Policy Privacy

§1. General Provisions

1. The controller of personal data is PWNONE sp. z o.o.with its registered office at Dorohucza 15, 21-044 Trawniki, Poland; VAT ID (NIP): 7123508194, REGON: 543945668, KRS: 0001222700. Contact:+48 500‑480‑420 / contact@pwnone.com. Data is protected in accordance with generally applicable law and stored on secured servers.
2. Terms are interpreted according to the glossary of the Terms of Service or as described in this Privacy Policy (where this follows directly from the description).
3. For readability, the term „User” has been replaced with „You”, and „Controller” with „We”. „GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data.
4. Personal data submitted through forms on this site is treated as confidential and is not visible to unauthorized persons.

§2. Data Controller

1. The Service Provider is the controller of its clients' data. This means that if you sent an inquiry through the contact form, we process your data such as: first name, last name, e-mail address, phone number and the content of the message.
2. The Service Provider is also the controller of the data of newsletter subscribers. Sign-up uses a double opt-in mechanism, the subscription is activated only after clicking the confirmation link sent to the provided e-mail address.
3. The Service Provider is also the controller of the data of people who download e-books made available on the website. Details are described in §4b.
4. Personal data is processed:
   1. in accordance with personal data protection regulations,
   2. in accordance with the implemented Privacy Policy,
   3. to the extent and for the purpose necessary to establish, shape, amend or terminate the Agreement and to properly deliver Services provided electronically,
   4. to the extent and for the purpose necessary to pursue the Controller's legitimate interests, where the processing does not infringe the rights and freedoms of the data subject,
   5. to the extent and for the purpose covered by your consent, in the case of a newsletter subscription.
5. Every data subject (where we are the controller) has the right to access, rectify, erase or restrict processing, the right to data portability, the right to object to processing, the right to withdraw consent at any time without affecting the lawfulness of processing carried out before its withdrawal, and the right to lodge a complaint with the supervisory authority (President of the Personal Data Protection Office).
6. You can contact the person supervising personal data processing in the Service Provider's organization by e-mail at:contact@pwnone.com.
7. We reserve the right to process your data after the Agreement ends or consent is withdrawn, solely to the extent necessary to pursue possible claims in court or where national or EU law obliges us to retain the data.
8. The Service Provider may disclose the User's personal data and other data to entities authorized under applicable law (e.g. law enforcement authorities).
9. Personal data may be deleted as a result of withdrawing consent or filing a legally permissible objection to the processing of personal data.
10. The Service Provider does not disclose personal data to entities other than those authorized under applicable law.
11. Personal data is processed only by persons authorized by the Controller or by processors with whom we work closely under appropriate data processing agreements.

§3. Cookies

1. Website pwnone.comuses cookies. These are small text files sent by the web server and stored by the browser. When the browser connects to the site again, the site can recognize the device and tailor the page to the user's preferences.
2. The information collected concerns the IP address, browser type, language, operating system, internet service provider, time and date, location and information sent to the site via forms.
3. The collected data is used to monitor and analyze how users use our website, in order to improve the service and provide a more effective and trouble-free experience.
4. We use the following types of cookies on our website:
   1. „essential” cookies, enabling the use of services available within the Site, e.g. authentication cookies;
   2. security cookies, e.g. used to detect authentication abuse within the Site;
   3. „performance” cookies, enabling the collection of information about how the Site's pages are used;
   4. „functional” cookies, enabling „remembering” user settings and interface personalization, e.g. preferred language or font size;
   5. „analytics” cookies, enabling analysis of site traffic and user behavior in order to improve the service.
5. You can change or withdraw the consent you gave on this site at any time by clicking “Cookie settings” in the footer. You can also disable or re-enable cookies by changing your browser settings. Instructions for managing cookies are available on the browser vendor's website.allaboutcookies.org/manage-cookies.
6. Additional personal data, such as an e-mail address, is collected only where the user has actively consented by filling in a form. This data is retained and used only for the purposes necessary to perform the given function.

§4. Scope of Data Processing

1. As part of providing cybersecurity services (penetration tests, security audits, attack simulations) we may process technical and organizational data provided to us by the Client under a separate agreement and data processing agreement.
2. Data processed through the contact form includes: first and last name, e-mail address, phone number, the services of interest and the content of the message.
3. Data processed as part of the newsletter includes only the e-mail address. Details of newsletter data processing are described in §4a of this Policy.
4. When an e-book is downloaded, we process the business e-mail address and, if you provide them, your name and phone number. We also record the name of the downloaded e-book, the date and time of the request and which consents were ticked, together with their wording and version. Details are described in §4b.
5. Providing personal data is voluntary but necessary to establish contact, present a commercial offer or deliver a service. For the newsletter, providing an e-mail address is necessary to receive it.

