PRIVACY POLICY

www.diamondfreak.com


§ 1
General provisions

The administrator of the personal data of users of the website available under the domain www.diamondfreak.pl is Diamond Labs Anna Kwaśnik, with its registered office in Pionki (26-670), ul. Różana 8/32, entered into the Register of Economic Activity maintained by the minister responsible for the economy, holding NIP (Tax ID): 7962631724, REGON: 540533505 (hereinafter referred to as the “Administrator”).

The Administrator has designated an electronic contact point for direct communication with the authorities of the Member States, the Commission, and the Digital Services Board: hello@diamondfreak.com. This same contact point may also be used by any Customer for direct and prompt communication with the Administrator. Communication may be conducted in either Polish or English.

The purpose of this Privacy Policy is to define the actions taken regarding the personal data collected via the Administrator’s website, as well as the related services and tools used by its users, including activities involving the conclusion and performance of agreements conducted outside the website.

If necessary, the provisions of this Privacy Policy may be subject to change. Any changes will be communicated to users by publishing the new version of the Policy. For individuals who have consented to data processing via email or provided their email addresses in connection with contract execution, the changes will also be communicated by email.


§ 2
Legal bases, purposes, and storage of personal data

  1. Personal data of users are processed in accordance with the general data protection regulation, the personal data protection act, the personal data protection act of 10 may 2018, and the act on the provision of electronic services of 18 july 2002, as amended, and for the purpose of submitting a notification pursuant to article 16(1) of regulation (eu) 2022/2065 of the european parliament and of the council of 19 october 2022 on a single market for digital services and amending directive 2000/31/ec (digital services act) (oj l 277, 27.10.2022, p. 1, as amended; “dsa”), also pursuant to article 3(h) of the dsa.
  2. The administrator may collect the following data for the following purposes:
Purpose of data processingLegal basis for processing and data retention periodScope of processed data
Performance of a contract with the customer or taking steps at the request of the data subject prior to entering into the aforementioned contracts.Article 6(1)(b) of the GDPR (performance of a contract). The data is stored for the period necessary to perform, terminate, or otherwise expire the concluded contract.

● first and last name
● email address
● phone number
● address (street, house number, apartment number, postal code, city, country)
● company name
● tax identification number (NIP)
Delivery of the Order to the Client and activities related to the Order delivery procedureArticle 6(1)(b) of the GDPR (performance of a contract). Data will be processed until the expiry of the period during which claims can be asserted.
first and last name; email address; phone number; address (street, house number, apartment number, postal code, city, country); company name; tax identification number (NIP).
Direct marketingArticle 6(1)(f) of the GDPR (legitimate interests of the controller). data is stored for the duration of the legitimate interest pursued by the controller, but no longer than the statute of limitations period applicable to claims against the data subject arising from the controller’s business activities. the controller may process data for direct marketing purposes only after obtaining consent and if there is no objection from the data subject, and until the consent is withdrawn – remember, you can withdraw your consent at any time.
email address; phone number.
Marketing Article 6(1)(a) of the GDPR (consent). data is stored until the data subject withdraws their consent to further processing of their data for this purpose or until they unsubscribe from the newsletter.
first and last name; email address; phone number; address (street, house number, apartment number, postal code, city, country).
Client’s expression of opinion
Article 6(1)(a) of the GDPR. Data shall be stored until the data subject withdraws their consent to further processing of their data for this purpose.
first name and last name; email address; phone number.
Keeping accounting records



Article 6(1)(c) of the GDPR in connection with Article 86 § 1 of the Tax Ordinance Act of January 17, 2017 (Journal of Laws 2017, item 201) or Article 74(2) of the Accounting Act of January 30, 2018 (Journal of Laws 2018, item 395). Data is stored for the period required by law obliging the Administrator to retain tax books (until the expiration of the tax liability limitation period, unless tax laws provide otherwise) or accounting books (5 years, counted from the beginning of the year following the financial year to which the data relates).
first and last name; email address; phone number; address (street, house number, apartment number, postal code, city, country); tax identification number (NIP); business entity data.
Refund processing
Performance of the Contract or taking actions at the request of the data subject prior to the conclusion of the Contract.



