Effective date: 04.05.2021

1. INTRODUCTION

1. This privacy policy defines the manner in which inSTREAMLY uses personal data of the users visiting our websites, interacting with us and using our services. It also informs the users what rights they have and how they are protected by the law.
2. It is important for every user to read this privacy policy in order to be able to use the websites and services of inSTREAMLY in an informed manner (including the knowledge on how data are used and why they are used).
3. If you have any questions or you would like to exercise your right to privacy, you should follow the instructions contained in this privacy policy. The inSTREAMLY team is available to help you.

2. DATA CONTROLLER

1. Your personal data are controlled by inSTREAMLY P.S.A (simple joint-stock company) with its registered office in Warsaw, Poland, ul. Williama Heerleina Lindleya 16, 02-013 Warsaw, entered in the Register of Entrepreneurs of the National Court Register by the District Court for the Capital City of Warsaw in Warsaw, 12th Commercial Division of the National Court Register under KRS number: 0000953481, NIP [Tax No.]: (PL)7010954779. You can contact inSTREAMLY in the following manner: contact@instreamly.com.

3. STATEMENT ON THE COPPA

1. The website and the services of inSTREAMLY contain information which is not addressed to children (persons below the age of 13). This website as well as services and websites related thereto (including services and websites of partners of inSTREAMLY) are not intended for children, and inSTREAMLY does not knowingly collect data about children.

4. DATA BEING COLLECTED

1. inSTREAMLY collects various information about its customers and guests when it is provided to inSTREAMLY or when the users use services of inSTREAMLY or when inSTREAMLY collects such information from another source. Collected data can be assigned to the following categories:

   Identification data	First name and surname, platform, user name on that platform and profession (source of generated traffic). In the case of contact through social media – also the user name in these media.
   Contact data	First name and surname, user name. In the case of contact through social media – also the user name in these media. If you subscribe to the newsletter, Contact data refers only to the provided name and email address.
   Data related to image	Image of a person who has concluded a contract with inSTREAMLY (lease of advertising space).
   Financial data	Bank account number.
   Technical data	Internet protocol address (IP), browser type and version, settings and location of the time zone, types and versions of browser plug-ins, operating system and platform, other technologies applied in devices employed by the user in order to access this website.
   User data	Information about the manner of use of the website or services (tracking of behaviour).
   Tracking data	Information that is collected about the user by inSTREAMLY or other entities using cookies and similar tracking technologies, such as web beacons, pixels and mobile device identifiers.

2. inSTREAMLY collects, shares and uses Aggregated data (statistical or demographic data), which, nonetheless, do not constitute personal data. If these data are merged by inSTREAMLY with data allowing for the user identification, aggregated data are treated by inSTREAMLY as personal data.
3. inSTREAMLY does not collect sensitive data (data of special category), including data revealing one’s racial or ethnic origin, religious beliefs, data concerning sexual life and orientation, political views, information about health and diseases as well as biometric and genetic data.
4. If the user decides not to share some data with inSTREAMLY, it may result in the inability to perform serviced provided by inSTREAMLY. In the event when the consent is required by the law, it is always voluntary. However, when processing data, inSTREAMLY does not rely only on the user’s consent, but also on other bases for data processing.

5. MANNER OF DATA COLLECTION

1. inSTREAMLY uses various methods of personal data collection, that is:

   Direct interactions	The user provides data directly to inSTREAMLY. The provision is performed upon registration (conclusion of a contract), contact by mail or by phone and contact through social media, or upon performance of the contract (lease of advertising space). In this manner, we collect Identification data, Contact data, Data related to image and Financial data.
   Automated activities	Data are collected automatically during interactions with inSTREAMLY (also through the website) by cookies and analytic tools. In this manner, we collect Technical data, User data and Tracking data. We may also collect Aggregated data. In automated activities, we only use Google Analytics and Hotjar.
   From third parties	GENKI.ME uses YouTube API Services. Users using websites and solutions provided by YouTube API Services are bound by and are obligated to comply with the YouTube's Terms of Service (available at www.youtube.com/t/terms), and their data are processed in accordance with Google's Privacy Policy (available atwww.google.com/policies/privacy). Users, in addition to the rights provided for in this policy (section 13), can revoke inSTREAMLY's access to use the data via Google's security settings page (available atsecurity.google.com/settings/security/permissions).

