Privacy Policy

1. General Provisions

This Privacy Policy sets out the rules for the processing of personal data by Infuture Group Sp. z o.o. and the rights of individuals whose personal data is processed by Infuture Group Sp. z o.o.

This Policy has been prepared taking into account:

• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 ("GDPR"),
• the Polish Act of 10 May 2018 on the Protection of Personal Data,
• the provisions on electronic communications and direct marketing, to the extent applicable to the business activity conducted.

The controller of personal data is:

Infuture Group Sp. z o.o.
ul. Augustyna Szamarzewskiego 21/2
60-514 Poznań
Poland
Tax ID (NIP): 7812100304
KRS: 0001206748
REGON: 543310148

e-mail: contact@infuture-group.pl

hereinafter referred to as the "Controller" or "Infuture Group".

2. Scope of Application of the Policy

This Policy applies to personal data processed by Infuture Group in connection with:

1. use of the Infuture Group website,
2. contact with Infuture Group,
3. maintaining relationships with clients and contractors,
4. handling of prospective clients,
5. conducting informational and marketing activities,
6. sending information about Infuture Group's services,
7. handling consents, objections and requests concerning personal data,
8. maintaining documentation related to the fulfilment of obligations under the GDPR.

This Policy concerns the personal data of natural persons, including sole traders, representatives, employees, proxies and contact persons acting on behalf of businesses, where information about such persons constitutes personal data within the meaning of the GDPR.

3. What Personal Data We May Process

Depending on the nature of the relationship with the data subject, Infuture Group may process, in particular:

• first and last name,
• e-mail address,
• phone number,
• job title or function,
• the name of the business or organisation the person is associated with,
• the address of the registered office or place of business,
• Tax ID (NIP),
• statistical number (REGON),
• data relating to correspondence conducted,
• information about consents given,
• information about the withdrawal of consent,
• information about objections to marketing,
• information about the source from which the data was obtained,
• the date the data was obtained,
• information about the history of communication with Infuture Group,
• technical information related to the use of the website or services.

Infuture Group applies the principle of data minimisation and processes only data that is adequate, relevant and limited to what is necessary for the specific purpose.

Infuture Group does not assume that every e-mail address associated with a business is automatically anonymous corporate data. If an address or other information allows a natural person to be identified, it may constitute personal data subject to the GDPR.

4. Sources from Which Data Is Obtained

Personal data may be obtained:

1. directly from the data subject,
2. from a client or contractor,
3. from an employer or organisation the data subject is associated with,
4. from publicly available registers and databases,
5. from publicly available websites,
6. from publicly available business directories,
7. from publicly available information about businesses,
8. from other lawful sources.

In the course of activities related to identifying prospective clients, publicly available information may be used, in particular information about businesses and contact persons of businesses.

Example sources may include publicly available registers, business directories, company websites and other publicly available sources of information, including, among others, the CEIDG register and business directories.

The fact that data has been published publicly does not automatically mean that the data subject has lost the rights afforded by the GDPR.

Infuture Group assesses the source of the data and the scope of the information obtained having regard to the principles of lawfulness, fairness, transparency, data minimisation and purpose limitation.

5. Information Obligation for Data Obtained from Other Sources

Where personal data has not been obtained directly from the data subject, Infuture Group fulfils the information obligation under Article 14 of the GDPR, unless a legally provided exemption applies.

As part of the information obligation, the data subject may receive information concerning, in particular:

• the identity of the Controller,
• the Controller's contact details,
• the purposes of processing,
• the legal basis for processing,
• the Controller's legitimate interests, where the basis is Article 6(1)(f) GDPR,
• the categories of personal data,
• the source of the data,
• the recipients or categories of recipients of the data,
• the data retention period,
• the rights of the data subject,
• the right to object,
• the right to lodge a complaint with the President of the Personal Data Protection Office (UODO).

The information obligation is fulfilled in a transparent and comprehensible manner, taking into account the nature of the relationship and the way in which the data was obtained.

6. Purposes of Data Processing

Personal data may be processed by Infuture Group for the following purposes:

6.1. Contact and Handling Inquiries

For the purpose of:

• responding to messages,
• conducting correspondence,
• preparing information about services,
• handling inquiries and requests for quotation,
• contacting clients and contractors.

