PRIVACY POLICY

1. The website administrator is Altkom Software & Consulting sp. z o.o.

KRS: 0000448403,

NIP: 7123276080,

REGON: 061512913

with its registered office in Warsaw at ul. Przyokopowa 33, 01-208 Warsaw, Poland.

2. The Controller has appointed Mr. Mariusz Zajkiewicz as Data Protection Officer (DPO). He may be contacted by traditional mail sent to the Company’s address with the notation “GDPR,” or by email at: iod@altkomsoftware.com

3. Altkom Software & Consulting sp. z o. o. processes your personal data in connection with the operation of the website in order to respond to questions submitted through an electronic form available on the website or by other means (e.g., post or email). The legal basis for processing personal data is Article 6(1)(a) of the GDPR, i.e., your consent. Personal data processed for this purpose will be retained until a final response has been provided and the correspondence has been concluded, but no longer than two months.

4. Whose personal data do we process?

The website administrator processes, among other things, the personal data of:

• users of the Company’s website — https://www.altkomsoftware.com/ — i.e., individuals who submit inquiries through the Company’s website using electronic forms;
• customers who are individuals;
• in the case of customers that are legal entities or organizational units without legal personality — individuals authorized to represent such entities, as well as employees and associates of such customers;
• service providers who are individuals, as well as employees and associates of service providers.

5. Under a joint controllership agreement, the Controller may share the following data obtained through the website concerning:

• prospective employees or associates;
• prospective customers — including data obtained by the Company’s representatives in connection with sales or marketing activities (e.g., during meetings or business correspondence, conferences or other events, tender procedures, negotiations, etc.).

6. With respect to personal data shared under the joint controllership agreement, the Data Controllers are:

• Altkom Software & Consulting sp. z o.o., KRS: 0000448403, NIP: 7123276080, REGON: 061512913;
• Altkom Experts sp. z o. o., KRS: 0000532755, NIP: 7123291369, REGON: 360236318;
• Kreatik sp. z o. o., KRS: 0000405020, NIP: 7773223125, REGON: 301995381hereinafter collectively referred to as the Joint Controllers and individually as a Controller.

The companies have their registered offices in Warsaw at ul. Przyokopowa 33, 01-208 Warsaw, Poland.

If you have any questions regarding the manner or scope in which the Joint Controllers process your personal data, or regarding your rights in connection with our processing of your personal data, please contact us by email or traditional mail using the following contact details:

• asc@altkomsoftware.pl
• Altkom Software & Consulting sp. z o.o., ul. Przyokopowa 33, 01-208 Warsaw, Poland;
• Altkom Experts sp. z o.o., ul. Przyokopowa 33, 01-208 Warsaw, Poland;
• Kreatik sp. z o. o., ul. Przyokopowa 33, 01-208 Warsaw, Poland.

7. The Joint Controllers have appointed Mr. Mariusz Zajkiewicz as Data Protection Officer (DPO). He may be contacted by traditional mail sent to the Company’s address with the notation “GDPR,” or by email at: iod@altkomsoftware.com.

8.Additional purposes for which we process your personal data, the applicable legal basis for processing, and the period for which your personal data will be retained for each specific purpose are set out below:

• Conducting a recruitment process pursuant to Article 6(1)(a) of the GDPR (consent), where we receive from you more personal data than required under the provisions of law specified in Article 22¹ of the Labor Code. The period for which your personal data is processed is described in Section 9 below.
• Conducting a recruitment process pursuant to Article 6(1)(b) of the GDPR (taking steps prior to entering into a contract) and Article 22¹ of the Labor Code. The period for which your personal data is processed is described in Section 9 below.
• Establishing cooperation following the successful completion of a recruitment process. The legal basis for processing is Article 6(1)(b) of the GDPR — taking steps prior to entering into a contract or establishing a contractual relationship at the request of the individual concerned. Data will be retained for 10 years in accordance with the Labor Code in the case of employment under an employment contract, and for five years from the end of the calendar year in which a civil-law contract was terminated, in accordance with the Civil Code.
• Compliance with the legal obligation to prepare and retain documentation. The legal basis for processing in this case is Article 6(1)(c) of the GDPR. Personal data will be retained for the period applicable to accounting records and documents confirming the conclusion and performance of a contract, as required under national law. Where a contract or order is performed for your benefit, the Controller will process personal data contained in invoices, accounting records, or other documentation confirming the conclusion and performance of the contract for the purpose of preparing and retaining documents in accordance with applicable law. We will retain such data in accordance with applicable legal requirements, but no longer than five years from the year in which the cooperation ended.
• Pursuing the Controller’s legitimate interests pursuant to Article 6(1)(f) of the GDPR (preparing and presenting offers, performance of contracts, establishment, pursuit and defense of claims, debt collection, court, arbitration and mediation proceedings, and audit purposes). We will retain the data in accordance with applicable legal requirements, but no longer than five years from the year in which the cooperation ended.

