ATF PRO
pl Polski en English de Deutsch es Español

Privacy Policy of the ATFPRO.EU website

§1. General provisions

  1. This Privacy Policy sets out the rules for processing the personal data of Users of the website available at atfpro.eu (the “Website”).
  2. The Privacy Policy sets out how the personal data of Users necessary for the provision of services by electronic means through the atfpro.eu website are collected, processed and stored.
  3. The Website collects only the personal data necessary to provide and develop the services offered on it.
  4. Personal data collected through the Website are processed in accordance with:
    • Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the “GDPR”);
    • the Polish Act of 10 May 2018 on the Protection of Personal Data;
    • the Polish Act of 12 July 2024 – Electronic Communications Law.
  5. This Privacy Policy constitutes the performance of the information obligation referred to in Articles 13 and 14 of the GDPR and is informational in nature. The rules, rights and obligations of Users of the Website are set out in the Website Terms of Service, to which this Policy refers.
  6. The purpose of this Privacy Policy is to present, in a transparent manner, information concerning:
    • the controller of personal data;
    • the purposes and legal bases of data processing;
    • the scope of the data processed;
    • the recipients of personal data;
    • the rules for sharing data with authorised Distributors and the capacity in which the Distributors and Ravenol DE act in the processing of data;
    • data retention periods;
    • the rights of data subjects;
    • the rules for using cookies and similar technologies.
  7. Through the Website, the User may in particular:
    • register and maintain a user account;
    • activate a Device and indicate the Distributor to which the Device will be assigned;
    • create complaint tickets concerning an activated Device;
    • use technical materials and the knowledge base;
    • send a message to the Controller using the contact form;
    • send an enquiry concerning devices, adapters or other products to the relevant Distributor.
  8. The Website does not carry out online sales and does not allow orders to be placed online. The Quote Request form may be completed by a User or by a person who is not logged in. The person completing the form indicates the Distributor to which the enquiry is to be directed. The Controller provides the technical handling of the form and the transfer of its content to the selected Distributor outside the Website panel, in particular to the e-mail address indicated by the Distributor, and may record the fact that the enquiry was sent in the system logs. The further handling of the Quote Request is carried out by the Distributor as a separate controller of personal data. These rules are set out in §5.

§2. Data controller

  1. The controller of personal data is:

    RAVENOL Polska Sp. z o.o., ul. Chojnicka 61, 83-200 Starogard Gdański, Poland, VAT ID (NIP): 592-21-85-163, REGON: 220627540, KRS: 0000307750, entered in the register of entrepreneurs of the National Court Register kept by the District Court Gdańsk – Północ in Gdańsk, 7th Commercial Division of the National Court Register, share capital: PLN 50,000.00, e-mail: support@atfpro.eu, tel.: (+48) 58 775 01 15, hereinafter the “Controller”.

  2. The Website operates within the international distribution network for RAVENOL products. The country indicated during registration is the country in which the User conducts business. This information is not used to automatically assign the User or the Device to a Distributor, and providing it does not in itself result in the User’s data being shared with a Distributor. A specific Device is assigned to a Distributor only when the Device is activated, on the basis of the Distributor indicated by the User.

§3. Definitions

  • Controller – RAVENOL Polska Sp. z o.o. with its registered office in Starogard Gdański at ul. Chojnicka 61, 83-200 Starogard Gdański, entered in the register of entrepreneurs of the National Court Register under KRS number 0000307750, being the controller of the personal data processed through the Website.
  • Website – the online platform available at atfpro.eu together with all its functionalities, subpages and services provided by electronic means.
  • User – a natural person using the Website, acting as an entrepreneur (within their own business activity) or on behalf of or for the benefit of an entrepreneur, in particular a car workshop or a Distributor.
  • Distributor – an entrepreneur or another entity belonging to the authorised RAVENOL distribution network organised by Ravenol DE, which purchases Devices through Ravenol DE and may hold a Distributor Account on the Website, as well as a natural person authorised by such an entity to use the Website on its behalf, in particular its employee, associate or representative.
  • Ravenol DE – Ravensberger Schmierstoffvertrieb GmbH with its registered office in Werther, Jöllenbecker Str. 2, 33824 Werther, Germany, entered in the commercial register (Handelsregister) kept by the Amtsgericht Gütersloh under number HRB 5470, EU VAT number: DE813693380, the entity organising the international distribution network for RAVENOL brand products, which, as part of organising that network, obtains the data of persons representing Distributors and transfers them to the Controller in order to create and maintain Distributor accounts on the Website. Ravenol DE holds a Distributor Account on the Website and, as regards the use of the functionalities assigned to that Account, is subject to the rules concerning Distributors set out in this Policy. Ravenol DE is a separate controller of personal data as regards its own purposes, in particular maintaining relations with Distributors and Users and conducting commercial and marketing communication outside the Website, including the exclusive sending of the Newsletter on the basis of consents obtained through the Website.
  • Account – an individual User profile created on the Website enabling the use of functionalities that require registration.
  • Personal data – any information relating to an identified or identifiable natural person within the meaning of Article 4(1) of the GDPR.
  • Data processing – an operation or set of operations performed on personal data by automated or non-automated means, in particular the collection, recording, storage, organisation, modification, consultation, use, disclosure, restriction, erasure or destruction of data.
  • GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data.
  • Newsletter – a service provided by electronic means consisting in the periodic sending, exclusively by Ravenol DE, of information concerning the activities of the RAVENOL network, products, services, technical materials, training, industry events and other information related to the subject matter of the Website. The Controller does not send commercial or marketing information to Users or Distributors.
  • Cookies – IT data, in particular small text files, saved and stored on the User’s end device while using the Website.
  • President of the Personal Data Protection Office – the authority competent for personal data protection in the territory of Poland.
  • Device – a Ravenol brand device for dynamic oil exchange, in particular the ATF Professional device, manufactured by the Controller.
  • Terms of Service – the Terms of Service of the atfpro.eu Website, available on the Website.
  • Data Processing Agreement – the agreement on entrusting the processing of personal data referred to in Article 28 of the GDPR, concluded between the Controller and the Distributor.
  • Quote Request – an enquiry concerning devices, adapters, other products or commercial terms, addressed by the User through the Website to the selected Distributor and forwarded to that Distributor in order to prepare and submit an offer.

