Privacy Policy

Privacy Policy – information clauses concerning the processing of personal data. This Privacy Policy contains information about the processing of personal data in connection with the use of websites maintained by XPLUS S.A. with its registered office in Warsaw; National Court Register (KRS): 0000296278; (hereinafter referred to as XPLUS) or services available through them, as well as in other cases where XPLUS, in the scope of personal data protection, refers to the Privacy Policy.

The Privacy Policy contains information required by the provisions of the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, GDPR).

Information clauses are grouped according to the circumstances of processing personal data.

1. Visiting and browsing websites.

2. Contacting a consultant and/or responding to questions.

3. Newsletter, webinars, free materials.

4. Participation in recruitment.

5. Cold mailing.

6. Information about the rights.

7. Cookie policy.

8. Agreements concluded via Microsoft Marketplace. 

1. Data processed in connection with visiting and browsing websites

Data: IP addresses, cookies, and similar location data, user devices and activity, including information about clicks on links.

The data controller is XPLUS S.A. as the publisher of websites and the manager of IT systems for their maintenance and support for other services.

Contact details: ul. Puławska 435 A, 02-801 Warsaw; contact@xplusglobal.com.

We process data for the purposes of:

• enabling comfortable use of websites,
• monitoring abuses,
• informing about XPLUS content and services,
• handling complaints and securing claims,
• conducting marketing activities,
• tailoring content and ads to users’ interests,
• conducting statistics, quality measurements, and effectiveness measurements.

The legal basis for data processing is the necessity to achieve the above-mentioned purposes, arising from the legally justified interests of the controller or third parties.

Legally justified interests consist of continually improving the quality, increasing the availability, and the number of visitors to the websites or users of the services available through these websites, including free of charge, and establishing, pursuing, and defending against claims in court proceedings and other state authorities if the claims arise from using XPLUS services.

The controller may disclose data to other recipients only at the request of entities authorized by law or when it is necessary to achieve the above-mentioned purposes, e.g., to entities providing hosting and marketing tools.

The controller retains data only for the time necessary to achieve the above-mentioned purposes, but not longer than until the objection to processing or the expiration of the statute of limitations for claims.

2. Data processed in connection with contact with a consultant and/or responding to questions via the contact form, chat, or the free helpline

Data: name and surname, telephone number, e-mail address, company name, industry, version of used software.

The data controller is XPLUS S.A. as the recipient of inquiries.

Contact details: ul. Puławska 435 A, 02-801 Warsaw; contact@xplusglobal.com.

We process data for the purposes of:

• handling the inquiry,
• verifying the addressee of the inquiry and maintaining continuity of correspondence,
• contacting back according to the recipient’s preference,
• informing about XPLUS content and services,
• handling complaints and securing claims.

The legal basis for data processing is the necessity to perform the contract or to take action at the request of the user before concluding the contract (depending on the content of the inquiry) and the necessity to achieve the remaining purposes, which arise from the legally justified interests of the controller or third parties. In the case of certain types of processing, the user is separately asked to confirm the consent. In such cases, the legal basis for data processing is the consent of the data subject.

Legally justified interests consist of continually improving the quality, increasing the availability, attractiveness, and the number of ordered newsletters, free materials, webinars, and other services offered by XPLUS, as well as establishing, pursuing, and defending against claims in court proceedings and other state authorities if the claims arise from using XPLUS services.

The controller may disclose data to other recipients only at the request of entities authorized by law or when it is necessary to achieve the above-mentioned purposes, e.g., to entities providing hosting, a free helpline, chat.

The controller retains data only for the time necessary to achieve the above-mentioned purposes, but not longer than until the objection to processing or the expiration of the statute of limitations for claims.

3. Data processed in connection with ordering commercial information, newsletters, free materials, and registering for webinars

Data: in connection with ordering commercial information, newsletters, free materials, and registering for webinars, only an e-mail address may be processed (if the user does not provide other data). It is also possible that the following data may be processed: name, surname, telephone number, company name, position, profession/industry, LinkedIn profile address.

The data controller is XPLUS S.A. as the publisher of websites, free materials, and webinars and the sender of commercial information sent electronically.

Contact details: ul. Puławska 435 A, 02-801 Warsaw; contact@xplusglobal.com.

