EXACTFLOW PROSTA SPÓŁKA AKCYJNA PRIVACY POLICY B2C Platform

This Privacy Policy explains how Exactflow PROSTA SPÓŁKA AKCYJNA (referred as in Exactflow P.S.A here onwards) incorporated and registered under the laws of the Republic of Poland under KRS number 0001218490, with its registered office at  ul. Stanisława Bodycha 87, 05-816 Reguły, Poland ("Company", "we", "us", "our") collects, uses, stores, discloses, and protects personal data when you interact with our Platform at www.exactsolution.com, use our services, or otherwise engage with us as a customer, visitor, or subscriber.

This Privacy Policy is issued in compliance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the "General Data Protection Regulation" or "GDPR"), the Act of 10 May 2018 on the Protection of Personal Data (Ustawa z dnia 10 maja 2018 r. o ochronie danych osobowych), and applicable implementing legislation. Where we operate in the United Kingdom, we also comply with the UK GDPR as retained in English law by the European Union (Withdrawal) Act 2018.

We are committed to protecting your privacy and handling your personal data transparently, lawfully, and fairly. We do not sell your personal data to third parties for their own marketing purposes.

The data controller responsible for your personal data is Exactflow P.S.A. Our contact details for all data protection matters are as follows: Exactflow P.S.A., ul. Stanisława Bodycha 87, 05-816 Reguły, Poland, Email: compliance@exactsolution.com

Where the Company processes personal data jointly with other entities for specific purposes, we will inform you of the identity of those joint controllers and the allocation of responsibilities between us.The data controller responsible for your personal data.Our contact details for all data protection matters are as follows: EXACTFLOW PROSTA SPÓŁKA AKCYJNA, ul. Stanisława Bodycha 87, 05-816 Reguły, Poland. Email: compliance@exactsolution.com

Where the Company processes personal data jointly with other entities for specific purposes, such processing is governed by a written joint controllership arrangement in accordance with Article 26 GDPR. That arrangement determines the respective responsibilities of each joint controller, in particular as regards the exercise of data subject rights. The essence of the arrangement is made available to data subjects upon request. Prior to commencing any joint processing activity, we will inform you of the identity of the relevant joint controllers and direct you to the applicable arrangement or a summary thereof. 

All data protection enquiries should be directed to compliance@exactsolution.com

"Personal Data" means any information relating to an identified or identifiable natural person ("data subject"); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.

"Processing" means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction.

"Special Categories of Data" means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data processed for the purpose of uniquely identifying a natural person, data concerning health, data concerning a natural person's sex life or sexual orientation.

"Data Processor" means any natural or legal person, public authority, agency, or other body which processes personal data on behalf of the Controller. All Data Processors engaged by Exactflow are bound by written Data Processing Agreements ("DPAs") executed prior to the commencement of any processing activity, in accordance with Article 28 GDPR. Each DPA contains, as a minimum, all mandatory provisions required by Article 28(3), including: the subject matter, duration, nature, and purpose of the processing; the type of personal data and categories of data subjects involved; the obligations and rights of the Controller; and provisions governing the engagement of sub-processors.

4.1 Account and Registration Data

When you register an Account on the Platform, we collect: your full name; email address; delivery address(es); billing address; telephone number; and the password you create (stored in hashed and salted form — never in plain text). We also collect your language and currency preferences, and any other optional profile information you choose to provide. This information is necessary to create and manage your Account, process your Orders, and communicate with you effectively.

4.2 Transaction and Order Data

When you place an Order, we collect: details of the Product(s) ordered, including model, grade, and configuration; the total purchase price; payment method used (we do not store full card numbers — only the last four digits, card type, and expiry date for reference purposes); billing and delivery addresses for the specific order; Order confirmation numbers and invoice references; delivery tracking information; and records of any returns, refunds, or warranty claims associated with your Orders.

4.3 Communication and Support Data

When you contact us by email, telephone, or through the Platform's messaging features, we collect: the content of your communications with us; your contact details as provided; and records of any complaints, warranty claims, or support requests, including their resolution.

