Privacy and Cookies Policy

Last updated: 21 September 2026

§1. Definitions

For the purposes of this document, the following definitions apply:

Personal Data Controller/Controller – Jakub Szafrański, conducting business activity under the business name SAMU.PL JAKUB SZAFRAŃSKI, entered in the register of entrepreneurs of the Central Registration and Information on Business (CEIDG) maintained by the minister competent for the economy, at the address ul. Franciszka Rakoczego 23 lok. 308, 80 – 288 Gdańsk, NIP 8792650260, REGON 363475503;

Personal Data – information relating to a natural person which identifies that person or enables that person to be identified, meaning that on the basis of such information the identity of the natural person to whom the data relate can be established, directly or indirectly;

Online Platform/Platform – the online Platform operated by the Controller under the domain fibly.pl;

Processing – an operation or set of operations performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as, among others, collection, recording, organisation, structuring, storage, retrieval, consultation or erasure;

Privacy and Cookies Policy/Privacy Policy – this document, setting out the rules for processing personal data via the Platform, on the basis of and in accordance with the GDPR;

GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation);

User – a User or Client within the meaning of the Terms and Conditions, whose Personal Data are Processed within the Platform and the agreements concluded through it.

§2. General information

The Privacy Policy has been prepared on the basis of and in accordance with all requirements of the GDPR; in particular, it contains all the necessary information which the Controller is obliged to provide to a person whose Personal Data it Processes and from whom it has collected those Data – pursuant to Article 13 of the GDPR, i.e. the information necessary to ensure fair and transparent Processing of Personal Data by the Controller.
Capitalised terms not defined in this Privacy Policy have the meaning given to them in the Platform's Terms and Conditions, available on the Platform's website.
The Privacy Policy describes matters relating to the Processing of Personal Data solely via the Platform, including within the framework of Agreements concluded at a distance on the basis of information contained on the Platform's website.
The Platform uses encrypted data transmission, which means that it has a so-called SSL (Secure Sockets Layer) certificate, i.e. a network protocol used for secure network connections.
This version of the Privacy Policy is effective from 21.09.2026.

§3. Personal Data Controller

The Controller of the User's Personal Data is Jakub Szafrański, conducting business activity under the business name SAMU.PL JAKUB SZAFRAŃSKI, entered in the register of entrepreneurs of the Central Registration and Information on Business (CEIDG) maintained by the minister competent for the economy, at the address ul. Franciszka Rakoczego 23 lok. 308, 80 – 288 Gdańsk, NIP 8792650260, REGON 363475503.
The User may contact the Controller regarding their Personal Data by the following means of contact:
1. by post at the address: ul. Franciszka Rakoczego 23 lok. 308, 80 – 288 Gdańsk;
2. by e-mail at the e-mail address: jszafranski@fibly.pl;
3. by telephone at the number: +48 518 202 239.
The Controller has not appointed a Data Protection Officer because, given the small scope and scale of the Personal Data Processed, in the Controller's assessment this is neither necessary nor legally required.

§4. Scope of Personal Data Processed

Via the Platform, the Controller may Process Personal Data through:
1. the contact form available on the website;
2. the chat;
3. the newsletter;
4. the Account;
5. collecting and publishing reviews;
6. ensuring continuity of communication and enabling contact with the Controller on matters relating to its business activity;
7. placing Orders and concluding Agreements for the provision of SaaS Services;
8. the Google Analytics analytics tool used;
9. running business accounts related to its business activity on Facebook and LinkedIn;
10. fulfilling legal obligations arising from applicable law, in particular accounting and tax regulations.
The Controller may also Process Personal Data in the event of the establishment, pursuit and enforcement of claims in court proceedings or proceedings before other authorities.
All Personal Data that may be Processed by the Controller via the Platform are provided by the User voluntarily.
The User is not required to provide the Controller with their Personal Data, whether directly (e.g. via the contact form) or indirectly (data collected by means of third-party cookies. However, failure to provide certain Personal Data may make it impossible to perform a given service or achieve a specific purpose.
If, however, the User provides their Personal Data, the Controller will Process them on the basis of and within the limits of the law, including in particular in an adequate manner within the meaning of the GDPR, i.e. relevant and limited to what is necessary for the purposes for which they are Processed, in accordance with the principle of data minimisation.
The specific legal bases for the Processing of Personal Data are set out further in this Privacy Policy.