6.2. Performance of Contracts

For the purpose of:

• concluding and performing a contract,
• customer service,
• providing services,
• maintaining documentation related to the contract,
• settlements.

6.3. Direct Marketing

Data may be processed for the purpose of direct marketing of the services and products offered by Infuture Group, in accordance with applicable law.

Where the basis for processing is the Controller's legitimate interest, that basis is Article 6(1)(f) GDPR, taking into account the rights and freedoms of the data subject.

Where data is processed for direct marketing purposes, the data subject may object to such processing at any time.

After an effective objection has been raised, Infuture Group ceases to use the data for direct marketing purposes.

6.4. Handling Marketing Consents

Where a given marketing activity requires consent, Infuture Group may process data for the purpose of:

• collecting consent,
• documenting that it was given,
• determining the scope of the consent,
• handling the withdrawal of consent,
• demonstrating that the process complies with the law.

6.5. Handling Objections and Opt-outs

Infuture Group may process the minimum amount of data necessary to ensure that a person who has objected to marketing or withdrawn consent is not again subjected to marketing communications against their wishes.

7. Legal Grounds for Processing

Depending on the purpose of processing, Infuture Group may base the processing of data on:

1. Article 6(1)(a) GDPR – the consent of the data subject;
2. Article 6(1)(b) GDPR – where processing is necessary for the performance of a contract or to take steps at the request of the data subject prior to entering into a contract;
3. Article 6(1)(c) GDPR – where processing is necessary for compliance with a legal obligation to which the Controller is subject;
4. Article 6(1)(f) GDPR – where processing is necessary for the purposes of the legitimate interests pursued by the Controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject.

Where Article 6(1)(f) GDPR is applied, Infuture Group takes into account the nature of the processing, the legitimate interest pursued, and the rights and freedoms of the data subject.

8. Consent

Where processing is based on consent, that consent is freely given, specific, informed and unambiguous.

The data subject may withdraw consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

Infuture Group ensures that consent can be withdrawn in a manner as easy as, and appropriate to, the way in which it was given.

9. Objection to Direct Marketing

The data subject may object at any time to the processing of their data for direct marketing purposes.

An objection may be raised in particular by:

• replying to an e-mail message,
• contacting: contact@infuture-group.pl,
• using the opt-out mechanism, if one was provided in the message.

An objection to direct marketing is recorded in Infuture Group's systems.

Data necessary to ensure the objection is respected may be stored to a limited extent and for the period necessary to achieve that purpose effectively.

The mere placement of data on a list used to prevent renewed marketing contact does not mean that marketing is continuing to be directed at that person.

10. Objection List / Suppression List

In order to effectively honour objections, Infuture Group may maintain an internal marketing suppression list.

The list may contain the minimum amount of information necessary to identify the address or person who raised the objection.

Information on the list may include, in particular:

• e-mail address,
• contact identifier,
• the date of the objection,
• the source of the objection,
• technical information necessary to prevent renewed communication.

Data on the suppression list is stored for as long as necessary to effectively honour the objection and to demonstrate compliance with legal obligations.

Infuture Group periodically reviews whether continued storage of the data remains justified.

In justified cases, data on the suppression list may be stored for up to 5 years, where this is necessary and proportionate to the purpose of effectively honouring the objection and preventing the data from being used again for marketing.

11. Marketing Communications

Infuture Group may conduct communications concerning the services it offers, including services related to:

• designing and building IT systems,
• CI/CD process automation,
• containerisation,
• server configuration and maintenance,
• website development,
• development of applications and online services,
• IT infrastructure,
• DevOps services,
• other services offered by Infuture Group.

In the case of electronic communications, Infuture Group also applies the requirements arising from the relevant provisions on electronic communications and commercial information.

This Privacy Policy sets out the rules for the processing of personal data and does not replace the requirements concerning the admissibility of a particular form of marketing communication arising from separate legislation.

12. Communication Model Requiring Consent

Where prior consent is required for a given method of communication, Infuture Group may apply a mechanism whereby:

1. the person receives a message about the possibility of receiving further information,
2. the person gives consent if they wish to receive further information,
3. Infuture Group records the fact that consent was given,
4. further communication is carried out within the scope resulting from the consent given and applicable law.