Article 6(1)(b) of the GDPR. Data is stored for the period necessary to perform, terminate, or otherwise expire the concluded contract.
first and last name; email address; phone number; address (street, house number, apartment number, postal code, city, country); business entity data.
Establishment, pursuit, or defense of claims that may be raised by the Administrator or against the Administrator.Article 6(1)(f) of the GDPR. Data are stored for the duration of the legitimate interest pursued by the Administrator, but no longer than the limitation period for claims against the data subject arising from the business activities conducted by the Administrator.
first and last name; email address; phone number; address (street, house number, apartment number, postal code, city, country); tax identification number (NIP); business entity data.
Conducting research and analysis to improve the operation of available services.Article 6(1)(f) of the GDPR. Data is stored for the duration of the legitimate interest pursued by the Administrator, but no longer than the limitation period for claims against the data subject arising from the business activities conducted by the Administrator.
first and last name; company name; email address; phone number; address (street, house number, apartment number, postal code, city, country); computer components; settings;installed software.
Collection of telemetry data.Article 6(1)(f) of the gdpr. until the expiration or deletion of cookies used for analytical purposes.
ip address; approximate location based on the ip address; user identifier; software sharing and usage.
Contract execution or taking actions at the request of the data subject before concluding the contract.Article 6(1)(b) of the GDPR. Data is stored for the period necessary to perform, terminate, or otherwise expire the concluded contract.
first and last name; date of birth; email address; PESEL (national identification number); phone number; address (street, house number, apartment number, postal code, city, country); business entity data.
Fulfillment of a legal obligation incumbent on the administrator.Article 6(1)(c) of the GDPR. Data is stored for the duration of the legitimate interest pursued by the Administrator, but no longer than the limitation period for claims against the data subject arising from the business activities conducted by the Administrator.
first name and last name; email address; phone number; PESEL (national identification number); address (street, house number, apartment number, postal code, city, country); business entity data.
Correct functioning of the service. Maintenance of the service’s performance and its improvement. Information about actions performed on the service, such as button clicks, visit duration, read notifications, and other information depending on the specific business case. Tracking visits to the service for security reasons. Protection and securing of the service, safeguarding clients’ interests, and ensuring client security.

Article 6(1)(f) of the GDPR. Data is stored for the duration of the legitimate interest pursued by the Administrator, but no longer than the statute of limitations period for claims related to the business activity conducted by the Administrator concerning the data subject.
User ID; IP address; Browser; Content and URLs accessed by the User; Date and time of connections.
Protection of Clients against the use of disclosed login passwords. Protection and security of the service, Clients’ interests, and ensuring Client security. Enabling the Client to reset the password. Protection and security of the service, Clients’ interests, and ensuring Client security.
Article 6(1)(f) of the GDPR. Data is stored for the duration of the legitimate interest pursued by the Administrator, but no longer than the statute of limitations period for claims against the data subject arising from the business activities conducted by the Administrator.
first and last name; email address; business entity data; user ID; client password.
Supervising compliance with regulations, agreements, and the privacy policy. Protection and security of the service, interests of clients, and ensuring client safety.
Article 6(1)(f) of the GDPR. The data are stored for the duration of the legitimate interest pursued by the Administrator, but no longer than the limitation period for claims against the data subject arising from the business activity conducted by the Administrator.
first name and last name; email address; phone number; address (street, house number, apartment number, postal code, city, country); tax identification number (NIP); transaction data; business entity data.
Considering requests regarding personal data.Article 6(1)(c) of the GDPR. Data is stored for the duration of the legitimate interest pursued by the Administrator, but no longer than the statute of limitations for claims against the data subject arising from the business activity conducted by the Administrator.  first and last name; email address; phone number; address (street, house number, apartment number, postal code, city, country); tax identification number (NIP); business entity data.
Providing information to law enforcement authorities and other government institutions.Article 6(1)(c) of the GDPR. Data is stored for the duration of the legitimate interest pursued by the Administrator, but no longer than the limitation period for claims against the data subject arising from the business activity conducted by the Administrator.
first name and last name; email address; phone number; address (street, house number, apartment number, postal code, city, country); tax identification number (NIP); business entity data.
Fulfilling the legal obligation specified in Article 16 paragraphs 1, 4, 5, and 6 of the DSA, consisting of: receiving a notification regarding the presence of information in the hosting service that, according to the notifier, constitutes illegal content as defined in Article 3 letter h of the DSA; reviewing the notification; informing about the decision made concerning the submitted notification; informing about the possibility to appeal the decision referred to in point 3.



