Privacy Policy - Latwy Start

1. Data controller

The controller of your personal data is:

ŁATWY START sp. z o.o., ul. Płocka 5A lok. 6, 01-231 Warszawa, woj. mazowieckie, Polska; KRS 0000964608, NIP 1231511132, REGON 521672800.

Contact for all matters relating to the processing of personal data: info@latwy-start.pl.

A Data Protection Officer (DPO) has not been appointed. For matters relating to your data, please contact us at the address above.

2. Categories of data processed

Depending on how you use the website, we process the following categories of data:

Data from application and contact forms: first name (and surname if provided), e-mail, phone number and/or Telegram handle, citizenship, position/specialisation, type of visa or residence card (e.g. visa, karta pobytu), and any other information you voluntarily provide in your message.
Client data (if the application leads to a contract for incubator services): data necessary to provide the service and for settlements, to the extent agreed in the contract.
Resident data (persons you indicate when services are provided, if applicable): data necessary to perform the contract, to the minimum extent required.
Technical data: IP address, cookie data, browser type and version, access time, referral source (referrer), advertising click identifier (Google Click ID) — if you arrived at the site from a Google ad, website usage statistics.

Citizenship and the type of visa/card do not constitute special categories of data within the meaning of art. 9 GDPR (race/ethnicity, health, religion, biometrics, etc.) — immigration status and citizenship do not fall into this category.

3. Purposes of processing, legal bases and retention periods

3.1. Data collected via forms on the website (applications and enquiries)

Purpose: handling your application/enquiry, contacting you and taking steps prior to entering into a contract for incubator services (responding to the enquiry, assessing whether the service can be provided).
Basis: art. 6 (1) (b) GDPR (steps taken at the data subject's request prior to entering into a contract). If the enquiry is not related to a possible contract (a general enquiry) — art. 6 (1) (f) GDPR (legitimate interest: responding to the enquiry).
Retention period: if the application did not result in a contract — the data is stored for a limited period necessary to handle the enquiry and any repeat contact, then deleted — no later than 12 months from the last contact. If the application did result in a contract — see section 3.2.

3.2. Provision of incubator services (client and resident data)

Purpose: entering into and performing the service contract, settlements, client support.
Basis: art. 6 (1) (b) GDPR (performance of the contract).
Retention period: for the duration of the contract and, after it ends, until the limitation period for any mutual claims expires.

3.3. Accounting and tax obligations

Purpose: issuing and storing accounting/tax documents, settlements, reporting.
Basis: art. 6 (1) (c) GDPR (compliance with the Controller's legal obligations).
Retention period: for the period required by the law of the Republic of Poland for storing accounting and tax documentation — generally 5 years, counted from the end of the calendar year in which the tax payment deadline fell (the exact period depends on the type of document).

3.4. Marketing (newsletter, offers, partner program)

Purpose: sending commercial and marketing information through the indicated communication channels.
Basis: art. 6 (1) (a) GDPR (consent). Consent is voluntary and is not a condition for handling the application.
Retention period: until consent is withdrawn. Withdrawal does not affect the lawfulness of processing before withdrawal.

3.5. Website security, protection of rights, pursuit of claims

Purpose: ensuring the technical security of the website, preventing abuse, establishing, pursuing and defending legal claims.
Basis: art. 6 (1) (f) GDPR (the Controller's legitimate interest).
Retention period: for as long as the legitimate interest exists, in particular until the limitation period for any claims expires.

3.6. Cookies and analytics

See section 7 and the separate Cookie Policy (/cookie-policy-eu/). The basis for technically necessary cookies is art. 6 (1) (f) GDPR; for analytics/marketing cookies — art. 6 (1) (a) GDPR (consent given via the cookie banner).

TikTok Pixel (provider — TikTok Technology Limited): remarketing and measuring ad effectiveness based on site visitors' behaviour. The tag fires exclusively after you have given marketing consent via the cookie banner (just like Meta Pixel and LinkedIn Insight Tag); no data is sent before consent. We do not use so-called advanced matching — no e-mail or other contact data is transmitted through TikTok Pixel. Legal basis: art. 6 ust. 1 lit. a RODO and art. 398 Prawa komunikacji elektronicznej.

3.7. Measuring advertising effectiveness (Google Ads offline conversions)

Purpose: measuring the effectiveness of Google Ads advertising campaigns by linking your application with a prior ad click (so-called offline conversions). For this purpose, the advertising click identifier (Google Click ID / gclid), together with the date and time of the application, may be transferred to Google.
Basis: art. 6 (1) (a) GDPR (marketing consent given via the cookie banner). We transfer the data only when you have given marketing consent; otherwise the identifier is not transferred.
Retention period: until consent is withdrawn; on Google's side — in accordance with Google Ads rules.

3.8. Sharing of the hashed e-mail address with advertising platforms (advertising audiences)

Purpose: showing you ŁATWY START ads, excluding you from selected advertising campaigns, and building lookalike audiences on that basis (Custom Audiences / Lookalike Audiences).
What exactly is shared: your e-mail address solely in hashed form (irreversible SHA-256 hash). The address in plain form is not shared with advertising platforms.
Recipients (closed list): Meta Platforms Ireland Ltd. (Facebook, Instagram), Google Ireland Ltd. (including YouTube), LinkedIn Ireland Unlimited Company, Microsoft Ireland Operations Limited (Microsoft Advertising, Bing). Your data is not shared with other advertising platforms for this purpose.
Basis: art. 6 (1) (a) GDPR - separate marketing consent expressed by a checkbox that is not pre-ticked, in a form on the website or on a paper form. Without such consent no sharing takes place. Suppressing ads to you may also be carried out on the basis of art. 6 (1) (f) GDPR (legitimate interest: not showing ads to people who are already our clients).
Retention period: until consent is withdrawn. Withdrawal - by e-mail to info@latwy-start.pl; withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
Transfer outside the EEA: see section 5.

