COOKIE POLICY

This Cookie Policy explains in detail how Exactflow Prosta Spółka Akcyjna is registered in Poland under KRS number 0001218490, with its registered office at ul. Stanisława Bodycha 87, 05-816 Reguły, Poland ("Company", "we", "us", "our"), uses cookies and similar tracking technologies on our website at www.exactsolution.com and Where our services are also accessed via mobile applications or other digital platforms, separate notices governing the use of device identifiers, SDK-based tracking technologies, and in-app consent mechanisms will be made available within those applications prior to any tracking commencing. Those notices should be read alongside this Cookie Policy. 

This Cookie Policy is issued in accordance with the requirements of: Regulation (EU) 2016/679 of the European Parliament and of the Council (General Data Protection Regulation, "GDPR"); Directive 2002/58/EC concerning the processing of personal data and the protection of privacy in the electronic communications sector (ePrivacy Directive), as amended by Directive 2009/136/EC; the Polish Act of 16 July 2004, Telecommunications Law (Prawo telekomunikacyjne), which implements the ePrivacy Directive in Poland, In particular Article 173(1) governing the general rule on placement and reading of cookies and Article 173(3) governing the consent requirement therefor; and guidance issued by the Polish supervisory authority, the Urząd Ochrony Danych Osobowych (UODO), and the European Data Protection Board (EDPB) on the use of cookies and the validity of consent. 

By using the Platform, you acknowledge that cookies and similar technologies may be deployed on your device. Where your consent is required for a particular category of cookie, that consent will be sought through our Cookie Preference Centre prior to the deployment of those cookies. Strictly necessary cookies are deployed without your consent on the legal basis described in Section 4.1 of this Policy.

This Cookie Policy should be read in conjunction with our Privacy Policy(opens in a new tab) ,which provides full information about how we collect, use, and protect personal data processed through cookies and other means. All capitalized terms not defined in this Policy carry the meaning given to them in our Privacy Policy.

A cookie is a small text file that is placed on your device, including desktop computers, laptops, tablets, and smartphones, by a website you visit. Cookies are stored locally on your device by your web browser and are sent back to the originating website on each subsequent visit, or to any other website that recognises that cookie. Cookies serve a wide range of functions and are fundamental to how most websites operate today, enabling websites to remember your actions and preferences, such as login status, language, or font size, over a period of time.

Cookies can be categorised in several ways. A "first-party cookie" is a cookie placed directly by the website you are visiting, whereas a "third-party cookie" is placed by a domain other than the website you are visiting, typically by an advertising network, analytics provider, or social media platform that has embedded code on the visited website. Cookies can also be classified by their duration: "session cookies" exist only for the duration of your browsing session and are deleted when you close your browser, while "persistent cookies" remain on your device after your browsing session ends, for a fixed period defined at the time of their deployment or until you manually delete them.

In addition to cookies, the Platform may use other similar tracking technologies, including but not limited to: web beacons (also known as "clear GIFs" or "pixel tags"), which are small transparent graphic images embedded in web pages or emails that record whether a page has been accessed or an email has been opened; local storage (including HTML5 localStorage and sessionStorage),.which allows websites to store data locally in your browser similar to cookies but with greater storage capacity; and software development kit (SDK) tags deployed within mobile applications to collect information about app usage and user behaviour 

None of the tracking technologies described in this Policy install software on your device, access existing files stored on your device, execute arbitrary code, or modify your device settings. They are passive data collection mechanisms that operate solely within the scope of your browser session or application environment.

For the purposes of this Cookie Policy, references to "cookies" should be understood to include all such similar technologies unless otherwise specified.

We use cookies and similar technologies for several distinct purposes, each described in detail in Section 4 of this Policy. At the highest level, cookies enable us to: operate the core functions of the Platform, including maintaining your login session and your shopping basket; understand how visitors use the Platform so that we can identify improvements and fix problems; remember your preferences and settings to provide a more personalised experience; deliver and measure the effectiveness of marketing communications; and prevent fraud and protect the security of the Platform and its users.

Each cookie deployed on the Platform serves one of the functional categories described below. The scope of data collected by each cookie is limited to what is necessary for its stated purpose. Where a cookie involves the processing of personal data, that processing is governed by our Privacy Policy- (https://www.exactsolution.com/privacy) and conducted on the legal bases described in Section 5 of this Cookie Policy.

