Policy Privacy

§1. General Provisions

1. The controller of personal data is PWNONE sp. z o.o.with its registered office at Dorohucza 15, 21-044 Trawniki, Poland; VAT ID (NIP): 7123508194, REGON: 543945668, KRS: 0001222700. Contact:+48 500‑480‑420 / contact@pwnone.com. Data is protected in accordance with generally applicable law and stored on secured servers.
2. Terms are interpreted according to the glossary of the Terms of Service or as described in this Privacy Policy (where this follows directly from the description).
3. For readability, the term „User” has been replaced with „You”, and „Controller” with „We”. „GDPR” means Regulation (EU) 2016/679 of the European Parliament and of the Council on the protection of natural persons with regard to the processing of personal data.
4. Personal data submitted through forms on this site is treated as confidential and is not visible to unauthorized persons.

§2. Data Controller

1. The Service Provider is the controller of its clients' data. This means that if you sent an inquiry through the contact form, we process your data such as: first name, last name, e-mail address, phone number and the content of the message.
2. The Service Provider is also the controller of the data of newsletter subscribers. Sign-up uses a double opt-in mechanism, the subscription is activated only after clicking the confirmation link sent to the provided e-mail address.
3. Personal data is processed:
   1. in accordance with personal data protection regulations,
   2. in accordance with the implemented Privacy Policy,
   3. to the extent and for the purpose necessary to establish, shape, amend or terminate the Agreement and to properly deliver Services provided electronically,
   4. to the extent and for the purpose necessary to pursue the Controller's legitimate interests, where the processing does not infringe the rights and freedoms of the data subject,
   5. to the extent and for the purpose covered by your consent, in the case of a newsletter subscription.
4. Every data subject (where we are the controller) has the right to access, rectify, erase or restrict processing, the right to object to processing, and the right to withdraw consent at any time without affecting the lawfulness of processing carried out before its withdrawal.
5. You can contact the person supervising personal data processing in the Service Provider's organization by e-mail at:contact@pwnone.com.
6. We reserve the right to process your data after the Agreement ends or consent is withdrawn, solely to the extent necessary to pursue possible claims in court or where national or EU law obliges us to retain the data.
7. The Service Provider may disclose the User's personal data and other data to entities authorized under applicable law (e.g. law enforcement authorities).
8. Personal data may be deleted as a result of withdrawing consent or filing a legally permissible objection to the processing of personal data.
9. The Service Provider does not disclose personal data to entities other than those authorized under applicable law.
10. Personal data is processed only by persons authorized by the Controller or by processors with whom we work closely under appropriate data processing agreements.

§3. Cookies

1. Website pwnone.comuses cookies. These are small text files sent by the web server and stored by the browser. When the browser connects to the site again, the site can recognize the device and tailor the page to the user's preferences.
2. The information collected concerns the IP address, browser type, language, operating system, internet service provider, time and date, location and information sent to the site via forms.
3. The collected data is used to monitor and analyze how users use our website, in order to improve the service and provide a more effective and trouble-free experience.
4. We use the following types of cookies on our website:
   1. „essential” cookies, enabling the use of services available within the Site, e.g. authentication cookies;
   2. security cookies, e.g. used to detect authentication abuse within the Site;
   3. „performance” cookies, enabling the collection of information about how the Site's pages are used;
   4. „functional” cookies, enabling „remembering” user settings and interface personalization, e.g. preferred language or font size;
   5. „analytics” cookies, enabling analysis of site traffic and user behavior in order to improve the service.
5. You can change or withdraw the consent you gave on this site at any time by clicking “Cookie settings” in the footer. You can also disable or re-enable cookies by changing your browser settings. Instructions for managing cookies are available on the browser vendor's website.allaboutcookies.org/manage-cookies.
6. Additional personal data, such as an e-mail address, is collected only where the user has actively consented by filling in a form. This data is retained and used only for the purposes necessary to perform the given function.

§4. Scope of Data Processing

1. As part of providing cybersecurity services (penetration tests, security audits, attack simulations) we may process technical and organizational data provided to us by the Client under a separate agreement and data processing agreement.
2. Data processed through the contact form includes: first and last name, e-mail address, phone number, the services of interest and the content of the message.
3. Data processed as part of the newsletter includes only the e-mail address. Details of newsletter data processing are described in §4a of this Policy.
4. Providing personal data is voluntary but necessary to establish contact, present a commercial offer or deliver a service. For the newsletter, providing an e-mail address is necessary to receive it.

§4a. Newsletter

1. Within the site pwnone.comwe provide a newsletter service through which we send cybersecurity information, including tips, threat analyses, and news about PWNONE services and publications.
2. Newsletter sign-up is voluntary. The subscriber provides only an e-mail address in the sign-up form available in the site footer.
3. We use a double opt-in confirmation mechanismcompliant with GDPR requirements. After submitting the sign-up form, a message with a unique confirmation link is sent to the provided e-mail address. The subscription is activated only after clicking that link.
4. The legal basis for processing personal data as part of the newsletter is the subscriber's consent (art. 6(1)(a) GDPR), expressed through the double opt-in mechanism.
5. Data processed as part of the newsletter includes: e-mail address, sign-up date, subscription confirmation date and a unique subscriber identifier.
6. The subscriber may withdraw consent to receive the newsletter (unsubscribe) at any time by clicking the opt-out link included in every newsletter message or by contacting the Controller at:contact@pwnone.com. Withdrawing consent results in immediate removal of the subscriber's data from the mailing list.
7. Personal data of newsletter subscribers is stored until consent is withdrawn (unsubscription). After withdrawal, the data is immediately and permanently deleted.
8. The Controller does not share newsletter subscribers' data with third parties for marketing purposes. Data may be entrusted only to technical providers of the newsletter infrastructure, under data processing agreements.

§5. Data Retention Period

1. Personal data processed to perform an agreement is stored for the duration of the agreement and for the period necessary to pursue or defend against claims (in line with general limitation periods).
2. Personal data processed on the basis of consent (including newsletter subscribers' data) is stored until consent is withdrawn. For the newsletter, consent is withdrawn by clicking the opt-out link or contacting the Controller.
3. Personal data processed on the basis of the Controller's legitimate interest is stored until an effective objection is raised.

§6. Final Provisions

1. The Controller reserves the right to amend this Privacy Policy. Users will be informed of any changes by an appropriate notice on the website.
2. In matters not regulated by this Privacy Policy, the GDPR, the Personal Data Protection Act and other applicable provisions of Polish law shall apply.
3. This Privacy Policy is effective as of 13 March 2026.