Privacy policy

General information

This privacy policy (the "Policy") is addressed to users of the website available at https://skyverse.co (the "Website"), run by Skyverse sp. z o.o. (the "Controller"), and sets out:

• the purpose, type and scope of the data the Controller collects through the Website in connection with the User's use of the Website, including the contact forms,
• the rules the Controller follows when handling that data, including how the Controller uses and secures it,
• the User's rights and obligations regarding that data.

A User is: a natural person, including a natural person running a business or professional activity in their own name; a legal person or an organisational unit without legal personality to which the law grants legal capacity, and natural persons representing or acting on behalf of such legal persons or organisational units; who visits the Website and possibly:

• uses the Website by browsing its content to learn about the services and products offered by the Controller or about the Controller, or
• uses a contact form provided on the Website (on the home page or the Contact page) to send an enquiry to the Controller.

Personal data collected by the Controller through the Website is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (the "GDPR").

The Controller takes particular care to respect and protect the privacy of Users visiting the Website.

Data controller

The controller of personal data is Skyverse sp. z o.o., registered office: ul. Szczepańska 7/4, 31-011 Kraków, Poland, entered in the register of entrepreneurs of the National Court Register (KRS) under number 0000861281, registry court: Sąd Rejonowy dla Krakowa-Śródmieścia w Krakowie, XI Wydział Gospodarczy Krajowego Rejestru Sądowego, NIP (tax ID): 6762585657, share capital: PLN 5 010, phone: +48 508 146 947, e-mail: [email protected].

In all matters concerning personal data you can contact the Controller at [email protected] or in writing at the Controller's registered office.

Types of processing, purposes and legal bases

The Controller collects information about Users.

Users' personal data is collected when:

• an enquiry is sent through a contact form on the Website, in order to answer it and, at the User's request, to take steps before entering into a contract (e.g. to prepare an offer) – the legal basis is that processing is necessary to take steps at the request of the data subject prior to entering into a contract (Article 6(1)(b) GDPR), and where the User acts on behalf of a company or another organisation, or the enquiry does not concern a contract – the Controller's legitimate interest in answering the enquiry and corresponding with the User (Article 6(1)(f) GDPR),
• the User contacts the Controller by the e-mail address or phone number given on the Website, in order to answer and deal with the matter raised by the User – the legal basis is that processing is necessary to take steps prior to entering into a contract (Article 6(1)(b) GDPR) or the Controller's legitimate interest in corresponding with the User (Article 6(1)(f) GDPR),
• the Website's security is ensured, including protecting the contact forms against spam and abuse – the legal basis is the Controller's legitimate interest (Article 6(1)(f) GDPR),
• statistics of visits to the Website are kept using Google Analytics – the legal basis is the User's consent given in the cookie banner (Article 6(1)(a) GDPR in conjunction with Article 399 of the Polish Electronic Communications Law of 12 July 2024),
• the Controller fulfils its statutory obligations, including handling Users' requests concerning their personal data – the legal basis is that processing is necessary for compliance with a legal obligation to which the Controller is subject (Article 6(1)(c) GDPR),
• possible claims are established, pursued or defended – the legal basis is the Controller's legitimate interest (Article 6(1)(f) GDPR).

When sending an enquiry through the contact form on the home page, the User provides:

• their first name,
• their e-mail address,
• the type of service they need (chosen from a list),
• optionally: the company name and the name or location of the development.

When sending an enquiry through the contact form on the Contact page, the User provides:

• their first name and surname,
• their e-mail address or phone number (at least one of them),
• the type of service they need, the planned start of sales and a budget range (chosen from lists),
• optionally: the company name, the name or location of the development and the number of units.

Together with the enquiry, the Controller receives information about the language version of the Website it was sent from.

When the Website is used, the Controller may collect additional information, in particular but not limited to:

• the IP address of the User's device,
• the type and version of the User's browser,
• the type of the User's operating system,
• the time and date of access and the address of the page visited.

