-
TrafficWatchdog is the data controller of Users' personal data and the personal data of their employees or other individuals used by the User (“User Data”), and processes this personal data in accordance with the principles set out in the Privacy Policy available here: https://trafficwatchdog.pl/en/docs/privacy-policy. The User hereby declares that they have read and accept the content of the Privacy Policy, and in particular confirms and acknowledges that:
User Data placed within the Account or elsewhere on the TrafficWatchdog Website will be processed in accordance with applicable law by the data controller: Spark DigitUP Sp. z o.o., Plac Wolnica 13 lok. 10, 31-060 Kraków, NIP 6762496391, registered in the District Court of Kraków-Śródmieście, XI Commercial Division of the National Court Register, under KRS number 0000587711, REGON 363042916, share capital 205,000.00 PLN fully paid up;
in the event that the User places personal data of their employees or other individuals used by the User in the Account or elsewhere on the TrafficWatchdog Website, the User is obliged to inform these data subjects of this fact and to familiarize them with the Privacy Policy referred to in paragraph 1 of this section, and to obtain written declarations from these individuals acknowledging that they have read the Privacy Policy, and to submit the signed declarations of the data subjects at any request from TrafficWatchdog within no more than 3 days from the date of such request.
The Client may grant TrafficWatchdog access to the Account on the target advertising platform for the purpose of providing the Service. To achieve this, the Client provides the required account information on the Client's advertising platform.
The Client declares that they are the data controller or a data processor acting on behalf of the data controller of the Client Users' personal data. The Client declares that they collect and process this personal data in accordance with generally applicable laws.
The Client authorizes TrafficWatchdog as a Processor to process the personal data of Users on their behalf in connection with the provision of Services.
In any case, the Client declares that they are authorized to entrust or further entrust the personal data of Client Users to third parties.
The Client declares that, in the course of operating the Client Website, they comply with applicable regulations regarding the collection of information from Client Users, including informing Client Users about the scope of data collected and processed by TrafficWatchdog, and, if required by law, obtaining appropriate consents from Client Users for the collection and processing of data by TrafficWatchdog.
In connection with the provision of Services, TrafficWatchdog will process the personal data of Client Users. The Client, as the data controller of Client Users' personal data and Visit Data, declares and ensures that they, on their own behalf and at their own expense, fulfill all obligations imposed on the data controller by applicable regulations towards these data subjects, including in particular the proper fulfillment of the information obligation, obtaining all necessary and legally required consents from Client Users for the processing of their personal data, including in connection with the User's use of the Services, Software, Detection Code, and Chat Widget. TrafficWatchdog is not responsible for the Client's failure to fulfill the obligations referred to in this paragraph, including the improper fulfillment or non-fulfillment of the information obligation towards data subjects or the failure to provide an appropriate legal basis for the processing of personal data of data subjects processed in connection with the provided Service.
The provisions of the Regulations constitute a contract or other legal instrument binding the data processor and the data controller within the meaning of Article 28(1) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC - General Data Protection Regulation (“GDPR”), under which the Client entrusts TrafficWatchdog, as a data processor, with the processing of personal data and visit data of Client Users in the following scope: IP address, cookies, basic information about the computer device used to access the Client Website, identifier assigned to the device from which visits are generated, end device parameters, operating system parameters, browser parameters, general geographic location of the visit, the way a potential Client User interacts with the Client Website and activity data on the Client Website, time spent on the Website, HTTP header parameters, marketing campaign parameters, data on visited websites, URLs of visited pages, date and time of the visit, and, in the case of using the Chat Widget, contact details provided by the User during the conversation: name, surname, email, phone number, social media account data.
The entrusted personal data will be processed by TrafficWatchdog for the proper performance of the Agreement, i.e., for the proper provision of Services.
TrafficWatchdog may entrust the processing of entrusted personal data to another person or entity (“Further Processor”), to which the Client hereby gives general consent. If TrafficWatchdog uses the services of a Further Processor to perform specific processing activities on behalf of TrafficWatchdog, the Further Processor is subject to the same obligations and level of data protection as in the Agreement. If the Further Processor fails to fulfill their data protection obligations, TrafficWatchdog is responsible to the Client for fulfilling the Further Processor’s obligations.
TrafficWatchdog undertakes to comply with generally applicable legal provisions regarding personal data protection during their term of validity and to implement them before commencing the processing of entrusted personal data, and then to apply them throughout the term of the Agreement.
TrafficWatchdog undertakes to process the entrusted personal data only on documented instructions from the Client, which also applies to the transfer of personal data to third countries, i.e., outside the European Economic Area, or to an international organization – unless such an obligation is imposed on it by European Union law or the law of the Member State to which TrafficWatchdog is subject. In such a case, TrafficWatchdog informs the Client of this legal obligation before commencing processing, unless that law prohibits the provision of such information. Documented instructions include the provisions of the Regulations, instructions transmitted electronically or in writing, and the obligations of TrafficWatchdog arising from the Agreement.
TrafficWatchdog ensures that persons authorized to process personal data entrusted by the Client have committed to maintaining confidentiality or are subject to an appropriate statutory obligation of confidentiality.
TrafficWatchdog is authorized to authorize persons acting on its behalf, including Further Processors, to process the entrusted personal data on behalf of the Client, including issuing instructions to these entities on behalf of the Client regarding the processing of the entrusted personal data, within the limits of the instructions issued by the Client.
TrafficWatchdog ensures that persons who will process the entrusted data on its behalf have been adequately trained in the field of personal data protection.