Where telephone calls are recorded for quality assurance and staff training purposes, you will be informed of this at the start of the interaction and before any personal data is discussed, by means of a verbal notice delivered by the agent or an automated message. The notice will state: "This call may be recorded for quality assurance and training purposes." 

4.4 Technical and Usage Data

When you use the Platform, we automatically collect certain technical information, including: your IP address; browser type and version; device type, model, and operating system; the referring URL from which you accessed the Platform; pages viewed and time spent on each page; click-stream data and interaction events; session identifiers and authentication tokens; and error logs. This information is collected through server logs, cookies, and similar tracking technologies as described in Section 12.

4.5 Marketing and Preference Data

If you have consented to marketing communications, we maintain records of your marketing preferences, communication channel choices (email, SMS), and your interaction history with marketing materials including email opens, clicks, and unsubscribes. You may withdraw your consent at any time as described in ie Section 11.

4.6 Data We Do Not Collect

We do not intentionally collect Special Categories of Data (as defined in Section 3 above). We do not collect or process data relating to children under the age of sixteen (16) years without verifiable parental or guardian consent.

If we become aware that we have inadvertently collected personal data relating to a child under 16 without the requisite parental or guardian consent, we will delete that data promptly and, where required, notify the relevant supervisory authority.

We do not store unencrypted financial credentials, full payment card numbers, or government-issued identification numbers unless specifically required by applicable law for a defined purpose.

Under Article 6 of the GDPR, we rely on the following legal bases to process your personal data:

5.1 Performance of a Contract (Article 6(1)(b))

The processing of your Account data, transaction data, and delivery data is necessary to perform the Sales Contract we have entered into with you. Without processing this data, we would be unable to create your Account, process your Order, arrange delivery, handle returns and warranty claims, or provide after-sales support. If you decline to provide this data, we may be unable to complete your purchase.

5.2 Compliance with Legal Obligations (Article 6(1)(c))

We are required by applicable Polish and EU law to retain certain personal data to fulfil statutory obligations. These include: retaining invoices and financial records for a period of five (5) years as required under the Polish Accounting Act (Ustawa o rachunkowości) and tax regulations; retaining records of consumer complaints and warranty claims for the duration of statutory limitation periods; and compliance with anti-money laundering, customs, and tax reporting obligations where applicable.

5.3 Legitimate Interests (Article 6(1)(f))

We process certain data on the basis of our legitimate interests where those interests are not overridden by your rights and freedoms. Our legitimate interests include: detecting, preventing, and investigating fraud, unauthorised access, and other illegal activities; improving the functionality, security, and performance of the Platform; conducting internal analytics and business reporting to understand how Users interact with the Platform and how we can improve our services; communicating with existing customers about changes to our services, Products, or policies; and defending legal claims and protecting our rights and property.

Before relying on legitimate interests as a legal basis, we conduct a Legitimate Interests Assessment (LIA) for each processing activity that relies on Article 6(1)(f). LIAs are completed prior to the commencement of any such processing and are maintained as formal documented records within our compliance documentation folder, subject to version control. We conduct LIAs in respect of the following processing activities: fraud prevention and security monitoring; platform analytics and performance measurement; internal business reporting; communications with existing customers regarding related products or services; and the establishment, exercise, or defence of legal claims.

Each LIA sets out the nature of our legitimate interest, an assessment of the necessity and proportionality of the processing, and a balancing test weighing our interests against your rights, interests, and freedoms. Responsibility for completing, reviewing, and approving LIAs rests with the Data Protection Officer or a designated compliance officer.

LIAs are reviewed annually and whenever a processing activity materially changes in scope, purpose, or risk profile. A summary of any LIA is available to you upon written request submitted to compliance@exactsolution.com Full LIA records are retained and made available to supervisory authorities upon request.

You have the right to object to processing based on legitimate interests at any time, as described in Section 10.

