PRIVACY POLICY

§ 1. Data Controller

The controller of personal data collected via the website ready2go.com.pl is:

KANCELARIA READY2GO SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ (limited liability company)

ul. Kielecka 41A/8, 02-530 Warsaw, Poland

Tax ID (NIP): 5214076948 | National Court Register (KRS): 0001115248

For any matters relating to the protection of personal data, please contact us at the e-mail address above.

The Controller has not appointed a data protection officer. All matters concerning the processing of personal data should be addressed to the e-mail address indicated above.

§ 2. Definitions

For the purposes of this Privacy Policy, the following definitions apply:

Controller – KANCELARIA READY2GO SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, indicated in § 1.
Personal data – any information relating to an identified or identifiable natural person.
GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data.
Website – the website available at ready2go.com.pl.
User – any natural person visiting the Website or using its functionalities.
Cookie – a small text file saved on the User’s device by the web browser.

§ 3. Purposes and legal bases of processing

The Controller processes Users’ personal data for the following purposes and on the following legal bases:

3.1 Contact form

The data provided in the contact form (first name and surname, e-mail address, telephone number, message content and information about the subject of the enquiry) is processed in order to respond to the enquiry submitted.

Legal basis: Article 6(1)(b) GDPR (steps taken prior to entering into a contract) or Article 6(1)(f) GDPR (legitimate interest of the Controller).
Retention period: until the correspondence is concluded, and thereafter for the period resulting from legal provisions or for the time necessary to establish, exercise or defend legal claims.

3.2 Conclusion and performance of a contract

Client data (first name and surname, address, Tax ID, contact details) is processed in order to perform the contract for the sale of ready-made companies and to provide legal services.

Legal basis: Article 6(1)(b) GDPR (performance of a contract).
Retention period: for the duration of the contract and for the period resulting from tax and accounting regulations (as a rule, 5 years from the end of the tax year).

3.3 Newsletter and commercial information

An e-mail address provided in order to subscribe to the newsletter, or submitted in a form together with marketing consent, is processed for the purpose of sending commercial and marketing information by electronic means.

Legal basis: Article 6(1)(a) GDPR (consent) and Article 10 of the Polish Act on Providing Services by Electronic Means.
Retention period: until consent is withdrawn. Consent may be withdrawn at any time by clicking the “Unsubscribe" link in any message or by contacting the Controller.

3.4 Marketing and analytics

Data concerning Users’ activity on the Website (cookies, IP address, browser and device data) is processed for analytical and marketing purposes.

Legal basis: Article 6(1)(a) GDPR (consent given in the cookie management panel) or Article 6(1)(f) GDPR (legitimate interest in analysing website traffic).
Retention period: until consent is withdrawn or the relevant cookies expire, and no longer than 26 months from the User’s last activity.

3.5 Contact forms on social media platforms (Instant Forms)

The Controller runs advertising campaigns on Facebook and Instagram in which the User may submit their contact details without leaving those platforms, using a so-called Instant Form provided by Meta Platforms Ireland Ltd.

Scope of data: first name and surname, e-mail address, telephone number and answers to the qualifying questions asked in the form (for example, the planned date of commencing business activity or holding a certificate of professional competence).
Purpose: responding to the enquiry and presenting an offer.
Legal basis: Article 6(1)(b) GDPR (steps taken prior to entering into a contract) and Article 6(1)(a) GDPR (consent) in respect of marketing contact.
Retention period: until the correspondence is concluded, and thereafter for the time necessary to establish, exercise or defend legal claims.

Data entered in an Instant Form is first collected by Meta Platforms Ireland Ltd. and subsequently transferred to the Controller and saved in the CRM system. The rules governing processing on Meta’s side are set out in that company’s privacy policy: facebook.com/privacy/policy

3.6 Social media profiles

The Controller maintains profiles on Facebook and Instagram. In connection with maintaining these profiles, the Controller processes the data of persons who interact with them (follow the profile, react to posts, leave comments or send messages) for the purpose of communication and responding to enquiries.

Legal basis: Article 6(1)(f) GDPR (legitimate interest in communicating with the audience and promoting the Controller’s own services).
Retention period: until an objection is raised or the profile ceases to be maintained.

With regard to statistics concerning the profile’s audience (aggregate data on reach, impressions and audience demographics), the Controller and Meta Platforms Ireland Ltd. act as joint controllers. The arrangement governing this joint controllership and the allocation of responsibilities between the parties is set out in the document available at: facebook.com/legal/terms/page_controller_addendum. The Controller receives aggregate data only and has no access to data identifying individual members of the audience.

3.7 Voluntary nature of providing data

Providing personal data is voluntary, but necessary in order to respond to an enquiry, to conclude and perform a contract and to receive commercial information. The consequence of not providing the data is that these purposes cannot be fulfilled.