The data referred to above is used to administer the Website properly and to keep it secure – the legal basis is the Controller's legitimate interest (Article 6(1)(f) GDPR). Data on how the Website is used, including the pages visited and clicks on selected links, is collected for statistical purposes only after the User consents to Google Analytics cookies.

For the purpose of establishing, pursuing and enforcing the Controller's claims against the User, or defending against the User's claims, some of the personal data provided by the User while using the Website's features may be processed, such as the User's name and other data necessary to prove the existence, validity and amount of a claim and the extent of any damage – the legal basis is the Controller's legitimate interest (Article 6(1)(f) GDPR) in establishing, pursuing and enforcing claims and defending against claims in proceedings before common courts, public authorities and other state bodies and entities.

Providing personal data to the Controller is voluntary. However, the Controller notes that a contact form cannot be sent without the data marked as required, and an enquiry cannot be answered without contact details.

Some User data is collected automatically in accordance with the provisions of this Policy.

The Controller does not make decisions about Users based solely on automated processing, including profiling.

If the User notices that e-mail correspondence from the Controller ends up in the "spam" folder of their mailbox, the User should report this to the Controller without delay so that the problem can be eliminated.

Sharing Users' data

Users' personal data is shared with service providers the Controller uses to run the Website. Depending on the arrangements and circumstances, these providers either follow the Controller's instructions as to the purposes and means of processing, or determine the purposes and means of processing themselves.

The Controller uses service providers that process personal data on the Controller's instructions (processors), such as:

• INTERNET CZ, a.s. (Czech Republic) – the server the Website runs on (hosting),
• Cloudflare, Inc. (USA) – content delivery network (CDN), domain name service (DNS) and the proxy server every connection to the Website passes through (it processes, among other things, IP addresses and technical connection data), and the Cloudflare Turnstile service that protects the contact forms against spam (loaded on pages with a form; it analyses, among other things, the IP address and data about the browser and device),
• Resend, Inc. (USA) – sending the e-mails with enquiries submitted through the contact forms to the Controller,
• Microsoft Ireland Operations Limited (Ireland) – the Microsoft 365 service in which the Controller keeps its mailbox and corresponds with Users,
• Google Ireland Limited (Ireland) – the Google Analytics service, only after the User has given consent,
• to the extent necessary: the Controller's legal advisers.

Where an obligation to disclose a User's personal data to state authorities arises from the law or from a decision of a competent authority, the Controller discloses the data to those authorities to the extent necessary. State authorities include, in particular but not limited to: public administration bodies, the judiciary, law enforcement authorities (e.g. the public prosecutor's office, the police), the President of the Personal Data Protection Office (UODO) and the President of the Office of Electronic Communications (UKE).

Personal data is transferred in the manner set out in the applicable law, including the GDPR and the Polish Personal Data Protection Act of 10 May 2018.

Transfers outside the European Economic Area

Some of the service providers listed above (Cloudflare, Inc. and Resend, Inc., and, for the Google Analytics and Microsoft 365 services, also companies of the Google and Microsoft groups) may process Users' personal data in the United States of America, that is outside the European Economic Area.

Data is transferred to entities that participate in the EU-US Data Privacy Framework on the basis of the European Commission's implementing decision of 10 July 2023 on the adequate level of protection of personal data (Article 45 GDPR), and otherwise on the basis of standard contractual clauses adopted by the European Commission (Article 46(2)(c) GDPR).

The User may obtain a copy of the safeguards applied to transfers outside the European Economic Area, including a copy of the standard contractual clauses, as described in the "Users' rights" section.

How long Users' data is kept

Where the Controller processes a User's personal data on the basis of their consent, the data is processed until the consent is withdrawn, and after withdrawal only to the extent necessary for the limitation period of the Controller's claims against the User or the User's claims against the Controller. Statistical data in Google Analytics is kept for no longer than 14 months.

Data provided in an enquiry and in further correspondence is processed for as long as needed to answer it and hold discussions, and if no contract is concluded – for no longer than 12 months from the last contact. If a contract is concluded, the Controller processes the data until the contract has been performed, and afterwards only to the extent necessary for the limitation period of claims.

