Suite login
-Mar-11-2025-10-07-16-4716-AM.jpg?width=2000&name=Reception%20with%20Guest_00125%20(3)-Mar-11-2025-10-07-16-4716-AM.jpg)
Privacy Policy
Update: 01.04.2025
What is the purpose of this statement? What is GDPR and UK GDPR?
1. This statement serves to fulfill our information obligation and to inform you about how we process personal data.
2. The Profitroom Group (hereinafter referred to as the “Profitroom Group”) consists of the following companies:
- Profitroom S.A., headquartered in Poznań (60-829), ul. Franklina Roosevelta 9, registered in the National Court Register by the District Court for Poznań Nowe Miasto and Wilda, 8th Commercial Division under KRS number: 0000793213, VAT ID: 5252423458, with share capital of PLN 1,513,067.20 (hereinafter referred to as “Profitroom S.A.”),
- Profitroom Ltd., with its registered office at: 6th Floor 2 London Wall Place, London, United Kingdom, EC2Y 5AU, VAT Number: GB 386259945, Company Registration Number: 13470993 (hereinafter referred to as “Profitroom LTD”),
- Profitroom s.r.o., with its registered office at: Haštalská 1072/6, Staré Město, 110 00 Prague 1, Czech Republic. VAT Number: CZ11823941, Company ID: 118 23 941 (hereinafter referred to as “Profitroom SRO”).
3. Each of the companies within the Profitroom Group processes personal data:
- only for clearly defined, lawful purposes,
- in a precise, relevant, and non-excessive manner,
- fairly, lawfully, and securely,
- transparently, with the knowledge of the data subjects and with respect for their rights,
- no longer than necessary,
- in a way that demonstrates compliance with data protection regulations,
- shared with third parties only under appropriate safeguards.
4. GDPR stands for the General Data Protection Regulation 2018/1725. The regulation defines the principles and requirements we must follow when processing personal data. All companies within the Profitroom Group comply with these regulations.
5. In the United Kingdom, data protection is governed by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. These regulations are followed by Profitroom LTD. Profitroom S.A. acts as a representative of Profitroom LTD within the meaning of the GDPR.
When are we a data controller? When are we a data processor?
6. A data controller determines the purposes and means of processing personal data and has control over that data. A data processor, on the other hand, acts on behalf of the controller, does not independently decide on the purposes or means of processing, and performs tasks specified in a data processing agreement (DPA).
7. We act as a data controller in the following situations:
- HR matters: Profitroom S.A.
- Human Resources: Profitroom S.A.
- Employee recruitment: Profitroom Group companies
- Employee training: Profitroom Group companies
- Ordering parts, raw materials, products, external services: Profitroom S.A.
- IT and equipment servicing: Profitroom S.A.
- Service quality testing: Profitroom Group companies
- Planning new services, R&D, strategy: Profitroom S.A.
- Sales: Profitroom Group companies
- Marketing: Profitroom Group companies
- Customer service: Profitroom Group companies
- Finance and Accounting (in relation to settlements with Clients, not between hotel guests and hotels): Profitroom Group companies
- Suite users (Suite has a separate Privacy Policy): Profitroom S.A.
8. The Profitroom Group companies act as data processors in the following situations:
- Enabling the Client to provide services to their customers (e.g., online hotel booking)
- Processing card transactions
- Allowing the Client to send stay offers and information about events and promotions
- Enabling the Client to run a loyalty program
- Access to and maintenance of systems provided under the Agreement, including conducting related trainings, webinars, and system-generated messages
- Performing analytics on data to display reports in the system or generate reports for the Client
How do we process personal data?
9. Choose the option that applies to you and learn more about how we process your personal data.
What data do we process?
We process the data you provide us with, primarily your name, surname, gender, email address, phone number, workplace, job title, image (if included in your email signature).
For what purpose?
We process data to communicate with you (legitimate interest of the controller). For example, if you email us at a profitroom.com domain, we will respond based on the nature of your inquiry.
Who is the data controller in this specific case?
For email communication, the controller is Profitroom S.A. For written correspondence, it is the specific company in the Profitroom Group with which you are communicating.
What is the source of the processed data?
We obtain personal data directly from you.
How long do we process personal data?