Taking into account the state of technical knowledge, the cost of implementation, and the nature, scope, context, and purposes of processing, as well as the risk of violation of the rights or freedoms of natural persons with varying probabilities of occurrence and severity of the threat, TrafficWatchdog implements appropriate technical and organizational measures to ensure a level of security appropriate to the risk assessed in accordance with point 13 above, including, where appropriate: (i) pseudonymization and encryption of personal data, (ii) the ability to continuously ensure the confidentiality, integrity, availability, and resilience of processing systems and services, (iii) the ability to quickly restore the availability of personal data and access to it in the event of a physical or technical incident, and (iv) regular testing, measuring, and evaluating the effectiveness of technical and organizational measures to ensure the security of processing.
-
TrafficWatchdog assists the Client, through appropriate technical and organizational measures, in fulfilling the obligation to respond to requests from data subjects regarding the exercise of their rights under Chapter III of the GDPR, and in particular requests regarding being informed, access to data, rectification of data, erasure of data, restriction of processing, data portability, objection, and requests related to automated decision-making and profiling. Within the scope of the obligation referred to in the preceding sentence:
TrafficWatchdog undertakes to immediately notify the Client of any received notification or request from a data subject – but no later than within 72 hours of receiving such notification or request;
TrafficWatchdog provides the Client with all the information necessary to fulfill the request of the data subject within 3 working days from the date of the Client's request for information;
TrafficWatchdog does not provide data subjects with responses to their submitted requests.
-
TrafficWatchdog assists the Client in fulfilling the obligations specified in Articles 32–36 of the GDPR, including in particular:
regarding the notification of personal data breaches;
regarding the implementation of adequate technical and organizational measures, appropriate to the identified risks related to the processing of entrusted personal data;
regarding the Client's performance of data protection impact assessments and consultations with the supervisory authority in connection with such assessments.
TrafficWatchdog maintains a register of categories of processing activities in accordance with Article 30(2) of the GDPR. TrafficWatchdog provides the register referred to above at the request of the supervisory authority and cooperates with the supervisory authority in the performance of its tasks.
The entrusted personal data is processed by TrafficWatchdog from the moment of implementation of the Software, Detection Code, or Chat Widget on the Client Website. Subject to paragraphs 22 and 23 of this section, after the termination of the provision of Services and the termination or expiration of the Agreement, depending on the Client's decision, TrafficWatchdog deletes or returns all personal data within 14 days and deletes all existing copies thereof, unless Union or Member State law requires the storage of personal data.
TrafficWatchdog has the right to retain data to the extent necessary to establish, assert, and defend claims, thereby becoming a separate data controller in this regard.
The provisions of this paragraph do not affect TrafficWatchdog's right to retain and use data resulting from or derived from the provided Service for the purpose of conducting research, statistics, and analyses, improving the Software and Services, and offering general analytical information to Clients, Potential Clients, and third parties, provided that this data is aggregated and does not allow for the identification of Client Users.
TrafficWatchdog cooperates with supervisory authorities and controlling institutions and the Client upon request.
TrafficWatchdog provides the Client with all the information necessary to demonstrate compliance with the obligations specified in this paragraph and the GDPR within 14 days of the Client's request in this regard, and allows the Client or an auditor authorized by the Client to conduct audits, including inspections.
The Client has the right to direct inquiries to TrafficWatchdog regarding the correctness of TrafficWatchdog's performance of obligations related to the security of the personal data entrusted to it.
The Client or an auditor authorized by the Client will exercise the right of audit on Mondays to Fridays between 9:00 AM and 3:00 PM and after prior written notification to TrafficWatchdog at least 14 days before the planned audit date. The costs of the audit are borne by the Client.
The Client will conduct the audit with respect for TrafficWatchdog's trade secrets.
After conducting the audit, the Client may provide TrafficWatchdog with post-audit recommendations in writing. TrafficWatchdog will be obliged to implement them within a deadline specified by the Client, but not shorter than 30 days.
-
Upon detecting a breach of the protection of entrusted personal data, TrafficWatchdog shall, without undue delay, but no later than within 72 hours of receiving information about the occurrence of the event, report it to the Client. This report shall include:
the nature of the personal data breach, including indicating the categories and approximate number of data subjects concerned, and the categories and approximate number of personal data records concerned by the breach;
the name and contact details of the data protection officer or other contact point from which more information can be obtained;
the possible consequences of the personal data breach;
the measures taken or proposed to address the personal data breach, including measures to minimize its possible negative effects.
TrafficWatchdog undertakes to inform the Client, immediately upon becoming aware of information, but no later than within 7 days, about any proceedings, in particular administrative or judicial, concerning the processing of entrusted personal data. TrafficWatchdog also informs the Client about all administrative decisions or judgments concerning the processing of entrusted data addressed to TrafficWatchdog, as well as about all planned – if TrafficWatchdog is aware of them – or ongoing controls and inspections concerning the processing of entrusted personal data at TrafficWatchdog.
To the extent resulting from this paragraph, TrafficWatchdog, as the processor of entrusted personal data, is liable to the Client, as the controller of the entrusted personal data, for non-performance or improper performance of the Agreement or for any other legal grounds and bases for its pursuit, in accordance with the principles set out in the GDPR – provided that in the above scope, TrafficWatchdog's liability is limited to the Client's damages resulting solely from actions of intentional fault of TrafficWatchdog and, regardless of the legal basis for its pursuit and from all legal grounds combined, is limited to an amount constituting 100% (one hundred percent) of the total amount that was actually paid by the Client to TrafficWatchdog as remuneration due under the Agreement in the last 12 (twelve) months.