9.Data processing periods for recruitment

• If you participate only in the current recruitment process, your personal data will be processed for the duration of that process, but no longer than 24 months.
• If you consent to participating in future recruitment processes, your personal data will be processed for 36 months from the date the current recruitment process begins.
• Once a contract has been entered into, data will be processed for five years in the case of civil-law contracts and for 10 years in the case of employment contracts.

10.Who do we share your personal data with?

Państwa dane osobowe, w zakresie w jakim będzie to niezbędne, możemy udostępniać:

• entities authorized to receive it under applicable law (e.g., courts, law enforcement authorities, public administration authorities, and supervisory authorities);
• entities processing your personal data on our behalf (e.g., service providers, entities that operate our IT systems or provide us with IT tools, advisory and consulting service providers, Traffit in connection with recruitment, PeopleForce in connection with employment or cooperation, etc.).

Whenever your personal data is disclosed or entrusted for processing, we will ensure that only the minimum amount of information necessary to achieve the relevant processing purpose is transferred.

11. What rights do you have in connection with the Controller’s processing of your personal data?

In connection with the Controller’s processing of your personal data, you have the following rights:

• pursuant to Article 15 of the GDPR — the right of access to your personal data, including the right to obtain a copy of the personal data being processed;
• pursuant to Article 16 of the GDPR — the right to rectify personal data that is incorrect, outdated, or inaccurate, as well as the right to have incomplete personal data completed;
• pursuant to Article 17 of the GDPR, in the circumstances specified therein — the right to erasure of personal data (the so-called “right to be forgotten”). As a general rule, this right allows you to request that the Controller erase your personal data without undue delay. However, Article 17 of the GDPR provides for exceptions to this right, in particular where processing is necessary for the establishment, exercise, or defense of legal claims;
• pursuant to Article 18 of the GDPR — the right to request that the Controller restrict the processing of personal data. In practical terms, this may involve temporarily blocking access to your personal data or transferring it to another system;
• the right to lodge a complaint with the supervisory authority responsible for personal data protection, i.e., the President of the Personal Data Protection Office, if you believe that the processing of personal data infringes the GDPR;
• pursuant to Article 21 of the GDPR — the right to object to the processing of personal data.

To exercise any of the above rights, please contact the Controller or the Data Protection Officer using the contact details provided in Sections 2, 6, and 7.

Your requests will be fulfilled without undue delay and no later than within 30 days of receipt. This period may be extended by an additional 30 days due to the complexity of the request or the number of requests received, in which case we will notify you accordingly.

Where personal data is processed on the basis of your consent, you may withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of that consent before its withdrawal.

Withdrawal of consent will result in your data being deleted from our database.

12.Personal data security

The Company implements technical and organizational measures designed to protect your personal data against unlawful or unauthorized access or use, as well as against accidental destruction, loss, or loss of integrity.

The principle of ensuring security guided us in designing our IT infrastructure, standards, and business practices. Our security procedures include, in particular, access controls, backup systems, monitoring, reviews and maintenance, and security incident management.

As part of our efforts to ensure the security of the personal data we process, we undertake to maintain:

• confidentiality — we will protect personal data against accidental disclosure to third parties;
• integrity — we will protect personal data against unauthorized modification;
• availability — we will ensure that authorized individuals have access to your data when necessary.

Every employee and associate who has access to your personal data is appropriately authorized and required to maintain confidentiality.

13. Provision of personal data

Regardless of how your personal data is provided to the Controllers, you will in each case receive detailed information regarding its processing.

Where data is collected by representatives of the Controller or Joint Controllers in connection with purchasing, sales, or marketing activities, providing such data is entirely voluntary. However, failure to provide it may prevent us from contacting you in the future.

Providing your personal data is voluntary in all cases, but it is necessary for us to take action at your request as the data subject. Failure to provide the data will prevent the Controller or Joint Controllers from taking the requested action.

COOKIE POLICY

1. Website accessibility

The website https://www.altkomsoftware.com/ can be viewed on any internet-connected device using any web browser. We recommend using the latest version of your browser.

2. What are cookies and what do they do?

Cookies are small text files sent by a web server and stored on the user’s device. The information contained in a cookie can be read only by the server that created it.

Cookies contain various types of information about a website user and the history of the user’s interactions with the website. This information may allow the owner of the server that sent the cookies to determine which websites the user visited before accessing its website, identify the user’s IP address, and determine whether any errors occurred while the website was being displayed.

It should be noted, however, that this data is not associated with specific individuals browsing the website, but only with the internet-connected device on which the cookie has been stored.