From the moment contact is initiated, we process your data for the duration of communication and for 2 additional years for the purpose of legal claims.
Who has access to the data?
Profitroom Group is part of a group of companies that have a legitimate interest in sharing personal data for internal administrative purposes. Access is granted to employees, partners, and external service providers involved in processing (e.g., IT, customer support, sales, legal services).
Is providing data voluntary?
Yes.
Data is transferred within the Profitroom Group to Profitroom LTD based in the UK. Data transfers outside the EEA occur only under adequate safeguards, such as Standard Contractual Clauses. Specific service providers (e.g., email or server providers) are not disclosed publicly. Contact us for more details.
What is the legal basis?
Article 6(1)(f) GDPR: for Profitroom S.A. and Profitroom SRO.
Article 6(1)(f) UK GDPR: for Profitroom LTD.
What data do we process?
Event registration is required, so the data processed depends on the registration form. Typically, we request name, surname, email address, phone number, workplace, and job title.
If you attend a trade fair or event organized by an entity other than a Profitroom Group company, we may also receive your personal data provided during registration or when you directly share your data with us at a Profitroom booth.
For what purpose?
We process data to send event reminders or to contact you in connection with the personal data you have provided (legitimate interest of the controller).
For example, if you register for an event organized by a Profitroom Group company, you will receive an email or SMS reminder about the event details.
If we receive your data from an event organizer, we will contact you to fulfill our information obligations and share what you agreed to when providing your data. The same applies if you give us a business card.
Who is the data controller in this specific case?
The event organizer is the data controller—typically, this is Profitroom S.A. However, always check who is organizing the event. If you consent to data sharing, the consent specifies the data controller. If you hand us a business card, the controller is Profitroom S.A.
What is the source of the processed data?
If you fill out a form or give us your business card, we collect the data directly from you. If you agree to share your data with one or more Profitroom Group companies, we obtain it from the event organizer.
How long do we process personal data?
We process the data for 2 years from collection or 2 years from the end of communication with you, whichever is later.
Who has access to the data?
Profitroom Group may share data internally for administrative purposes. Access is granted to employees, collaborators, and external companies involved in processing (e.g., IT, legal, sales support, customer service).
Is providing data voluntary?
Yes, although failure to provide data prevents event registration.
Is data transferred to a third country?
Yes—within the group, data is transferred to Profitroom LTD in the UK. Other transfers outside the EEA occur only with adequate safeguards such as Standard Contractual Clauses. Contact us for more details.
What is the legal basis?
Article 6(1)(f) GDPR: for Profitroom S.A. and Profitroom SRO.
Article 6(1)(f) UK GDPR: for Profitroom LTD.
What data do we process?
Email address, country. Optionally, we may infer your name, surname, gender, and workplace from this data.
For what purpose?
We process the data to send you marketing information. Each time you consent to receiving such information, you are subscribed to our newsletter.
Who is the data controller in this specific case?
Profitroom S.A.
What is the source of the processed data?
We obtain the data directly from you.
How long do we process personal data?
We process the data from the moment you consent to receive marketing information. Once you withdraw your consent, we will stop sending newsletters, but we may still process records of who gave consent, when, and what messages were sent. These records are kept for 2 years for the purpose of establishing, exercising, or defending legal claims.
Who has access to the data?
The Profitroom Group is part of a group of companies with a legitimate interest in sharing personal data internally for administrative purposes, including operational activities. Access is granted to employees, collaborators, and external companies involved in processing, such as IT, legal, customer service, and sales support providers.
Is providing data voluntary?
Yes.
Is data transferred to a third country?
Data is transferred within the Profitroom Group to Profitroom LTD based in the United Kingdom. Transfers outside the EEA occur only to entities with appropriate safeguards in place, such as Standard Contractual Clauses. For security reasons, we do not publicly disclose specific providers, such as email or server providers. Contact us if you need more details.
What is the legal basis?
Article 6(1)(a) GDPR
What data do we process?
We process the data required at the recruitment stage. These data are collected via a form on the dedicated website https://jobs.profitroom.com/jobs/careers/. It is also possible to provide data by contacting a recruitment officer via LinkedIn. In such cases, the recruiter will not ask for your data but may answer your questions or clarify the recruitment process. Note that we do not conduct recruitment via social media or external websites — the only valid site to apply is the one linked above.
