§ 1. DataController

Noctuai sp. z o. o. with its registered office in Warsaw, Nowogrodzka 56A, 00-695 Warszawa, KRS 0000420156, whose registration file is kept by the District Court for the Capital City of Warsaw, 12th Commercial Division of the National Court Register, NIP 1132856632, REGON 146111427, the share capital of PLN 111,200.00 fully paid up.

§ 2. Purpose of data processing

We process personal data on a legal basis, such as:

• consent (Art. 6(1)(a) GDPR),
• Processing is necessary for the performance of a contract (Article 6(1)(.b) GDPR),
• Legal obligation to which the controller is subject (Article 6(1)(c) GDPR),
• Processing is necessary for the legitimate interests pursued by the controller or by a third
  party (Article 6(1)(f) GDPR).

We process personal data for:

• enter into and performance of contracts;
• communicate with contractors, partners, or customers;
• recruitment;
• the provision of services;
• maintenance of the website noctuai.com.

§ 3. Kind of data

The purpose and legal basis limit the scope of the data processing. According to the purposes of the processing, the content of the data may include identification data (such as name and surname), correspondence data, and other information made available to Noctuai.

§ 4. Cookies

Noctuai (noctuai.com) uses the following types of cookies:

• own cookies, identifying the user, and collecting information about the acceptance of cookies;
• third-party cookies (OneSignal based in the USA) to recognize users who wish to receive notifications;
• Third-party cookies –Google Inc. marketing cookies collect information for display by Google Inc. AdWords ads.

In the case of third-party cookies, data may be transferred outside the European Economic Area, i.e., within the US. Users can change the scope of their consent to using cookies in the web browser’s privacy settings.

§ 5. How do we collect data

We usually collect personal data directly from data subjects.

§ 6. Data transfers

• We entrust the processing of specific personal data to our subcontractors, e.g., cloud service providers.
• We may transfer the data to the relevant state authorities if legally obliged.
• We may also share personal data with third-party advisors or auditors.

§ 7. Processing period

We process personal data as long as necessary to achieve the purpose. If you withdraw your consent or object to processing your data, we shall no longer process your data. However, we may process personal data until the possible claims are time-barred if it’s needed to protect against potential lawsuits or Noctuai’s rights.

§ 8. Rights of the data subject

The data subject has the following rights:

• access to their data;
• request rectification, erasure, or restriction of the processing of their data;
• right to object to the processing;
• the right to data portability;
• the right to withdraw the consent if the processing takes place based on their support;
• complain with the supervisory authority, the President of the Personal Data Protection Office (https://uodo.gov.pl/).

§ 9. Updates to this privacy policy

We reserve the right to change the privacy policy at any time.

§ 10. Contact