§5. Personal Data Processed via the contact form and the chat

Through the contact form or the chat available on the Platform's website, the Controller Processes the Personal Data that you provide when completing the form or using the chat, i.e. in particular the Personal Data required to send a message via the form and the chat, namely: first name and e-mail address.
The legal basis for the Processing of Personal Data via the form and the chat is Article 6(1)(f) of the GDPR, i.e. Processing for the purposes of the legitimate interest pursued by the Controller, which in this case means enabling contact between you and the Controller on matters relating to the business activity conducted by the Controller.
Your Personal Data Processed via the form and the chat are Processed for no longer than is necessary to contact you for the purpose for which you approached the Controller, i.e. until the correspondence has been expressly concluded or earlier – i.e. until you object to the Processing of Personal Data for this purpose.

Through subscription to the newsletter, the Controller Processes the Personal Data that the User provides when completing and submitting the newsletter subscription form, i.e. the e-mail address.
The legal basis for the Processing of Personal Data is Article 6(1)(a) of the GDPR, i.e. Processing on the basis of the consent of the data subject, for the purpose of the Service Provider sending the newsletter.
The User's Personal Data Processed in connection with the newsletter are Processed until consent to the Processing of the Data is withdrawn.
The User may withdraw their consent to the processing of their personal data at any time. Withdrawal of consent to the processing of personal data does not affect the lawfulness of processing carried out by the Controller on the basis of the consent given by the User before its withdrawal.
If the User wishes to withdraw consent to the processing of Personal Data for the purpose of providing the newsletter Service, they may unsubscribe from it by clicking the newsletter unsubscribe link sent in every e-mail message sent as part of the newsletter.

§7. Personal Data Processed via the Account

Through the Account registration form and the maintenance of the Account on the Platform's website, the Controller Processes the Personal Data that the User provides to register the Account or data in the Account that the User completes themselves, i.e. in particular the Personal Data required to register the Account, namely: e-mail address, first name, surname, business name, NIP (tax identification number).
The legal basis for the Processing of Personal Data via the Account registration form is Article 6(1)(b) of the GDPR, i.e. Processing in order to take steps at the request of the User prior to entering into an agreement, and processing necessary for the performance of an agreement to which the User is a party.
Personal Data Processed in connection with the Account are Processed until the expiry of the limitation period for claims relating to the performance of the agreement.

§8. Personal Data Processed via reviews

Through collecting and presenting reviews on the Platform's website, the Controller Processes the Personal Data that the Client provides for the publication of a review or data published as part of a review, i.e. in particular the following Personal Data: first name, surname, image, job title, business name.
The legal basis for the Processing of Personal Data in connection with collecting and publishing reviews is Article 6(1)(f) of the GDPR, i.e. Processing for the purposes of the legitimate interest pursued by the Controller, which in this case means enabling the collection and presentation of reviews concerning the Services provided, as well as the course of the process of concluding the Agreement and the customer service related to the fulfilment of Orders, which serves to ensure reliable information about the offer and transparency of the Service provision process.
Personal Data Processed in connection with collecting and publishing reviews are Processed until the review is removed or earlier – i.e. until the User objects to the Processing of Personal Data for this purpose.

§9. Personal Data processed to ensure continuity of communication and to enable contact with the Controller on matters relating to its business activity

By providing the possibility of contacting the Controller on matters relating to its business activity, the Controller processes the Personal Data provided by the User or Client, namely: first name and surname, name, e-mail address, telephone number, business name, NIP, as well as other Data voluntarily provided by the User or Client in the content of the message.
The legal basis for the processing of Personal Data in this respect is Article 6(1)(f) of the GDPR, i.e. processing for the purposes of the legitimate interest pursued by the Controller, which in this case means ensuring continuity of communication and enabling Users or Clients of the Platform to contact the Controller on matters relating to its business activity.
Personal Data processed for the purpose of ensuring contact with the Controller will be stored for the period necessary to conduct the correspondence and to achieve the purpose for which they were provided, and once that purpose has been achieved they may be Processed for the period resulting from the Controller's legitimate interests.
The User has the right to object at any time to the Processing of their Personal Data for this purpose, which may result in the cessation of further correspondence and the erasure of the Data, unless there is another legal basis for their further Processing.

