The legally binding version is the Polish one (wersja polska rozstrzygająca). This English text is an informational translation.

RODO INFORMATION / PRIVACY POLICY FOR THE PROCESSING OF THE PARTNER’S PERSONAL DATA

Version 1.5 of 07.10.2026

In accordance with Art. 13 of Regulation (EU) 2016/679 (RODO/GDPR), we inform you about the processing of your personal data within the Łatwy Start partner programme.

1. Data controller (Administrator)

The controller of your personal data is:

ŁATWY START sp. z o.o., ul. Płocka 5A lok. 6, 01-231 Warszawa, woj. mazowieckie, Polska; KRS 0000964608, NIP 1231511132, REGON 521672800.

Contact regarding data processing: info@latwy-start.pl.

A Data Protection Officer (IOD/DPO) has not been appointed.

2. Purposes and legal bases of processing

Purpose	Legal basis (RODO)
Registration in the partner programme, its operation, recording of referred clients, accrual and payment of remuneration, settlements with the Partner	Art. 6(1)(b) (performance of the contract concluded through acceptance of the Terms-and-Conditions offer)
Fulfilment of the Controller’s legal obligations: recording of documents, settlements and withholdings (where applicable), retention of accounting documentation in accordance with the law of the Republic of Poland	Art. 6(1)(c) (fulfilment of the Controller’s legal obligations)
Handling of and defence against claims, prevention of abuse (anti-fraud)	Art. 6(1)(f) (the Controller’s legitimate interest)
Marketing: sending ŁATWY START offers to the e-mail address provided and sharing an encrypted (SHA-256 hash) e-mail address with advertising platforms in order to show or suppress ŁATWY START advertising to you and create lookalike audiences (see section 5a)	Article 6(1)(a) GDPR (voluntary consent). Suppression from advertising may also be carried out under Article 6(1)(f) GDPR (legitimate interest)

2a. Request to be contacted about the Programme (persons who are not yet Partners)

When this applies: you submit the form on partner.latwy-start.pl so that our manager contacts you about the Programme. We send the guides together with our reply. Submitting the form does not sign you up for the Programme.
What data: your first name, e-mail address, the content of our correspondence, the page language and technical details of the request (date, campaign source). To protect the form against spam, your IP address is used only in hashed form and kept for 1 hour (Article 6(1)(f) GDPR).
Purposes and legal bases: (1) our manager contacting you about your request, sending the guides and corresponding with you before you may join the Programme: Article 6(1)(b) GDPR (steps taken at your request prior to entering into a contract); we send these messages to the address you gave us for this purpose (Article 398(2) of the Polish Electronic Communications Law of 12 July 2024); (2) keeping a record of the request and correspondence and how they were handled: Article 6(1)(f) GDPR (legitimate interest).
Retention period: for purposes (1) and (2), up to 12 months from the last contact. If you become a Partner, sections 2 to 4 apply.
Recipients: our e-mail and IT providers, as processors; transfers outside the EEA: section 5(1). We do not share the data with Programme partners or advertising platforms.
Your rights: as in section 6. You may at any time ask us to stop contacting you and object to processing for purpose (2) by writing to info@latwy-start.pl or by replying to our message.
Voluntary provision: giving your first name and e-mail is voluntary, but without them we cannot contact you.

3. Categories of data processed

identification and contact data: first name, surname, e-mail, phone number and other registration data;
data required for payment and tax reporting (depending on the Partner’s status): bank details / account details, data for a faktura for a sole trader (NIP, business name); for a natural person – the data required to make the payment and for tax reporting, including data on tax residence (a declaration of Polish tax residence – oświadczenie o rezydencji podatkowej – for a resident; for a non-resident – the data required to withhold tax at source and prepare the IFT-1R information);
data on activity in the programme: referral link/code, referred clients (in a form anonymised for the Partner), accruals and payments.

The referral cookie is stored for 90 days from the moment the affiliate link is clicked.