4.1 Strictly Necessary Cookies

Strictly necessary cookies are essential to the basic functioning of the Platform. Without them, services you have requested, such as logging into your Account, adding Products to your shopping basket, or completing a checkout, cannot be provided. Because these cookies are indispensable to the delivery of a service you have explicitly requested, they are deployed without requiring your prior consent, in accordance with the ePrivacy Directive and Article 173(3) of the Polish Telecommunications Law, which exempts from the consent requirement cookies that are "strictly necessary" for the provision of a service requested by the user.

The types of strictly necessary cookies we deploy include: session authentication cookies, which verify your identity and maintain your secure login state throughout your visit; shopping basket cookies, which retain the contents of your basket as you navigate between pages; CSRF (Cross-Site Request Forgery) protection tokens, which prevent malicious third parties from submitting fraudulent requests using your credentials; load balancing cookies, which distribute traffic efficiently across our server infrastructure; and consent management cookies, which store the record of your cookie preferences as expressed through our Cookie Preference Centre. These cookies are exclusively first-party cookies and are session-based or short-term persistent in nature.

Strictly necessary cookies are deployed without requiring your prior consent, in accordance with Article 173(3) of the Polish Telecommunications Law (Prawo telekomunikacyjne) and the equivalent exemption under Article 5(3) of the ePrivacy Directive, on the basis that they are essential to provide a service you have explicitly requested. The applicable GDPR legal basis varies by cookie type: session authentication cookies, shopping basket cookies, and load balancing cookies are processed under Article 6(1)(b) GDPR as necessary for the performance of a contract to which you are party; CSRF protection tokens and security-related cookies are processed under Article 6(1)(f) GDPR on the basis of our legitimate interests in maintaining platform security and preventing fraudulent activity; and consent management cookies are processed under Article 6(1)(c) GDPR as necessary for compliance with our legal obligations under data protection law. 

4.2 Functional Cookies

Functional cookies allow the Platform to remember choices you make and provide enhanced, personalised features. They do not track your browsing activity across unrelated third-party websites. The information collected by functional cookies may include your language preference, your selected currency, your region or country setting, your display preferences, and whether you have previously dismissed notifications or promotional banners.

Functional cookies are deployed on the basis of your consent, which is obtained through the Cookie Preference Centre prior to their deployment. If you do not consent to functional cookies, certain Platform features, such as automatic language detection or saved preferences, will not be available to you, but the core functionality of the Platform will remain accessible. Functional cookies are generally persistent in nature and remain active for the period described in the cookie register available in the Cookie Preference Centre on the Platform.

4.3 Analytics and Performance Cookies

Analytics and performance cookies collect information about how visitors use the Platform. This includes data such as which pages are visited most frequently, how long visitors spend on each page, where visitors come from (for example, via search engines, direct navigation, or referral links), and any error messages or technical issues encountered during a session. This information is used in aggregate and statistical form to understand usage patterns and to continuously improve the Platform's structure, content, and performance.

We configure our analytics tools to apply enhanced privacy settings, including data minimisation measures and restricted data sharing. Analytics cookies are only activated after you provide your explicit consent through our Cookie Preference Centre. You may withdraw your consent for analytics cookies at any time by updating your cookie preferences.

4.4 Marketing and Advertising Cookies

Marketing and advertising cookies are used to deliver advertisements and promotional content that is relevant and tailored to your interests, based on your browsing behaviour and interaction history. These cookies track your visit to our Platform and other websites you may visit, enabling us and our advertising partners to build a profile of your interests and to show you relevant advertisements across the web and on social media platforms.

Third-party advertising partners, including but not limited to Meta Platforms Ireland Limited (Facebook and Instagram Pixel), Google LLC (Google Ads remarketing), and other digital marketing platforms, may deploy their own cookies through our Platform where you have consented to marketing cookies. These third parties act as independent controllers in respect of the data collected through their cookies, and we have no control over their cookie practices. We encourage you to review the privacy policies and cookie policies of these third parties directly.

Marketing and advertising cookies are deployed exclusively on the basis of your explicit, freely given, specific, informed, and unambiguous consent, in accordance with Article 4(11) and Article 7 of the GDPR and the EDPB Guidelines 05/2020 on Consent.
You may withdraw your consent to marketing cookies at any time by visiting the Cookie Preference Centre, accessible via the [Cookie Settings] link in the footer of every page of the Platform. Withdrawal of consent takes effect immediately upon your selection being saved. Cookie files already placed on your device prior to withdrawal may persist until their natural expiry unless you delete them manually through your browser settings, which are described in Section 6 of this Policy. 

4.5 Social Media Cookies

Where the Platform incorporates social media plugins, share buttons, or embedded social media content, such as Facebook Like buttons, Twitter/X share icons, or Instagram embeds, social media platforms may deploy cookies on your device as a result of your interaction with these features, or in some cases upon page load if the plugin is configured to load automatically. These social media cookies are controlled by the respective platform providers and are subject to their independent privacy and cookie policies.

