This Privacy Policy (the "Policy") contains information about the processing of your personal data in connection with your use of the "INSY" platform, available at insy.io (the "Platform").
Any capitalized terms not defined otherwise in this Policy have the meanings given to them in the Terms of Service, available at: insy.io/terms-of-service.
The controller of your personal data is INSY sp. z o.o. with its seat in Rzeszow (registered office address: ul. Borowa 1C, 35-232 Rzeszow), entered in the Register of Entrepreneurs of the National Court Register maintained by the District Court in Rzeszow, 12th Commercial Division of the National Court Register, under KRS number: 0001191036, NIP: 5170462877, REGON: 542552731, with share capital of PLN 5,000 (five thousand zlotys) (the "Controller").
In all matters related to the processing of personal data, you may contact the Controller by means of:
The Controller uses modern organizational and technical safeguards in order to ensure the best possible protection of your personal data and guarantees that it processes such data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (the "GDPR"), the Polish Personal Data Protection Act of 10 May 2018, and other personal data protection laws.
Using the Platform requires the processing of your personal data. Below you will find detailed information about the purposes and legal bases of the processing, as well as the storage period and whether providing the data is mandatory or voluntary.
| Purpose of processing | Processed personal data | Legal basis |
|---|---|---|
| Conclusion and performance of the agreement for the Account Service |
| Art. 6(1)(b) GDPR (processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract) |
| Providing the above personal data is a condition for entering into and performing the agreement for the Account Service (providing the data is voluntary, but failure to do so will make it impossible to conclude and perform the agreement). The Controller will process the above personal data until limitation periods for claims arising from the agreement for the Account Service expire. | ||
| Purpose of processing | Processed personal data | Legal basis |
|---|---|---|
| Conclusion and performance of the agreement for the Community Joining Service |
| Art. 6(1)(b) GDPR (processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract) |
| Providing the above personal data is a condition for entering into and performing the agreement for the Community Joining Service (providing the data is voluntary, but failure to do so will make it impossible to conclude and perform the agreement). The Controller will process the above personal data until limitation periods for claims arising from the agreement for the Community Joining Service expire. | ||
| Purpose of processing | Processed personal data | Legal basis |
|---|---|---|
| Conclusion and performance of the agreement for the Community Creation Service |
| Art. 6(1)(b) GDPR (processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract) |
| Providing the above personal data is a condition for entering into and performing the agreement for the Community Creation Service (providing the data is voluntary, but failure to do so will make it impossible to conclude and perform the agreement). The Controller will process the above personal data until limitation periods for claims arising from the agreement for the Community Creation Service expire. | ||
| Purpose of processing | Processed personal data | Legal basis |
|---|---|---|
| Conclusion and performance of the Newsletter supply agreement |
| Art. 6(1)(b) GDPR (processing is necessary for the performance of the Newsletter or Digital Content supply agreement concluded with the data subject or in order to take steps prior to entering into such agreement) and Art. 6(1)(f) GDPR (processing is necessary for the purposes of the Controller's legitimate interests, in this case informing about new features and promotions available on the Platform) |
| Providing the above personal data is voluntary, but necessary in order to receive the Newsletter (failure to provide the data will result in the inability to receive the Newsletter). The Controller will process the above personal data until an effective objection is raised, the processing purpose is achieved, or limitation periods for claims arising from the Newsletter supply agreement expire (whichever occurs first). | ||
| Purpose of processing | Processed personal data | Legal basis |
|---|---|---|
| Handling complaint proceedings |
| Art. 6(1)(c) GDPR (processing is necessary for compliance with a legal obligation to which the Controller is subject, including the obligations to respond to a complaint - Art. 7a of the Polish Consumer Rights Act; and to perform the Customer's rights under the provisions concerning the Controller's liability for non-conformity of a tangible good with the sales agreement or a digital performance with the agreement applicable to it) |