Article 6(1)(c) of the GDPR. Until the notification of: the decision made by the Administrator regarding the submitted notification; the possibility to appeal the decision referred to in point 1).
first and last name; email address; phone number; address (street, house number, apartment number, postal code, city, country); tax identification number (NIP); business entity data.
Processing of personal data to the extent that, based on proceedings conducted before competent public administration authorities, including law enforcement agencies, in matters concerning the purposes or grounds for processing personal data, the Administrator is obligated to process such data.Article 6(1)(c) of the GDPR. For the duration of such an obligation.
first and last name; email address; phone number; address (street, house number, apartment number, postal code, city, country); tax identification number (NIP); business entity data.
  1. Users’ personal data are stored no longer than necessary to achieve the purpose of processing, i.e., until the consent is withdrawn if the processing is based on such consent, until the statute of limitations for claims of the Administrator and the other party in relation to the performance of concluded contracts expires (in the case of sales contracts/service agreements, 2 years counted until the end of the year), and until the inquiry sent by e-mail is processed or the complaint handling is completed. After this period, the Client’s personal data will be processed by the Administrator based on Article 6(1)(f) of the GDPR, i.e., for purposes arising from legally justified interests pursued for marketing campaigns.
  2. Personal data of users obtained for the purpose of performing the contract of maintaining a user account are stored for a period of 2 years from the last purchase made using the account and no longer than 3 years from that activity.
  3. To the extent necessary for the proper functioning of the website, its functionalities, and the correct execution of payment operations (if such are carried out via the website), the site uses User metadata. Metadata means the process of reading and recognizing, by the website’s IT system, the configuration and components of the computer used by the user to adapt the site to the user’s capabilities and establish a secure connection between the user’s computer and the site. Importantly, such metadata cannot lead to the identification of the User, nor are they in any way harmful to data stored on the computer. Nevertheless, the User has the right to withdraw consent for the processing of metadata at any time by properly configuring their browser or downloading an appropriate plugin provided by the browser manufacturer. For this purpose, the User should consult the software producer and follow their recommendations.
  4. The Administrator may use profiling for direct marketing purposes, but decisions made based on profiling by the Administrator do not concern entering into or refusing to enter into a contract, nor the possibility of using electronic services. The effect of profiling may be, for example, granting a discount to a person, sending them a discount code, reminding them of unfinished purchases, sending product offers that may match their interests or preferences, or offering better terms compared to the standard offer. Despite profiling, the person freely decides whether to use the discount or better conditions and make a purchase. Profiling involves the automatic analysis or prediction of a person’s behavior on the Administrator’s site, e.g., by adding a specific product to the shopping cart, browsing a particular product page, or analyzing the person’s previous activity history on the site. A condition for such profiling is that the Administrator possesses the person’s personal data to subsequently send them, for example, a discount code.
  5. To the extent necessary for the proper functioning of the website and its functionalities, the site may, during the User’s use, collect other information, including but not limited to:
    a. IP address;
    b. Information about the device, hardware, and software, such as hardware identifiers, mobile device identifiers (e.g., Apple Identifier for Advertising [“IDFA”] or advertising identifier on an Android device [“AAID”]);
    c. Type of platform;
    d. Settings and components;
    e. Data related to the web browser, including the browser type and preferred language.
  6. Taking into account the nature, scope, context, and purposes of processing, as well as the risk of violation of the rights or freedoms of natural persons with varying likelihood and severity of threat, the Administrator implements appropriate technical and organizational measures to ensure that processing is carried out in compliance with the regulation and to be able to demonstrate this. These measures are reviewed and updated as necessary. The Administrator applies technical measures to prevent unauthorized acquisition and modification of personal data transmitted electronically.


