google may process this data on servers located in the European Economic Area (EEA) or, in some cases, in the United States. For more information, please see Google's Privacy Policy.
2. b) Google Tag Manager
   We use Google Tag Manager to effectively and securely manage website tags and scripts. This tool does not itself process personal data, but may run other tags that collect data. Any data collected through these tags is subject to the relevant third party privacy policies.
3. c) RankMath Analytics
   RankMath Analytics is an SEO and analytics tool that helps us understand website performance, user engagement and traffic sources. This tool can collect anonymised data about how visitors interact with our site, such as referral sources and search engine queries, in compliance with RODO.

We recommend that you read the privacy policies of these third party services to understand how your data is processed. Integration with these services is designed to comply with the requirements of the DPA, including, where applicable, anonymisation or pseudonymisation of data and management of user consent.

7. Recipients of Data

Your personal data may be shared with selected third parties only if necessary for the purposes described in this privacy policy and always in accordance with the DPA. The main categories of data recipients include:

• Service providers and processors: Korzystamy z usług starannie wybranych zewnętrznych dostawców usług (podmiotów przetwarzających) w celu wspierania działania i bezpieczeństwa naszej strony internetowej. Obejmuje to  wsparcie techniczne, infrastrukturę IT oraz dostawców usług analitycznych (np. Google Analytics, RankMath Analytics). Wszyscy tacy podmioty przetwarzające są umownie zobowiązani do przetwarzania danych osobowych wyłącznie zgodnie z naszymi instrukcjami i obowiązującymi przepisami o ochronie danych, w tym do zawierania umów powierzenia przetwarzania danych (DPA), jeśli jest to wymagane przez prawo.
• Third-party content providers: When you interact with embedded content, such as Spotify or YouTube, your data may be transferred directly to these third party providers. The processing of your data by such providers is subject to their respective privacy policies, and we encourage you to read these policies for further information.
• Public authorities: We may disclose your data to public authorities, law enforcement agencies or courts if required to do so by law or in response to valid legal requests.
• Other recipients: In exceptional cases, such as a merger, acquisition or sale of assets, your personal data may be transferred to the new owners or operators of the website, subject to further protection in accordance with this privacy policy and applicable data protection legislation.

We do not sell or rent your personal data to any third parties for marketing purposes. Except as described above, your data will not be disclosed to third parties without your express consent, unless required by law.

8. Data Storage and Hosting

All personal data collected through our website is stored on secure servers located in Poland, operated by our hosting provider.

We are fully committed to ensuring the maximum possible security of all personal data entrusted to us, including your name, company name, email address, telephone and fax numbers, as well as any other information - both public and confidential - that you provide to us. We use technical and organisational measures such as encrypted data transmission (SSL/TLS), firewalls, access controls, regular security audits and strict internal procedures to protect your data from unauthorised access, loss, destruction or alteration.

Only authorised personnel who have received the appropriate training and are bound by confidentiality obligations have access to your personal data. All information entrusted to us - whether unclassified or confidential - remains inaccessible to unauthorised persons and is treated with the utmost care and responsibility.

All data is processed and stored primarily in the European Economic Area (EEA), specifically in the territory of Poland. We do not transfer or store your personal data outside the EEA unless appropriate safeguards such as Standard Contractual Clauses or equivalent mechanisms have been applied, or if such transfer is necessary for the performance of the contract.

Access to your personal data is strictly limited to authorised personnel who require access for the purposes described in this policy and who are bound by confidentiality obligations.

9. Data retention period

We retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, to comply with applicable legal and regulatory obligations or in accordance with contractual requirements. The specific retention periods depend on the type of data and the purpose of the processing and are determined in accordance with the following criteria:

• Usage and analytical data collected via cookies and third-party tools (such as Google Analytics, RankMath Analytics) are typically stored for up to 26 months, unless you withdraw your consent earlier. Data retention periods for third-party cookies are determined by the respective providers and more details can be found in their privacy policies.
• Data provided via contact forms or e-mail correspondence (including your name, company name, email address, telephone number, fax number and the content of your enquiry) are stored for as long as necessary to process and respond to your enquiry, and for a maximum period of 3 years after the end of your enquiry, unless further storage is required to comply with legal obligations (e.g. for accounting, tax or dispute resolution purposes).
• Data relating to contractual obligations (if you become our customer or business partner) may be retained for the duration of the contract and for up to 6 years thereafter in order to fulfil legal, accounting or regulatory requirements.

At the end of the retention period or when data is no longer needed for a specific purpose, your personal data will be securely deleted, anonymised or, where appropriate, archived in accordance with legal requirements. We regularly review the data we hold and delete or anonymise it when it is no longer necessary for processing.

You have the right to request the erasure of your personal data at any time, subject to certain exceptions provided by law. For more information on your rights, please see the 'Data Subject Rights' section below.