Where the Controller processes personal data on the basis of its legitimate interest, the data is processed until the purpose of processing is achieved or until the User lodges an effective objection.

Unless a specific provision states otherwise, the limitation period for claims is 6 years, and 3 years for claims related to running a business and for claims for periodic payments.

If a contract is concluded, after the above period the data will be kept for the period required by tax and accounting regulations, and after that only where and to the extent required by law.

The IP address used to limit the number of forms sent from one device is kept only in the server's working memory, for no longer than 11 minutes. Server logs containing IP addresses are kept for no longer than 30 days, unless they are needed to investigate a security incident.

Cookies

The Website uses cookies and a similar technology – the browser's local storage (localStorage).

When the User uses the Website, the following User data is collected automatically: the User's IP address, browser type and the type of operating system the User uses. This data may be collected in the server logs and, only after the User has given consent, by Google Analytics cookies.

Cookies are files sent automatically to the User's computer or other device while browsing the Website and stored on the terminal equipment of the person visiting the Website, if the web browser allows it. Cookies make it possible, among other things, to compile viewing statistics and to improve the quality of the Website. Cookies also contain their own "expiry time" and an individual, randomly chosen number identifying the file.

On the first visit to the Website, the Controller displays a cookie banner. Google Analytics cookies are stored only after the User clicks "Accept". Until then, and after the User clicks "Reject", the Website does not load the Google Analytics scripts. The User may change or withdraw their consent at any time by choosing "Cookie settings" in the Website footer. Withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal. Cookies stored before consent was withdrawn can be deleted in the browser settings.

The User may also block cookies by configuring the settings of the web browser they use. How cookie settings are configured depends on the browser the User uses.

A User who wishes to delete cookies already stored on their device should choose the appropriate settings in their web browser or delete the cookies manually. How cookies are deleted depends on the web browser the User uses.

Blocking or deleting cookies or the browser's local storage may make the Website less convenient to use, e.g. the cookie banner may be shown on every visit.

The Controller uses two types of cookies:

• persistent cookies – stored in the memory of the User's terminal equipment until they are deleted or expire,
• session cookies – not stored in the memory of the terminal equipment after the browser session ends or the device is switched off; in those cases these files are deleted from the device.

Neither persistent nor session cookies allow any confidential information to be retrieved from the User's device.

The Website stores:

• skyverse-consent (browser local storage, the Website's domain, 12 months) – remembers the User's choice in the cookie banner; it is necessary for the banner to work, it is not a cookie and it is not sent to the server,
• _ga (a Google Analytics cookie stored in the Website's domain, 2 years) – distinguishes unique Users by assigning a randomly generated identifier; stored only after consent,
• _ga_ followed by the property identifier, e.g. _ga_AB12CD34EF (a Google Analytics cookie stored in the Website's domain, 2 years) – stores the session state; stored only after consent,
• technical cookies of Cloudflare, Inc. (e.g. __cf_bm, 30 minutes) – may be stored to protect the Website against automated traffic; the Cloudflare Turnstile widget runs in a frame from the challenges.cloudflare.com domain and may use browser storage there.

Cookies are safe for the User's devices; in particular, they cannot be used to infect the User's device with viruses or other unwanted or malicious software.

Information on changing cookie settings in popular web browsers is available below:

• Opera – https://help.opera.com/en/latest/web-preferences/#cookies,
• Microsoft Edge – https://support.microsoft.com/en-us/windows/microsoft-edge-browsing-data-and-privacy-bb8174ba-9d73-dcf2-9b4a-c582b4e640dd,
• Mozilla Firefox – https://support.mozilla.org/en-US/kb/cookies-information-websites-store-on-your-computer,
• Chrome and Chrome Mobile – https://support.google.com/chrome/answer/95647?hl=en,
• Safari and Safari Mobile – https://support.apple.com/en-us/HT201265.

The legal bases for processing personal data contained in cookies and in the browser's local storage are:

• for remembering the choice made in the cookie banner and for keeping the Website secure, e.g. against external attacks – the Controller's legitimate interest (Article 6(1)(f) GDPR); storing this information is necessary to provide the service the User requests and does not require consent,
• for statistical and analytical purposes – the User's consent (Article 6(1)(a) GDPR in conjunction with Article 399 of the Polish Electronic Communications Law).