5.4 Consent (Article 6(1)(a))

Where we rely on your consent as the legal basis for processing, such as for the sending of direct marketing emails, the use of non-essential cookies, or participation in voluntary surveys, we will always request your consent explicitly and separately from other terms. Your consent is freely given, specific, informed, and unambiguous. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal. Withdrawal of consent does not affect our ability to process your data on other legal bases.

5.4.1 How We Collect and Record Consent

Consent is collected through separate, unchecked checkboxes presented at the point of registration and at any subsequent point where a new processing purpose arises. Each checkbox corresponds to a distinct processing purpose (for example, marketing emails, analytics cookies, and survey participation are each presented as a separate consent option) so that you may consent to some purposes without being required to consent to others.

Acceptance of our Terms of Service is not conditional upon granting consent to any optional processing activity. Consent checkboxes are never pre-ticked, bundled with contractual terms, or presented in a manner that makes refusal difficult.

A timestamped record of each consent event is stored securely within our consent management system. That record captures the date, time, consent version, specific purpose consented to, and the mechanism by which consent was given. These records are retained for the duration of your relationship with us and for a period of three years thereafter, and are available to our Data Protection Officer for audit and compliance purposes.

5.5 Vital Interests and Public Tasks

In rare circumstances, we may be required to process personal data to protect the vital interests of a data subject (Article 6(1)(d)) or to perform a task carried out in the public interest (Article 6(1)(e)). We will inform you of such processing by email to the address associated with your Account, or by a prominent notice on the Platform, as soon as we are legally permitted to do so. Where we are not permitted to inform you at the time of processing (e.g., due to a legal obligation of confidentiality), we will notify you at the earliest opportunity thereafter. 

We use your personal data for the following principal purposes: 

(a) to operate and administer your Account and enable your access to the Platform; 

(b) to process, fulfil, and deliver your Orders and manage returns, refunds, and warranty claims; 

(c) to communicate with you regarding your Orders, Account, and any queries or complaints you raise; 

(d) to issue VAT invoices, manage payments, and comply with our financial and tax obligations; 

(e) to prevent fraud, detect suspicious activity, and protect the security of the Platform; 

(f) to improve and develop our Products and services based on usage data and feedback; (g) to send you marketing communications where you have provided consent or where we have a legitimate interest to do so for similar products and services; 

(h) to comply with legal and regulatory obligations; and 

(i) to defend or pursue legal claims.

We will not use your personal data for automated decision-making processes that produce legal or similarly significant effects without your explicit consent or another lawful basis under Article 22 of the GDPR. If we employ profiling for marketing or personalisation purposes, we will inform you and provide you with the right to object or opt out.

7.1 Service Providers and Data Processors

We share personal data with trusted third-party service providers who process data on our behalf as Data Processors under written agreements compliant with Article 28 of the GDPR. These categories of processors include: payment service providers and banking institutions for the processing of transactions; logistics and courier companies (including DHL, FedEx, DPD) for delivery of Products and management of returns; cloud hosting and infrastructure providers for the operation of the Platform; email service providers for transactional and marketing communications; customer relationship management (CRM) software providers; analytics platform providers; and fraud prevention and identity verification services.

We require all Data Processors to: process personal data only on our documented instructions; implement appropriate technical and organisational security measures; not engage sub-processors without our prior authorisation; and assist us in meeting our obligations to data subjects. The generic categories of process. Data Processors must provide at least 30 days' written notice before engaging any new sub-processor or making material changes to an existing one, during which time the Controller retains the right to object. Failure to comply with this notification requirement will be treated as a breach of the applicable Data Processing Agreement. 

7.2 Marketplace Platform Partners

We share your Order and delivery data with the relevant marketplace platform to the extent necessary to fulfil Orders placed on that platform. We recommend that you review the privacy policies of any marketplace platform through which you transact.