3a. Data of referred persons. Aggregated statistics

The personal data of referred persons is not passed to the Partner (persons who followed their link, submitted an application or became clients of the Controller): neither names, nor contacts, nor the content of applications, nor any other data enabling the identification of these persons.

Statistics on participation are provided to the Partner in the account exclusively in aggregated form: the number of clicks on the link, the number of applications/registrations, the number of active referred clients, and the amounts accrued and paid.

The Partner is obliged not to attempt to identify referred persons on the basis of aggregated statistics and not to combine it with other information for the purpose of such identification.

It follows from the nature of the referral programme that, where the number of referred persons is small, aggregated indicators may indirectly point the Partner to the very fact that a person to whom the Partner personally gave their link made an enquiry or entered into a contract. The Controller does not thereby disclose any data beyond the aggregated indicators; referred persons are informed about the processing of their data (including the source of referral – the referral link) in the RODO information for the Controller’s clients.

4. Retention period

data related to participation in the programme – for the term of the contract (participation) and thereafter until the expiry of the limitation period for possible claims;
data forming part of the accounting and tax documentation – for the period established by the law of the Republic of Poland for the retention of such documentation: as a general rule 5 years, counting from the end of the calendar year in which the deadline for paying the relevant tax expired (art. 70 § 1 i art. 86 § 1 Ordynacji podatkowej); for accounting documents – at least 5 years from the beginning of the year following the reporting year to which they relate (art. 74 ust. 2 ustawy o rachunkowości). The legal basis for such retention is Art. 6(1)(c) RODO (fulfilment of the Controller’s legal obligation); it also limits the right to erasure until the expiry of these periods (art. 17 ust. 3 lit. b RODO, see section 6).

Upon expiry of the said periods, the data is permanently deleted or irreversibly anonymised.

5. Data recipients

The data may be transferred to:

entities servicing the Controller’s accounting and settlements (accounting department / accounting office) – as processors;
public authorities to which the Controller is obliged by law to transfer data (the tax authority / Urząd Skarbowy, ZUS) – to the extent required by law;
the provider of the Programme’s IT infrastructure (the Website platform) – as a processor.
advertising platforms to which your encrypted (SHA-256 hash) e-mail address is disclosed where you have given marketing consent (see section 5a). The closed list is: Meta Platforms Ireland Ltd. (Facebook, Instagram), Google Ireland Ltd. (including YouTube and Google Ads audiences), TikTok Technology Limited, LinkedIn Ireland Unlimited Company, and Microsoft Ireland Operations Limited (Microsoft Advertising, Bing). Your data are not disclosed to other advertising platforms for these purposes.

Data are stored on servers located in the EEA. Transfers outside the EEA may take place in two cases:

(1) E-mail services. The Controller uses Google services; transfers outside the EEA are made on the basis of Standard Contractual Clauses approved by the European Commission (Article 46(2)(c) GDPR).

(2) Advertising audiences (where you have given marketing consent). Your encrypted (SHA-256 hash) e-mail address is disclosed to the advertising platforms listed in section 5 and may consequently be transferred outside the EEA, including to the United States and other third countries. The Chapter V GDPR safeguard depends on the recipient:
— for Meta Platforms Ireland Ltd., Google Ireland Ltd., LinkedIn Ireland Unlimited Company, and Microsoft Ireland Operations Limited — a European Commission adequacy decision (the EU-US Data Privacy Framework, where the recipient is certified under it) or Standard Contractual Clauses (SCCs, Article 46(2)(c) GDPR);
— for TikTok Technology Limited — the European Commission adequacy decision for the United Kingdom and/or Standard Contractual Clauses (SCCs). A TikTok transfer may involve third countries for which no adequacy decision has been adopted; in that case the transfer is based on your explicit consent given after being informed of that risk (Article 49(1)(a) GDPR).

Transfers for advertising audiences take place only where you have given marketing consent. You may withdraw consent at any time by writing to info@latwy-start.pl; withdrawal does not affect the lawfulness of processing before it was withdrawn.