§ 3 
Data sharing

  1. The Administrator ensures that all collected personal data is used to fulfill obligations towards users. This information will not be shared with third parties except in situations where:
    a. prior explicit consent is given by the persons to whom the data relates for such action, or,
    b. the obligation to transfer this data arises or will arise from applicable legal regulations, e.g., law enforcement authorities.
  2. Additionally, personal data of service recipients and clients may be transferred to the following recipients or categories of recipients:
    a. service providers supplying the Administrator with technical, IT, and organizational solutions enabling the Administrator to conduct business activities, including the website and electronic services provided through it (in particular software providers, marketing agencies, email and hosting providers, software providers for company management and technical support to the Administrator and the product delivery operator) – the Administrator discloses the collected personal data of the Client to the selected provider acting on its behalf only in the case and to the extent necessary to achieve the given data processing purpose consistent with this privacy policy.
    b. providers of accounting, legal, and advisory services supporting the Administrator in accounting, legal, or advisory matters (in particular accounting offices, law firms, or debt collection companies) – the Administrator discloses the collected personal data of the Client to the selected provider acting on its behalf only in the case and to the extent necessary to achieve the given data processing purpose consistent with this privacy policy.
    c. payment gateway providers and payment processing solutions on the website – the Administrator discloses the collected personal data of the Client to the selected provider acting on its behalf only in the case and to the extent necessary to achieve the given data processing purpose consistent with this privacy policy. In the case of the Administrator’s activity, this service is provided by: Autopay S.A. headquartered in Sopot at Powstańców Warszawy 6, registered at the District Court Gdańsk – North in Gdańsk, VIII Commercial Division of the National Court Register under number 0000320590, with share capital amounting to PLN 2,205,500 (fully paid), NIP: 585-13-51-185; entered in the register of payment service providers under number IP17/2013.
    d. providers of transport and product delivery services (couriers) – the Administrator discloses the collected personal data of the Client to the selected provider acting on its behalf only in the case and to the extent necessary to achieve the given data processing purpose consistent with this privacy policy, including enabling the provider to identify the Order recipient.
  3. The Administrator may share anonymized data (i.e., data that does not identify specific Users) with external service providers to better understand the attractiveness of advertisements and services for users. Due to the location of software providers, such data may be transferred—while ensuring data protection principles—to third countries that provide standard contractual clauses approved by the European Commission for personal data processing or have appropriate authorization to act based on bilateral data processing agreements between the European Union and the given third country, which is not a member of the European Economic Area. These entities, in the case of the Administrator, are:
    a. Google LLC. (headquarters: 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA) for tools such as Google Analytics used to analyze website statistics, Google Tag Manager used to manage scripts by easily adding code snippets to the website or application and tracking user activities on the website, Google Ads used to display sponsored links in Google search results and on partner sites within the Google AdSense program, Google Workspace allowing comprehensive site editing and coordination of work among contributors (including Google Drive, Gmail, Google Sheets, Google Forms, Google Looker Studio);
    b. Meta Platforms, Inc. (headquarters: 1601 Willow Road Menlo Park, CA 94025, USA) for Facebook Pixel used to track conversions from Facebook ads, optimize them based on collected data and statistics, and build audience lists targeted for future advertising.Administrator zawsze informuje o zamiarze przekazania danych osobowych poza EOG na etapie ich zbierania.
  4. The Administrator continuously conducts risk analysis to ensure that personal data is processed securely—primarily ensuring that only authorized persons have access to the data and only to the extent necessary for the tasks they perform. The Administrator ensures that all operations on personal data are logged and carried out solely by authorized employees and collaborators.
  5. The Administrator takes all necessary measures to ensure that subcontractors and other cooperating entities also guarantee the application of appropriate security measures whenever they process personal data on behalf of the Administrator.
  6. The Administrator’s website may use the functionality of Google Analytics, a web traffic analysis service provided by Google LLC (“Google”). Google Analytics uses cookies to help website operators analyze how visitors use the site. Information generated by cookies about visitors’ use of the site is generally transmitted to and stored by Google on servers in the United States. According to current IT standards, IP addresses of users visiting the Administrator’s website are anonymized. Only in exceptional cases is the full IP address transmitted to a Google server in the United States and anonymized there. On behalf of the Administrator, Google uses this information to evaluate the website for its users, prepare reports on website traffic, and provide other services related to website traffic and internet usage for website operators. Google will not associate the IP address transmitted within Google Analytics with any other data held by Google. More information on how Google Analytics collects and uses data can be found on Google’s official site at: www.google.com/policies/privacy/partners. Furthermore, every User can prevent Google from collecting and processing data about their use of the website by downloading and installing a browser plugin available at the following link: http://tools.google.com/dlpage/gaoptout.
  7. When sharing data with third parties, the Administrator makes every effort to ensure this occurs only with entities that meet the criteria and requirements set forth under Articles 46 or 49 of the GDPR. Where applicable, the Administrator will rely on the EU standard contractual clauses and other safeguards to enable transfers outside the EEA. Pursuant to the European Court of Justice decision of 16 July 2020, the Administrator continues to assess the legal system of countries to which data is transferred and, as necessary, updates measures to ensure appropriate levels of protection.
  8. With regard to data transferred to the United States, the Administrator, when sharing data with third parties, makes every effort to ensure that this is done, in accordance with the European Commission’s decision of July 10, 2023, only to entities and organizations in the USA that comply with the new “EU-US Data Privacy Framework.” The list of these organizations has been published by the U.S. Department of Commerce. The transfer of personal data from the EEA to organizations that have joined the “EU-US Data Privacy Framework” program and are on this list is possible without the need to obtain additional authorizations or to apply legal instruments such as standard contractual clauses or binding corporate rules. However, if a data importer in the USA has not joined the “EU-US Data Privacy Framework” program, the transfer of personal data to that importer is possible and will take place only after meeting the conditions set out in Articles 46 or 49 of the GDPR. In such cases, the Administrator will rely on the EU standard contractual clauses and other safeguards to enable transfers outside the EEA.


