Zaktualizowano: 10 October 2025 In accordance with Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter referred to as „GDPR”) The Controller has appointed a Data Protection Officer, whom you can contact by sending an email to: [email protected]
The Administrator can be contacted via:
| PURPOSE OF DATA PROCESSING | LEGAL BASIS | DATA RETENTION PERIOD | SCOPE OF DATA PROCESSING |
|---|---|---|---|
| Provision of the Service by the Controller | – Article 6(1)(b) of the GDPR; – Article 6(1)(c) of the GDPR; | Until the end of cooperation, i.e. for the period required by law (e.g. tax, accounting, AML Act) or until the expiry of claims. | – Identification data (first and last name, PESEL number); – Contact details (email address, telephone number); – Address details (home address, residence address), Financial data (income information, bank transaction data, bank account statements, tax returns, declarations of residence); – Service-related data (cryptocurrency wallet data); – Biometric and Technical data (biometric data, selfie identity verification (liveness check)); – Image, IP address, data on devices used for verification). |
| Verification in accordance with the requirements of the AML Act / sanction lists: – Customers; – Contractors; – Customer representatives and agents | Article 6(1)(c) of the GDPR in conjunction with Article 37(1) of the AML Act | For the period required by law, i.e. 5 years in accordance with Article 49(1) of the AML Act | – Identification data (concerning natural persons, representatives of legal persons and beneficial owners): name and surname, citizenship, PESEL number or date of birth and country of birth – if no PESEL number is available, series and number of identity document; – Address details (if the obligated institution has this information): address of residence, registered office or place of business – in the case of legal persons and organizational units; – Business entity data (concerning natural persons conducting business activity and legal persons): name (company name), organizational form, tax identification number (NIP), and if unavailable – country of registration, name of the relevant register, registration number and date. |
| – Establishment and defense of own claims – Internal accounting | – Article 6(1)(c) of the GDPR in conjunction with Article 74(2) of the Accounting Act; – Article 6(1)(f) of the GDPR; | For the period required by law, i.e. – 6 years for most property claims; – 3 years for relations between entrepreneurs; – for 5 years from the end of the calendar year in which the tax obligation arose. | – Identification data (concerning natural persons) first name and surname, PESEL number; – Address details (residential address, registered office or business address); – Business entity data (for natural persons conducting business activity and legal persons): name, NIP (tax identification number), REGON (statistical number), KRS (National Court Register number). |
| Use of the Website | Article 6(1)(f) of the GDPR | For the duration of the storage of cookies on the website visitor’s device or until objection to processing is expressed. | – Information about visited pages (visited pages and subpages, time spent on each of them); – Technical data (IP address, device ID, browser and operating system data); – Location and search data (location, search history). |
| – Contractor data – Contractor Representatives’ Data Aimed at establishing cooperation and during Cooperation | – Article 6(1)(f) of the GDPR; – Article 6(1)(b) of the GDPR | For the duration of the Cooperation and after its termination until objection to processing is expressed. | – Identification data (concerning natural persons, representatives of legal persons) first name and surname, position held; – Address details (registered office or business address); – Business entity data (regarding natural persons conducting business activity and legal persons): name, tax identification number (NIP), statistical identification number (REGON), National Court Register number (KRS); – Contact details – email address, telephone number. |
| Conducting marketing activities, including positioning, marketing, and online advertising | Article 6(1)(f) of the GDPR | Until objection is raised | – Identification data – first and last name; – Business entity data (regarding natural persons conducting business activity and legal persons) – name, tax identification number, REGON number, KRS number; – Contact details – email address, telephone number. |
| Sending newsletters and text messages | Article 6(1)(a) of the GDPR | Until consent is withdrawn. | – Identification data – first and last name; – Business entity data (concerning natural persons conducting business activity and legal persons) – name, tax identification number, REGON number, KRS number; – Contact details – email address, telephone number. |
| Transaction monitoring | – Article 6(1)(c) of the GDPR; – Article 6(1)(f) of the GDPR | Until the end of cooperation, i.e. for the period required by law or until the expiry of the limitation period for claims. | – Identification data of the parties to the transaction (name and surname or name, address, account number or identifier, ID card number – if required); – Transaction data (transaction value, currencies or crypto assets being transferred). |
| Application of the Travel Rule | Article 6(1)(c) of the GDPR | Until the end of the cooperation, i.e. for the period required by law or until the expiry of the limitation period for claims. | – Identification data of the parties to the transaction (name and surname or name, address, account number or identifier, ID card number – if required); – Transaction data (value of the transaction, currencies or crypto assets being transferred). |
| Recruitment | – Article 6(1)(b) and (c) of the GDPR; – in the case of consent to future recruitment – Article 6(1)(a) of the GDPR | Until the end of the recruitment process, and in the case of consent to future recruitment – until its withdrawal or in accordance with the retention period resulting from legal provisions. | – Candidate identification data (name and surname, contact details, address, professional experience, education); – Other data contained in the application documents (CV, cover letter, references, recruitment test results – if required); – Information about the recruitment process (e.g., interview results, competency assessments); – If consent is given for future recruitment, personal data will be stored until consent is withdrawn, but no longer than for the period specified in the recruitment policy. |
Taking into account the nature, scope, context and purposes of the processing and the risk of varying likelihood and severity of the risk to the rights and freedoms of natural persons, the Controller implements appropriate technical and organizational measures to ensure that the processing is performed in accordance with the Regulation and to be able to demonstrate this. These measures are reviewed and updated as necessary. The Administrator uses technical measures to prevent unauthorized persons from obtaining and modifying personal data transmitted electronically.