§ 4. Recipients of personal data

Users’ personal data may be transferred to the following categories of recipients:

IT and hosting service providers – in order to maintain the technical infrastructure of the Website (hosting: Zenbox).
Google LLC – in respect of analytics and advertising services (Google Analytics 4, Google Tag Manager, Google Ads, Google reCAPTCHA, Google Maps). Google may process data on servers outside the European Economic Area. More information: policies.google.com/privacy
Meta Platforms Ireland Ltd. – in respect of advertising and remarketing tools (Meta Pixel, Conversions API, Instant Forms, advertising on Facebook and Instagram). More information: facebook.com/privacy/policy
Brevo (Sendinblue) – in respect of e-mail marketing and newsletter distribution services. More information: brevo.com/legal/privacypolicy
Pipedrive – a CRM system for managing client relationships and for operating the chat available on the Website. More information: pipedrive.com/en/privacy
Make.com (Celonis SE) – a data workflow automation platform used to transfer form submissions to the CRM system and to mailing and advertising systems. More information: make.com/en/privacy-notice
CookieYes Limited – in respect of operating the cookie consent panel and storing records of the consents given. More information: cookieyes.com/privacy-policy
Notarial offices and registry courts – to the extent necessary to carry out company sale transactions.
Public authorities – in cases required by law.

The Controller does not sell Users’ personal data to third parties.

§ 5. Users’ rights

Every User has the following rights in connection with the processing of their personal data:

Right of access – the right to obtain information about the personal data processed and a copy of that data (Article 15 GDPR).
Right to rectification – the right to request the correction of inaccurate data or the completion of incomplete data (Article 16 GDPR).
Right to erasure – the right to request the deletion of data in the cases set out in Article 17 GDPR.
Right to restriction of processing – the right to request the restriction of processing in the cases set out in Article 18 GDPR.
Right to data portability – the right to receive the data in a structured, commonly used format (Article 20 GDPR).
Right to object – the right to object to the processing of data carried out on the basis of the Controller’s legitimate interest (Article 21(1) GDPR).
Right to object to direct marketing – the User may object at any time to the processing of their data for direct marketing purposes, without giving any reason. Once an objection has been raised, the Controller ceases such processing (Article 21(2) GDPR).
Right to withdraw consent – at any time, without affecting the lawfulness of processing carried out before the withdrawal.
Right to lodge a complaint – the right to lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland, www.uodo.gov.pl).

To exercise the above rights, please contact the Controller at the e-mail address indicated in § 1.

§ 6. Cookies

6.1 What cookies are

Cookies are small text files saved on the User’s end device by the web browser while visiting the Website. Cookies do not contain personal data allowing the User to be identified directly.

6.2 Types of cookies used

Necessary – required for the Website to function correctly (session, security, storing cookie preferences). No consent required.
Analytical – enable the analysis of traffic on the Website (Google Analytics 4). Require the User’s consent.
Marketing – used to display personalised advertising (Meta Pixel, Google Ads). Require the User’s consent.
Functional – enable the use of additional features of the Website (Google Maps, Pipedrive chat). Require the User’s consent.

6.3 Managing cookies

The User may manage their cookie preferences by means of:

The CookieYes consent management panel, available on the Website as a banner and as a link allowing the consents given to be changed at any time.
Web browser settings – it is possible to disable all or selected cookies. Detailed instructions are available in the browser’s help section.

Disabling cookies may limit the functionality of the Website.

§ 7. Analytical and marketing tools

7.1 Google Analytics 4

The Website uses Google Analytics 4 (GA4), a web analytics service provided by Google LLC. GA4 uses cookies to analyse how Users use the Website (number of visits, time spent on the site, traffic sources). IP addresses are not stored in full and the data is pseudonymised. Users may opt out of GA4 tracking by installing the add-on available at tools.google.com/dlpage/gaoptout.

Within Google Analytics 4, the Controller uses the Google Signals feature. It allows information about visits to the Website to be associated with the Google account data of those Users who are signed in to their Google account and have consented to ad personalisation. This feature serves to obtain aggregate information about the Website’s audience, including approximate age, gender and interests, as well as cross-device measurement. The Controller receives aggregate data only and has no access to data identifying individual persons.

Legal basis: Article 6(1)(a) GDPR – consent given in the cookie management panel in respect of analytical and marketing cookies.

Users may disable ad personalisation and the association of data on Google’s side at any time in their account settings at myadcenter.google.com, and may review and delete the data collected at myactivity.google.com.

7.2 Google Tag Manager

The Website uses Google Tag Manager, a tool for managing analytical and marketing tags. GTM does not itself collect personal data, but it manages other tags that may do so.

7.3 Google reCAPTCHA

The contact forms are protected by Google reCAPTCHA v3. This service collects data on User behaviour in order to distinguish humans from bots. The data is transferred to Google LLC. Google’s privacy policy: policies.google.com/privacy

7.4 Google Maps

The Website may contain Google Maps. Using the maps may involve the transfer of data (IP address) to Google LLC.