10. Rights of Data Subjects

Under the RODO, you have a number of rights regarding the processing of your personal data. These include:

• Right of access - You have the right to obtain confirmation as to whether or not personal data relating to you is being processed and, if so, to access that personal data and information on how it is being processed.
• Right of rectification - You have the right to request the rectification of inaccurate or incomplete personal data concerning you.
• Right to erasure ("right to be forgotten") - You may request the deletion of your personal data when it is no longer necessary for the purposes for which it was collected or if you withdraw your consent, among other things.
• Right to restrict processing - In certain circumstances, you have the right to request the restriction of the processing of your personal data.
• Right to data portability - You have the right to receive your personal data that you have provided to us in a structured, commonly used machine-readable format and to have this data sent to another controller.
• Right to object - You have the right to object, on grounds relating to your particular situation, to the processing of your personal data, including for direct marketing purposes.
• Right of withdrawal of consent - Where the processing is based on your consent, you may withdraw it at any time with effect for the future.

Informal Withdrawal of Cookie Consent

You may also informally withdraw your consent to cookies and tracking technologies at any time by clearing cookies in your web browser. This action will immediately stop the collection of your data via these technologies on our website.

Important clarifications:

• Deleting cookies in your browser does not constitute a formal withdrawal of consent, which you may have given on various websites - but in practice, for a website, it is as if you were visiting it for the first time.
• Zgoda na pliki cookie i inne technologie śledzące jest zazwyczaj przechowywana w formie plików cookie (lub w localStorage przeglądarki). Po usunięciu tych plików strona internetowa nie będzie wiedziała, że wcześniej udzielili Państwo (lub odmówili) zgody, i ponownie zapyta o Państwa preferencje.
• Deleting cookies does not mean that the website 'remembers' your withdrawal of consent - it simply 'remembers nothing' and will ask for your choices again.

To sum up:
Clearing cookies causes your browser and websites to "forget" your previous choices and consents. As a result, you will see the cookie consent banner again on your next visit. However, from a data protection perspective, this is not a formal withdrawal of consent to processing - if you require a formal withdrawal, please do so via your account settings on the website or contact us directly.

11. Data security

We are fully committed to ensuring the security and confidentiality of your personal information. We implement a wide range of technical and organisational measures to protect your information from unauthorised access, loss, misuse, alteration or disclosure. These measures are regularly reviewed and updated in line with the latest data protection standards and best practices.

Our security measures include, but are not limited to:

• Encrypted data transmission: All data exchanged between your device and our website is protected using SSL/TLS encryption.
• Secure server infrastructure: Our hosting provider uses modern and secure server facilities located in the European Economic Area, with robust access controls, firewalls and intrusion prevention systems.
• Access controls: Access to your personal data is strictly limited to authorised personnel who need it to perform their duties, and all such personnel are bound by strict confidentiality obligations.
• Regular audits and monitoring: We conduct regular reviews of our systems and procedures to identify and address potential security vulnerabilities.
• Data minimisation and pseudonymisation: Wherever possible, we limit the collection and processing of personal data to what is strictly necessary and use pseudonymisation or anonymisation techniques to enhance privacy.
• Staff training: Our employees regularly receive training on data protection, information security and privacy responsibilities.

Despite our best efforts, no system can guarantee absolute security. However, we aim to maintain the highest possible level of protection for your personal data by constantly monitoring risks and responding quickly to any incidents. In the unlikely event of a data breach that may pose a risk to your rights and freedoms, we will notify you and the relevant supervisory authority without undue delay, as required by law.

12. International Data Transfers

As a matter of principle, we aim to ensure that your personal data is processed and stored in the European Economic Area (EEA), in particular in Poland, where our main hosting provider is located.

However, some of our third party service providers, such as Google (for Analytics and embedded YouTube content) and Spotify, may also transfer data to servers located outside the EEA, including to the United States or other jurisdictions. Transfers of personal data outside the EEA are carried out in accordance with applicable data protection laws. We ensure that appropriate safeguards are in place to protect your data, such as standard contractual clauses approved by the European Commission, or other mechanisms that provide an adequate level of protection in accordance with Article 46 of the DPA. These providers are responsible for ensuring that appropriate safeguards are in place and for compliance with applicable data protection legislation. More information on their data transfer mechanisms and security measures can be found in their respective privacy policies.

We take all reasonable steps to ensure that your data is processed securely and in accordance with this privacy policy, wherever it is processed.

13. Policy changes

We reserve the right to update or modify this privacy policy at any time to reflect changes in our practices, legal requirements or in response to new technological developments or the introduction of new services. Any updates or changes will be posted on this page, including the date of the most recent update, and will become effective upon publication unless otherwise specified.

We encourage you to review this privacy policy regularly to keep up to date with how we protect your personal data and any changes that may affect your rights or how we process your data. Material changes to this policy, or changes that materially affect your privacy rights, will be communicated to you directly where possible (for example, by email or notification on our website).

Your continued use of our website after the publication of changes to this privacy policy implies your acceptance of these changes.

We take all privacy issues seriously and will respond to your enquiry as soon as possible and, in any case, within the deadlines required by applicable data protection legislation. If you believe that your data protection rights have been violated, you also have the right to lodge a complaint with your local data protection supervisory authority or the competent supervisory authority in the European Union. In Poland, the supervisory authority is the President of the Office for Personal Data Protection (UODO).