7.3 Legal Disclosure

We may disclose personal data to courts, regulatory authorities, law enforcement agencies, or other government bodies where required to do so by law, court order, or binding legal process. We may also disclose data where we genuinely believe disclosure is necessary to: investigate, prevent, or take action regarding illegal activities or suspected fraud; enforce our Terms of Service; or protect the rights, property, or safety of the Company, our employees, or others.

7.4 Business Transfers

In the event of a merger, acquisition, restructuring, or sale of all or part of the Company's business or assets, personal data held by the Company may be transferred to the acquiring entity as part of the transaction. We will notify you of any such transfer by email or prominent notice on the Platform at least thirty (30) days before any change in control that materially affects the processing of your personal data.

7.5 No Sale of Personal Data

We do not sell, rent, or exchange your personal data to or with third parties for their own commercial purposes. We do not permit third-party advertisers to access your personal data for the purpose of targeting you with advertisements on other platforms, except where you have given explicit consent for such processing.

Our primary data processing operations are conducted within the European Economic Area (EEA). Some of our service providers are located in third countries outside the EEA. Where we transfer personal data to recipients outside the EEA, we ensure that appropriate safeguards are in place in accordance with Chapter V of the GDPR.

Appropriate safeguards include: Standard Contractual Clauses (SCCs) as adopted by the European Commission under Article 46(2)(c) of the GDPR, including the updated Module 2 (Controller to Processor) and Module 3 (Processor to Processor) clauses as applicable; binding corporate rules where applicable within corporate groups; adequacy decisions issued by the European Commission recognising equivalent levels of data protection in certain third countries; or derogations under Article 49 of the GDPR where no other safeguard is available and the transfer is necessary for the performance of a contract with you.

Where required under the Schrems II judgment (Data Protection Commissioner v Facebook Ireland Limited and Maximillian Schrems, C-311/18) and the EDPB guidelines on transfers, we conduct Transfer Impact Assessments (TIAs) for transfers to jurisdictions deemed to present risks to data subject rights. We will provide you with a copy of the relevant safeguards upon request to compliance@exactsolution.com

For transfers of personal data to the United Kingdom, the Company relies on the adequacy decision adopted by the European Commission on 28 June 2021, recognising that the United Kingdom ensures an adequate level of protection for personal data under Article 45 of the GDPR. The Company monitors the status of this adequacy decision on an ongoing basis and will implement alternative safeguards where required in the event that the adequacy decision is amended, suspended, or revoked.

For transfers of personal data to the United States and other countries that are not subject to an adequacy decision, the Company relies on appropriate safeguards under Chapter V of the GDPR, including the Standard Contractual Clauses (SCCs) adopted by the European Commission, supplemented by additional technical and organisational measures where necessary to ensure an essentially equivalent level of protection.

Where personal data is subject to the UK GDPR and transferred from the United Kingdom to third countries, the Company applies appropriate transfer mechanisms in accordance with UK data protection law, including the International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, as applicable.

We retain personal data only for as long as is necessary to fulfil the purposes for which it was collected, or as required by applicable law. Our retention periods are determined based on the following criteria: the nature and sensitivity of the data; the purposes of processing; our legal and regulatory obligations; and the applicable statute of limitations for potential legal claims.

Account and transaction data, including Order history and invoices, is retained for a minimum of five (5) years from the date of the last transaction, in accordance with Polish tax and accounting law. Warranty and consumer complaint records are retained for three (3) years after the expiry of the relevant warranty or complaint resolution, to manage potential legal claims within the applicable limitation period under Polish civil law. Marketing data (where based on consent) is retained until you withdraw your consent or for a maximum of three (3) years of inactivity, at which point we will re-seek consent or delete the data.

Technical and log data used for security and fraud detection purposes is retained for a maximum of twelve (12) months, unless a specific security incident requires extended retention for investigation, legal, or enforcement purposes.

Technical and usage data collected for analytics, performance monitoring, and platform functionality is retained for a period not exceeding twelve (12) months, after which it is deleted or irreversibly anonymised, unless a longer retention period is required for legitimate business purposes or legal obligations.