We endeavour to implement social media plugins in a privacy-preserving manner, using two-click solutions or server-side rendering where technically feasible, so that social media cookies are not deployed until you actively choose to interact with a social media feature. Where this approach is not technically feasible, social media cookies are treated as non-essential and are subject to your prior consent.

If auto-loading is confirmed and remediation is not yet complete: Social media cookies are treated as non-essential and are subject to your prior consent via the Cookie Preference Centre. Social media plugins are not activated on the Platform until you have provided explicit consent for this category of cookies. 

4.6 Security and Fraud Prevention Cookies

In addition to the strictly necessary authentication cookies described in Section 4.1, we deploy certain cookies specifically for the purpose of detecting, preventing, and investigating fraud, abuse, and security incidents. These cookies may collect information about your device characteristics, browser fingerprint, interaction patterns, and behavioural signals that may indicate automated or fraudulent activity. The data collected by security cookies is processed solely for the purpose of protecting the security of the Platform and its users and is not used for profiling or advertising purposes. Security cookies are deployed on the basis of our legitimate interests in maintaining the security and integrity of the Platform.

Security cookies are deployed on the basis of the strictly necessary exemption under Article 5(3) of the ePrivacy Directive and, in respect of the processing of personal data thereby collected, Article 6(1)(f) of the GDPR (legitimate interests). Any processing of personal data collected through security cookies is subject to appropriate technical and organisational safeguards and is retained only for as long as necessary for the security purpose for which it was collected. 

The data collected through cookies constitutes personal data within the meaning of Article 4(1) of the GDPR to the extent that it relates to identified or identifiable individuals. Accordingly, the processing of data collected through cookies must be based on one of the lawful grounds established in Article 6 of the GDPR, as follows.

Strictly necessary cookies are deployed on the basis of Article 6(1)(b) of the GDPR (performance of a contract) where they are essential to delivering the services you have requested, and Article 6(1)(c) of the GDPR (compliance with a legal obligation) where required for security or fraud prevention mandated by applicable law. Security cookies deployed for the purpose of protecting the integrity of the Platform are processed on the basis of Article 6(1)(f) of the GDPR (legitimate interests), where the Company's interest in maintaining a secure platform is not overridden by your privacy rights, given the non-intrusive and operationally essential character of such processing.

Analytics cookies, functional cookies, and marketing cookies are deployed on the basis of Article 6(1)(a) of the GDPR, your freely given, specific, informed, and unambiguous consent, as required by the ePrivacy Directive and as interpreted by the Court of Justice of the European Union in its judgment of 1 October 2019 in Case C-673/17 (Planet49 GmbH). Consent for these categories of cookies is obtained via the Cookie Preference Centre prior to the loading of the relevant cookies.

Third-party social media and advertising cookies operated by independent controllers are subject to the legal bases relied upon by those controllers as disclosed in their respective privacy policies. Where we act as joint controller with a third-party social media platform, the allocation of responsibilities between us is governed by a written arrangement made available to you upon request. 

6.1 The Cookie Preference Centre

When you first visit the Platform, a Cookie Consent Banner is displayed, informing you of the categories of cookies we use and inviting you to make granular choices about which categories you accept. The Cookie Consent Banner does not use pre-ticked boxes. Consent for non-essential cookie categories is obtained only upon affirmative action on your part, such as clicking "Accept All" or individually toggling on specific cookie categories. Clicking "Reject All" or closing the banner without making selections will result in only strictly necessary cookies being deployed.

At any time after your initial choice, you may update your cookie preferences by accessing the Cookie Preference Centre, which is accessible via a persistent link in the footer of the Platform. Changes to your preferences take effect within a technically reasonable period and are recorded on your device as a consent cookie.

6.2 Validity and Duration of Consent

Your cookie consent preferences are stored for a maximum period of 12 Months from the date of their recording. At the end of this period, you will be prompted to review and reconfirm your preferences through the Cookie Consent Banner. If you make no selection at the re-consent prompt, only strictly necessary cookies will continue to be deployed. Cookies set under your prior consent are not automatically renewed upon expiry of the consent period, all non-essential cookies cease to be deployed until a fresh, affirmative selection is made through the Cookie Preference Centre.

We maintain server-side records of each consent event to demonstrate accountability as required under Article 7(1) of the GDPR. Each consent record captures: the timestamp at which consent was given or withdrawn; the version and text of the Cookie Consent Banner displayed at the time; the granular selections made by you, including which cookie categories were accepted and which were rejected; a pseudonymised user identifier (cookie ID or hashed session ID); and a pseudonymised record of the IP address associated with the consent event. Consent logs are retained for a period of three (3) years from the date of recording, in accordance with Section 9 of this Policy.