The administrator processes personal data solely for the purpose of fulfilling its obligations towards users. The data is not disclosed to third parties unless the user consents to this or it is required by law (e.g. at the request of law enforcement authorities). Personal data is not used for profiling or automated decision-making.
The Administrator may transfer personal data outside the European Economic Area, in particular when using IT tool providers based outside the European Union.
The Administrator conducts ongoing risk analysis to ensure that personal data is processed by it in a secure manner, ensuring in particular that access to the data is limited to authorized persons and only to the extent necessary for the performance of their tasks. The controller ensures that all operations on personal data are recorded and carried out only by authorized employees and associates.
Personal data may be transferred outside the European Economic Area (EEA), in particular to IT and analytics service providers such as Google LLC and Meta Platforms, Inc. In such cases, the transfer of data is carried out in accordance with the GDPR, on the basis of:
Meta Platforms (Facebook, Instagram) We use Meta Platforms plugins on our Website. Clicking on the link will take you to our Facebook or Instagram profile. In this case, your data, such as information about the web browser or app you are using, online identifiers (e.g., IP addresses, mobile advertising identifiers of the operating system), and data about your interaction with ads, will be transmitted to Facebook or Instagram.
With regard to this data, Meta Platforms Ireland Limited and the Administrator act as joint controllers in accordance with Article 26 of the GDPR.
For detailed information on Facebook’s data processing and your rights, please refer to Facebook’s privacy policy: https://www.facebook.com/about/privacy. For more information on joint data control, please visit: https://www.facebook.com/legal/controller_addendum.
TikTok Our Website may contain links to our profile on the TikTok platform. When you click on the link, TikTok Technology Limited may process your data, such as your IP address, device data, web browser, and interactions with content and advertisements. TikTok processes data based on its own privacy policy, which can be found at: https://www.tiktok.com/legal/privacy-policy.
Telegram Our Website may contain links to our Telegram profile. Clicking on the link establishes a connection to the servers of Telegram Messenger Inc., which may process data such as your IP address, browser type, and information about your interactions with our website. Detailed information on data processing by Telegram is available in its privacy policy: https://telegram.org/privacy.
Exercising your rights: Requests to exercise the above rights can be sent to the following email address: [email protected]. The controller will consider the request within one month, with the possibility of extending this period to two months in special cases.
The Website uses cookies (small text files, so-called cookies) or technologies with similar functionality to cookies, which are stored by your browser on your device (e.g. laptop, smartphone).
We use two types of cookies: session cookies and persistent cookies. Session cookies are temporary files that are stored on your device until you log out or leave the Website. Persistent cookies are stored on your end device for the time specified in the cookie parameters or until they are deleted.
The following types of cookies may be used on the Website:
Detailed information on the cookies used on the Website is available in the table below:
| Cookie | Domain | Description | Type |
|---|---|---|---|
| pll_language | finunion.pl | The pll_language cookie is used by Polylang to remember the language selected by the user when returning to the website, as well as to obtain information about the language when it is not available in any other way. | functional |
| burst_uid | finunion.pl | None | other |
| _gcl_au | finunion.pl | Google Tag Manager sets this cookie to experiment with the effectiveness of ads on websites using their services. | analytical |
| _ga_* | finunion.pl | Google Analytics sets this cookie to store and count page views. | analytical |
| _ga | finunion.pl | The _ga cookie, installed by Google Analytics, calculates visitor, session, and campaign data and tracks website usage for the website’s analytics report. The cookie stores information anonymously and assigns a randomly generated number to identify unique visitors. | analytical |
| _ga_* | finunion.pl | Google Analytics sets this cookie to store and count page views. | analytical |
| _fbp | finunion.pl | Facebook sets this cookie to store and track interactions. | analytical |
| lastExternalReferrerTime | finunion.pl | None | other |
| lastExternalReferrer | finunion.pl | None | other |
| wpEmojiSettingsSupports | finunion.pl | WordPress sets this cookie when a user interacts with emojis on a WordPress website. It helps determine whether the user’s browser can correctly display emojis. | essential |
| _ga_* | finunion.pl | Google Analytics sets this cookie to store and count page views. | analytical |
| _ga | finunion.pl | The _ga cookie, installed by Google Analytics, calculates visitor, session, and campaign data and tracks website usage for the website’s analytics report. The cookie stores information anonymously and assigns a randomly generated number to identify unique visitors. | analytical |
Obtaining and storing information using cookies, except when necessary to ensure the proper functioning of the Website and your use of its functionality, is only possible with your consent.
You can withdraw your consent to the use of cookies via your browser settings. Detailed information on this can be found at the following links:
You can verify your current privacy settings in your browser at any time using the tool available at https://optout.aboutads.info/?c=2&lang=EN
Withdrawing your consent will not affect the lawfulness of any processing activities carried out based on your consent before its withdrawal. Restricting the use of cookies may affect some of the features available on the Website, prevent or significantly hinder the proper use of the Website.
This website uses cookies and services to collect technical data from visitors (IP address, location, etc.) in order to ensure correct operation and improve the quality of the service. By continuing to use our site, you automatically consent to the use of these technologies.