Customer support and communication data, including correspondence and support tickets, is retained for a period of three (3) years following the closure of the relevant matter, unless retention is required for the establishment, exercise, or defence of legal claims.

Backup copies of personal data are retained for a maximum period of ninety (90) days in accordance with the Company’s backup and disaster recovery procedures, after which they are securely overwritten or deleted.

When personal data is no longer necessary for the purposes for which it was collected, it is securely deleted or anonymised in accordance with the Company’s data destruction procedures.

The Company maintains a formal internal Data Retention Schedule, which defines retention periods for all categories of personal data processed. This schedule is regularly reviewed and updated to ensure compliance with applicable legal, regulatory, and operational requirements. This section provides a high-level summary for transparency purposes and does not constitute an exhaustive record of all retention activities.

As a data subject whose personal data is processed by us, you have the following rights under the GDPR. These rights are not absolute and may be subject to limitations provided for by applicable law, but we will always endeavour to respond to your requests fully and in a timely manner.

10.1 Right of Access (Article 15)

You have the right to obtain confirmation from us as to whether or not personal data concerning you is being processed, and where that is the case, access to the personal data and information regarding: the purposes of processing; the categories of data; recipients or categories of recipient; the envisaged retention period; the existence of automated decision-making; and your rights in respect of the data. We will provide a copy of the personal data undergoing processing at no charge. For additional copies, we may charge a reasonable administrative fee.

10.2 Right to Rectification (Article 16)

You have the right to obtain from us without undue delay the rectification of inaccurate personal data concerning you. You also have the right to have incomplete personal data completed, including by means of providing a supplementary statement.

10.3 Right to Erasure (Article 17)

You have the right to request that we erase personal data concerning you without undue delay where: the data is no longer necessary for the purposes for which it was collected; you withdraw consent and there is no other legal basis for processing; you object to the processing and there are no overriding legitimate grounds; the data has been unlawfully processed; the data must be erased to comply with a legal obligation; or the data relates to a child under sixteen (16) years of age. This right does not apply where processing is necessary for compliance with a legal obligation, for the establishment, exercise, or defence of legal claims, or on other grounds provided in Article 17(3) of the GDPR.

10.4 Right to Restriction of Processing (Article 18)

You have the right to request that we restrict the processing of your personal data where: you contest the accuracy of the data and we need time to verify it; the processing is unlawful and you request restriction rather than erasure; we no longer need the data but you need it for the establishment, exercise, or defence of legal claims; or you have objected to processing pending verification of whether our legitimate grounds override yours.

10.5 Right to Data Portability (Article 20)

Where processing is based on consent or on the performance of a contract and is carried out by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to have that data transmitted directly to another controller where technically feasible. This right covers data that you have actively provided to us, such as Account information and Order history.

10.6 Right to Object (Article 21)

You have the right to object at any time to the processing of your personal data on grounds relating to your particular situation where processing is based on our legitimate interests (Article 6(1)(f)). Where you object, we will no longer process your data unless we can demonstrate compelling legitimate grounds which override your interests, rights, and freedoms, or for the establishment, exercise, or defence of legal claims. Where personal data is processed for direct marketing purposes, you have an absolute right to object at any time and we will cease processing for that purpose without requiring grounds.

10.7 Rights Related to Automated Decision-Making (Article 22)

You have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. Where we employ such processing, we will inform you and provide you with the opportunity to request human review, express your point of view, and contest the decision.

10.8 How to Exercise Your Rights

To exercise any of the rights described above, please submit a written request to compliance@exactsolution.com or by post to the Company's registered address. Please include your full name, the email address associated with your Account, and a description of the right you wish to exercise. We will respond to your request within one (1) calendar month of receipt. In cases of complexity or volume, we may extend this period by a further two (2) months, in which case we will inform you of the extension and the reasons for it within the first month.