| Providing the above personal data is a condition for receiving a response to a complaint or for exercising the User's rights under the provisions concerning the Controller's liability for non-conformity of the digital performance with the agreement applicable to it (providing the data is voluntary, but failure to do so will make it impossible to receive a response to the complaint and to exercise the above rights). The Controller will process the above personal data for the duration of the complaint procedure and, if the above rights are exercised by the User, until the relevant limitation periods expire. | ||
| Purpose of processing | Processed personal data | Legal basis |
|---|---|---|
| Conducting verification proceedings and considering appeals against decisions regarding unlawful content handling |
| Art. 6(1)(c) GDPR (processing is necessary for compliance with a legal obligation to which the Controller is subject, including the obligations to provide a mechanism for reporting unlawful content (Art. 16 of Regulation 2022/2065 on a Single Market for Digital Services and amending Directive 2000/31/EC (Digital Services Act) (the "DSA")) and to handle complaints (Art. 20 DSA)) |
| Providing the above personal data is a condition for receiving a response to a notice or for exercising the User's rights under the DSA (providing the data is voluntary, but failure to do so will make it impossible to receive a response and to exercise the above rights). The Controller will process the above personal data for the duration of the verification procedure and, if the above rights are exercised by the User, until the relevant limitation periods expire. | ||
| Purpose of processing | Processed personal data | Legal basis |
|---|---|---|
| Handling inquiries submitted by Users |
| Art. 6(1)(f) GDPR (processing is necessary for the purposes of the Controller's legitimate interests, in this case answering the received inquiry) |
| Providing the above personal data is voluntary, but necessary in order to receive a response to the inquiry (failure to provide the data will result in the inability to receive a response). The Controller will process the above personal data until an effective objection is raised or the processing purpose is achieved (whichever occurs first). | ||
| Purpose of processing | Processed personal data | Legal basis |
|---|---|---|
| Making Reviews of Services available |
| Art. 6(1)(f) GDPR (processing is necessary for the purposes of the Controller's legitimate interests, in this case making Reviews available for informational and promotional purposes) |
| Providing the above personal data is voluntary, but necessary in order to add a Review (failure to provide the data will result in the inability to add a Review). The Controller will process the above personal data until an effective objection is raised or the processing purpose is achieved (whichever occurs first). | ||
| Purpose of processing | Processed personal data | Legal basis |
|---|---|---|
| Compliance with tax obligations (including issuing VAT invoices and storing accounting records) |
| Art. 6(1)(c) GDPR (processing is necessary for compliance with a legal obligation to which the Controller is subject, in this case obligations arising from tax law) |
| Providing the above personal data is voluntary, but necessary for the Controller to comply with its tax obligations (failure to provide the data will result in the inability to comply with those obligations). The Controller will process the above personal data for 5 years from the end of the year in which the tax payment deadline for the previous year expired. | ||
| Purpose of processing | Processed personal data | Legal basis |
|---|---|---|
| Performance of obligations related to personal data protection |
| Art. 6(1)(c) GDPR (processing is necessary for compliance with a legal obligation to which the Controller is subject, in this case obligations arising from personal data protection laws) |
| Providing the above personal data is voluntary, but necessary for the proper performance by the Controller of obligations arising from personal data protection laws, including the exercise of rights granted to you under the GDPR (failure to provide the data will result in the inability to properly exercise those rights). The Controller will process the above personal data until limitation periods for claims related to breaches of personal data protection laws expire. | ||
| Purpose of processing | Processed personal data | Legal basis |
|---|---|---|
| Establishment, assertion, or defense of claims |
| Art. 6(1)(f) GDPR (processing is necessary for the purposes of the Controller's legitimate interests, in this case establishing, asserting, or defending against claims that may arise in connection with the performance of agreements concluded with the Controller) |
| Providing the above personal data is voluntary, but necessary in order to establish, assert, or defend against claims that may arise in connection with the performance of agreements concluded with the Controller (failure to provide the data will result in the inability of the Controller to take the above actions). The Controller will process the above personal data until the limitation periods for claims that may arise in connection with the performance of agreements concluded with the Controller expire. | ||
| Purpose of processing | Processed personal data | Legal basis |
|---|---|---|