The IP address of the User's device

The Controller may collect Users' IP addresses. An IP address is an individual number assigned to the User's device by their internet provider that enables access to the internet. In the vast majority of cases an IP address is assigned to a device dynamically, which means it changes with each connection to the internet. The opposite of a dynamic IP address is a static IP address, which stays the same.

The Controller uses the IP address mainly for:

• diagnosing technical problems with the Website's server,
• administering the Website,
• security, including limiting the number of contact forms sent from one IP address and Cloudflare Turnstile verification,
• identifying the load on the Website's server, in particular by determining which devices run programs that browse the Website's content automatically.

The Website may contain links to other websites not owned by the Controller, e.g. the websites of clients and products. In such cases the Controller is not responsible for the data protection rules that apply there, nor for any unlawful disclosure of personal data by the people running those websites or any interference with that data by them.

Google Analytics

Google Analytics, used by the Controller (provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), is a web analytics system that gives insight into traffic on the Website and is used to find out which content Users find useful. Google Analytics collects, among other things, information about the pages visited, approximate location, device and browser type, and selected events (e.g. sending a contact form or clicking an e-mail address or phone number), without the content of the form and without the User's contact details.

Google Analytics runs only after the User has given consent in the cookie banner. The Controller does not use Google Analytics advertising features or remarketing: consent to advertising cookies and ad personalisation is always switched off on the Website.

A User who does not consent to Google Analytics can click "Reject" in the cookie banner or withdraw consent by choosing "Cookie settings" in the Website footer.

Google's privacy policy is available at: https://policies.google.com/privacy?hl=en

Users' rights

The User has the right to request erasure of their data (the "right to be forgotten") under Article 17 GDPR. Under this right the User may request erasure of all or some of their personal data.

The Controller must erase the User's personal data without undue delay where one of the following applies:

• the personal data is no longer necessary for the purposes for which it was collected or otherwise processed;
• the User concerned has withdrawn the consent on which the processing is based and there is no other legal ground for the processing;
• the User concerned objects to the processing under Article 21(1) GDPR and there are no overriding legitimate grounds for the processing, or the User concerned objects to the processing under Article 21(2) GDPR;
• the personal data has been processed unlawfully;
• the personal data has to be erased to comply with a legal obligation under Union or Member State law to which the Controller is subject;
• the personal data has been collected in relation to the offer of information society services.

Where the Controller has made the personal data public and is obliged under the paragraph above to erase it, the Controller, taking account of available technology and the cost of implementation, takes reasonable steps, including technical measures, to inform controllers processing the personal data that the data subject has requested the erasure by such controllers of any links to, or copies or replications of, that personal data.

Despite a request for erasure, an objection or a withdrawal of consent, the Controller may retain certain personal data, but only to the extent necessary to establish, pursue or defend claims and to comply with a legal obligation requiring processing under Union or Member State law to which the Controller is subject. This applies in particular to personal data including the name, company name, e-mail address, phone number and the content of correspondence, which are retained in order to handle complaints and claims.

The User has the right to restriction of processing of their personal data under Article 18 GDPR. The User may request the Controller to restrict processing where:

• the User concerned contests the accuracy of the personal data – for a period enabling the Controller to verify its accuracy,
• the processing is unlawful and the User concerned opposes the erasure of the personal data and requests the restriction of its use instead,
• the Controller no longer needs the personal data for the purposes of the processing, but the User concerned needs it for the establishment, exercise or defence of legal claims,
• the User concerned has objected to processing under Article 21(1) GDPR – pending verification whether the Controller's legitimate grounds override those of the User.

Where processing has been restricted, such personal data may, with the exception of storage, only be processed with the consent of the User concerned, for the establishment, exercise or defence of legal claims, for the protection of the rights of another natural or legal person, or for reasons of important public interest of the Union or of a Member State.

Before the restriction of processing is lifted, the Controller informs the User concerned who requested the restriction.