The interview may be recorded and transcribed using Fireflies.ai. When using artificial intelligence tools (such as OpenAI ChatGPT) to assist with note-taking or summarizing, personal data may be anonymized before being shared. These tools do not evaluate candidates or make recruitment decisions. All hiring decisions are made by recruiters. Recruiters may also collect your personal data from publicly available sources (such as LinkedIn or job boards).
For what purpose?
We process the data to carry out the recruitment process ensuring efficiency and transparency.
Who is the data controller in this specific case?
Profitroom S.A.
What is the source of the processed data?
We obtain the data directly from you or through a referral.
How long do we process personal data?
We process the data from the moment you submit your application. During recruitment, the data is actively used and then deleted 3 years after the process ends (if you are not hired), to allow for the establishment, exercise, or defense of legal claims. If you are hired, recruitment-related data will be stored for the duration of employment and the legally required retention period thereafter. If you withdraw your application before the recruitment process ends, we retain data about who gave consent, when, and how it was processed, for 3 years after withdrawal.
Who has access to the data?
The Profitroom Group is part of a group of companies with a legitimate interest in sharing personal data internally for administrative purposes, including operational activities. Access is granted to employees, collaborators, and external companies involved in processing, such as IT and legal services providers.
Your personal data may be disclosed in particular to:
- the data controller's associates involved in the recruitment process
- recruitment support service providers acting as data processors, including:
- Zoho Recruit – system śledzenia kandydatów
- Fireflies.ai – recording and transcription of job interviews (with consent)
- OpenAI – used to prepare summaries and notes based on recruitment documentation
All of these entities process data only on our instructions and in accordance with applicable data processing agreements.
Is providing data voluntary?
Yes, but it is necessary for the recruitment process.
Is data transferred to a third country?
Data is transferred within the Profitroom Group to Profitroom LTD based in the United Kingdom. Your personal data may be transferred outside the European Economic Area (EEA), particularly when using services such as Fireflies.ai and OpenAI, which may process data in the United States. Such transfers are based on standard contractual clauses adopted by the European Commission, ensuring an adequate level of data protection. When using artificial intelligence (AI) tools, personal data may be pseudonymized before transfer but may still be considered personal data under the GDPR.
What is the legal basis?
In the case of recruitment, the legal basis is consent, i.e., Article 6(1)(a) of the GDPR. If the interview is recorded and transcribed using Fireflies.ai, the legal basis for such processing is also your consent (Article 6(1)(a) of the GDPR). Consent is voluntary, and refusing or withdrawing it does not affect your participation in the recruitment process – in such a case, the interview will take place without recording.
In the case of using artificial intelligence tools (such as OpenAI ChatGPT), the legal basis for this processing is the controller's legitimate interest (Article 6(1)(f) of the GDPR), which is to ensure the efficiency and transparency of the recruitment process.
In the case of collecting personal data from publicly available sources (such as LinkedIn or job portals), the legal basis for such processing is the controller's legitimate interest (Article 6(1)(f) of the GDPR), which is to ensure the effective verification of candidates' professional qualifications and their suitability for a given position.
What data do we process?
The data we process depends on the type of consent given. We use different forms that collect various types of data, so please pay attention to the information requested when filling out the form.
For what purpose?
We process the data for the purpose specified in the consent.
Who is the data controller in this specific case?
The entity to which the consent is given is the data controller.
What is the source of the processed data?
We obtain the data directly from you.
How long do we process personal data?
We process the data from the moment consent is given. After consent is withdrawn, we no longer process the data for the specified purpose, but we may retain information about when, who, and what consent was given and what messages were sent. This information is retained for 2 years for the purpose of establishing, exercising, or defending legal claims.
Who has access to the data?
The Profitroom Group is part of a group of companies with a legitimate interest in sharing personal data internally for administrative purposes, including operational activities. Access is granted to employees, collaborators, and external companies involved in processing, such as IT, customer service, sales support, and legal service providers.
Is providing data voluntary?
Yes, although giving consent may be necessary – please refer to the form to check whether consent is required. For example, consent for receiving marketing information may be necessary to participate in a Profitroom event.