To protect your personal data and prevent unauthorised access or disclosure, we may request additional information to verify your identity before processing your request, in accordance with Article 12(6) of the GDPR. We will not process requests where we are unable to reasonably verify the identity of the requester. Identity verification may include confirmation of your Account email address, Order reference number, or other identifying information relevant to your interaction with the Company. Any information collected for verification purposes will be used solely for that purpose and will be deleted once verification is complete, unless retention is required for legal or compliance reasons.

10.9 Right to Lodge a Complaint

If you believe that our processing of your personal data violates the GDPR or applicable Polish data protection law, you have the right to lodge a complaint with the competent supervisory authority. In Poland, the competent supervisory authority is the Urząd Ochrony Danych Osobowych (UODO — Personal Data Protection Office), ul. Stawki 2, 00-193 Warsaw, Poland, website: www.uodo.gov.pl. EU residents may also lodge a complaint with the data protection supervisory authority in the EU member state of their habitual residence, place of work, or place of the alleged infringement.

With your consent, we may use your email address, telephone number, or other contact details to send you marketing communications about our Products, promotional offers, new arrivals, and related news. We will always identify ourselves clearly as the sender and include an unsubscribe mechanism in every marketing communication.

You may withdraw consent for marketing at any time by: clicking the "unsubscribe" link in any marketing email; updating your marketing preferences in your Account settings; or contacting us directly at legal@exactsolution.com. We will process your opt-out within ten (10) business days. Please note that transactional communications relating to your Orders (such as Order confirmations, delivery notifications, and warranty communications) are not marketing communications and cannot be opted out of while you have an active Account.

Where marketing communications are sent on the basis of the Company’s legitimate interests in promoting its own similar products or services to existing customers (commonly referred to as the “soft opt-in”), such communications are carried out in accordance with applicable law, including Article 13 of Directive 2002/58/EC as implemented in Polish law, in particular Article 172 of the Telecommunications Law (Prawo telekomunikacyjne).

This basis is relied upon only where: (i) the customer has obtained a product or service from the Company; (ii) the customer was clearly informed, at the time of data collection, of the possibility to object to the use of their contact details for marketing purposes and was given a simple means to do so; and (iii) each subsequent marketing communication includes a clear and easy option to opt out, free of charge.

You have the right to object to the use of your personal data for direct marketing purposes at any time, without giving reasons and without detriment. Upon receipt of such objection, your personal data will no longer be processed for marketing purposes.

The Platform uses cookies and similar technologies (such as web beacons, pixels, and local storage) to enhance your experience, remember your preferences, secure your session, and understand how you use our Platform. This Section summarises our use of cookies. Our full Cookie Policy, which provides detailed information about each cookie category and the names of specific cookies used, is available on the Platform.

Strictly Necessary Cookies are essential for the Platform to function correctly. They enable core features such as session management, shopping cart functionality, and secure login. These cookies do not require your consent as they are necessary to provide a service you have requested. Analytics Cookies allow us to understand how visitors interact with the Platform, including which pages are most popular and whether error messages occur. We use this information to improve the Platform. We deploy analytics cookies only with your consent. Functional Cookies remember your preferences, such as language settings and currency selection, to provide a more personalised experience. Marketing Cookies, where deployed with your consent, allow us to present you with relevant advertisements and to measure the effectiveness of our campaigns.

You may manage your cookie preferences at any time through the Cookie Preference Centre on the Platform, or by adjusting your browser settings to refuse or delete cookies. Please note that disabling certain cookies may impair the functionality of the Platform. Your cookie preferences are stored for a period of twelve (12) months and you will be prompted to review them at the end of that period.

The Company implements a consent management platform (CMP) to obtain, manage, and document user consent for the use of cookies and similar tracking technologies in accordance with applicable data protection laws, including the GDPR and the ePrivacy Directive. Through this mechanism, users are provided with clear, granular options to accept or reject different categories of cookies.

Non-essential cookies, including analytics and marketing cookies, are not deployed on the user’s device unless and until valid consent has been obtained. Consent is recorded and stored as part of the Company’s compliance records, including the time, method, and scope of the consent provided. Users may withdraw or modify their consent preferences at any time via the Cookie Preference Centre without detriment.