§4. Purpose of personal data processing

The Controller processes personal data for the following purposes:

  1. creating and operating an account (Article 6(1)(b) of the GDPR);
  2. providing services by electronic means (Article 6(1)(b) of the GDPR), in particular:
    • device activation,
    • handling complaint tickets,
    • making technical materials available,
    • providing access to the knowledge base,
    • enabling contact with Distributors;
  3. assigning a specific Device to the Distributor indicated by the User when activating that Device, and enabling the Distributor to take part in handling complaint tickets concerning Devices assigned to it on the Website, as well as to create and handle service tickets to the extent related to organising the servicing of those Devices (Article 6(1)(b) and (f) of the GDPR);
  4. using information about the country indicated by the User during registration for statistical and analytical purposes, in particular to analyse interest in the Website and the Devices in individual markets and to assess the development of the distribution network (Article 6(1)(f) of the GDPR);
  5. fulfilling legal obligations (Article 6(1)(c) of the GDPR);
  6. enabling the User and a person who is not logged in to address a Quote Request to the selected Distributor through the form available on the Website, the technical transfer of that enquiry to the Distributor and the recording on the Website of the fact that it was submitted (Article 6(1)(b) and (f) of the GDPR); the handling of the Quote Request and the further processing of the data contained in it are carried out by the Distributor as a separate controller, under the rules set out in §5;
  7. handling complaints (Article 6(1)(f) of the GDPR);
  8. ensuring the security of the Website (Article 6(1)(f) of the GDPR);
  9. presenting information about products and services on the Website, without addressing marketing communication to the User by e-mail, SMS or telephone calls (Article 6(1)(f) of the GDPR);
  10. collecting and recording consent to receive the Newsletter and transferring it, together with contact details, to Ravenol DE, which sends the Newsletter as a separate controller (Article 6(1)(a) of the GDPR);
  11. creating and maintaining Distributor accounts on the Website and managing the network of authorised Distributors, including verifying the Distributor’s entitlement to use the Website (Article 6(1)(b) and (f) of the GDPR);
  12. organising and maintaining the distribution network and ensuring that only authorised entities have access to the Website (Article 6(1)(b) and (f) of the GDPR);
  13. documenting the acceptance of the Terms of Service and of the declarations and consents made on the Website, including demonstrating that consent was given (Article 6(1)(c) of the GDPR in conjunction with Article 7(1) of the GDPR);
  14. examining reports concerning illegal content and performing the obligations arising from Regulation (EU) 2022/2065 (Article 6(1)(c) of the GDPR).