Is data transferred to a third country?
Data is transferred within the Profitroom Group to Profitroom LTD based in the United Kingdom. Transfers outside the EEA occur only to entities with appropriate safeguards in place, such as Standard Contractual Clauses. For security reasons, we do not publicly disclose specific providers, such as email or server providers. Contact us if you need more details.
What is the legal basis?
Article 6(1)(f) GDPR: for Profitroom S.A. and Profitroom SRO.
Article 6(1)(f) UK GDPR: for Profitroom LTD.
What data do we process?
Depending on the data you provide in the survey or feedback. Typically, we collect information such as name, surname, email address, workplace, and job title.
For what purpose?
We process the data for the purpose specified in the consent. If the survey or feedback is collected based on the controller's legitimate interest, that interest is obtaining client service-related information.
Who is the data controller in this specific case?
Depending on the entity to which the consent is given, that entity is the data controller. If based on legitimate interest, the controller is Profitroom S.A.
What is the source of the processed data?
We obtain the data directly from you.
How long do we process personal data?
We process the data from the moment consent is given. After consent is withdrawn, we may retain records for 2 years for legal purposes. If based on legitimate interest, we process the data from the time the survey/feedback request is sent and retain it for 2 years thereafter.
Who has access to the data?
The Profitroom Group is part of a group of companies with a legitimate interest in sharing personal data internally for administrative purposes, including operational activities. Access is granted to employees, collaborators, and external companies involved in processing, such as IT, legal, and customer service providers.
Is providing data voluntary?
Yes, providing consent is voluntary. If based on legitimate interest, surveys or requests for feedback may be sent as customary practice, but you may object if you prefer not to receive them.
Is data transferred to a third country?
Data is transferred within the Profitroom Group to Profitroom LTD based in the United Kingdom. Transfers outside the EEA occur only to entities with appropriate safeguards in place, such as Standard Contractual Clauses. For security reasons, we do not publicly disclose specific providers. Contact us for more information.
What is the legal basis?
Article 6(1)(a) GDPR: for Profitroom S.A. and Profitroom SRO.
Article 6(1)(a) UK GDPR: for Profitroom LTD.
Article 6(1)(f) GDPR: for Profitroom S.A. when the legal basis is the controller's legitimate interest.
What data do we process?
Depending on the data we receive from a Partner or provider collecting data from publicly available sources or who possesses business cards with personal data. Our intent is not to process anything other than business data such as: name, surname, email address, phone number, workplace, job title. Additionally, we may infer gender, image (if publicly available online with the data), and country.
For what purpose?
We process the data to initiate contact and request permission to conduct business communication with you (legitimate interest of the controller).
Who is the data controller in this specific case?
Profitroom S.A.
What is the source of the processed data?
We obtain the data not directly from you, but from a third party. In the first contact, we provide the information obligation referred to in Article 14 GDPR and specify who provided your personal data. Contact us if you need further details.
How long do we process personal data?
We start processing the data from the moment your data is acquired as a lead. If we contact you, we archive the necessary details for 2 years to establish, exercise, or defend legal claims. If we do not contact you, the data is deleted within 12 months from the time of acquisition.
Who has access to the data?
The Profitroom Group is part of a group of companies with a legitimate interest in internal data sharing for administrative purposes. Access is granted to employees, collaborators, and external service providers (e.g., IT, legal, customer service).
Is providing data voluntary?
Yes, giving consent is voluntary. In the case of legitimate interest, surveys or feedback requests may be customary. You can object if you do not wish to receive them.
Is data transferred to a third country?
Data is transferred within the Profitroom Group to Profitroom LTD in the UK. Other transfers outside the EEA are made only under appropriate safeguards such as Standard Contractual Clauses. For security reasons, we do not publicly disclose specific providers. Contact us for more details.
What is the legal basis?
Article 6(1)(f) GDPR
What data do we process?
Name, surname, email address, workplace.
For what purpose?
We process the data to send you a notification. The notification may concern important information related to services provided by one or more Profitroom Group companies, or other matters important to you, such as: information about changes to terms and conditions, changes to the agreement, changes in the system, etc. (legitimate interest of the controller).
Who is the data controller in this specific case?
Profitroom S.A.