§10. Personal Data Processed in connection with placing an Order and concluding an Agreement for the provision of the SaaS Service

In connection with the conclusion of an Agreement for the provision of the SaaS Service concluded at a distance via the Platform's website, the Controller Processes the Personal Data necessary to place an Order and conclude the Agreement, namely: first name, surname, e-mail address, contact telephone number, correspondence address, bank account number, NIP, business name.
The legal basis for the Processing of Personal Data in connection with placing an Order and concluding an Agreement is Article 6(1)(b) of the GDPR, i.e. processing in order to take steps at the request of the User prior to entering into the Agreement, and processing necessary for the performance of the Agreement to which the User is a party.
The User's Personal Data Processed in connection with the Order placed and the Agreement concluded are Processed until the expiry of the limitation period for claims relating to the Agreement, arising from the provisions of currently applicable law.

§11. Personal Data Processed via Google Analytics

The Controller uses an analytics tool on the Platform's website, such as Google Analytics.
Within Google Analytics, the Controller may Process the following scope of the User's Personal Data: IP address, approximate location limited to the town or city, gender, age.
The purpose of the Processing of Personal Data by Google Analytics is statistical analysis of the User's traffic on the Platform's web pages and of the User's interaction with the Platform's web pages, which is used by the Controller so that it can optimise the operation of the Platform's website and thereby conduct its business activity effectively.
The legal basis for the Processing of the Personal Data referred to in this section is Article 6(1)(a) of the GDPR, i.e. Processing on the basis of consent given by the data subject, for the purpose served by Google Analytics.
The User may give consent to the Processing of Personal Data via Google Analytics by means of the cookie notice (the so-called cookie banner), which will appear on the Platform's website when the User visits it for the first time.
The User is also entitled to withdraw the consent given to the Processing of Personal Data at any time, without affecting the lawfulness of Processing based on consent before its withdrawal.
In order to withdraw consent, the User may at any time disable the cookies described in this section in the cookie settings.
Personal Data processed within Google Analytics are Processed for up to 2 years, i.e. for the period of validity of the cookie or until the User withdraws consent to the Processing of those Data by the actions referred to in the point above.

In connection with running the Controller's business accounts on Facebook and LinkedIn, the Controller processes the Personal Data of Users who interact with the accounts, in particular by following the accounts, reacting to published content (e.g. likes, comments, shares) or sending private messages. The Data Processed include in particular: the account identifier (e.g. User name), first name and surname or business name (if they constitute the User name), profile picture, the content of comments and messages, and other information voluntarily made available by the user in the course of their activity on Facebook and LinkedIn.
The legal basis for the processing of Personal Data in connection with the accounts is:
1. Article 6(1)(f) of the GDPR, i.e. the legitimate interest of the Controller consisting in running a social media profile for the purpose of promoting its own services, building and maintaining relationships with Users and responding to their enquiries;
2. Article 6(1)(b) of the GDPR, i.e. processing necessary in order to take steps at the request of the data subject prior to entering into an agreement (e.g. presenting an offer, providing information about services) – where the User makes contact by private message.
Personal Data are processed for the period necessary to achieve the purposes for which they were collected, in particular until the accounts cease to be run or the interaction with the User ends. In the case of private messages, the Data may be stored for the limitation period of any claims related to the correspondence conducted or the Agreement concluded.
Please note that Meta Platforms Ireland Limited (Facebook) and LinkedIn Ireland Unlimited Company (LinkedIn) are also controllers of the data of users of the Facebook and LinkedIn services with regard to the operation of the platform itself (e.g. terms of use, profiling, statistics), acting as separate personal data controllers. These entities transfer Personal Data to third countries.

