§ 1. General Information

This document sets out the rules for the processing and protection of personal data and the rules for the use of cookies on the website (hereinafter: the "Website" or the "Service").

The controller of personal data collected via the Website is:

ELTEL KATOWICE SP. Z O.O.
ul. Milowicka 1E, 40-312 Katowice
NIP: 634-019-68-09

District Court Katowice,
National Court Register (KRS) No. 0001034972
GIOŚ register number: E0007190W
Tel.: 32 202 78 86 (ext. 139)
Email: eltel@eltel.katowice.pl

(hereinafter: the "Controller", "we").

The Controller makes every effort to ensure that personal data is processed in accordance with:

• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data (GDPR);
• the Act of 10 May 2018 on the Protection of Personal Data (Journal of Laws 2018, item 1000, as amended);
• the Act of 18 July 2002 on Providing Services by Electronic Means (Journal of Laws 2002, No. 144, item 1204, as amended);
• the Act of 16 July 2004 – Telecommunications Law (Journal of Laws 2004, No. 171, item 1800, as amended).

§ 2. Scope and Purpose of Personal Data Processing

2.1. Contact form

Through the contact form provided on the Website, we process the following data:

• first and last name, or company name;
• email address;
• phone number (if provided voluntarily);
• the content of the message.

Purpose of processing: responding to the submitted enquiry, establishing business contact, or handling correspondence. Legal basis: Article 6(1)(b) GDPR (necessity to take steps prior to entering into a contract at the request of the data subject) or Article 6(1)(f) GDPR (the legitimate interest of the Controller, consisting in being able to respond to enquiries addressed to it). Retention period: the data is stored for as long as necessary to handle the correspondence and, once it is concluded, for the limitation period of any potential claims, no longer than 3 years from the last contact.

2.2. Server log files (logs)

The IT systems operating the Website automatically record data in the server logs, such as: the device's IP address, browser type and version, operating system, date and time of the visit, and the URL of the page from which the redirect occurred. This data is used exclusively for technical purposes (ensuring the security and stability of the Service) and is automatically deleted after no more than 90 days.

Legal basis: Article 6(1)(f) GDPR (the legitimate interest of the Controller).

2.3. Web analytics and remarketing

The Website uses analytics and marketing tools – Google Analytics 4 and Meta Pixel (Facebook Pixel). The data collected by these tools is described in detail in §§ 7–9 of this Policy.

§ 3. Rights of Data Subjects

Every person whose data is processed by the Controller has the right to:

• access their personal data (Article 15 GDPR);
• rectification of personal data (Article 16 GDPR);
• erasure of personal data – the "right to be forgotten" (Article 17 GDPR);
• restriction of processing (Article 18 GDPR);
• data portability (Article 20 GDPR);
• object to the processing of their data (Article 21 GDPR);
• not be subject to automated decision-making, including profiling (Article 22 GDPR);
• withdraw consent at any time (if processing is based on consent) – without affecting the lawfulness of processing carried out before the withdrawal of consent;
• lodge a complaint with the supervisory authority – the President of the Personal Data Protection Office (PUODO), ul. Stawki 2, 00-193 Warsaw, www.uodo.gov.pl.

Requests and demands concerning these rights may be sent to the Controller's email address or in writing to its registered office. The Controller responds to requests without undue delay, no later than within one month of receiving them.

§ 4. Data Recipients and Transfers to Third Countries

4.1. Processors

Personal data may be entrusted to entities that process data on behalf of the Controller, including:

• providers of hosting and server infrastructure services;
• providers of email-handling software;
• providers of analytics and marketing tools;
• entities providing legal and accounting services.

Each such entrustment of data takes place on the basis of a written data processing agreement compliant with Article 28 GDPR.

4.2. Transfers to third countries

As a rule, personal data is not transferred outside the European Economic Area (EEA). Where the services of providers established outside the EEA are used (e.g. Google LLC), the transfer of data takes place on the basis of standard contractual clauses approved by the European Commission or another mechanism compliant with Article 46 or 47 GDPR.

§ 5. Data Security

The Controller applies appropriate technical and organisational measures to protect the personal data processed, adequate to the risks and to the categories of data covered, in particular:

• encryption of data transmission using the SSL/TLS protocol (HTTPS certificate);
• protection of servers against unauthorised access;
• restricting access to data solely to authorised persons;
• regular creation of backups.

§ 6. What are cookies?

Cookies are small text files saved on the user's end device (computer, tablet, smartphone) by the web browser when visiting websites. Cookies make it possible to recognise the user's device on subsequent visits and to collect various information about how the Website is used.

The legal basis for the use of technically necessary cookies is Article 6(1)(f) GDPR in conjunction with Article 173 of the Telecommunications Law. For non-essential cookies, the legal basis is the user's voluntary consent (Article 6(1)(a) GDPR).

§ 7. Types of Cookies Used on the Website

7.1. Essential (technical) cookies

These are absolutely necessary for the Website to function correctly. Without them, the Service could not operate properly. They do not require the user's consent.

• Server session cookies – identification of the user's session, session duration.
• Contact form cookies – protection of the form against spam (e.g. CSRF token).

The Website is built on the Webflow platform. Below is a list of technical cookies used by Webflow and the Service:

• __wf_csrf – provider: Webflow Inc., USA; purpose: protecting the contact form against CSRF attacks; duration: browser session.
• wf_checkout – provider: Webflow Inc., USA; purpose: handling the user's session; duration: browser session.
• cookie_consent – provider: own (Controller); purpose: remembering the user's choice in the cookie consent panel; duration: 12 months.

More information: policies.google.com/privacy. You can opt out of GA4 tracking at: tools.google.com/dlpage/gaoptout.