The right to withdraw consent under Article 7(3) GDPR is the User's right to withdraw, at any time, consent given to the Controller. Withdrawal of consent:

• takes effect from the moment of withdrawal,
• does not affect the processing carried out by the Controller before the withdrawal,
• does not have any negative consequences for the User.

The right of access under Article 15 GDPR is the User's right to obtain from the Controller confirmation as to whether personal data concerning them is being processed, and, where that is the case, to obtain:

• access to their personal data,
• information about the purposes of the processing; the categories of personal data; the recipients or categories of recipients to whom the personal data has been or will be disclosed, in particular recipients in third countries or international organisations; where possible, the envisaged period for which the personal data will be stored or, if not possible, the criteria used to determine that period; the right to request from the Controller rectification or erasure of personal data or restriction of processing of personal data concerning the User, or to object to such processing; the right to lodge a complaint with a supervisory authority; where the personal data is not collected from the User, any available information as to its source; the existence of automated decision-making, including profiling, and, at least in those cases, meaningful information about the logic involved, as well as the significance and the envisaged consequences of such processing for the User; the safeguards applied when the data is transferred outside the European Union;
• a copy of their personal data.

The right to rectification under Article 16 GDPR is the right of the User concerned to obtain from the Controller without undue delay the rectification of inaccurate personal data concerning them and, taking into account the purposes of the processing, to have incomplete personal data completed (including by means of providing a supplementary statement), by sending a request in writing to the Controller's registered office (ul. Szczepańska 7/4, 31-011 Kraków, Poland) or electronically to [email protected].

The right to be informed about rectification or erasure of personal data or restriction of processing under Article 19 GDPR means that the Controller communicates any rectification or erasure of personal data or restriction of processing carried out in accordance with Article 16, Article 17(1) and Article 18 GDPR to each recipient to whom the personal data has been disclosed, unless this proves impossible or involves disproportionate effort. The Controller informs the User concerned about those recipients if the User requests it.

The right to data portability under Article 20 GDPR is the right of the User concerned to receive the personal data concerning them, which they have provided to the Controller, in a structured, commonly used and machine-readable format (e.g. csv), and to transmit that data to another controller without hindrance from the Controller. This right applies where:

• the processing is based on consent or on a contract, as referred to in Article 20 GDPR,
• the processing is carried out by automated means.

In exercising the right to data portability, the User concerned has the right to have the personal data transmitted by the Controller directly to another controller, where technically feasible. Exercising the right to data portability is without prejudice to the User's right to request erasure of their personal data (the "right to be forgotten"). The right to data portability does not apply to processing necessary for the performance of a task carried out in the public interest, and it must not adversely affect the rights and freedoms of others.

The right to object under Article 21 GDPR is the right of the User concerned to object, on grounds relating to their particular situation, to processing of their personal data, including profiling, where the Controller processes the User's personal data on the basis of its legitimate interest (e.g. to answer an enquiry and correspond with the User, to keep the Website secure or to protect the forms against spam) or because processing is necessary for the performance of a task carried out in the public interest. The User may object at any time.

If the objection is justified, the Controller will no longer process the personal data covered by the objection (the User's data covered by the objection will be erased), unless the Controller demonstrates:

• compelling legitimate grounds for the processing which override the interests, rights and freedoms of the User concerned, or
• grounds for the establishment, exercise or defence of legal claims, or
• another legal basis for processing the User's personal data.

The User may submit complaints, questions and requests to the Controller concerning the processing of their personal data and the exercise of their rights.

The User has the right to request a copy of the standard contractual clauses from the Controller by sending a request in writing to the Controller's registered office (ul. Szczepańska 7/4, 31-011 Kraków, Poland) or electronically to [email protected].

Without prejudice to other rights, the User has the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, ul. Stawki 2, 00-193 Warsaw, Poland) about an infringement of their rights under the GDPR, including the right to the protection of personal data.

The User has the right to control the processing of personal data concerning them in the manner set out in this Policy and in the GDPR.

