Privacy and Cookies Policy

§ 1 — Introduction

This Privacy Policy (hereinafter referred to as the “Policy”) includes information regarding the processing conducted by the Controllers, specified below your personal data, as well as the use of cookies on foap.com website (hereinafter referred to as the “Website” or “Platform”). The Privacy Policy also includes information regarding the purposes, methods and principles governing the processing of personal data via the Foap mobile application (hereinafter referred to as the “App”), as well as in connection with events organized by the data Controllers (as specified in Section I of the Privacy Policy).

§ 2 — Personal data processing

In connection with the execution of the Regulation (EU) No 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the “GDPR”) under Art. 13 of the GDPR, we provide you with information about our processing of your personal data related to your use of the Website.

I – Personal Data Controllers

The joint controllers (hereinafter jointly “Controllers”) of the personal data processed within the scope specified in § 1 are the entities forming part of the Foap Group, namely:

  • Foap Poland sp. z o.o. with its registered office in Warsaw (02-051), Zygmunta Glogera 2/11 street, entered into the entrepreneurs register of the National Court Register under KRS number: 0000498244, NIP (Tax Identification Number): 1070028702, REGON: 14710203400000, with the share capital in the amount of PLN 111.900;
  • Foap Creators sp. z o.o with its registered office in Warsaw (02-051), Zygmunta Glogera 2/11 street, entered into the entrepreneurs register of the National Court Register under KRS number: 0001231085, NIP (Tax Identification Number): 7011305244 , REGON: 544327381, with the share capital in the amount od PLN 5.000.

II – Contact

You can contact Controllers at support@foap.com in all matters regarding our processing of your personal data. You can also contact Controllers by letter to the address of its registered office indicated in point I above.

Controllers have designated a contact point – Foap Poland sp. z o.o. – which is responsible for handling enquiries and requests from data subjects. Foap Poland sp. z o.o. is also responsible for maintaining the technical infrastructure and ensuring the security of the IT systems used for data processing. Each Data Controller is responsible for ensuring that the rights of data subjects are upheld; furthermore, the Data Controllers are jointly responsible for properly fulfilling their obligation to provide information.

Regardless of the established division of responsibilities, a data subject may exercise their rights under the GDPR with respect to any of the Controllers.

III – Purposes and basis of processing of your data

We process your data for the following purposes and on the following basis:

  1. fulfilling legal obligations under GDPR in respect of the performance of your rights and, in connection with that, archiving your requests sent to us or informing you about threats to your privacy – Art. 6(1)(c) of GDPR (scope of personal data processed: e-mail address, name, surname, other categories of personal data provided by you);
  2. concluding and performing the agreement – when you register an account or make a purchase via Website or App – Art. 6(1)(b) of GDPR (scope of personal data processed: name, surname, e-mail address, profile nickname, Apple account ID, social media profiles data, sex, birthday date, state, city, phone number, other personal data voluntary provided by you);
  3. establishing, executing or defending claims, e.g., when you lodge a complaint – Art. 6(1)(f) of GDPR ; (scope of personal data processed: all personal data voluntarily provided by you, necessary to defend or execute existing claims);
  4. sending you a newsletter, which constitutes information about news and updates – Art. 6(1)(a) of GDPR (your consent) (scope of personal data processed: email address);
  5. fulfilling obligations under the tax law – Art. 6(1)(c) of GDPR (scope of personal data processed: name, surname, address, TIN, VAT number, other data required by tax authorities);
  6. enabling you taking part in events organized by Controllers – Article 6(1)(b) of GDPR – performance of the contract concluded with you, the subject of which is your participation in the event for which you have registered (scope of personal data processed: email address, name, surname, other personal data voluntary provided by you);
  7. distribution of your image in accordance with the separate consent you have given, which specifically covers the distribution of your image – Article 6(1)(a) of GDPR – consent of the data subject (scope of personal data processed: email address, image, other personal data provided within the given consent).
  8. displaying personalized ads within the mobile app in accordance with separate consent provided—Article 6(1)(a) of the GDPR. (scope of data processed: advertising identifier (IDFA for iOS, Android Advertising ID for Android, approximate location (inferred from the IP address), device information (model, operating system version), data regarding the use of and interaction with the mobile app used by the data subject, enabling the display of ads tailored to the user’s preferences, the identifier of the consent granted by the user).