§ 4
User rights

  1. The User whose personal data is processed has the right to:
    • access, rectify, restrict, delete, or transfer – the data subject has the right to request from the Administrator access to their personal data, correction, deletion (“the right to be forgotten”), or restriction of processing, and also has the right to object to processing, as well as the right to data portability. Detailed conditions for exercising these rights are provided in Articles 15-21 of the GDPR.
    • withdraw consent at any time – a person whose data is processed by the Administrator based on consent (under Art. 6(1)(a) or Art. 9(2)(a) of the GDPR) has the right to withdraw consent at any time without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal.
    • lodge a complaint with the supervisory authority – a person whose data is processed by the Administrator has the right to lodge a complaint with the supervisory authority in the manner and procedure specified in the GDPR and Polish law, in particular the Personal Data Protection Act. The supervisory authority in Poland is the President of the Personal Data Protection Office in Warsaw.
    • object – the data subject has the right to object at any time – for reasons related to their particular situation – to the processing of their personal data based on Art. 6(1)(e) (public interest or exercise of official authority) or (f) (legitimate interest of the administrator), including profiling based on these provisions. In such a case, the Administrator must stop processing the personal data unless they demonstrate compelling legitimate grounds for the processing which override the interests, rights, and freedoms of the data subject or grounds for the establishment, exercise, or defense of legal claims.
    • object to direct marketing – if personal data is processed for direct marketing purposes (based on the Administrator’s legitimate interest, not on data subject consent), the data subject has the right to object at any time to the processing of their personal data for such marketing, including profiling, to the extent that processing is related to such direct marketing.
  2. The exercise of the above rights is done based on a user request sent to the email address: hello@diamondfreak.com. Such a request should include the user’s full name.
  3. The User assures that the data provided or published by them on the service is correct.


