Privacy Policy

1. Data controller

The controller of Rejestr360 user data is K&K GLOBAL SOLUTIONS Sp. z o.o., KRS 0001117071, NIP 5842854900, address: ul. Józefa Sowińskiego 59/46, 01-105 Warszawa.

For privacy matters, contact us at kontakt@kkglobal.pl.

2. Data we process

• account data, in particular your email address, user identifier, information about the sign-in method and account settings;
• data related to private features, such as monitored companies, monitoring settings, saved views and plan entitlements;
• data provided to Address Control, such as company identifiers, agreement numbers and statuses, agreement dates and — if supplied by the user — information about settlement/payment status; the uploaded file is used only for import and is not stored;
• technical and security data, such as IP address, device information, HTTP requests, authentication events and information needed to limit abuse;
• service-use data including Google Analytics 4 (G-6QZJF61JTL) data such as page category, device type, approximate location, limited acquisition source and the public KRS/NIP of the viewed company; sign-in and confirmed-purchase events also include the sign-in method and limited transaction data (internal identifier, product, amount, tax and currency); we do not send entered search text, personal names, email addresses, passwords or Stripe identifiers;
• the content of correspondence when you contact us about the service;
• public information from public registers concerning entrepreneurs, companies and people holding disclosed roles in business entities, to the extent necessary to operate Rejestr360.

3. Purposes and legal bases

• creating and operating an account and providing Rejestr360 features — performance of a contract or steps taken before entering into a contract;
• comparing a supplied agreement list with public registry data and presenting discrepancies in Address Control — performance of a contract;
• traffic and usability measurement, including Google Analytics 4 — our legitimate interest in developing and evaluating the service; you can disable analytics using Privacy settings in the footer;
• protecting accounts, preventing abuse, diagnostics and service security — our legitimate interest;
• handling enquiries and complaints and establishing, pursuing or defending claims — performance of a contract, legal obligations and legitimate interests;
• processing public registry data for searching, comparison, source presentation and monitoring business changes — our legitimate interest in providing information about business entities;
• complying with obligations imposed by law — legal obligation.

4. Service providers and recipients

We use providers of cloud infrastructure, application hosting, database and authentication services, transactional email and protection against automated abuse. They receive only the data necessary to provide the entrusted services and act under appropriate agreements or their own legal obligations.

Google Analytics 4 (Google Ireland Limited / Google LLC), measurement ID G-6QZJF61JTL, starts automatically. Advertising storage and ad personalisation are disabled. You can disable analytics using Privacy settings in the footer; doing so does not restrict service features. Disabling stops further measurement, removes accessible Google analytics cookies and is stored in your browser for up to 180 days. Data may be processed outside the EEA using mechanisms permitted by the GDPR. An additional Google tool: tools.google.com/dlpage/gaoptout.

Data may also be disclosed to authorised public authorities where required by law. We do not sell users' personal data as a marketing database.

5. Transfers outside the EEA

Some technology providers may process data outside the European Economic Area. In those cases we use mechanisms permitted by the GDPR, in particular adequacy decisions or standard contractual clauses, depending on the provider and service.

6. How long we retain data

As a rule, account and private-feature data is retained while you use the account and afterwards for the period necessary to settle obligations or claims. Data imported into Address Control is retained until the user deletes the location or account; the file itself is not retained. Security data and logs are retained for a limited period appropriate to the purpose of protecting the service. Google Analytics data is retained according to the service retention setting (by default up to 14 months). Public registry data may be retained for longer where necessary to preserve the source or change history.

7. Your rights

Where provided by law, you may request access to your data, rectification, erasure, restriction of processing and data portability, and you may object to processing based on legitimate interests. Where processing is based on consent, you may withdraw that consent for the future.

You also have the right to lodge a complaint with the President of the Polish Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych).

8. Automation and data sources

Rejestr360 automatically organises and compares information from registry sources. We do not make decisions about users that produce legal effects solely on the basis of automated profiling. Company signals and summaries are informational and should be verified against the indicated sources.

9. Changes to this policy

We may update this policy when features, providers or applicable laws change. The current version is published at this address together with its effective date.