Consent to the processing of personal data may also be withdrawn by phone by contacting the Controller at +48 508 146 947. The simplest way to withdraw consent to Google Analytics cookies is to choose "Cookie settings" in the Website footer.

The Controller's obligations and rights regarding Users' requests

If the User exercises any of the rights set out above, the Controller provides information on the action taken on the request without undue delay and in any event within one month of receipt of the request. The Controller may extend that period by two further months where necessary, taking into account the complexity and number of the requests. In that case, the Controller informs the User of the extension within one month of receipt of the request, together with the reasons for the delay.

Where the User makes the request by electronic means, the information is provided by electronic means where possible, unless the User requests otherwise (e.g. in writing).

If the Controller finds the User's request justified, it fulfils it; otherwise the Controller refuses to fulfil it within the time limits set out above.

If the Controller does not take action on the User's request, it informs the User without delay and at the latest within one month of receipt of the request of the reasons for not taking action and of the possibility of lodging a complaint with a supervisory authority and seeking a judicial remedy.

The Controller provides the information required by the GDPR and takes the actions requested by the User as described above free of charge. However, where the User's requests are manifestly unfounded or excessive (in particular because of their repetitive character), the Controller may:

• charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested, or
• refuse to act on the request.

The Controller bears the burden of demonstrating the manifestly unfounded or excessive character of the request.

If the purposes for which the Controller processes personal data do not or no longer require the identification of the data subject, the Controller is not obliged to maintain, acquire or process additional information in order to identify the data subject for the sole purpose of complying with the GDPR. Where, in such cases, the Controller is able to demonstrate that it is not in a position to identify the data subject, it informs the data subject accordingly, if possible. In such cases, the rights under Articles 15 to 20 GDPR (described above, except the right to object) do not apply, unless the data subject, for the purpose of exercising those rights, provides additional information enabling their identification.

Without prejudice to the previous paragraph, where the Controller has reasonable doubts concerning the identity of the natural person making any of the requests set out above (Articles 15 to 21 GDPR), it may request additional information necessary to confirm the identity of the data subject.

Security of Users' data

The Controller applies the technical and organisational measures required by the GDPR to protect personal data; in particular, the Controller protects Users' personal data against disclosure to unauthorised persons, loss or damage.

The Controller provides Users with an encrypted and secure connection when using the Website and sending personal data through the contact forms. Encryption uses the HTTPS protocol with a TLS certificate, the accepted standard of encryption on websites. Data is encoded before it is sent from the User's browser and decoded once it has safely reached the server running the Website. Information sent from the server to the User is encoded and then decoded.

Changes to the Policy

The Controller reserves the right to make changes to, withdraw or modify the functions or features of the Website, to cease its activity, to transfer the rights to the Website and to perform any legal acts permitted by applicable law.

The Controller may change this Policy unilaterally and will inform Users of this by a notice published on the Website. Changes do not affect rights or benefits already acquired by the Controller and the User; in particular, a change to the Policy does not affect the User's rights under applicable law.

If the Policy changes, the Controller will inform Users of the change 7 days in advance.

The new text of the Policy will also be published on the Website.

Final provisions

The rules set out in this Policy are governed by Polish law; matters not covered by the Policy are governed by generally applicable law, including the GDPR.

The Policy is available on the Website and will be sent to the User electronically free of charge on request. The Policy can be recorded at any time by printing it, saving it on a storage medium or downloading it from the Website. In case of doubt about the application of the Policy, the User may at any time ask the Controller for the proper interpretation of its provisions.

No provision of this Policy excludes or limits, in any way, the rights the User has under applicable law, nor may it be interpreted in that way.

Please send any questions, statements, requests, objections and demands first to the Controller's e-mail address [email protected], and if that is not possible – in writing to the Controller's registered office: ul. Szczepańska 7/4, 31-011 Kraków, Poland.

Where the User is an entrepreneur, any disputes arising from or in connection with this Policy will be settled by the court having local jurisdiction over the Controller's registered office at the time the statement initiating the court proceedings is filed.

This English version is a translation of the Polish privacy policy. In case of any discrepancy, the Polish version prevails.

This Policy enters into force on 26 October 2026.