§13. Processing of Personal Data in order to fulfil legal obligations

As an entrepreneur, the Controller is also subject to a number of legal obligations which it must fulfil, such as issuing invoices, including structured invoices via the National e-Invoice System (Krajowy System e-Faktur, KSeF), and accounting for them. Accordingly, the Controller Processes the Personal Data necessary to fulfil all the required legal obligations incumbent on it, in particular under accounting and tax regulations.
The Personal Data referred to in point 1 above are: first name, surname, correspondence address, e-mail address, telephone number, bank account number, business name, NIP or REGON, as well as other data required by law to issue an invoice, including a structured invoice in the National e-Invoice System (KSeF).
The legal basis for the Processing of Personal Data in connection with the Controller's fulfilment of the legal obligations referred to in this section is Article 6(1)(c) of the GDPR, i.e. processing necessary for compliance with legal obligations to which the Controller is subject, arising from applicable law, in particular accounting and tax regulations, including those governing the operation of the National e-Invoice System (KSeF).
The User's Personal Data Processed for the purpose of fulfilling legal obligations are Processed until the expiry of the legal obligations incumbent on the Controller that required the Processing of those Data, including for the period required by tax law provisions on the retention of accounting records and invoices, including structured invoices in KSeF.

§14. Processing of Personal Data in the event of the establishment, pursuit and enforcement of claims arising from the Agreement

Where it is necessary to establish, pursue and enforce claims arising from the Agreement, or to defend against such claims, in court proceedings or before other authorities, the Controller will Process the Personal Data necessary for that purpose, in accordance with the law.
The Personal Data referred to in point 1 above may include: first name, surname, correspondence address, e-mail address, telephone number, bank account number, PESEL (national identification number), NIP or REGON, and business name.
The legal basis for the Processing of Personal Data in the situation referred to in this section is Article 6(1)(f) of the GDPR, i.e. Processing for the purposes of the legitimate interest pursued by the Controller, which may consist in the establishment, pursuit or enforcement of claims or the defence against potential claims in court proceedings or before other authorities.
The User's Personal Data that may be Processed for the purposes of potential claims or disputes are Processed until the expiry of the limitation period for claims relating to the Agreement concluded.

§15. Processing of Personal Data by other entities

In order to use the tools enabling the Controller to maintain the Platform, and in order to conclude and perform the Agreement, the User's Personal Data may also be Processed by the following entities:

a. the hosting provider of the Platform's website, which stores Personal Data on its server and thereby Processes them, as a data processor;

b. the entity providing accounting services, as a data processor;

c. the entity operating the invoicing software, as a data processor;

d. entities providing electronic payment services, as separate and independent controllers of Personal Data;

e. the entity providing the service of sending newsletter messages, as a data processor;

f. the Service Provider uses network intermediary services and distributed server infrastructure to ensure data security and speed up access to the Platform (e.g. in the form of CDN services, protection against DDoS attacks, anonymisation of server addresses), as a data processor;

g. Google LLC 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA – for the purpose of the Controller's use of the Google Analytics tools, which is an independent controller of those Personal Data;

h. public administration authorities, including in particular the Ministry of Finance and the authorities of the National Revenue Administration (Krajowa Administracja Skarbowa), in connection with the Controller's use of the National e-Invoice System (KSeF) and the performance of obligations arising from the law on electronic invoicing.

§16. Transfer of Personal Data to third countries or international organisations

The Controller does not directly transfer the User's Personal Data to third countries or international organisations.
However, the User's Personal Data may be transferred to third countries by Google LLC, whose tool the Controller uses (Google Analytics) and which, in the course of those activities, becomes a separate controller of the User's Personal Data.
Google LLC is included in the list of entities participating in the Data Privacy Framework programme and, in accordance with Commission Implementing Decision (EU) C(2023) 4745 of 10 July 2023 on the adequate level of protection of personal data under the EU- USA Data Privacy Framework, the protection of Personal Data therefore corresponds to the standards of the regulations in force in the European Union.

§17. Information on automated decision-making, including profiling

The User's Personal Data are not used by the Controller for the purpose of making decisions regarding the User based on automated Processing of Personal Data, including profiling.