Further detailed information about the specific cookies used on the Platform, including their purpose, duration, and providers, is available in our Cookie Policy, accessible at:

The Platform is not directed at, and we do not knowingly collect personal data from, children under the age of sixteen (16) years. In jurisdictions where a lower age of consent for data processing applies (minimum thirteen (13) years under Article 8 of the GDPR), we will apply the lower threshold, but we nonetheless recommend that minors under sixteen (16) use the Platform only with parental supervision. If we discover that we have inadvertently collected personal data from a child below the applicable age threshold without verifiable parental consent, we will take immediate steps to delete that data from our records.

Parents or guardians who believe that the Company may have collected personal data from their child should contact us immediately at compliance@exactsolution.com so that we can investigate and take appropriate action.

The Company implements appropriate technical and organisational security measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access, in accordance with Article 32 of the GDPR. These measures include, but are not limited to: encryption of data in transit using TLS 1.2 or higher; encryption of sensitive data at rest; pseudonymisation of personal data where appropriate; access controls and role-based permissions limiting access to personal data to authorised personnel on a need-to-know basis; multi-factor authentication for administrative access; regular security assessments, vulnerability scanning, and penetration testing; and incident response and business continuity procedures.

The Company maintains an internal Incident Response Policy that defines procedures for the identification, reporting, escalation, and management of personal data breaches. All personnel are required to report suspected or actual security incidents without undue delay through designated internal reporting channels. Incidents are assessed and escalated in accordance with defined response protocols to ensure timely containment, investigation, and remediation.

In accordance with Article 33(5) of the GDPR, the Company maintains a Data Breach Register documenting all personal data breaches, including those not notified to a supervisory authority. This register records the facts relating to the breach, its effects, and the remedial actions taken.

In the event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority (Urząd Ochrony Danych Osobowych – UODO) without undue delay and, where feasible, no later than seventy-two (72) hours after becoming aware of the breach, in accordance with Article 33 of the GDPR. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay in accordance with Article 34 of the GDPR. The assessment of risk and severity is conducted in alignment with the Company’s data protection risk assessment processes, including those described in Section 16 (Privacy by Design and Default).

Our breach response procedures are set out in our internal Incident Response Policy, which is available to relevant personnel and governs the Company’s approach to breach detection, reporting, investigation, and notification.

All third parties that process personal data on our behalf act as Data Processors and are bound by written Data Processing Agreements (DPAs) that comply with Article 28 of the GDPR. These agreements specify: the subject matter, duration, nature, and purposes of the processing; the type of personal data and categories of data subjects; the obligations and rights of the Company as Controller; and the security measures that the Processor must implement.

A list of our current sub-processors is available upon request to compliance@exactsolution.com We will notify you of any intended changes in the list of sub-processors that may affect data protection, providing you with an opportunity to object to such changes before they take effect.

In accordance with Article 25 of the GDPR, the Company implements data protection by design and by default in all its processing activities and product development. This means that we integrate data protection considerations at the earliest stage of any new feature, system, or service development, not as an afterthought. We ensure that, by default, only personal data which is necessary for each specific purpose of the processing is processed, applying the data minimisation principle across all our activities. Privacy Impact Assessments (PIAs) or Data Protection Impact Assessments (DPIAs) are conducted in accordance with Article 35 of the GDPR for any new or changed processing activity that is likely to result in a high risk to the rights and freedoms of natural persons.

16.1 DPIA Triggers and Governance

The Company conducts Data Protection Impact Assessments (DPIAs) in accordance with Article 35 of the GDPR where processing is likely to result in a high risk to the rights and freedoms of natural persons. In determining whether a DPIA is required, the Company considers, among other factors, whether the proposed processing involves:

• the use of new or innovative technologies or solutions, including artificial intelligence or automated processing tools;

• systematic and extensive evaluation of personal aspects relating to individuals, including profiling or automated decision-making that produces legal or similarly significant effects;

• large-scale processing of personal data, particularly where it involves extensive datasets, high volumes of transactions, or broad user bases;

• processing of special categories of personal data or data relating to criminal convictions and offences;

• systematic monitoring of publicly accessible areas or large-scale tracking of user behaviour;

• processing of personal data relating to vulnerable individuals, including minors;

• combining or matching datasets from multiple sources in a manner that may increase risk to data subjects; or

• any processing activity identified by applicable supervisory authorities as requiring a DPIA.