3. Privacy

Website encryption (SSL/TLS):

• A *.altkomsoftware.pl certificate has been issued for the domain https://www.altkomsoftware.com/. The certificate ensures the confidentiality and integrity of data transmission and provides server authentication.
• Encrypted communication is enabled throughout the domain to ensure user security. Communications are encrypted using a 256-bit key, and the independent certificate authority, Certum Domain Validation CA SHA2, confirms that you are accessing the authentic, original website at https://www.altkomsoftware.com/.
• Detailed certificate information can be accessed by clicking “More information” in the browser bar and then selecting “View certificate.”
• The browser may indicate that the connection is not secure if the website contains images sourced from an http:// address rather than an https:// address. However, no such elements are present on the website during the period in which this Policy remains in effect.

The website includes Google Analytics code.

This tool is used for web analytics and helps us improve the website based on users’ needs. Google Analytics collects anonymized information and identifies trends on the website without identifying individual users.

Like many other services, Google Analytics uses its own cookies to analyze website user activity. These cookies are used to store information such as when the current visit began, whether the user has previously visited the website, and which website referred the user to the current website.

Google Analytics uses the following types of cookies. All of them are persistent cookies except for __utmc, which is a temporary cookie. The stated cookie expiration periods are the maximum periods. In practice, expiration depends on user activity, such as deleting cookies, changing devices, or reinstalling the browser:

• Name: __utma

Expiration: Two years from initial creation or reset.
Description: Google Analytics cookie used to determine the number of unique users, defined as a particular browser on a particular computer, who visit the website. The cookie records the number of visits to the website and the dates and times of the first, previous, and current visits.

• Name: __utmb

Expiration: 30 minutes from initial creation or reset.
Description: Google Analytics cookie used to determine the number of visits made to the website by a unique user, defined as a particular browser on a particular computer. It is used together with the __utmc cookie described below. The cookie measures the duration of a visit, including its start and end.

• Name: __utmc

Expiration: 30 minutes from initial creation or reset.
Description: Google Analytics cookie used to determine the number of visits made to the website by a unique user, defined as a particular browser on a particular computer. It is used together with the __utmb cookie described above. The cookie measures the duration of a visit, including its start and end.

• Name: __utmz

Expiration: Six months from initial creation or reset.
Description: Google Analytics cookie used to determine how a unique user, defined as a particular browser on a particular computer, arrived at the website. The cookie identifies the source of a visit to the blog and how the user navigates it.

If you do not consent to the collection of anonymized statistical data concerning your activity on the website, you may disable Google Analytics in your browser by downloading and installing an add-on available for Mozilla Firefox, Google Chrome, Apple Safari, Opera, and Microsoft Internet Explorer, or by disabling cookies in your browser.

The website uses GetResponse tools.

GetResponse is an email marketing tool that makes it possible to collect data from users who voluntarily choose to provide their contact details through a form on the website. The information collected is used for subsequent communications to which the user has previously given informed and voluntary consent.

The website also uses tools provided by Google, LinkedIn, Meta, and YouTube, which process cookie data in accordance with their respective policies and terms and conditions. These tools use mechanisms that collect data concerning user behavior.

The website uses Microsoft Clarity.

Microsoft Clarity is an analytics tool used, among other purposes, to record user sessions on our website and create heatmaps showing how users navigate the website. Based on the data collected, we can analyze user behavior and make changes to the website structure to make it more intuitive, engaging, and user-friendly.

4. How do we use information obtained from cookies?

The data is generally used to allow a server to automatically recognize a particular user and generate a webpage tailored to that user. This makes it possible, for example, to customize online services and webpages, support login functionality, and operate certain contact forms.

The Company, as the publisher of the website https://www.altkomsoftware.com/, uses cookies to optimize the use of the website and tailor its content to user preferences. Cookies are also used to create anonymous, aggregated statistics without personally identifying users. This helps us understand how users use the website and allows us to improve its structure and content.

In addition, the Company may place cookies on a user’s device, or allow a third party to do so, to ensure that the website functions properly. This helps monitor and verify the website’s operation.

Such third parties may include Google, which collects data required by the Company.

Users may configure their browsers so that cookies are not stored on their devices or are automatically deleted after a specified period. Browser settings can therefore be changed to block the automatic handling of cookies or to notify the user whenever a cookie is sent to their device. Unfortunately, doing so may cause problems displaying certain websites or make certain services unavailable.

5. How to change cookie settings in the most popular browsers:

• Mozilla Firefox: Instructions: https://support.mozilla.org/enUS/kb/storage?as=u&utm_source=inproduct&redirectslug=permission-storedata&redirectlocale=en-US
• Opera: Instructions: https://help.opera.com/pl/latest/security-and-privacy/
• Safari: Instructions: https://support.apple.com/pl-pl/guide/safari/sfri11471/mac
• Google Chrome: Instructions: https://support.google.com/chrome/answer/95647?hl=pl&co=GENIE.Platform%3DDesktop

Policy dated August 4, 2026.