IV – Data Receivers

Your data can be transferred to public or legal entities, if such obligations results from generally applicable provisions of law, and to a company which provides hosting services, an accounting office, a courier advertising service providers (including, in particular, Google) and our other subcontractors providing services to Controllers, for which the processing of personal data is necessary. In same situations your personal data will be provided to clients of Controllers - this will apply if you enter into a contract with us for the purpose of engaging you on projects carried out by the Controllers with a particular client.

V – Storage period for data

We will process your data for the following period of time:

  1. fulfilling legal obligations under GDPR in respect of the performance of your rights and, in connection with that, archiving your requests sent to us our informing you about threats to your privacy – until the expiration of limitation periods (if there are any claims on your or our part);
  2. concluding and performing an agreement – when you register an account or make a purchase – during our cooperation or until the expiration of limitation periods (if there are any claims on your or our part);
  3. establishing, executing or defending claims, e.g., when you lodge a complaint – until the expiration of limitation periods (if there are any claims on your or our part);
  4. fulfilling obligations under the tax law – for the period provided for in the provisions of the tax law (5 years from the end of the year in which the taxable event occurred);
  5. sending you a newsletter, which constitutes information about news and updates – until the data is no longer useful or until you withdraw your consent,
  6. Enabling you taking part in events - until the event has been organised;
  7. Distribution of your image - until consent is withdrawn or until the data processed on the basis of consent is no longer required.
  8. To display personalized ads—until you withdraw your consent or the personal data being processed is no longer required.

VI – Transferring your data to a third country

Controllers might transfer your personal data to countries outside the European Economic Area (hereinafter referred to as ‘Third countries’) which is connected with the scope of the business conducted by the Controllers and the collaboration with various entities. Controllers ensures that the data are transferred to the countries where the European Commission has decided on their compliance with an adequate level of protection of personal data and/or in compliance with any legal requirements, including the relevant agreement, which includes the data protection clauses adopted by the European Commission, ensuring an adequate level of protection of the personal data transferred.

In connection with our use of the tools described above to create your profile and statistics, we may transfer your data to the United States in accordance with Data Privacy Framework to entities that have been certified under this program.

We may provide you with a copy of your data transferred to a third country.

VII – Your rights

We hereby kindly inform you that you have:

  1. the right to access your data and copy of your data;
  2. the right to correct your data (rectify your data);
  3. the right to delete your data – if you believe we have no right to process your data, you may require that we delete them;
  4. the right to limit the processing of your data – you may require limitation of the processing of your personal data to storage only, if you believe your data are incorrect or their processing is illegal, you do not want to have them deleted as you need them to establish, execute or defend claims or for the time of verification of the appropriateness of the objection;
  5. the right to object – you can object to the processing of your personal data for marketing purposes, if such processing is conducted on the basis of a legitimate interest of the Controllers, and we shall cease such processing; you may also object to the processing of your data for other purposes, if the legal basis of the processing is the legitimate interest of the Controllers. The request should include a justification of the objections by stating the particular situation due to which you object. The objection will not be considered, if we show that our legitimate interest takes precedence over your claim or that we need your data to establish, execute or defect claims against you;
  6. the right to transfer your data – this right applies to the data processing in an automated manner which have been provided by you on the basis of your consent or an agreement. You can receive the data in a structured format, e.g. xml, or we can transfer them directly the specified controller;
  7. the right to lodge a complaint – if you believe we process your data illegally, you will be able to lodge a complaint to the Head of the Personal Data Protection Office (polish supervisory authority) or other supervisory authority;
  8. In the event when we process your data on the basis of your consent, you can withdraw your consent at any time. As a result, we will cease our processing of these data, if there is no other legal basis which allows us to process them. Your withdrawal of your consent does not affect the legality of the processing before this withdrawal.