Infuture Group documents, in particular:

• the date consent was given,
• the manner in which it was given,
• the scope of the consent,
• the source of the consent,
• the identifier of the communication or event, where available.

The use of the above mechanism does not exclude the obligation to comply with other provisions concerning the admissibility of marketing communications.

13. Recipients of Data and Data Processors

Infuture Group may use the services of external entities that process personal data on the Controller's behalf.

Such entities are selected taking into account the requirements of the GDPR and appropriate technical and organisational guarantees.

One of the entities processing data on behalf of Infuture Group is:

SEOHOST Sp. z o.o.
ul. Obornicka 330
60-689 Poznań
Poland
Tax ID (NIP): PL9721323212

SEOHOST acts as a data processor under a data processing agreement concluded with Infuture Group in accordance with Article 28 of the GDPR.

The scope of services includes, in particular, the provision of hosting services and the related processing of data.

The processing agreement concluded with SEOHOST provides that data is processed only on the Controller's documented instructions, subject to a confidentiality obligation, the use of appropriate technical and organisational measures, and support for the Controller in fulfilling its obligations under the GDPR.

14. SEOHOST's Sub-processors

In connection with the services provided by SEOHOST, data may be processed by further sub-processors, in accordance with the processing agreement concluded between Infuture Group and SEOHOST.

As of 23 September 2026, the list of sub-processors set out in that agreement includes:

The current list of sub-processors may change in accordance with the terms of the processing agreement concluded with SEOHOST.

15. Rules for the Use of Data Processors

Infuture Group only uses data processors that provide sufficient guarantees of implementing the technical and organisational measures required by the GDPR.

Data processors may process data only to the extent necessary to perform the services entrusted to them and on the basis of appropriate contractual obligations.

Infuture Group retains control over the purposes and scope of data processing.

16. Data Security

Infuture Group applies appropriate technical and organisational measures aimed at protecting personal data against:

• access by unauthorised persons,
• loss,
• destruction,
• alteration,
• unauthorised disclosure,
• unauthorised use.

Within the infrastructure used by Infuture Group, the following are applied, as appropriate to the type of service:

• encrypted connections,
• secure transmission protocols,
• individual authentication credentials,
• access control,
• restriction of privileges,
• backups,
• infrastructure monitoring,
• event logging,
• system updates,
• incident response procedures,
• mechanisms ensuring the availability and recoverability of data.

Security measures are selected taking into account the nature, scope, context and purpose of processing, and the risk of a violation of the rights and freedoms of natural persons.

17. E-mail and Hosting

Infuture Group uses hosting and e-mail services provided by SEOHOST.

Accordingly, data contained in e-mail messages, mailboxes, hosting systems and related logs may be processed by SEOHOST to the extent necessary to provide those services.

In this respect, SEOHOST acts as a data processor under the processing agreement concluded with it.

18. Transfer of Data Outside the European Economic Area

Infuture Group strives to ensure that personal data is processed within the European Economic Area.

Based on the information resulting from the current processing agreement with SEOHOST, the infrastructure and processor locations indicated therein are located in Poland and within the European Union.

Should it become necessary in the future to transfer personal data outside the European Economic Area, Infuture Group will ensure that an appropriate mechanism provided for in Chapter V of the GDPR is applied, where such a mechanism is required.

Information about the appropriate safeguards will be made available in accordance with applicable law.

19. Data Retention Period

Infuture Group stores personal data for no longer than is necessary to achieve the purpose for which it was collected, unless a longer period results from the law or is necessary to establish, pursue or defend legal claims.

The retention period depends on the type of data and the purpose of its processing.

In particular:

• contract-related data may be stored for the duration of the contract and for the period required by legal and accounting obligations;
• data relating to inquiries may be stored for the period necessary to handle the inquiry and any further contact;
• data processed on the basis of consent is stored until the consent is withdrawn, unless another legal basis for further processing exists;
• data used for marketing is stored until an effective objection is raised, consent is withdrawn, or the legal basis for processing ceases to apply;
• data on the suppression list may be stored for the period necessary to effectively honour the objection, taking into account periodic reviews of whether continued storage remains justified.

20. Rights of the Data Subject

The data subject has, to the extent set out in the GDPR, in particular:

1. the right of access to their data,
2. the right to rectification of their data,
3. the right to erasure of their data,
4. the right to restriction of processing,
5. the right to data portability,
6. the right to object,
7. the right to withdraw consent,
8. the right to lodge a complaint with the President of the Personal Data Protection Office.