Where a DPIA is required, the Company follows a structured assessment process using an internal DPIA template and maintains a DPIA register documenting all completed assessments, outcomes, and mitigation measures.

In accordance with Article 35(2) of the GDPR, the Company involves its data protection function in the DPIA process.

We may update this Privacy Policy from time to time to reflect changes in our data processing practices, applicable law, or Platform functionality. When we make material changes, we will notify you by email to the address associated with your Account and/or by prominent notice on the Platform at least thirty (30) days before the changes take effect. For minor changes, such as corrections or clarifications that do not affect your rights, we may update the Policy without advance notice, though we will always update the effective date at the top of the document.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your personal data. Previous versions of this Privacy Policy will be archived and made available upon request.

The Company maintains internal data protection policies and procedures designed to ensure compliance with applicable data protection laws, including the General Data Protection Regulation (GDPR). This includes the implementation of organisational and technical measures appropriate to the nature, scope, context, and purposes of processing.

The Company provides regular training to its personnel on data protection obligations and information security practices. Access to personal data is restricted to authorised personnel on a need-to-know basis, and all staff with access to personal data are subject to confidentiality obligations.

The Company conducts periodic reviews and audits of its data protection practices, including assessments of risks to data subjects and the effectiveness of implemented safeguards, in order to maintain and continuously improve its compliance posture.

For all data protection enquiries, exercise of data subject rights, or concerns regarding this Privacy Policy, please contact our data protection team at: support@exactsolution.com 

For general legal correspondence: EXACTFLOW PROSTA SPÓŁKA AKCYJNA .,ul. Stanisława Bodycha 87, 05-816 Reguły, Poland, Email: support@exactsolution.com 

Supervisory Authority (Poland): Urząd Ochrony Danych Osobowych (UODO), ul. Stawki 2, 00-193 Warsaw, Poland. Website: www.uodo.gov.pl

Annex A — Summary of Processing Activities
The following table in prose format summarises the principal categories of personal data processed, the legal bases relied upon, and the retention periods applied. This summary is provided for transparency and does not constitute an exhaustive record of all processing activities maintained in our internal Record of Processing Activities (ROPA) as required under Article 30 of the GDPR.

Account Management: Data categories include name, email, password hash, contact details. Legal basis: contract performance and legitimate interests. 

Retention: duration of Account plus five years.

Order Processing: Data categories include name, delivery address, Order details, payment method reference, invoice data. Legal basis: contract performance and legal obligation. 

Retention: five years from transaction date per Polish accounting law.
Customer Support: Data categories include name, contact details, communication content, Order references. Legal basis: contract performance and legitimate interests. Retention: three years after closure of matter.

Marketing (with consent): Data categories include email address, interaction preferences. Legal basis: consent. Retention: until withdrawal or three years of inactivity.

Fraud Prevention: Data categories include IP address, device data, session data, transaction data. Legal basis: legitimate interests. Retention: twelve months unless extended by incident.

Legal Compliance: Data categories include invoice data, tax records. Legal basis: legal obligation. Retention: five years per statutory requirement.

International Transfers (Transparency Note):
Where personal data described in this Annex A is transferred outside the European Economic Area (EEA), such transfers are carried out in accordance with the safeguards set out in Section 8 (International Data Transfers) of this Policy. These safeguards may include, as applicable, the use of Standard Contractual Clauses (SCCs) adopted by the European Commission, reliance on adequacy decisions, or other legally recognised transfer mechanisms under Chapter V of the GDPR