VIII – Information about the requirement/voluntary character of the provision of your data

Providing your data is voluntary but it also a condition for entering into an agreement – when you register an account or make a purchase or a condition for sending you information about news and promotions – regarding the newsletter. Providing your personal data is obligatory if this is required by applicable tax laws.

IX – Automated decision-making

In order to send you a personalized advertisement we will process your data in an automated manner, including in the form of profiling, but it will not produce legal effects concerning you nor will it not significantly influence your situation in a similar way.

The profiling we conduct allows us to determine your interests in our services or offered products. This enables us to create for you a personalized advertisement tailored to your interests and needs. You can object to profiling. In this case, we will immediately stop using your personal data for this purpose.

We will not process your data in an automated manner (including profiling) for any other purposes than indicated above.

§ 3 — Cookies Policy

  1. The Controllers declares that the Website uses "cookies files" (cookies). The use of cookies other than those that are technically necessary—including analytical cookies and those used to display personalized ads—is subject to the User’s prior voluntary consent. Consent is obtained and may be modified or withdrawn at any time using the consent management mechanism (cookie banner) displayed upon the User’s first visit to the Platform and available at all times in its settings.
  2. Cookies are information that is sent by the Website server and are kept in record on the User's device (for example, on computer's hard disk or phone).
  3. The data obtained through the cookies does not allow to identify the User and third parties, but allows the Controllers to determine whether the computer was used by User to visit the Website (which is not who visited the Website) and what preferences User had at that time (what interested him most in the Platform).
  4. The Controllers uses internal cookies to:
    • ensure proper functioning of the Platform,
    • statistical purposes,
    • adapt the Platform to the User's preferences,
    • target personalized ads.
  5. The Controllers may place both permanent and temporary files on the User’s and third parties’ devices.
  6. Temporary files are usually deleted when the browser is closed, but for non-permanent files, closing the browser does not delete them.
  7. Temporary files are used to identify the User as logged in.
  8. Permanent files are files that provide specific functions not only in the course of a given session, but throughout their storage on the computer. Permanent files are used to: collect information about how to use the Platform, including data about User and third parties visits on the subpages and possible errors, checking the effectiveness of the Platform's ads, Platform's enhancements by recording bugs, testing various Platform stylistics variants, memorize User and third parties settings for their preferences, showing Users that they are logged into the Platform.
  9. The Controllers uses Google Analytics and Google AdMob, which uses cookies on User and third party device to generate statistics about traffic on the Platform and how User uses the Platform as well as displaying personalized ads. Google LLC's Privacy Policy is available at https://policies.google.com/privacy
  10. At any time, the User may remove the cookies left by the Platform from his device in accordance with the manufacturer's web browser instructions.
  11. There is also possibility of blocking access of cookies to your device through appropriate browser configuration, however, then the Platform may not function properly.
  12. The Controllers uses a server that saves automatically to the server's logs to analyze information about the device that User uses to connect with Platform, ie the type of device and browser used by the User, the IP of the User's computer, date and time of entrance, text description of event, event qualification.
  13. Log files can be used to compile statistics on the traffic assessment on the Platform and errors occurring that prevent identifying the User.
  14. The Controllers will use for statistical purposes the following analytical/statistical data: number, frequency and effectiveness in a way to prevent the identification of the User and will be entitled to publish the statistics, in particular during conferences, industry meetings and in the trade press.

§ 4 — Final Provisions

  1. This Policy is effective as of 08.09.2026.
  2. You will be notified of every change made to the Policy by e-mail (if u are a User registered on the Platform).