Privacy policy

Who is the controller of your personal data and how can you contact us?

We are the controller of your personal data. This means that we decide how and for what purposes the personal data that you provided to us is processed. We want you to know that we make every effort to ensure that your personal information is safe. We do not provide personal data entrusted to us for payment.

If you have any questions regarding the processing of your personal data by us, please contact us using the contact details below:

Coditive Sp. z o.o. seated in Knurów (44-193), ul. Hugo Kołłątaja 1B/9, Poland phone: +48 453 481 820, or via our contact form

How do we process your personal data?

In connection with our business, we process the personal data of different people for different purposes, to a different extent, and on a different legal basis set out in the GDPR. In order to provide you with the most transparent information, we have grouped this information by referring to the purpose of processing your personal data.

What terms we use in the privacy policy

Personal data - means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

We - Coditive Sp. z o.o., ul. Hugo Kołłątaja 1B/9, 44-193 Knurów, registered in the District Court in Gliwice, X Commercial Division of the National Court Register, under KRS number 0000907960, VAT No. PL9691643891.

You, your - every natural person with whom we have a legal relationship.

GDPR - Regulation of the European Parliament and of the Council (EU) 2016/679 of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

Website - websites we run, including coditive.com.

Recipients of your personal data - entities to which we may transfer part of your personal data in connection with the performance of certain activities or services on our order. These entities cannot do anything with your personal data unless we instruct them, and only in the scope indicated by us. They will store your personal data securely and only for the period that we indicate to them or as required by applicable law.

Cooperating entities

I. The purpose of processing. We process your personal data in order to execute a binding contract or implement a collaborative relationship.

Processing period. We process your personal data for this purpose until the contract between us or the settlement of mutual obligations ends, and for the limitation period applicable to the type of contract concluded.

Legal basis. Indispensable for the performance of the contract or the implementation of our cooperation (Article 6 (1) (b) of the GDPR).

II. The purpose of processing. We process your personal data in order to fulfill our legal obligation to keep accounting records, in the form of VAT invoices or other regulations required by law. This obligation is imposed on us by the applicable legal act.

Processing period. We process your personal data for this purpose for a 5-year period which starts from the beginning of the year following the financial year in which the documentation was created.

Legal basis. Compliance with the legal obligation (Article 74 paragraph 2 point 8 of the Accounting Act in connection with Article 6 (1) (c) of the GDPR).

III. The purpose of processing. We process your personal data in order to assess your payment credibility in connection with the conclusion and performance of a contract or the cooperation that binds us, and also to establish, investigate or defend against claims.

Processing period. Your personal data is processed for the purpose of assessing payment credibility for the duration of the contract between us and the execution of the agreement concluded. Personal data to establish, investigate or defend against claims is processed for a period of 3 years or 10 years (the length of the period depends on whether both parties are entrepreneurs or not).

Legal basis. Our legitimate interest in verifying and assessing the reliability of our contractors and having personal data that will allow us to determine, assert or defend against claims, including clients and third parties (Article 6 (1) letter f GDPR).

Categories of recipients of your personal data: entities providing accounting services; IT service providers; professional legal advisors and entities dealing in debt collection; entities operating postal or courier services.

Representatives of contractors

Categories of personal data. We process only your personal data such as name, surname, employer, position, address of the place of employment, business phone, and business e-mail.

Source of personal data. Your personal data has been made available to us by the entity with whom we cooperate based on a contract or other binding arrangement and of which you are an employee or representative.

The purpose of processing. We process your personal data in order to comply with our obligations under the legal relationship with the entity of which you are an employee or representative.

Processing period. We process your personal data for this purpose until the relationship ends, is settled, and the limitation period for claims regarding our cooperation expires, or until you raise objections - if we acknowledge their legitimacy.

Legal basis. Our legitimate interest based on the implementation of our agreements and legal relationships with the entity of which you are an employee or representative (Article 6 (1) letter f).

Categories of recipients of your personal data: IT service providers; professional legal advisors; entities operating postal or courier services.

Candidates for work

I. The purpose of processing. We process your personal data in the form of first name, surname, first names of your parents, date of birth, place of residence (address for correspondence), your education, and the course of previous employment in order to carry out the recruitment process.