5a. Sharing an encrypted e-mail address with advertising platforms (advertising audiences)

Purpose: showing you ŁATWY START advertising, suppressing selected campaigns for you, and creating Custom Audiences / Lookalike Audiences on that basis.
What is shared: your e-mail address solely in encrypted form (an irreversible SHA-256 hash). The unencrypted address is not shared with advertising platforms.
Recipients (closed list): Meta Platforms Ireland Ltd. (Facebook, Instagram), Google Ireland Ltd. (including YouTube and Google Ads audiences), TikTok Technology Limited, LinkedIn Ireland Unlimited Company, and Microsoft Ireland Operations Limited (Microsoft Advertising, Bing). The data are not disclosed to other platforms for these purposes.
Legal basis: Article 6(1)(a) GDPR (separate marketing consent expressed by an unticked checkbox in the form). Without this consent, no sharing takes place. Suppression may also take place under Article 6(1)(f) GDPR.
Transfers outside the EEA: see section 5(2).
Retention period: until consent is withdrawn. Consent may be withdrawn by writing to info@latwy-start.pl; withdrawal does not affect the lawfulness of processing before withdrawal and means that your hash is removed from the relevant advertising audiences.

6. Rights of the data subject

You have the right:

to access your data and obtain a copy of it;
to rectify (correct) the data;
to erasure of the data (“the right to be forgotten”, art. 17 RODO) – within the limits not conflicting with the Controller’s legal obligations (procedure – section 6a);
to restriction of processing;
to data portability (in the part processed on the basis of the contract);
to object to processing based on legitimate interest;
to withdraw consent – if and to the extent that the processing is based on consent (withdrawal does not affect the lawfulness of processing prior to withdrawal);
to lodge a complaint with the supervisory authority – the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO).

6a. Deletion of the account and data on request (right to erasure)

The Partner may at any time request the deletion of their account and the personal data associated with it – via the account or to the Controller’s e-mail (info@latwy-start.pl). Such a request simultaneously means the end of participation in the Programme (Terms and Conditions, § 8 point 1). From the moment the request is submitted, the Controller ceases processing the Partner’s data for the purpose of the further operation of the Programme, except for processing necessary to complete settlements and fulfil the Controller’s legal obligations.

Account without accruals and payments (“clean”). If there were neither accruals nor payments on the account and there are no outstanding settlements and tax/accounting obligations associated with the Partner, the Partner’s account and personal data are deleted within a short time (including automatically) after the request is confirmed – there is no legal basis for further retention.

Account with accruals or payments. If there were accruals and/or payments on the account, the data is not deleted immediately. The account is placed in the status “Pending deletion” and is retained until: (a) all settlements with the Partner have been completed, including payment of the balance earned in good faith (Terms and Conditions, § 5 point 8, § 8); (b) the necessary tax and accounting documents have been drawn up and stored (in particular PIT-11 / IFT-1R / faktury / rachunki); (c) the statutory retention periods for these documents have expired (section 4). The request undergoes a check (moderation) of the state of settlements and tax reporting; only then is the data deleted or anonymised.

Legal basis. The right to erasure is exercised on the basis of art. 17 RODO. Its immediate fulfilment as regards accounting and tax documentation is limited by art. 17 ust. 3 lit. b RODO: processing is necessary to fulfil the Controller’s legal obligation requiring the retention of data (tax and accounting retention, section 4). Until the retention periods expire, such data is retained to the minimum necessary extent; everything not covered by this obligation is deleted or anonymised immediately after the settlements are completed. Upon expiry of the retention periods (section 4), the data is permanently deleted or irreversibly anonymised.

7. Voluntariness of providing data

The provision of data is voluntary but necessary for participation in the Programme and for making payments. Without the data required to make the payment, remuneration is not paid out (see Terms and Conditions, § 6).

8. Automated decision-making

Your data is not used for automated decision-making producing legal effects, including profiling.

9. Contact

For questions regarding the processing of personal data: info@latwy-start.pl.

Privacy Policy (EN)