• Data will be processed for the purposes of:
• sending ordered commercial information,
• sending the ordered newsletter; verifying the entitlement to receive specific content or services,
• sending ordered free materials,
• sending information about the webinar and the link to its playback,
• marketing of services and communication by XPLUS with recipients of newsletters, free materials, and webinars,
• adapting content and advertisements to users’ interests,
• conducting statistics, quality measurements, and effectiveness measurements,
• handling complaints and securing claims.

The legal basis for data processing is the necessity to perform the contract or to take action at the request of the user before concluding the contract (purposes from points i and v) and the necessity to achieve the remaining purposes, arising from the legally justified interests of the controller or third parties.

Legally justified interests consist of continually improving the quality, increasing the availability, attractiveness, and the number of ordered newsletters, free materials, webinars, and other services offered by XPLUS, as well as establishing, pursuing, and defending against claims in court proceedings and other state authorities if the claims arise from using XPLUS services.

The controller may disclose data to other recipients only at the request of entities authorized by law or when it is necessary to achieve the above-mentioned purposes, e.g., to entities providing hosting and a webinar platform.

The controller retains data only for the time necessary to achieve the above-mentioned purposes, but not longer than until the objection to processing or the expiration of the statute of limitations for claims.

4. Data processed in connection with participation in recruitment conducted by XPLUS S.A.

Data: in connection with participation in recruitment, the following data are processed: name (names) and surname, date of birth, contact details, education, professional qualifications, previous employment history, (if the candidate does not provide other data).

The data controller is XPLUS S.A. as the entity conducting the recruitment.

Contact details: ul. Puławska 435 A, 02-801 Warsaw; contact@xplusglobal.com.

Data will be processed for the purposes of:

• conducting the recruitment process,
• creating a database of candidates for future recruitments,
• handling complaints and securing claims.

The legal basis for data processing is:

• the legal obligation imposed on the Controller by the Labor Code – in the case of employment on an employment contract,
• the necessity to perform the contract or to take action at the request of the data subject before concluding the contract – in the case of cooperation based on a civil law contract,
• consent – for the purposes of future recruitment processes,
• the legally justified interest of the Controller – for the purposes of conducting the recruitment process; the Controller’s interest is to communicate with candidates to conduct qualification interviews and determine the conditions of employment/cooperation, and to inform them about the outcome of the recruitment,
• the legally justified interest of the Controller – in order to establish or pursue potential claims or to defend against claims brought against the Controller.

The Controller may disclose data to other recipients only when it is necessary to achieve the above-mentioned processing purposes, e.g., to external entities providing recruitment support.

The Controller retains data only for the time necessary to achieve the above-mentioned purposes of processing, but not longer than until the objection to processing or within five years – from obtaining consent to process the candidate’s data for future recruitment purposes.

Consent may be withdrawn at any time (e.g., in writing or electronically) without affecting the lawfulness of the data processing performed based on the consent before its withdrawal.

Providing data to the extent required by the Labor Code is obligatory (for persons applying for employment based on an employment contract). Failure to provide mandatory data may result in the inability to participate in the recruitment. In the case of data not required by labor law, providing data is voluntary.

5. Data for communication with potential clients

Data: name and surname, profession, position, company, LinkedIn profile address,

Data source: publicly available information about the target group: website, LinkedIn

The data controller is XPLUS S.A.

Contact details: ul. Puławska 435 A, 02-801 Warsaw; contact@xplusglobal.com.

Data will be processed for the purposes of:

• preparing a database of potential clients based on specific criteria of the target group;
• sending the first message about the possibility of ordering commercial information to persons potentially interested.

The legal basis for data processing is the necessity to achieve the above-mentioned purposes, arising from the legally justified interests of the Controller.

Legally justified interests consist of continually improving the quality, increasing the availability, attractiveness, and the number of ordered newsletters, free materials, webinars, and other services offered by XPLUS.

The Controller may disclose data to other recipients only at the request of entities authorized by law or when it is necessary to achieve the above-mentioned purposes, e.g., to entities providing database building, hosting, and mailing platforms.

The Controller retains data only for the time necessary to achieve the above-mentioned purposes of processing, but not longer than until the objection to processing or within three months from the first contact.