Processing period. We process your personal data for this purpose until the recruitment process is completed, resulting in admission or refusal to work.

Legal basis. Compliance with the legal obligation (Article 22¹ § 1 of the Labor Code in connection with Article 6 (1) (c) of the GDPR).

II. The purpose of processing. We process your personal data other than those mentioned above, indicated by you in the submitted recruitment application, in order to carry out the recruitment process.

Processing period. We process your personal data for this purpose until the end of the recruitment process resulting in the acceptance or refusal, or until you withdraw your consent to the processing of your personal data for this purpose.

Legal basis. Voluntary consent (Article 6 (1) (a) of the GDPR).

III. The purpose of processing. If you have agreed to this, we process your personal data for the purposes of future recruitment processes.

Processing period. We process your personal data for this purpose until the completion of our recruitment processes for positions corresponding to your interests, experience, and education, or until you withdraw your consent to the processing of your personal data for this purpose.

Legal basis. Voluntary consent (Article 6 (1) (a) GDPR).

Categories of recipients of your personal data: entities providing recruitment services; entities providing service and security to the Website; IT service providers.

Persons visiting our office

The purpose of processing. We process your personal data in order to ensure the security of information and documents, our employees and guests, as well as to limit visits by so-called unwanted persons, due to your visits to our office.

Processing period. We process your personal data for this purpose only for the period necessary to ensure the above-mentioned security, but no longer than one year from the visit to our office, or until you object to the processing of your personal data and we acknowledge its legitimacy.

Legal basis. Our legitimate interest in the protection of information, documentation, and security of our employees and guests in our office (Article 6 (1) letter f).

Contact form on the website

The purpose of processing. We process your personal data in order to service your inquiry and provide an answer, e.g. preparation of a valuation of our services.

Processing period. Your personal data will be deleted by us in case of effective opposition by you or when the purpose of processing is achieved.

Legal basis. Our legitimate interest in allowing the conclusion of a contract within a limited period of time without the need to repeat the valuation, because you can make a decision about using our service after receiving the valuation (Article 6 (1) letter f GDPR).

Categories of recipients of your personal data: our e-mail delivery provider (Resend), which we use to send you a confirmation and to deliver your message to us; our anti-spam provider (Cloudflare Turnstile), which checks that the form was not submitted by a bot; entities providing service and security to the Website; IT service providers.

Newsletter subscription

The purpose of processing. If you sign up for our newsletter, we process your e-mail address in order to send you the newsletter - updates, articles, and information about our products and services.

Processing period. We process your e-mail address for this purpose until you unsubscribe or withdraw your consent, which you can do at any time using the unsubscribe link included in every message.

Legal basis. Your voluntary consent, given when you submit the sign-up form (Article 6 (1) (a) of the GDPR).

Categories of recipients of your personal data: our newsletter provider (Kit, formerly ConvertKit), which stores your e-mail address and sends the messages on our behalf; our anti-spam provider (Cloudflare Turnstile); IT service providers.

Direct marketing of our products and services

The purpose of processing. We may process your personal data such as first name, last name, and e-mail address in order to send you direct marketing about our business using the e-mail address provided by you.

Processing period. We will process your personal information for this purpose as long as you do not object to receiving it.

Legal basis. Our legitimate interest in providing information about our activities, including our products and services (Article 6 (1) letter f GDPR).

Categories of recipients of your personal data: entities providing service and security to the Website; IT service providers.

What are your rights in relation to the processing of your personal data?

We ensure the implementation of your rights listed below. You can exercise your rights by submitting your request using the contact details we have indicated.

The right to withdraw consent

You have the right to withdraw any consent you gave us for the processing of your personal data at any time. The withdrawal of your consent takes effect from its withdrawal. Withdrawal of consent does not affect the processing of your personal data carried out by us in accordance with the law before its withdrawal.

Withdrawal of consent does not entail any negative consequences for you. However, it may prevent us from continuing actions on your behalf or providing functionalities which we can only legally provide with your consent.

Legal basis: Article 7 par. 3 GDPR.