6. MANNER OF USE OF DATA

1. The manner of use of data by inSTREAMLY is contingent upon the purpose for which these data have been provided or obtained:

   If we perform a contract which has already been concluded or if we want to conclude a contract.	For example, if the user logs in to lease advertising space.
   If it is justified by the interests of inSTREAMLY or by the interests of third parties, and the interests of the user do not override them.	For example, if we have a reasonable suspicion of fraud; if inSTREAMLY wants to inform the user about new services.
   If inSTREAMLY must perform a legal obligation imposed on it.	For example, for the purpose of tax settlement.

   However, as a rule, inSTREAMLY uses data for the purpose of:
   a. performance of services provided by electronic means, and in the case of users with whom a contract has been concluded – also for the purpose of performance of that contract; b. performance of other services; c. handling of inquiries, requests and orders; d. marketing activities (marketing of own products); e. analysis and improvement of the functioning of websites and services provided by inSTREAMLY; f. development, repair or tests of various functionalities;

7. LEGAL BASIS FOR DATA COLLECTION. RETENTION

1. inSTREAMLY may process personal data on the following legal bases:

   Performance of a contract or action prior to its conclusion	Article 6(1)(b) of the GDPR. Data are retained for a period that is necessary for the contract to be performed, terminated or otherwise dissolved.	Identification data, Contact data, Data related to image and Financial data
   Direct marketing	Article 6(1)(f) of the GDPR. Data are stored for the period of existence of a legitimate interest pursued by inSTREAMLY, however, if you exercise your right to object or you withdraw your consent to receive our newsletter, no longer than for the period of limitation of claims after such action. The limitation period is defined by the law, in particular, by the provisions of the Civil Code (the basic limitation period for claims related to conducting business activity is three years, and in the case of a sales contract - two years). inSTREAMLY cannot process data for the purpose of direct marketing if the data subject effectively objects to it.	Contact data
   Keeping accounts	Article 6(1)(c) of the GDPR in conjunction with Article 74 paragraph 2 of the Accounting Act. Data are stored for a period required by the legal provisions obliging inSTREAMLY to maintain accounts (five years calculated from the beginning of the year following the financial year concerned by the data).	Identification data, Contact data and Financial data, NIP [Tax No.]
   Responding to an inquiry	Article 6(1)(f) of the GDPR. Data are stored for the period of existence of a legitimate interest pursued by inSTREAMLY, however, no longer than for a period necessary to respond to inquiries sent.	Identification data, Contact data
   Determining, pursuing or defending against claims	Article 6(1)(f) of the GDPR. Data are stored for the period of existence of a legitimate interest pursued by inSTREAMLY, however, no longer than for the period of limitation of claims in relation to the data subject. The limitation period is defined by the law, in particular, by the provisions of the Civil Code (the basic limitation period for claims related to conducting business activity is three years, and in the case of a sales contract – two years).	Identification data, Contact data and Financial data, NIP [Tax No.]
   Ensuring security, data protection and protection against fraud	Article 6(1)(f) of the GDPR. Data are stored for the period of existence of a legitimate interest pursued by inSTREAMLY, however, no longer than for the period of limitation of claims in relation to the data subject. The limitation period is defined by the law, in particular, by the provisions of the Civil Code (the basic limitation period for claims related to conducting business activity is three years, and in the case of a sales contract – two years).	Identification data, Contact data, Data related to image and Financial data
   Creation of a public profile	Article 6(1)(f) GDPR. Data are stored for the period of existence of a legitimate interest pursued by inSTREAMLY, however, if you exercise your right to object or you will terminate the agreement (lease of advertising space), no longer than for the period of limitation of claims after such action. The limitation period is defined by the law, in particular, by the provisions of the Civil Code (the basic limitation period for claims related to conducting business activity is three years, and in the case of a sales contract - two years). inSTREAMLY cannot process data for the purpose of creating of the public profile if the data subject effectively objects to it. The public profile will be created with the conclusion of a contract with inSTREAMLY (lease of advertising space).	Identification data, Data related to image