7.3. Functional cookies

These allow the user's preferences to be remembered (e.g. the selected language, the decision regarding cookies).

• cookie_consent – cookie consent cookie; stores the user's choices in the consent panel; duration: 12 months.

7.4. Marketing and advertising cookies

The Website uses Meta Pixel (Facebook Pixel) – a remarketing tool from Meta Platforms Ireland Ltd., 4 Grand Canal Square, Dublin 2, Ireland (for EEA users) / Meta Platforms Inc., USA. Meta Pixel makes it possible to measure the effectiveness of advertising and to target ads to users on the Facebook and Instagram platforms. Data may be transferred to the USA on the basis of the EU standard contractual clauses.

• _fbp – provider: Meta Platforms; purpose: identifying the browser for remarketing purposes on Facebook/Instagram; duration: 90 days.
• _fbc – provider: Meta Platforms; purpose: tracking clicks on Facebook ads; duration: 90 days.
• fr – provider: Meta Platforms; purpose: delivering ads, measuring and improving their relevance; duration: 90 days.

More information: pl-pl.facebook.com/privacy/explanation. You can opt out of interest-based advertising at youronlinechoices.eu or in the ad settings of your Facebook account.

The Website uses the LinkedIn Insight Tag – a remarketing and analytics tool from LinkedIn (Microsoft Ireland Operations Ltd., One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland). The Insight Tag makes it possible to measure the effectiveness of LinkedIn advertising campaigns and to target ads to users who visit the Website. Data may be transferred to the USA on the basis of the EU standard contractual clauses.

• bcookie – provider: LinkedIn / Microsoft; purpose: identifying the user's browser; duration: 2 years.
• bscookie – provider: LinkedIn / Microsoft; purpose: secure browser identification (HTTPS); duration: 2 years.
• li_sugr – provider: LinkedIn / Microsoft; purpose: identifying the browser for remarketing purposes; duration: 90 days.
• UserMatchHistory – provider: LinkedIn / Microsoft; purpose: synchronising user identifiers for remarketing purposes; duration: 30 days.
• lms_ads – provider: LinkedIn / Microsoft; purpose: targeting LinkedIn ads; duration: 30 days.
• lms_analytics – provider: LinkedIn / Microsoft; purpose: LinkedIn campaign analytics; duration: 30 days.
• AnalyticsSyncHistory – provider: LinkedIn / Microsoft; purpose: synchronising analytics data; duration: 30 days.
• lidc – provider: LinkedIn / Microsoft; purpose: optimising routing and LinkedIn server performance; duration: 24 hours.

More information: linkedin.com/legal/privacy-policy. You can opt out of LinkedIn advertising at linkedin.com/psettings/advertising.

§ 8. Managing Cookies

On your first visit to the Website, we display a banner informing you about the use of cookies, allowing you to grant or refuse consent for individual categories of cookies.

The user can change or withdraw their cookie preferences at any time via:

• The consent management panel – available by clicking the "Cookie settings" link in the Website footer or in the cookie banner.
• Browser settings – every browser allows cookies to be managed. Instructions for popular browsers:
  - Google Chrome: Settings → Privacy and security → Cookies and other site data
  - Mozilla Firefox: Settings → Privacy & Security → Cookies and Site Data
  - Microsoft Edge: Settings → Cookies and site permissions
  - Safari: Preferences → Privacy → Manage Website Data

Please note: restricting or blocking cookies may affect the availability of certain Website features.

§ 9. External Tools and Social Media Plugins

The Website uses the following external tools, which may install their own cookies:

9.1. Google Fonts

To display fonts, the Website connects to Google LLC servers. This may result in the user's IP address being recorded in Google's logs. Google's privacy policy: policies.google.com/privacy.

9.2. Webflow

The Website is built on the Webflow platform (Webflow Inc., 398 11th Street, San Francisco, CA 94103, USA). Webflow may process technical data (IP addresses, session data) for purposes related to maintaining the infrastructure. Webflow's privacy policy: webflow.com/legal/privacy.

9.3. Meta Pixel (Facebook Pixel)

The Website uses Meta Pixel – a remarketing tool from Meta Platforms Ireland Ltd. The Pixel collects data about users' activity on the Website and sends it to Facebook/Instagram in order to display personalised advertising. Meta Platforms is a separate controller of personal data. Meta's privacy policy: pl-pl.facebook.com/privacy/explanation.

9.4. LinkedIn Insight Tag and social media plugins

The Website uses the LinkedIn Insight Tag (described in § 7.4) and may contain LinkedIn social media plugins (e.g. the "Follow" or "Share" button). When a user visits a page containing a LinkedIn plugin, their browser establishes a direct connection to LinkedIn's servers. LinkedIn may then attribute the Website visit to the user's LinkedIn account if they are logged in. The Controller has no influence over the scope of data collected by LinkedIn via these plugins. Microsoft Ireland Operations Ltd. is a separate controller of personal data within the meaning of the GDPR. LinkedIn's privacy policy: https://linkedin.com/legal/privacy-policy.

§ 10. Changes to the Policy

The Controller reserves the right to make changes to this Privacy Policy and Cookies Policy. We will inform you of any significant changes by posting an updated version of the document on the Website, together with a new update date.

If you have any questions regarding the content of this Policy, please contact the Controller's email address.

§ 11. Contact

For matters relating to the processing of personal data and cookies, please contact us:

• E-mail: eltel@eltel.katowice.pl
• Correspondence address: Eltel Katowice Sp. z o.o., ul. Milowicka 1E, 40-312 Katowice
• Contact form: available on the Website

The Controller will make every effort to respond to your enquiry within no more than 30 days.

This document is effective as of: 18 May 2026
This document has been prepared in accordance with the GDPR, the Personal Data Protection Act, and the Telecommunications Law.