The right to object to the use of personal data

You have the right to object to the processing of your personal data at any time if we process it based on our legitimate interest - for example in connection with sending you information about our new activities and initiatives, including profiling based on this basis.

If your objection turns out to be justified and we have no other legal basis to process your personal data, we will delete the information to which you objected.

If you object to being sent marketing information, we will stop sending you this type of information.

Legal basis: Article 21 GDPR.

The right to delete personal data (“the right to be forgotten”)

You have the right to request the removal of all or some of your personal data.

Despite the request to delete your personal data in connection with opposition or withdrawal of consent, we may retain certain personal data to the extent necessary to establish, investigate or defend any claims related to the processing of your personal data. This applies in particular to personal data including name, surname, and information about your consents or activity history, which we retain for purposes of handling complaints and claims related to the processing of your personal data by us in connection with the legal relationship between us. We will process your personal data for this purpose for a period of 10 years from the end of the legal relationship between us.

The legal basis for processing your personal data for this purpose is our legitimate interest (Article 6 (1) letter f).

Legal basis: Article 17 GDPR.

The right to limit the processing of personal data

You have the right to request a restriction on the processing of your personal data. If you submit such a request, we will prevent you from using certain functionalities or services whose use would result in the processing of the requested data until we process your request. We will also not send any messages to you, including marketing ones.

Legal basis: Article 18 GDPR.

The right to access personal data

You have the right to obtain confirmation from us whether we process your personal data, and if this is the case, you have the right to:

a) get access to your personal data;

b) obtain information about the purposes of the processing, categories of personal data being processed, the recipients or categories of recipients of this data, the planned period of storage of your data or criteria for determining this period, about your rights under the GDPR and the right to lodge a complaint with the supervisory authority, the source of this data, automated decision-making including profiling, and safeguards applied in connection with the transfer of this data outside the European Union;

c) obtain a copy of your personal data, under the conditions indicated in the GDPR.

Legal basis: Article 15 GDPR.

The right to rectify personal data

You have the right to request that we rectify your personal data when it is inconsistent with the actual state, and the right to have incomplete personal data completed.

Legal basis: Article 16 GDPR.

The right to data portability

You have the right to receive the personal data that you provided to us and then send it to another personal data administrator of your choice. You also have the right to request that personal data be sent by us directly to such other administrator, if it is technically possible.

Legal basis: Article 20 GDPR.

The right to lodge a complaint

You can lodge complaints, questions, and requests regarding the processing of your personal data and the implementation of your rights.

If you believe that your right to the protection of personal data or other rights granted to you by the GDPR has been violated, you have the right to lodge a complaint with the competent supervisory authority.

Legal basis: Article 13 para. 2 lit. d) GDPR.

Is the submission of your personal data compulsory?

Providing your personal data is not mandatory. However, it is necessary to implement the legal relationship that binds us.

If you do not agree to receive information about our initiatives and proposals at the e-mail address provided by you, we will not be able to send you such information.

Personal data of persons visiting the website

We do not use cookies to track you, and we run no advertising or marketing pixels and no cross-site trackers. By default nothing is stored on your device and there is no cookie-consent banner, because there is nothing to consent to. A few things are worth explaining, and we cover each below: our two cookieless analytics tools, Cloudflare Web Analytics and Umami, which measure traffic without cookies and without identifying you; Cloudflare Turnstile, which protects our forms from spam without cookies; and YouTube embeds, which never load until you choose to play a video.

Server logs and IP address storage

The use of the Site involves the transmission of queries to the server on which the Site is stored. Each query addressed to the server is saved in the server logs. Logs include the user’s IP address, server date and time, information about the web browser, and the operating system used by the user. Logs are saved and stored on the server. The data stored in the server logs is not associated with specific people using the Site and is not used by us to identify visitors. Server logs are auxiliary material used to administer the Site, and their content is not disclosed to anyone except those authorized to administer the server. This data is also used to create statistics that help us assess the usefulness of the Website and optimize it.

Cloudflare Web Analytics

We use Cloudflare Web Analytics to understand how much traffic the Website receives and how it is used. Unlike most analytics tools, Cloudflare Web Analytics does not use any client-side state - no cookies and no local storage - to collect usage data. It also does not identify individual visitors by their IP address, User-Agent string, or any other data in order to produce its reports. It is a privacy-first measurement tool that does not track you across sites. More information is available in Cloudflare’s privacy documents: https://www.cloudflare.com/privacypolicy/.