8. THE RIGHTS OF DATA SUBJECTS

1. The data subject (the user) has the following rights:

   The right of access, rectification, limitation, erasure or portability	The data subject has the right to request the following from inSTREAMLY: access to their personal data, their rectification, erasure (“the right to be forgotten”) or limitation of their processing, the right to object to their processing and the right to data portability. The detailed conditions of exercising the aforementioned rights are indicated in Article 15-21 of the GDPR.
   The right to withdraw the consent at any time	The person whose data are processed by inSTREAMLY based on the consent given (pursuant to Article 6(1)(a) or Article 9(2)(a) of the GDPR) has the right to withdraw the consent at any time without affecting the legitimacy of the processing performed based on the consent prior to its withdrawal. To withdraw your consent simply write to us at contact@genki.me.
   The right to lodge a complaint with the supervisory body	The person whose data are processed by inSTREAMLY has the right to lodge a complaint with the supervisory body in the manner and mode defined in the provisions of the GDPR and the Polish law, in particular, the Act on Personal Data Protection. The President of Personal Data Protection Office is the supervisory body in Poland.
   The right to object	At any time, the data subject has the right to object – for reasons related to their specific situation – to the processing pertaining to their personal data based on Article 6(1)(e) (public interest or tasks) or (f) (legitimate interest), including profiling based on these provisions. In such an event, inSTREAMLY will no longer be able to process such personal data, unless it proves the existence of important, legitimate grounds for the processing, overriding the interests, rights and freedoms of the data subject, or any grounds for determining, pursuing or defending claims.
   The right to object to direct marketing	If personal data are processed for the purpose of direct marketing, the data subject has the right to object, at any time, to the processing pertaining to their personal data for the purposes of such marketing, within the scope in which the processing is related to such direct marketing.

2. The exercise of rights of the data subject is performed by contacting inSTREAMLY using the contact details indicated in the introduction to the policy.

9. PROFILING

1. inSTREAMLY does not perform profiling.

10. DATA PROVISION

1. As a rule, data collected by inSTREAMLY are not shared with third parties. However, inSTREAMLY may:
   a. share data of persons who have concluded a contract with inSTREAMLY (lease of advertising space) with advertisers at the stage of their deciding about cooperation with inSTREAMLY, as well as information about the implemented campaigns;
   b. share data of persons who have used the services of inSTREAMLY with entities supporting inSTREAMLY in the provision of services, such as payment processors or providers of analytic tools (e.g. Google Analitycs);
   c. provide data to law enforcement authorities, supervisory bodies, entities performing public tasks or other entities, if the obligation to provide data results from the legal provisions.
   The provision of data must always be performed based on the legal provision or the relevant contract (outsourcing of personal data processing).

2. Data may be shared outside the European Economic Area, whereby inSTREAMLY ensures that adequate security measures are provided. In particular, inSTREAMLY concludes the relevant contracts (standard contractual clauses) in order to secure personal data being transmitted, and provides data to those countries for which the European Commission has issued a decision acknowledging the appropriate level of protection.

11. COOKIES AND ANALYTICS

1. Cookies consist in small text information in the form of text files which are sent by the server and saved on the side of the person visiting websites (e.g. on the hard disk of a computer or laptop or on the smartphone memory card – depending on the device employed by the user).
2. As a standard, most web browsers available in the market accept saving cookies by default. Everyone is able to define the conditions of using cookies by means of settings of their web browser. This means that the possibility of saving cookies may be e.g. partially limited (e.g. in time) or totally disabled – however, in the latter case, it may affect some functionalities of websites.

3. inSTREAMLY uses the following cookies:
   a. Google Analytics
   b. Hotjar
   These files are necessary for traffic analysis and are not essential for the proper functioning of websites of inSTREAMLY. inSTREAMLY offers an easy way to disable these files.

4. Google Analytics - inSTREAMLY uses the services of Google Analytics and its functions provided by Google Inc. (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). These services support inSTREAMLY in analysing and enhancing its websites and the services provided through them. Along with advertising functions, Google Analytics employs cookies to analyse the manner of use of websites. The data received are processed in an aggregate and anonymous manner (which means that they prevent identification of a given person. However, these data may be merged with other data. Then, they constitute personal data for inSTREAMLY ). Everyone may block the transfer of data from electronic devices to Google Analytics by downloading and installing a free browser plug-in available here. More information about the Google Analytics tool is available here.
5. Hotjar - inSTREAMLY uses the services of Hotjar provided by Hotjar Ltd (address of the registered office: St Julian's Business Centre, 3, Elia Zammit Street, St Julian's STJ 1000, Malta), which monitors and records behaviour on websites. This tool records data pertaining to such behaviour as: navigation, page scrolling, cursor movement. Information about the location, operating system, browser or cookies are also collected. The data received are processed in an aggregated and anonymous manner (which means that they prevent the identification of a given person. However, these data may be merged with other data. Then, they constitute personal data for inSTREAMLY ). The activity measured by Hotjar may be disabled by using the functionality available here (https://www.hotjar.com/opt-out). More information about the Hotjar tool is available here (https://www.hotjar.com/privacy/).