4. Data recipients

Your data may be shared with the following categories of recipients (where necessary and to a minimum extent):

the provider of hosting and IT infrastructure for the website — as a processor;
the provider of e-mail / newsletter services — as a processor;
the entity keeping the Controller's accounts (accounting office) — as a processor;
providers of analytics and advertising tools used on the website (via the tag manager): Google (Google Analytics and Google Ads, including offline conversion measurement) and Meta Platforms (Meta Pixel);
TikTok Technology Limited (TikTok Pixel) — see section 3.6;
advertising platforms to which, where you have given marketing consent, your hashed (SHA-256) e-mail address is shared - see section 3.8. Closed list: Meta Platforms Ireland Ltd. (Facebook, Instagram), Google Ireland Ltd. (including YouTube), LinkedIn Ireland Unlimited Company, Microsoft Ireland Operations Limited (Microsoft Advertising, Bing);
public authorities to which the Controller is legally obliged to provide data (e.g. the tax office / Urząd Skarbowy, ZUS) — to the extent required by law.

We do not share your data with third parties for marketing purposes without your consent.

5. Transfer of data outside the EEA

In connection with the use on the website of Google (Google Analytics and Google Ads, including offline conversion measurement) and Meta Pixel (provider — Meta) your data may be transferred outside the European Economic Area (EEA), including to the USA. Such transfer takes place only with appropriate safeguards under Chapter V GDPR — in particular on the basis of a European Commission adequacy decision (the EU-US Data Privacy Framework, under which Google and Meta are certified) and/or standard contractual clauses (SCC). Analytics and marketing cookies related to these services are activated only after you give consent via the cookie banner. The click identifier (Google Ads, offline conversions) is transferred only where marketing consent has been given.

Likewise, where you have given marketing consent, your hashed (SHA-256) e-mail address may be shared with the advertising platforms listed in section 3.8 - Meta Platforms Ireland Ltd., Google Ireland Ltd., LinkedIn Ireland Unlimited Company, Microsoft Ireland Operations Limited - and therefore end up outside the EEA, including in the USA. Such a transfer takes place with appropriate safeguards under Chapter V of the RODO: on the basis of a European Commission adequacy decision (EU-US Data Privacy Framework) or standard contractual clauses (SCC), depending on the mechanism applied by the particular recipient. You may withdraw your consent at any time by writing to info@latwy-start.pl.

Data of site visitors collected via TikTok Pixel (provider — TikTok Technology Limited) may be transferred outside the EEA, including to third countries. No adequacy decision has been issued for this recipient, so the transfer is carried out on the basis of standard contractual clauses (SCC — art. 46 RODO). This concerns only data collected after you have given marketing consent; you may withdraw consent at any time in the cookie settings.

6. Rights of the data subject

You have the right to:

to access your data and obtain a copy of it;
to rectification (correction) of data;
to erasure of data ("the right to be forgotten") — to the extent not conflicting with the Controller's legal obligations;
to restriction of processing;
to portability of data (where processed on the basis of consent or contract, by automated means);
to object to processing based on legitimate interest (art. 6 (1) (f));
to withdraw consent — to the extent processing is based on consent; withdrawal does not affect the lawfulness of processing before withdrawal;
lodge a complaint with the supervisory authority.

To exercise your rights, write to info@latwy-start.pl.

7. Cookies

The website uses cookies. Technically necessary cookies enable the website to function; analytics and marketing cookies are installed only with your consent given via the cookie banner. Details (cookie types, purposes, periods, managing settings) can be found in the separate Cookie Policy: /cookie-policy-eu/.

Google Consent Mode (advanced mode)

Our website uses Google tools: Google Analytics 4 and Google Ads. They work together with the Google Consent Mode v2 mechanism in advanced mode. This means the Google script (gtag.js) loads as soon as you enter the website, before you make your choice in the cookie banner. The default setting is no consent.

If you reject cookies:

we do not store any analytics or advertising cookies on your device and do not read such files,
we do not create any identifiers that would allow us to recognise you on future visits.

Even without consent, the Google script sends basic technical signals to Google that contain no user identifiers. These are: the consent state (given or not), the address of the page viewed and the address of the referring page (referrer), the date and time of the visit, basic browser information (user agent), a random number generated anew on each page load, and an indication of whether the page address contained an ad-click parameter. Google does not combine these signals into a user profile. They are used solely for aggregated statistical estimation of conversion numbers (so-called conversion modelling), i.e. to understand how our website and our advertising perform.

The recipient of this data is Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Within the Google group, data may be transferred to Google LLC (USA). The transfer takes place on the basis of the European Commission's decision on the EU-US Data Privacy Framework (Google LLC holds an active DPF certification), with standard contractual clauses (SCC) as an additional safeguard.

The legal basis for this processing is our legitimate interest (art. 6 (1) (f) GDPR), consisting in the aggregated measurement of the effectiveness of the website and advertising in a way that does not require identifying the user.

You can change or withdraw your choice at any time: click the "" link or use the cookie settings icon on the website. The new setting takes effect from the moment it is saved.

8. Right to lodge a complaint with the supervisory authority

If you believe that the processing of your data infringes the GDPR, you have the right to lodge a complaint with the supervisory authority:

Prezes Urzędu Ochrony Danych Osobowych (UODO) ul. Stawki 2, 00-193 Warszawa, Polska.

9. Voluntary provision of data

Providing data is voluntary. However:

providing data in the application form is necessary to handle it and contact you — without it we cannot process the enquiry;
providing data to enter into and perform the contract is necessary to provide the service;
consent to marketing is entirely voluntary— its absence does not affect the handling of the application or the provision of services.