Umami (website analytics)

We also use Umami, a privacy-first analytics tool operated by Umami Software, Inc., to see how the Website is used. Like Cloudflare Web Analytics, the Umami tracking code sets no cookies and stores nothing on your device. It does not collect personally identifiable information and anonymizes the data it records - it measures only aggregate figures such as page views, referrers, browser, operating system, device type, and approximate country of origin, the last derived from your IP address without storing it or using it to identify you. Umami does not track you across sites. More information is available in Umami’s documentation: https://umami.is/ and https://docs.umami.is/.

Cloudflare Turnstile (form spam protection)

Our contact and newsletter forms are protected by Cloudflare Turnstile, a privacy-first alternative to traditional CAPTCHAs. When you start filling in a form, your browser loads a small script from Cloudflare (challenges.cloudflare.com) that confirms you are a person rather than an automated bot - it runs invisibly, with no puzzle for you to solve. To make that check, Cloudflare processes technical signals such as your IP address and your browser and device characteristics. Turnstile does not use cookies, and it does not profile you or track you across sites. The check produces a single-use token that we verify with Cloudflare when you submit the form. How Cloudflare handles this is described in its Turnstile Privacy Addendum and its general privacy policy.

YouTube embeds

Some of our articles include videos hosted on YouTube, which is operated by Google LLC. We do not load the YouTube player automatically. Instead we show a still preview image, served from our own domain, with a play button. Nothing is requested from YouTube until you click it, so no YouTube cookies are set unless you actively choose to load a video.

When you press play, you load the YouTube player and Google may set its own cookies on your device, receiving information that you played a recording from our website - the same as watching a video on YouTube anywhere else. If you are logged in to a Google account, Google may link the playback to that account. The purpose and scope of the data Google collects, your rights, and your privacy settings are described in Google’s own documents: terms - https://www.youtube.com/t/terms, privacy policy - https://policies.google.com/privacy.

To remember your choice so you are not asked again, we store a small flag in your browser’s local storage (this is not a cookie and never leaves your device). You can withdraw your consent at any time, and read how to clear cookies Google has already set, on our cookies page.

Will your personal data be transferred outside the European Economic Area?

In our activity, we use various popular services and technologies offered by entities such as Cloudflare (analytics and form spam protection), Umami (analytics), Resend (e-mail delivery), Kit/ConvertKit (newsletter), Facebook (Meta), Microsoft, Google, and Zendesk. These companies are based outside the European Union - in particular, in the United States - and are therefore considered “third countries” under the GDPR.

We assure you that when using these services and technologies, we transfer personal data only to entities that ensure an adequate level of data protection in line with the requirements of the GDPR. In particular, we rely on the EU-U.S. Data Privacy Framework, which was adopted by the European Commission on July 10, 2023, as a valid transfer mechanism for data flows from the EU to certified U.S. companies.

Entities participating in the Data Privacy Framework are committed to complying with data protection standards equivalent to those in force in the European Union. You can find more information on the European Commission’s website: https://commission.europa.eu/law/law-topic/data-protection/international-dimension-data-protection/eu-us-data-transfers_en.

If a service provider is not certified under the Data Privacy Framework, we ensure appropriate safeguards are in place - such as Standard Contractual Clauses (SCCs) approved by the European Commission - to ensure your data is processed in accordance with GDPR standards.

We will provide you with additional information upon request regarding the transfer of your personal data. You also have the right to obtain a copy of the data transferred to third countries at any time.

Changes in the privacy policy

Depending on our needs, we may change and supplement the Privacy Policy. We will inform you of any changes or additions by posting relevant information on the Website, and in the case of significant changes, we may also send you separate notifications to the e-mail address provided by you.

Contact with the service administrator

For any matters related to this Privacy Policy and the processing of your personal data, contact Coditive Sp. z o.o., ul. Hugo Kołłątaja 1B/9, 44-193 Knurów, Poland, phone +48 453 481 820, or use our contact form.