Big Picture service privacy policy

This Privacy Policy (hereinafter referred to as the "Policy") provides information about the processing of your personal data in connection with the use of the "Big Picture" website, accessible at https://big-picture.pl/ (hereinafter referred to as the "Service").

Personal Data Administrator

The Administrator of your personal data is BIG PICTURE spółka z ograniczoną odpowiedzialnością [Limited Liability Company], with its registered office in Warsaw (registered office address: ul. Mokotowska 51/53, Suite 46, 00-542 Warsaw), entered in the Register of Entrepreneurs of the National Court Register maintained by the District Court for the Capital City of Warsaw, XII Commercial Division of the National Court Register under KRS number: 0001005181, NIP: 5252634095, REGON: 362843689, with share capital of PLN 12,500 (twelve thousand five hundred zloty), fully paid (hereinafter referred to as the "Administrator").

Contact with the Administrator

In all matters related to the processing of personal data, you may contact the Administrator via email at: biuro@big-picture.pl

Data Protection Measures

The Administrator employs modern organizational and technical safeguards to ensure optimal protection of your personal data and guarantees that data processing is carried out in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons concerning the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as the "GDPR"), the Polish Personal Data Protection Act of 10 May 2018, and other relevant data protection regulations.

Information on Processed Personal Data

Using the Service requires the processing of your personal data. Below, you will find detailed information on the purposes and legal bases for processing, the duration of processing and whether providing this data is mandatory or voluntary.

Profiling

To create a profile for marketing purposes and direct personalized marketing to you, the Administrator will process your personal data in an automated manner, including profiling. This will not, however, produce any legal effects for you or otherwise significantly impact your situation.

The scope of the profiled personal data corresponds to the data outlined above regarding the analysis of your activity on the Service.

The legal basis for processing personal data for this purpose is Article 6(1)(f) of the GDPR, which permits the Administrator to process personal data to pursue its legitimate interests, in this case, conducting marketing activities tailored to user preferences. Providing the above personal data is voluntary but essential to achieve this purpose (failure to provide this data will result in the Administrator being unable to conduct marketing activities tailored to user preferences).

The Administrator will process personal data for profiling purposes until an effective objection is raised or the purpose of processing is achieved.

Recipients of Personal Data

The recipients of personal data will include the following external entities collaborating with the Administrator:

• Hosting service provider;
• IT service provider;
• Providers of tools used to analyze activity on the Service and direct marketing to its users (e.g., Google Analytics);
• Accounting service provider;
• Legal service provider.

Additionally, personal data may be disclosed to public or private entities if such an obligation arises from applicable legal provisions, a binding court judgment, or a final administrative decision.

Transfer of Personal Data to Third Countries

Due to the Administrator’s use of services provided by Google LLC and Meta Platforms Ireland Limited, your personal data may be transferred to the following third countries: United Kingdom, Canada, USA, Chile, Brazil, Israel, Saudi Arabia, Qatar, India, China, South Korea, Japan, Singapore, Taiwan (Republic of China), Indonesia, and Australia. The basis for transferring data to these third countries is as follows:

• For the United Kingdom, Canada, Israel, Japan, and South Korea – decisions by the European Commission affirming an adequate level of personal data protection in each of these third countries;
• For the USA – the Commission Implementing Decision (EU) 2023/1795 of 10 July 2023, under Regulation (EU) 2016/679, affirming the adequate level of personal data protection provided under the EU-U.S. Data Privacy Framework;
• For Chile, Brazil, Saudi Arabia, Qatar, India, China, Singapore, Taiwan (Republic of China), Indonesia, and Australia – contractual clauses ensuring an adequate level of protection, in line with the standard contractual clauses set out in the Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries under Regulation (EU) 2016/679.

You may obtain a copy of the data transferred to a third country from the Administrator.

Rights

In connection with the processing of personal data, you have the following rights:

1. The right to information about which personal data concerning you is processed by the Administrator and to receive a copy of this data (the so-called right of access). The first copy of the data is free; the Administrator may charge a fee for subsequent copies;
2. If the processed data becomes outdated, incomplete, or otherwise incorrect, you have the right to request its rectification;
3. In certain situations, you may request the Administrator to delete your personal data, for example, when:
   
   • the Administrator no longer needs the data for the purposes it was collected;
   • you have successfully withdrawn your consent for data processing – provided that the Administrator has no other legal basis for processing;
   • the processing is unlawful;
   • the need to delete the data results from a legal obligation incumbent on the Administrator;
4. In cases where personal data is processed by the Administrator based on consent given for processing or to fulfill a contract concluded with the Administrator, you have the right to transfer your data to another Administrator;
5. When personal data is processed based on your consent, you have the right to withdraw that consent at any time (withdrawal of consent does not affect the legality of processing carried out based on consent before its withdrawal);
6. If you consider that the personal data being processed is incorrect, its processing is unlawful, or the Administrator no longer needs specific data, you may request that for a specified, necessary period (e.g., for verifying data accuracy or pursuing claims), the Administrator refrain from any operations on the data and only stores it;
7. You have the right to object to the processing of personal data where the basis for processing is the Administrator’s legitimate interest. In the event of a successful objection, the Administrator will cease processing the personal data for the above-mentioned purpose;
8. You have the right to lodge a complaint with the President of the Personal Data Protection Office if you believe that the processing of personal data violates GDPR provisions.

Cookies

1. The Administrator hereby informs you that the Service uses cookie files, which are installed on your end device. These are small text files that can be read by the Administrator’s system and also by the systems of other entities whose services the Administrator uses (e.g., Facebook, Google).
2. The Administrator uses cookies for the following purposes:
   
   • Ensuring proper Service functioning – cookies enable the smooth operation of the Service, the use of its features, and easy navigation between various subpages;
   • Enhancing the convenience of browsing the Service – cookies make it possible to detect errors on certain subpages and continual subpage improvements;
   • Collecting statistics – cookies are used to analyze how users utilize the Service. This enables constant improvement of the Service and adaptation of its functionality to user preferences;
   • Conducting marketing activities – cookies allow the Administrator to target advertisements to users that match their preferences.
3. The Administrator may place both persistent  and temporary (session) cookies on your device. Session cookies are typically deleted upon closing the browser, while closing the browser does not delete persistent cookies.
4. Information about cookies used by the Administrator is displayed in a panel located at the bottom of the Service. Depending on your selection, you may enable or disable cookies in specific categories (except for essential cookies) and change these settings at any time.
5. Data collected through cookies does not allow the Administrator to identify you.
6. The Administrator uses the following cookies or tools that employ cookies:

 7. Using most common browsers, you can check if cookies have been installed on your end device, delete installed cookies, and block future installation of cookies by the Service. However, disabling or restricting cookies may result in significant difficulties when using the Service, such as longer page load times and limitations on certain functionalities.

Final Provisions

Generally applicable provisions on personal data protection shall apply in matters not regulated by this Policy.
This Policy shall be effective from 15.10.2024.