6.3 Withdrawal of Consent

You may withdraw your consent for any category of non-essential cookies at any time, either through the Cookie Preference Centre on the Platform, by adjusting your browser settings, or by using an opt-out tool provided by a specific third-party service (such as the Google Analytics opt-out browser add-on or the Digital Advertising Alliance opt-out tool). Withdrawal of consent does not affect the lawfulness of any processing carried out before the withdrawal. Upon withdrawal, we will cease to deploy the relevant cookies within a technically reasonable period. Please note that cookies already placed on your device prior to withdrawal will remain on your device until they expire or you delete them through your browser settings.

6.4 Browser-Level Controls

All major web browsers provide settings that allow you to control cookie behaviour, including the ability to refuse all cookies, delete existing cookies, accept cookies from specific websites only, or be notified when a cookie is being placed. Instructions for managing cookies in major browsers are available in those browsers' help documentation. Please be aware that restricting or disabling cookies through browser settings may affect the functionality of the Platform or prevent you from using certain features, including shopping basket functionality, secure login, and personalised preferences.

7.1 Overview of Third-Party Services

The Platform may incorporate or interact with third-party services and technologies that deploy their own cookies and tracking technologies independently of the Company. The Company does not control these third-party cookies and is not responsible for how those third parties use data collected through their cookies. 

7.2 Categories of Third-Party Services

Analytics providers such as Google Analytics collect anonymised or pseudonymised data about how visitors interact with the Platform, including pages visited, session duration, geographic region, and referral source, subject to IP anonymisation. Payment service providers may deploy cookies necessary to process payments securely, authenticate sessions, and prevent payment fraud. These are treated as strictly necessary where they are essential to the completion of a transaction. Advertising networks and remarketing platforms may deploy cookies to track your browsing behaviour for the purpose of showing you relevant advertisements on other websites and social media platforms, subject to your consent. Customer support and live chat tools may deploy session cookies to maintain continuity of support interactions. Where Orders are placed through third-party marketplace channels, those marketplace platforms may deploy their own tracking technologies, including conversion pixels and affiliate tracking scripts, in connection with such Orders. We only permit named and documented third-party tracking technologies to operate through the Platform, and all such technologies are disclosed in our Cookie Register maintained in Section 8 of this Policy. 

7.3 International Transfers Via Third-Party Cookies

Some of our third-party cookie providers are incorporated in or operate servers in countries outside the European Economic Area, including the United States. Where such international transfers of data occur, we ensure that appropriate safeguards are in place in accordance with Chapter V of the GDPR. For transfers to Google LLC (United States), we rely on Standard Contractual Clauses as adopted by the European Commission.

We maintain a detailed Cookie Register setting out the name, provider, category, purpose, type (first-party or third-party), duration, and applicable legal basis for each cookie deployed on the Platform. The Cookie Register is embedded within the Cookie Preference Centre on the Platform and is updated whenever new cookies are introduced or existing cookies are modified.

Strictly necessary cookies currently deployed include: a session authentication cookie issued by the Platform's identity management system with a session lifetime; a shopping basket identifier cookie persisting for the duration of your session and up to thirty (30) days if "remember basket" is enabled; a CSRF token cookie expiring at the end of each session; and a load balancing cookie persisting for the duration of your session.

Analytics cookies currently deployed include the following Google Analytics cookies, which are only placed on your device following your consent: the ga cookie, which persists for two years and is used to distinguish returning visitors; the ga_[Measurement ID] cookie, which persists for two years and tracks session state for the Platform's specific Google Analytics 4 property; and the _gid cookie, which persists for twenty-four hours and is used to differentiate between sessions on the same day. The Measurement ID associated with the Platform's Google Analytics 4 property is available in the Cookie Preference Centre alongside the full Cookie Register.

Analytics cookies currently deployed include the following Google Analytics cookies, which are only placed on your device following your consent: the ga cookie, which persists for two years and is used to distinguish returning visitors; the ga_[Measurement ID] cookie, which persists for two years and tracks session state for the Platform's specific Google Analytics 4 property; and the _gid cookie, which persists for twenty-four hours and is used to differentiate between sessions on the same day. The Measurement ID associated with the Platform's Google Analytics 4 property is available in the Cookie Preference Centre alongside the full Cookie Register. 

The final sentence directs users to the Cookie Preference Centre for the specific ID, which is the correct place to maintain that level of technical detail since it can be updated live without amending the policy document.