| Analysis of your activity within the Platform |
| Art. 6(1)(f) GDPR (processing is necessary for the purposes of the Controller's legitimate interests, in this case obtaining information about your activity within the Platform) |
| Providing the above personal data is voluntary, but necessary in order for the Controller to obtain information about your activity within the Platform (failure to provide the data will result in the inability of the Controller to obtain such information). The Controller will process the above personal data until an effective objection is raised or the processing purpose is achieved. | ||
| Purpose of processing | Processed personal data | Legal basis |
|---|---|---|
| Administration of the Platform |
The above data are automatically recorded in so-called server logs whenever the Platform is used (it would not be possible to administer the Platform without server logs and automatic recording). | Art. 6(1)(f) GDPR (processing is necessary for the purposes of the Controller's legitimate interests, in this case ensuring the proper functioning of the Platform) |
| Providing the above personal data is voluntary, but necessary in order to ensure the proper functioning of the Platform (failure to provide the data will result in the inability to ensure that the Platform functions properly). The Controller will process the above personal data until an effective objection is raised or the processing purpose is achieved. | ||
In order to create your profile for marketing purposes and to direct direct marketing tailored to your preferences to you, the Controller will process your personal data in an automated manner, including profiling; however, this will not produce any legal effects concerning you or similarly significantly affect your situation.
The scope of the profiled personal data corresponds to the scope indicated above with respect to the analysis of your activity within the Platform and the data you save in your Account.
The legal basis for processing personal data for the above purpose is Art. 6(1)(f) GDPR, pursuant to which the Controller may process personal data for the purposes of its legitimate interests, in this case conducting marketing activities tailored to recipients' preferences. Providing the above personal data is voluntary, but necessary to achieve the above purpose (failure to provide the data will result in the inability of the Controller to conduct marketing activities tailored to recipients' preferences).
The Controller will process personal data for profiling purposes until an effective objection is raised or the processing purpose is achieved.
The recipients of personal data will include the following external entities cooperating with the Controller:
In addition, personal data may also be disclosed to public or private entities if such an obligation arises from generally applicable laws, a final court judgment, or a final administrative decision.
In connection with the Controller's use of services provided by Google LLC, your personal data may be transferred to the following third countries: the United Kingdom, Canada, the United States, Chile, Brazil, Israel, Saudi Arabia, Qatar, India, China, South Korea, Japan, Singapore, Taiwan (Republic of China), Indonesia, and Australia. The legal basis for transfers to the above third countries is:
You may obtain a copy of the data transferred to a third country from the Controller.
In connection with the processing of personal data, you are entitled to the following rights:
| Tool | Provider | Functions and scope of collected data | Storage period |
|---|---|---|---|
| Necessary cookies | Controller | These cookies are necessary for the proper operation of the Platform / Platform website, therefore you cannot disable them. Thanks to these cookies (collecting, among other things, your device IP address), it is possible, among other things, to inform you about cookies operating within the Platform. | Most necessary cookies are session cookies; however, some remain on your device for 12 months or until they are deleted. |
| Google Analytics | This tool allows statistical data to be collected about how Users use the Platform, including the number of visits, visit duration, search engine used, and location. The collected data help improve the Platform and make it more user-friendly. | up to 2 years or until deleted (whichever occurs first) | |
| Facebook Pixel | This tool makes it possible to determine that you opened the Platform and also to direct advertisements displayed on Facebook and Instagram social media services to you and measure their effectiveness. | up to 3 months or until deleted (whichever occurs first) |
7. Through most commonly used browsers, you can check whether cookies have been installed on your device, remove installed cookies, and block their installation by the Platform in the future. However, disabling or restricting cookies may cause significant difficulties in using the Platform, for example the need to log in on every subpage, longer loading times, and limitations in using certain functionalities.
In matters not regulated by this Policy, generally applicable personal data protection laws shall apply.
The Policy is effective as of 01.01.2026.