§18. Rights of the User in connection with the Processing of their Personal Data

Pursuant to Articles 16 – 21 of the GDPR, the User is granted the following rights in relation to the Personal Data Processed by the Controller.
Within the legal bases indicated above, the User has the right to exercise the following rights concerning their Personal Data Processed by the Controller, i.e. the User has the right to:
1. access Personal Data, pursuant to Article 15 of the GDPR;
2. rectification of Personal Data, pursuant to Article 16 of the GDPR;
3. erasure of Personal Data, pursuant to Article 17 of the GDPR;
4. restriction of Processing of Personal Data, pursuant to Article 18 of the GDPR;
5. portability of Personal Data, pursuant to Article 20 of the GDPR;
6. object to the Processing of Data, pursuant to Article 21 of the GDPR.
More detailed information on the rights available to the User can be found in Articles 16 – 21 of the GDPR respectively.
If the Processing of the User's Personal Data is based on consent given by the User, the User also has the right to withdraw consent to the Processing of Personal Data at any time, without affecting the lawfulness of Processing based on that consent before its withdrawal.
The User also has the right to lodge a complaint with the competent supervisory authority if they consider that their Personal Data are not being Processed properly and in accordance with the law.
The competent supervisory authority may be the authority competent for the User's place of habitual residence in a Member State, the User's place of work or the place of the alleged infringement relating to Personal Data.
In Poland, the supervisory authority for Personal Data is the President of the Personal Data Protection Office (PUODO).
Before lodging any complaint, however, the Controller encourages the User to first contact it at one of the e-mail addresses indicated in this Privacy Policy in order to clarify the matter or any doubts the User may have regarding the Processing of Personal Data via the Platform or the Agreement concluded.

§19. Cookies – general information

The Platform's website uses cookies.
Cookies are small pieces of text information stored on the User's terminal device that the User uses to access the Platform's website, e.g. a computer or a mobile phone.
Cookies may be read by the Controller's ICT system (so-called first-party cookies) or by the ICT systems of third parties (so-called third-party cookies).

§20. Cookies and the Processing of Personal Data

By the Controller's ICT system reading the User's cookies, the Controller may have access to information constituting Personal Data and, accordingly, such activities result in the Processing of those Personal Data by the Controller.
Certain information, including Personal Data contained in cookies, may also be read by the ICT systems of third parties.
Some of the cookies used by the Controller are necessary for the proper provision of electronic services to the User within the meaning of the Act of 18 July 2002 on the Provision of Electronic Services, whereas the use of certain cookies by the Controller is not necessary, as they serve the Controller for purposes that are not required for the User to be able to use the Platform properly.
Cookies that are not necessary for the proper provision of electronic services to the User are blocked until the User consents to their use and thereby consents to the Processing of Personal Data.
The User may give the consent referred to above via the cookie banner, which will be displayed on the Platform's website during the User's first visit.
The legal basis for the Processing of Personal Data by means of the cookies referred to in the points above is Article 6(1)(a) of the GDPR, i.e. the User's consent, as described in more detail in the sections above concerning the rules for processing Data within the tools used on the Platform's website.
In addition, within their web browser, the User may at any time manage cookie settings, among other things by blocking their use or re-enabling them.

§21. Cookies used through the Platform's website

Through the Platform's website, the Controller uses its own (first-party) cookies and third-party cookies.
First-party cookies are used to ensure the proper operation of the individual mechanisms on the website.
Third-party cookies are used for the purposes described in the sections above concerning the rules for processing Data and for the purpose of promoting the Platform, and they are the cookies of:
1. Google Analytics, owned by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA;
2. the Facebook platform, owned by Meta Platforms Inc.;
3. the LinkedIn platform, owned by LinkedIn Ireland Unlimited Company.

§22. Final provisions

In matters not regulated in the Privacy Policy, the relevant provisions of Polish law and the GDPR shall apply.
The Controller has the right to amend the content of the Privacy Policy, in particular where this is required by changes relating to the Processing of Personal Data on the Platform's website, technological changes or changes in applicable law concerning the matters described in this document.