What is the source of the processed data?
We obtain the data from the system. The data is provided by you; if that is not the case, we will inform you. Communication may be directed to system users, contact persons, or email addresses specified in the agreement, T&Cs, or to entities affected by data breaches, etc.
How long do we process personal data?
From the moment the email is sent, we process data about who the email was sent to, what was sent, and when. This data is processed for up to 12 months. If you respond to such an email, further data processing will follow the applicable policy point.
What data do we process?
When choosing to pay via Google Pay or Apple Pay, we process personal data necessary for transaction handling. This includes email address, encrypted payment token, payment card identification data (e.g., card type and last digits – "Visa •••• 1234"), IP address, browser technical data (user-agent), and transaction identifier.
For what purpose?
The data is processed solely for the technical handling of payments, transaction authorisation, ensuring its security, and detecting fraud. This includes, among other things, passing the token to the payment operator (e.g., Przelewy24), logging transaction metadata, and verifying the correctness of the process.
Who is the personal data controller in this specific case?
Profitroom S.A.
What is the source of the processed data?
The data comes from APIs provided by Google LLC (Google Pay) or Apple Inc. (Apple Pay) and is transmitted after the user's conscious choice of this payment method.
Communication may be directed to system users, contact persons, or email addresses specified in the agreement or Terms and Conditions, or to entities affected by personal data breaches, etc.
How long do we process personal data?
Transaction data is stored for up to 6 years (in accordance with accounting obligations). Technical data (IP address, user-agent) is stored for 12 months. The encrypted payment token is not stored after being passed to the payment operator.
To whom is the data disclosed?
The Profitroom Group is part of a group of enterprises that have a legally justified interest in transferring personal data within their own group of enterprises for internal administrative purposes, which also applies to processing personal data related to operational activities.
Our employees, collaborators, and external companies that implement processes related to the realisation of the purpose have access to the data, which particularly includes companies providing service outsourcing (e.g., IT, legal services, etc.).
Is providing the data voluntary?
Yes. Using Google Pay and Apple Pay is voluntary. Other payment methods, such as bank transfer or payment card, are always available.
Does data transfer to a third country occur?
Data is transferred within the Profitroom Group to Profitroom LTD based in the United Kingdom. In the case of other data recipients, if the transfer occurs outside the European Economic Area, it is only to entities such as Google LLC or Apple Inc., which conduct the payment process and is based on guarantees such as Standard Contractual Clauses. If you need more detailed information, please contact us.
What is the legal basis?
Article 6(1)(b) GDPR (payment processing as part of the booking)
Article 6(1)(f) GDPR (legitimate interest of the controller, which is ensuring security and compliance of payment processes)
What data do we process?
We process the data we receive from the Client, Partner, or Supplier, or directly from you (e.g., when you contact us via email), in connection with the performance or conclusion of an agreement. Typically, this includes: name, surname, email address, workplace, position, country, and phone number.
For what purpose?
We process the data to maintain business communication when you represent or act as a contact person on behalf of the Client, Partner, or Supplier. We may send you information or notifications in connection with ongoing business operations, which are customary in such relationships and linked to an existing or intended agreement.
Who is the data controller in this specific case?
The relevant Profitroom Group company that is conducting business with the Client, Partner, or Supplier.
What is the source of the processed data?
We obtain the data directly from you or from the Client, Partner, or Supplier if they provide it to us — e.g., to create a system account for you or if your details are included in an agreement as the contact person.
How long do we process personal data?
From the moment a business relationship begins and data is obtained. Then throughout the duration of this relationship or until the data changes — e.g., if the Client, Partner, or Supplier notifies us to remove your data. If your data is no longer to be processed or if the business relationship ends, we may retain processing records for up to 2 years for legal claim purposes.
Who has access to the data?
The Profitroom Group is part of a group of companies with a legitimate interest in internal data sharing for administrative purposes. Access is granted to our employees, collaborators, and external service providers involved in the process (e.g., IT, customer support, sales, legal services).
Is providing data voluntary?
Yes.
Is data transferred to a third country?
Data is transferred within the Profitroom Group to Profitroom LTD in the UK. Transfers outside the EEA occur only under adequate safeguards, such as Standard Contractual Clauses. For security reasons, specific providers (e.g., email or server providers) are not publicly disclosed. Contact us for more details.