The scope of each right may depend on the legal basis and circumstances of the specific processing.

21. Right of Access to Data

The data subject may request confirmation from Infuture Group as to whether their personal data is being processed and, if so, may obtain access to that data and the information required under the GDPR.

In justified cases, Infuture Group may verify the identity of the person making the request, to the extent necessary to protect personal data against unauthorised disclosure.

22. Right to Rectification

The data subject has the right to request the rectification of inaccurate data and the completion of incomplete data.

23. Right to Erasure

The data subject may request the erasure of their data in the cases set out in Article 17 of the GDPR.

The right to erasure is not absolute. In particular, data may continue to be stored where its further processing is required by law or is necessary to establish, pursue or defend legal claims.

Where an objection to direct marketing is raised, Infuture Group ceases to use the data for that purpose.

24. Right to Restriction of Processing

The data subject may request the restriction of processing of their data in the cases set out in Article 18 of the GDPR.

During the period of restriction, the data may continue to be stored, but its further use will be limited in accordance with applicable law.

25. Right to Data Portability

In the cases set out in Article 20 of the GDPR, the data subject has the right to receive their personal data in a structured, commonly used and machine-readable format and, where the requirements of the GDPR are met, to transmit it to another controller.

26. Right to Lodge a Complaint

The data subject has the right to lodge a complaint with the President of the Personal Data Protection Office if they consider that the processing of their personal data infringes the GDPR.

Contact details and information on lodging complaints are available on the website of the Personal Data Protection Office.

27. Exercising the Rights of Data Subjects

Requests concerning the exercise of rights may be sent to:

e-mail: contact@infuture-group.pl

The request should, where possible, indicate which right it concerns and allow the identification of the data or relationship to which the request relates.

Infuture Group handles requests in accordance with the time limits set out in the GDPR.

28. Source of Data Where Obtained from the Internet

Where personal data has been obtained from a publicly available source, Infuture Group, to the extent required by Article 14 of the GDPR, indicates the source of that data.

The source may be, in particular:

• a public register,
• a publicly available business directory,
• a publicly available company website,
• a publicly available profile or contact details of a business,
• another lawful, publicly available source.

Where the data was obtained from a specific source, the information provided to the person may indicate that source in more detail, where this is required and possible.

29. Purpose Limitation Principle

Personal data is not used by Infuture Group for purposes incompatible with the purposes for which it was collected, unless further processing is permissible under the GDPR or other applicable law.

30. Profiling and Automated Decision-Making

Infuture Group does not make decisions concerning individuals that produce legal effects for them or similarly significantly affect them based solely on automated processing of data.

Infuture Group may use solutions that automate technical activities, such as:

• sending messages,
• handling queues,
• logging events,
• filtering the suppression list,
• synchronising data,
• handling communication statuses.

The automation of technical activities does not constitute automated decision-making concerning a person within the meaning of Article 22 of the GDPR.

31. Cookies

The Infuture Group website may use cookies and similar technologies.

Cookies may be used, among other things, to:

• ensure the website functions correctly,
• maintain a session,
• ensure security,
• analyse the use of the website,
• perform technical functions.

The extent to which cookies are used and the options for managing them may depend on the configuration of the website and the services used.

32. Changes to the Privacy Policy

Infuture Group may update this Privacy Policy, in particular in the event of:

• changes in the law,
• changes in the manner in which data is processed,
• changes in the services or providers used,
• changes in technical infrastructure,
• an expansion of business activity.

The current version of the Privacy Policy is published on the Infuture Group website.

33. Contact

For matters relating to the protection of personal data, please contact Infuture Group:

Infuture Group Sp. z o.o.
ul. Augustyna Szamarzewskiego 21/2
60-514 Poznań
Poland

e-mail: contact@infuture-group.pl
phone: +48 694 511 622

34. Final Provisions

This Privacy Policy is effective as of 23 September 2026.

In the event of any discrepancy between this Policy and mandatory provisions of law, the applicable law shall prevail.

Infuture Group applies the data protection principles set out in the GDPR, in particular the principles of lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, integrity, confidentiality and accountability.