§4a. Newsletter

1. Within the site pwnone.comwe provide a newsletter service through which we send cybersecurity information, including tips, threat analyses, and news about PWNONE services and publications.
2. Newsletter sign-up is voluntary. The subscriber provides only an e-mail address in the sign-up form in the site footer or ticks a separate, optional consent box in the e-book download form (§4b).
3. We use a double opt-in confirmation mechanismcompliant with GDPR requirements. After submitting the sign-up form, a message with a unique confirmation link is sent to the provided e-mail address. The subscription is activated only after clicking that link.
4. The legal basis for processing personal data as part of the newsletter is the subscriber's consent (art. 6(1)(a) GDPR), expressed through the double opt-in mechanism.
5. Data processed as part of the newsletter includes: e-mail address, sign-up date, subscription confirmation date and a unique subscriber identifier.
6. The subscriber may withdraw consent to receive the newsletter (unsubscribe) at any time by clicking the opt-out link included in every newsletter message or by contacting the Controller at:contact@pwnone.com. Withdrawing consent results in immediate removal of the subscriber's data from the mailing list.
7. Personal data of newsletter subscribers is stored until consent is withdrawn (unsubscription). After withdrawal, the data is immediately and permanently deleted.
8. The Controller does not share newsletter subscribers' data with third parties for marketing purposes. Data may be entrusted only to technical providers of the newsletter infrastructure, under data processing agreements.

§4b. Downloadable E-books

1. We offer free e-books for organisations on the website. To download an e-book, you enter your business e-mail address in the form on the e-book page. The form does not accept free mailbox addresses (e.g. Gmail, WP, Onet), because a business address shows which organisation is downloading the material. Your name is optional. So is your phone number, and we only record it if you tick the consent to contact. The download link is shown as soon as the form is submitted, and the file is also sent to the address provided. Our team receives a copy of that e-mail at contact@pwnone.com. Providing the address is voluntary, but without it we cannot provide the file.
2. We process the business e-mail address, your name and phone number (if provided), the name of the downloaded e-book, the date and time of the request, and which consents were ticked, together with their wording and version.
3. The legal basis is providing the e-book and sending it by e-mail at your request (Art. 6(1)(b) GDPR) and our legitimate interest in keeping download statistics and identifying which organisations the downloads come from, informing our team about the download and demonstrating which consents were given (Art. 6(1)(f) GDPR).
4. Consent to sales contact and newsletter sign-up are voluntary and do not affect the download. Consent to contact allows us to e-mail or call you about PWNONE services (Art. 6(1)(a) GDPR). For the newsletter, the rules in §4a apply, including double opt-in: if you do not click the confirmation link, you will not be added to the newsletter list. You can withdraw any consent at any time by writing to contact@pwnone.com. When you withdraw consent to contact, we delete your phone number; the download record keeps the dates on which consent was given and withdrawn. The download record itself is kept separately from the consents, for the period described in this section. Without consent to contact we do not send commercial information to the address provided and do not call with offers.
5. Data of people who downloaded an e-book is kept for 3 years from the download, and longer only where needed to establish, pursue or defend claims. You can request its deletion or object at any time by writing to contact@pwnone.com.
6. Form submissions reach us through providers with whom we have data processing agreements: website hosting, a form automation tool and our mailbox.

§5. Data Retention Period

1. Personal data processed to perform an agreement is stored for the duration of the agreement and for the period necessary to pursue or defend against claims (in line with general limitation periods).
2. Personal data processed on the basis of consent (including newsletter subscribers' data) is stored until consent is withdrawn. For the newsletter, consent is withdrawn by clicking the opt-out link or contacting the Controller.
3. Personal data processed on the basis of the Controller's legitimate interest is stored until an effective objection is raised.
4. Data of people who downloaded an e-book is kept for the period described in §4b.

§6. Final Provisions

1. The Controller reserves the right to amend this Privacy Policy. Users will be informed of any changes by an appropriate notice on the website.
2. In matters not regulated by this Privacy Policy, the GDPR, the Personal Data Protection Act and other applicable provisions of Polish law shall apply.
3. This Privacy Policy is effective as of 17 October 2026.