What is the legal basis?
Article 6(1)(b) GDPR: for Profitroom S.A. and Profitroom SRO.
Article 6(1)(b) UK GDPR: for Profitroom LTD.
What data do we process?
We process the data you provide to us. Typically, this includes: name, surname, email address, and country.
For what purpose?
We process the data in order to handle your complaint, request, or claim (legitimate interest of the controller).
Who is the data controller in this specific case?
The relevant Profitroom Group company to which you submit the complaint, request, or claim.
What is the source of the processed data?
We obtain the data directly from you.
How long do we process personal data?
From the moment you submit a complaint, request, or claim, we process the data for the duration of handling your case and delete it 2 years after completion for the purpose of establishing, exercising, or defending legal claims.
Who has access to the data?
The Profitroom Group is part of a group of companies with a legitimate interest in internal data sharing for administrative purposes, including processing related to operational activities.
Access is granted to our employees, collaborators, and external service providers involved in the process (e.g., IT, customer support, sales, legal services).
Is providing data voluntary?
Yes.
Is data transferred to a third country?
Data is transferred within the Profitroom Group to Profitroom LTD in the UK. Transfers outside the EEA are made only under appropriate safeguards, such as Standard Contractual Clauses. For security reasons, we do not publicly disclose specific providers (e.g., email or server providers). Contact us for more details.
What is the legal basis?
Article 6(1)(f) GDPR: for Profitroom S.A. and Profitroom SRO.
Article 6(1)(f) UK GDPR: for Profitroom LTD.
What data do we process?
We process the data necessary to carry out debt recovery or dispute procedures, based on all the data we have collected about you that is necessary for this purpose.
For what purpose?
We process data for the purpose of pursuing debt collection or legal disputes with you.
Who is the data controller in this specific case?
The Profitroom Group company against which you have a debt or dispute.
What is the source of the processed data?
We obtain the data directly from you.
How long do we process personal data?
From the start of the process until its conclusion. If soft debt collection leads to litigation, data is processed for the duration of proceedings and 2 years thereafter for archiving by legal counsel. If collection ends successfully, information is retained for 5 years for tax documentation archiving purposes.
Who has access to the data?
The Profitroom Group is part of a group of companies with a legitimate interest in internal data sharing for administrative purposes, including operational processing.
Access is granted to our employees, collaborators, and external service providers who are involved in fulfilling the process (e.g., IT, customer service, legal support, etc.).
Is providing data voluntary?
No, we do not request your data; we process the data we already hold about you.
Is data transferred to a third country?
Data is transferred within the Profitroom Group to Profitroom LTD in the UK. If further transfer outside the EEA is required, it is done solely under appropriate safeguards, such as Standard Contractual Clauses. For security reasons, we do not publicly disclose specific providers (e.g., email or server providers). Contact us for more details.
What is the legal basis?
Article 6(1)(c) GDPR: for Profitroom S.A. and Profitroom SRO.
Article 6(1)(c) UK GDPR: for Profitroom LTD.
Your rights
10. We would like to inform you that you have the right to:
- obtain confirmation as to whether we process your personal data and request a copy of the personal data we hold about you, to the extent that it does not affect the rights of third parties, in particular the right to defence or the right to privacy;
- request that we update the personal data we hold about you or correct such personal data that you consider to be incorrect or incomplete;
- request the deletion of the personal data we hold or restrict the way we use such personal data if you believe there is (no longer) a legal basis for processing. However, these rights do not apply to the extent that processing is necessary to establish, exercise, or defend legal claims;
- withdraw your consent to our processing of your personal data (to the extent such processing is based on consent);
- receive a copy of the personal data concerning you that you have provided to us, in a structured, commonly used, and machine-readable format, and to transmit such personal data to another party (to the extent the processing is based on consent or contract);
- object to our processing of your personal data where we rely on legitimate interest as the legal basis. In such case, we will stop processing unless we have compelling legitimate grounds for the processing or the processing is related to the establishment, exercise, or defence of legal claims;
- You also have the right to object at any time to the processing of personal data for direct marketing purposes. If you no longer wish to receive direct marketing from us, you can contact us (see below) or click the unsubscribe feature in any such message. In such case, your data will no longer be processed for these purposes.