6. Information about the rights that belong to you

In connection with the processing of personal data, you (the person whose data we are processing) have the following rights:

• the right to request access to data,
• the right to request rectification of data,
• the right to request erasure of data,
• the right to request the restriction of processing of data,
• the right to data portability,
• the right to object to the processing of personal data,
• if the processing is based on consent – the right to withdraw consent at any time without affecting the lawfulness of the processing carried out on the basis of consent before its withdrawal,
• the right to lodge a complaint regarding the processing of personal data with the competent supervisory authority.

If you have any questions or comments regarding the processing of personal data in connection with the use of websites or services available through them, you can contact the data controller at contact@xplusglobal.com.

7. Cookies Policy

XPLUS may use cookies, i.e., information stored by servers on the user’s end device, which servers can read each time the end device connects. Cookies (so-called “cookies”) are computer data, in particular text files, which are stored on the end device of the user and are intended for using the XPLUS websites. Cookies usually contain the name of the website they come from, the time of their storage on the end device, and a unique number.

Cookies can be used for the following purposes:

• adapting the content of XPLUS websites to the user’s preferences and optimizing the use of websites; in particular, these files allow to recognize the user’s device and properly display the website, tailored to his individual needs;
• creating statistics that help to understand how users use the websites, which allows improving their structure and content;
• providing users with content more tailored to their interests;
• promoting XPLUS on social networks.
• XPLUS uses the following types of cookies:
• “necessary” cookies, enabling the use of services available through websites, e.g., authentication cookies;
• cookies used to ensure security, e.g., used to detect fraud in the field of user authentication;
• “performance” cookies, enabling the collection of information on how the websites of XPLUS are used;
• “functional” cookies, allowing “remembering” the settings selected by the user and personalizing the user’s interface, e.g., in terms of the selected language or region from which the user comes, the font size, the appearance of the website, etc.;
• “advertising” cookies, allowing users to deliver advertising content better suited to their interests.

In many cases, the software used for browsing websites (web browser) allows cookies to be stored on the user’s end device by default. Users can change their cookie settings at any time. These settings can be changed in particular in such a way as to block the automatic handling of cookies in the web browser settings or to inform about them every time they are placed on the user’s device. Detailed information on the possibilities and ways of handling cookies is available in the software settings (web browser).

Limiting the use of cookies may affect some of the functions available on the XPLUS websites.

In some cases, in particular in environments that do not support cookies, other similar technologies may be used.

8. Personal Data Processed in Connection with Agreements Concluded via Microsoft Marketplace

In the event of purchasing products or services of XPLUS S.A. through Microsoft Marketplace platforms, users’ personal data may be processed in connection with the performance of the agreement, subscription activation, service provision, and customer support. 

Data Controller: The controller of personal data is XPLUS S.A. 

Contact details: ul. Puławska 435 A, 02-801 Warsaw, Poland 
contact@xplusglobal.com 

Scope of data: In connection with the performance of the agreement, the following data may be processed – first and last name, email address, phone number, company name, job title, billing data, technical data related to the use of the service, and data concerning subscription activation and usage. 

Source of data: Data may be obtained directly from the user or transferred by Microsoft in connection with a transaction carried out via Microsoft Marketplace. 

Microsoft acts as an independent data controller with respect to the processing of data related to the operation of the Marketplace platform and payment processing. 

Personal data are processed for the purposes of: 

• performing the agreement and providing services,
• activating and managing subscriptions, 
• providing technical support, 
• fulfilling accounting and tax obligations, 
• establishing, pursuing, or defending legal claims, 
• ensuring the security of services. 

The legal basis for processing personal data is: 

• Article 6(1)(b) GDPR – processing necessary for the performance of a contract, 
• Article 6(1)(c) GDPR – compliance with legal obligations (e.g., accounting obligations), 
• Article 6(1)(f) GDPR – legitimate interests of the controller (e.g., pursuing claims, ensuring system security). 

Data retention period: Personal data processed in connection with the performance of the agreement are retained for the duration of the agreement and thereafter for the period necessary to comply with legal obligations and to establish, pursue, or defend claims, in accordance with applicable law. 

Recipients of data :Personal data may be transferred to entities cooperating with the controller, in particular IT service providers, hosting providers, technical support providers, accounting service providers, and other entities processing data on the basis of data processing agreements. 

Where cloud services are used, personal data may be processed using Microsoft Azure infrastructure.