§ 5 
Cookies

  1. The term “cookies” refers to IT data, in particular text files, stored on end-user devices (usually on the computer’s hard drive or a mobile device) used by the user’s browser to save certain settings and data for the purpose of using websites. These files allow the user’s device to be recognized and display the website accordingly, ensuring comfort during its use. Storing “cookies” thus enables appropriate preparation of the website and offers according to the user’s preferences – the server recognizes and remembers, among others, preferences such as visits, clicks, previous actions.
  2. “Cookies” contain in particular the domain name of the website from which they originate, the duration of their storage on the end device, and a unique number used to identify the browser from which the connection to the website is made.
  3. “Cookies” are used for the purpose of:
    a. adapting the content of websites to the user’s preferences and optimizing the use of websites,
    b. creating anonymous statistics which, by helping determine how the user uses websites, allow for improving their structure and content,
    c. providing website users with advertising content tailored to their interests.
    “Cookies” do not serve to identify the user, and their identity is not determined based on them.
  4. The basic division of “cookies” consists of distinguishing them into:
    • Necessary “cookies” – absolutely necessary for the proper functioning of the website or functionalities the user wants to use, as without them many services offered could not be provided. Some also ensure the security of electronic services provided by us.
    • Functional “cookies” – important for the operation of the website because they:
      – enrich the functionality of websites; without them the website will work correctly but will not be tailored to the user’s preferences,
      – ensure a high level of website functionality; without them the functionality may decrease, but their absence should not completely prevent using the site,
      – serve the majority of website functionalities; blocking them will cause some functions to not work properly.
    • Business “cookies” – enable the realization of the business model on which the website is made available; blocking them will not cause the unavailability of all functionalities but may reduce the level of service due to the inability of the website owner to generate revenue subsidizing its operation. This category includes e.g. advertising “cookies.”
    • Configuration “cookies” – enable setting functions and services on websites.
    • Security and reliability “cookies” – enable verification of authenticity and optimization of website performance.
    • Authentication “cookies” – allow informing when the user is logged in, so the website can display appropriate information and functions.
    • Session state “cookies” – enable saving information about how users use the website. These may concern the most frequently visited pages or error messages displayed on certain pages. Session state “cookies” help improve services and increase browsing comfort.
    • Process-tracking “cookies” – enable smooth operation of the website and its available functions.
    • Advertising “cookies” – allow displaying ads that are more interesting to users and more valuable to publishers and advertisers; cookies may also be used to personalize ads and display ads outside of websites.
    • Location access “cookies” – enable adjusting displayed information to the user’s location.
    • Analytics, research, or audience audit “cookies” – allow the website owner to better understand their users’ preferences and improve and develop products and services through analysis. Usually, the website owner or a research company collects information anonymously and processes data on trends without identifying personal data of individual users.
  5. The use of “cookies” to tailor the content of websites to user preferences does not, as a rule, involve the collection of any information that would allow the identification of the user, although such information may sometimes constitute personal data, i.e., data that allows certain behaviors to be attributed to a specific user. Personal data collected through the use of “cookies” may be collected solely for the purpose of performing specific functions for the benefit of the user. Such data is encrypted in a way that prevents access by unauthorized persons.
  6. The cookies used by this website are not harmful to the user or the end device used by the user; therefore, in order for the service to function correctly, it is recommended not to disable their support in browsers. In many cases, the software used for browsing websites (web browser) by default allows the storage of information in the form of “cookies” and other similar technologies on the user’s end device. The user may, at any time, change the way the browser uses “cookies”. To do this, the browser settings must be changed. The way settings are changed depends on the software (web browser) used. Appropriate instructions can be found on subpages depending on the browser you use.
  7. “Cookies” are also used to facilitate logging into the user’s account, including via social media, and to enable navigation between subpages of websites without having to log in again on each subpage. At the same time, “cookies” are used to secure websites, e.g., to prevent access by unauthorized persons.
  8. As part of cookie technology, the Administrator may use tracking pixels or clear GIF files to collect information about how the user uses its services and how they react to marketing messages sent via email. A pixel is a software code that allows the embedding of an object on a website—usually a one-pixel image—which enables the tracking of user behavior on websites where it is placed. Upon granting appropriate consent, the browser automatically establishes a direct connection with the server storing the pixel, so data collected by the pixel is processed under the data protection policy of the partner administering the aforementioned server.
  9. The Administrator may use web log files (which contain technical data such as the user’s IP address) to monitor traffic within its services, resolve technical problems, detect and counteract fraud, and enforce the provisions of the User Agreement.
  10. The Administrator informs that the website does not respond to Do Not Track (DNT) signals; however, the user may disable certain forms of online tracking, including some analytics and personalized advertising, by changing cookie settings in their browser or by using our cookie consent tools (if applicable).
  11. Detailed information on changing cookie settings and manually deleting them in the most popular web browsers is available in the help section of the web browser and on the following pages (just click the link):
    • Google Chrome
    • Mozilla Firefox
    • Microsoft Edge
    • Opera
    • Safari macOS
    • Safari iOS/iPadOS
    • Detailed information on managing cookies on a mobile phone or other mobile device should be found in the user manual for the respective mobile device.