- lodge a complaint with a data protection authority in your jurisdiction or the jurisdiction of the relevant Profitroom Group company. Respectively:
- for Profitroom S.A. this is the President of the Personal Data Protection Office (uodo.gov.pl)
- for Profitroom LTD. this is the Information Commissioner’s Office (ico.org.uk)
- for Profitroom SRO this is the Office for Personal Data Protection (uoou.gov.cz)
Before submitting a complaint, we kindly ask that you contact us and let us know what you believe we are doing wrong. This will help us improve and may resolve your issue without needing to involve the supervisory authority.
11. To exercise any of your rights, you may contact us by submitting a request to Ms. Beata Marek, who has been appointed as the Data Protection Officer for each company in the Profitroom Group:
- by sending an email to gdpr@profitroom.com
- by mail using the contact details provided in section 2, addressing the request to the company of your choice.
Security
12. We implement strict technical and organizational (security) measures to protect your data against unauthorized access and against unlawful processing, accidental loss, destruction, and damage—both online and offline.
13. These measures include, among others:
- Training relevant personnel to ensure they are aware of our privacy obligations when processing personal data,
- Implementation of Policies and Procedures based on compliance with the GDPR, UK GDPR, and ISO 27001,
- Compliance with PCI DSS,
- Controls, inspections (reviews), and audits to verify compliance and accountability of processing activities,
- Access restrictions to personal data based on the "need to know" principle,
- Strong passwords, including two-factor authentication,
- Technological security measures, firewalls, encryption, and antivirus software; login access blocks in case of device loss or theft; electronic monitoring and physical security measures such as security badges granting access to our premises.
14. While we apply appropriate security measures once your personal data is received, data transmission—especially over the Internet (including email)—is never completely secure. We do our best to protect personal data, but we cannot guarantee the security of data transmitted to or by us. Access to your personal data is limited to individuals whom we believe need to access that information in order to perform their job duties.
Profiling and Automated Decision-Making
Minors' Data
16. We do not knowingly collect or conduct marketing targeting minors under the age of 18. Our aim is to process personal data related to professional or business activities that help us establish and maintain business relationships.
17. We do not knowingly collect or conduct marketing targeting minors under the age of 18. Our aim is to process personal data related to professional or business activities that help us establish and maintain business relationships.
How to contact us?
18. We hope this Privacy Policy helps you better understand and feel more confident about how we process your personal data. If you have any further questions, please contact us:
- By email: with the Data Protection Officer, Ms. Beata Marek (communication in Polish or English): gdpr@profitroom.com
- By post: to the address of the company to which you are directing your inquiry. Address details can be found in point 2.
Cookies and other identifiers
19. On the profitroom.com website, we use cookies and similar technologies. Below, we provide information about the cookies and similar technologies we use, as well as additional details about how our services and applications operate, including the use of geolocation.
What are cookies?
Cookies are text files saved on your device (e.g., computer, laptop, smartphone) when you browse the Internet. When you revisit our service, your browser sends the cookie back to the service (more precisely, to its server), allowing us to, for example, recognize when a user visits us again.
Cookies have an expiration date after which they become inactive. In our services and applications, we also use other similar technologies such as pixels, plugins, tags, and web beacons. Collectively, we will refer to these technologies as cookies.
By using cookies, we may collect and process information such as browser type and version, operating system, URL of the previously visited site, IP address, server request time, user ID, language, site search queries, products added to the cart, authentication data, content playback data, and other activities in the service or application. We associate the user identifier with other data provided by you (e.g., email address, phone number).
What do we use cookies for?
Some cookies are essential for the operation of services and applications and for accessing their resources, improving their performance and enabling faster access to necessary information. Some cookies are also used to gather information for analytical and statistical purposes or for marketing (e.g., delivering tailored advertising based on your activity or retargeting, which involves showing you specific ads on other websites).
Cookies that are not essential for the operation of our services and applications are installed only if you give your consent, which is voluntary and can be withdrawn at any time.
Do we use third-party cookies?