7.5 Meta Pixel

The Website may use the Meta Pixel (formerly Facebook Pixel), a remarketing tool provided by Meta Platforms Ireland Ltd. The Pixel collects information about Users’ actions in order to personalise advertising on Facebook and Instagram. Users may manage their advertising settings at facebook.com/ads/preferences

The Meta Pixel may use so-called Advanced Matching: it transfers to Meta, in encrypted form (SHA-256 hash), data provided in forms, such as an e-mail address, telephone number or first name and surname, solely in order to better match conversions and advertising audiences. The data is hashed in the browser before being sent, and the transfer takes place only after consent to marketing cookies has been given.

7.6 Meta Conversions API and lead quality measurement

In addition to the Meta Pixel operating in the browser, the Controller uses the Meta Conversions API, which enables information about conversions to be transferred directly from the Controller’s systems, on the server side.

Under this solution, the following is transferred to Meta Platforms Ireland Ltd.:

the submission identifier assigned by Meta (the so-called Lead ID) and the advertisement click identifier,
the e-mail address and telephone number in one-way encrypted form (SHA-256 hash) – Meta does not receive this data in plain form,
information about the stage of handling the submission (for example: contact made, submission qualified, contract concluded) – without the content of conversations, without financial data and without information about the subject matter of the contract.

This processing covers exclusively submissions originating from advertising campaigns run by the Controller on Meta platforms. Its purpose is to measure the effectiveness of those campaigns and to reduce the number of irrelevant submissions, which makes it possible to direct advertising to persons genuinely interested in the offer.

Legal basis: Article 6(1)(f) GDPR – the Controller’s legitimate interest in conducting and optimising its own marketing activities and in reducing advertising costs.
Retention period: data transferred to Meta is processed in accordance with that company’s rules; on the Controller’s side, information about the source of a submission is retained for the duration of handling the matter and for the limitation period for claims.

Transfers under the Conversions API take place on the server side and do not require cookies. The User has the right to object to this processing pursuant to Article 21(1) GDPR and, in respect of direct marketing, pursuant to Article 21(2) GDPR, without giving any reason. An objection may be submitted to the e-mail address indicated in § 1.

7.7 Website chat

The Website may provide a chat operated within the Pipedrive system. When the chat is used, the data provided by the User in the conversation (for example first name, e-mail address, telephone number, message content) and technical data (IP address, browser information) are processed. Conversations are saved in the Controller’s CRM system in order to handle the enquiry and to respond. The chat is launched only after consent to functional cookies has been given.

§ 8. Transfers of data to third countries

Some data recipients (Google LLC, Meta Platforms, Brevo, Pipedrive, Make.com, CookieYes Limited) may process data outside the European Economic Area. Such transfers take place on the basis of:

Standard Contractual Clauses approved by the European Commission, or
A European Commission decision confirming an adequate level of protection (including the Data Privacy Framework for entities based in the USA and the adequacy decision for the United Kingdom).

Users may obtain a copy of the safeguards applied by contacting the Controller.

§ 9. Data security

The Controller applies appropriate technical and organisational measures to ensure the security of personal data, including:

Encryption of data transmission using the SSL/TLS protocol (HTTPS certificate).
Regular backups.
Access control for personal data.
Keeping software and security systems up to date.

§ 10. Profiling and automated decision-making

The Controller does not take decisions in relation to Users based solely on automated processing that would produce legal effects concerning them or similarly significantly affect them.

Within the analytical and advertising tools used, profiling for marketing purposes may occur, consisting in matching advertising content to the User’s interests. This takes place solely on the basis of consent given in the cookie management panel and may be withdrawn at any time.

Profiling for marketing purposes also includes assessing the quality of submissions originating from advertising campaigns, carried out on the basis of the stage of handling the matter in the CRM system. This assessment produces no legal effects concerning the User and does not significantly affect them – it serves solely to direct future advertising to persons with a similar interest profile. The User has the right to object to such processing.

§ 11. Links to external websites

The Website may contain links to external websites. The Controller is not responsible for the privacy policies applied by the owners of those websites. We recommend reviewing the privacy policy of every website you visit.

§ 12. Changes to the Privacy Policy

The Controller reserves the right to amend this Privacy Policy. Any changes will be published on the Website together with the date of the update. In the event of significant changes, Users will be informed in a clearly visible manner.

Continued use of the Website after the changes have been introduced constitutes acceptance of those changes.

§ 13. Final provisions

This Privacy Policy is effective as of 13 August 2026.

Matters not governed by this Privacy Policy are subject to the provisions of the GDPR and of Polish law, in particular the Personal Data Protection Act of 10 May 2018 (Journal of Laws of 2018, item 1000, as amended).

This document is a translation of the Polish version of the Privacy Policy. In the event of any discrepancy between the language versions, the Polish version shall prevail.

KANCELARIA READY2GO SP. Z O.O. | ready2go.com.pl | Warsaw 2026