Functional cookies include language preference cookies and currency selection cookies, both persisting for twelve (12) months or until changed by you, deployed subject to your consent.

Marketing cookies, where consented to, include platform-specific remarketing pixels and identifiers from advertising network partners, whose duration and specific names are set out in the Cookie Preference Centre. The specific cookies and their durations vary by campaign and provider and are updated accordingly.

Please refer to the Cookie Preference Centre on the Platform for the most current and detailed version of the Cookie Register, which is the authoritative and up-to-date source.

Data collected through cookies and similar technologies is retained for the periods set out in the Cookie Register and in our Privacy Policy. Consent records, that is, the records of your cookie preferences as expressed through the Cookie Preference Centre, are retained for a period of up to three (3) years from the date of consent or withdrawal, to enable us to demonstrate compliance with our obligations under Article 7(1) of the GDPR in the event of a regulatory enquiry or dispute. This retention of consent records does not involve storing the content of your browsing session or any personal data collected by analytics or marketing cookies beyond the periods specified for those cookies.

Aggregated or anonymised data derived from analytics cookies, from which no individual user can be identified, may be retained for a period of up to thirty-six (36) months for historical analytical purposes and product development. Where true anonymisation has been achieved in accordance with the standard set out in Recital 26 of the GDPR, meaning that re-identification is not reasonably possible by any means likely to be used, such data falls outside the scope of the GDPR. Where data is pseudonymised rather than fully anonymised, it remains personal data and is subject to the standard retention periods set out in Section 9 of this Policy. 

Some web browsers and mobile operating systems include a "Do Not Track" (DNT) feature or signal that you can activate to signal your preference not to have information about your online browsing activities monitored and collected. As of the Effective Date of this Policy, no universal technical standard for recognising and implementing DNT signals exists across the industry, and this Platform does not currently recognise DNT signals or alter its cookie practices in response to them. Your cookie preferences must be managed directly through our Cookie Preference Centre, which provides granular, category-level control over the tracking technologies deployed on your device and in practice offers stronger and more legally certain protections than DNT signals in most browsers. 

Similarly, as of the Effective Date of this Policy, this Platform does not currently recognise Global Privacy Control (GPC) signals as a mechanism for withdrawing cookie consent. Where you wish to withdraw or amend your consent to non-essential cookies, this must be done through the Cookie Preference Centre accessible via the [Cookie Settings] link in the footer of every page of the Platform.

We do not knowingly deploy marketing or profiling cookies in connection with users who we know or have reason to believe are below the age at which consent is permitted under applicable law. 

If you are the parent or guardian of a minor and believe that non-essential cookies have been deployed on their device through the Platform without appropriate consent, please contact us at support@exactsolution.com so that we can investigate and take appropriate remedial action without undue delay.

We may update this Cookie Policy from time to time to reflect changes in the cookies we use, changes in applicable law or regulatory guidance, or changes in third-party services. When we make material changes to this Cookie Policy, we will notify you by updating the effective date at the top of this document and by presenting the updated Cookie Consent Banner through which you will be prompted to review and, where required, provide fresh consent before any affected cookies are deployed. Where changes affect the validity of previously obtained consent, including the introduction of new cookie categories, the addition of new third-party partners deploying cookies through the Platform, changes to the purposes for which cookies are used, or material extensions to cookie retention periods, we will seek fresh, affirmative consent through the Cookie Preference Centre before the relevant cookies are deployed. Previously obtained consent will not be treated as valid for materially changed processing activities.

For the purposes of this Policy, a material change includes: the introduction of a new category of cookie not previously disclosed; the addition of a named third-party partner deploying cookies through the Platform; a change in the purpose for which an existing cookie category is used; a significant extension of cookie retention periods; and any change in the legal basis relied upon for a cookie category. Minor updates that do not affect the nature, purpose, or legal basis of cookie deployment, such as corrections to cookie names, technical updates to cookie durations within previously disclosed ranges, or updates to contact details, may be made without formal notice, and the effective date will be updated to reflect such amendments.

We encourage you to review this Cookie Policy periodically. Where changes affect cookies that were previously deployed on the basis of your consent, your existing consent records will remain valid until their natural expiry, after which you will be prompted to provide fresh consent in light of the updated information.

If you have any questions about this Cookie Policy, wish to exercise your data subject rights in relation to data collected through cookies, or wish to report a concern regarding our use of tracking technologies, please contact us at: support@exactsolution.com

For general queries: info@exactsolution.com 

Supervisory Authority: Urząd Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warsaw, Poland. Website: www.uodo.gov.pl