Yes, when you use our services or applications, you may receive cookies from third parties we work with. We mainly use these cookies for analytical and marketing purposes. We currently use or plan to use the following tools provided by third parties related to the use of cookies and identifiers:
- Google Tag Manager – a tool that enables tag management on the website. The tool itself does not use cookies but manages tags that may result in cookies being saved. Analytical tools.
- Google Analytics – a tool for collecting analytical data, such as counting visits to services or applications, measuring visit duration, and identifying the most frequently used or visited features or parts of services or applications. Google Analytics uses cookies and creates pseudonymized user profiles. IP addresses obtained by the tool are anonymized so that they cannot be assigned to specific users. You can block Google Analytics tracking via: tools.google.com/dlpage/gaoptout
- Hotjar – a tool used to gather analytical data about user behavior and preferences in our services, e.g., time spent on specific pages, most-clicked elements. Hotjar stores this information in a pseudonymized user profile. Neither Hotjar nor we will use this information to identify individual users or match it with additional user data. You can block Hotjar tracking via: help.hotjar.com/hc/en-us/articles/360002735873-How-to-Stop-Hotjar-From-Collecting-your-Data
- Survicate – a tool for conducting surveys to determine customer satisfaction to improve and enhance offered products and services.
- SALESmanago – tools supporting automation of marketing and sales processes, including the processing and advanced analytics of marketing and sales data in a so-called multichannel model – i.e., reaching users through various channels (e.g., websites, push notifications, SMS, MMS, email, chat, phone, etc.) and devices (e.g., computer, smartphone, tablet, phone).
- Google Ads – Google’s advertising system that allows the display of text, graphic, and video ads, and sponsored links in Google search results and on websites participating in the Google AdSense program.
- Google Marketing Platform – a platform that allows us to use various Google marketing tools to deliver tailored ads, avoid showing the same ads repeatedly, optimize campaigns, and monitor their performance. You can block these tools via: www.google.com/settings/ads/plugin
- Facebook (Meta) Ads Manager – Facebook’s advertising system allowing for the creation, purchase, and management of ads across the Facebook social network, Instagram, Messenger, and Facebook Audience Network. On our websites, we use the Facebook Pixel, which allows us to track actions taken on our site and show you ads tailored to your needs or to users with similar profiles. Facebook users can manage ad preferences at: www.facebook.com/ads/preferences. (Additional options available at: www.facebook.com/settings/ads/ or via: youronlinechoices.com/pl/twojewybory)
In addition to the tools mentioned above, other external advertising providers' cookies are used in our services and applications.
Our cookies, cookies from the listed providers, and cookies from other third parties collect information about users' activity on our services or applications. This information may be used to present personalized content and offers tailored to your potential interests and to run advertising campaigns, including retargeting.
These cookies collect information such as visits to our services and activities performed. They allow us and third-party providers to deliver marketing messages to specific user groups – users who have previously visited our services or applications – and to monitor the performance of advertising campaigns.
You can block personalized ads from providers participating in the “About Ads” program via: www.aboutads.info/choices or the “European Interactive Digital Advertising Alliance” via: www.youronlinechoices.com/pl/twojewybory. The block must be set for each browser and will remain until cookies are deleted. If you do not want your data to be used for marketing purposes, contact us at: gdpr@profitroom.com
How to manage cookies?
You can manage cookie settings through the cookie banner available on the profitroom.com website. Except for cookies necessary for the operation of the site, cookies are used only with your consent. At any time, you can disable, delete saved cookies, or change cookie settings on your device via browser settings or the cookie banner on the website. Note that changing your browser settings to disable or limit cookie storage may reduce the functionality of services or applications. You can find information on managing cookie settings in the "Help" section of your browser's menu.
Additional important information about how our Services work:
Geolocation: In your browser, app, or device settings, you can consent to the use of geolocation data. We use this function for analytical purposes.
How to disable location sharing?
You can disable location sharing using the app, device, or browser settings.
Changes
20. We may modify or change this Privacy Policy from time to time. Any changes we may make to this Privacy Policy in the future will be posted on this page. To inform you about such changes, we will update the date at the top of this page. The new, modified or amended Privacy Policy will be effective from the date of such update. We encourage you to periodically review this page for any changes or updates.
Subscribe to our newsletter!
Be in the know. Get the latest industry information, resources, and webinars from Profitroom.