§5. Role of the entities involved in data processing

  1. The Controller operates the Website and is responsible for its maintenance and functioning, including maintaining User accounts and processing the personal data connected with the use of the Website.
  2. In order to ensure support for Users in individual countries, the Controller cooperates with a network of authorised distributors of RAVENOL brand products and devices.
  3. When registering an account, the User indicates the country in which they conduct business. This information may also be used by the Controller for statistical and analytical purposes, in particular to assess interest in the Website and the Devices in individual markets and the development of the distribution network. Indicating the country does not serve to determine the Distributor, is not linked to the place where the Device is used or purchased and does not in itself result in the User’s data being transferred to a Distributor.
  4. A specific Device is assigned to a Distributor when the Device is activated on the Website, on the basis of the Distributor indicated by the User. Creating an Account alone does not constitute the activation of a Device and does not result in the User being assigned to a Distributor.
  5. Within the functionalities available for the Distributor Account, the Controller may enable the Distributor to create service tickets concerning Devices within its distribution and to process the data necessary to create and further handle such a ticket. The scope of the data and the manner of handling tickets depend on the functionalities of the Website currently made available. The Controller does not provide the Distributor with access passwords to User Accounts.
  6. As regards the data made available to the Distributor in connection with handling complaint tickets concerning Devices and – if that functionality is available – service tickets created by the Distributor, the Distributor processes the data solely on the documented instructions of the Controller and solely to the extent necessary to perform those functionalities. In this respect, the Distributor is a processor within the meaning of Article 4(8) of the GDPR, and the basis for the processing is the Data Processing Agreement meeting the requirements of Article 28 of the GDPR. The entrustment does not cover the data contained in a Quote Request, referred to in clauses 10 and 11.
  7. The Distributor is not entitled to use the User data received through the Website for its own purposes, in particular marketing, commercial or analytical purposes, or to combine them with data processed by it for other purposes. The preceding sentence does not apply to the data contained in a Quote Request, which the Distributor processes on its own account as a separate controller, in accordance with clauses 10 and 11.
  8. If the Distributor starts processing the User’s data for its own independent purposes – on a separate legal basis and outside the scope of the entrustment – it acts in this respect as a separate controller of personal data, independently determines the legal basis for the processing, independently performs the information obligations towards the User, in particular the obligation set out in Article 14 of the GDPR, and bears independent liability for the lawfulness of such processing.
  9. The Controller is not liable for the manner in which the Distributor processes personal data in the case referred to in clause 8, if the Distributor processes those data as a separate controller and independently determines the purposes and means of their processing.
  10. Unlike in the cases referred to in clauses 5–7, the data contained in a Quote Request are transferred to the Distributor indicated by the person completing the “Request a quote” form, which is available on the Website also without logging in to an Account. The Controller manages the Website and is responsible for the technical transfer of the enquiry and for recording on the Website the fact that it was submitted, whereas the handling of the Quote Request, including the preparation and submission of the offer and further commercial contact with the User, is carried out by the Distributor on its own account and for its own purposes. In this respect, the Distributor is a separate controller of personal data within the meaning of Article 4(7) of the GDPR, and not a processor, and this processing is not covered by the Data Processing Agreement.
  11. As a separate controller, the Distributor independently determines the purposes and means of processing the data contained in a Quote Request, independently determines the legal basis for the processing and the retention period for those data, independently performs towards the data subject, including the User or the person not logged in who submits the Quote Request, the information obligation referred to in Article 13 or Article 14 of the GDPR, independently examines requests concerning the rights indicated in §13 and bears independent liability for the lawfulness of that processing. The Controller is not liable for the processing of data by the Distributor in this respect. The Controller remains the controller of the data recorded on the Website in connection with the submission of a Quote Request, to the extent indicated in §7.
  12. Ravenol DE is a separate controller of personal data as regards its own purposes, in particular maintaining relations with Distributors and conducting commercial and marketing communication towards Distributors and Users outside the Website, including sending the Newsletter. The rules for transferring and sharing data between the Controller and Ravenol DE are set out in a separate arrangement concluded between those entities.
  13. Ravenol DE holds a Distributor account on the Website. To the extent that it uses the Website as a Distributor and obtains access to the data of Users of the Devices assigned to it, clauses 5–11 apply to it.

§6. When providing data is required

  1. Providing data is voluntary; however, to the extent marked on the Website as required, it is a condition for using a given functionality of the Website:
    • User account registration – without the data marked with an asterisk we will not create an account; without an account it is not possible to activate a device or submit a complaint ticket;
    • device activation – without the serial number, the registration code and the indication of a Distributor, activation is not possible and, consequently, the warranty period will not start;
    • a User’s complaint ticket – without a description and device details it will not be possible to examine the case;
    • where the functionality of creating service tickets is made available to the Distributor – providing the data required in the form will be necessary to create and further handle such a ticket;
    • contact form – without an e-mail address we will not reply to the message; quote request – without an e-mail address or telephone number the selected Distributor will not be able to answer the enquiry;
    • marketing consents and consent to analytical cookies – these are entirely voluntary and their absence does not limit the use of the website or the possibility of creating an Account (Article 7(4) of the GDPR).

§7. Scope of the data processed

  1. The Controller may process the following data:
    1. Identification data: first name and surname, company name, tax identification number (NIP), business address;
    2. Contact details: e-mail address, telephone number, correspondence address, website address;
    3. Account data: login, login history, IP address, device identifiers;
    4. Device data: device serial numbers, activation history, history of complaint or service tickets, activation date and the warranty status and dates of the Device;
    5. Communication data: the content of correspondence, technical tickets, complaints, quote requests – to the extent that they are transferred and recorded on the Website (§5(10) and (11));
    6. Organisational data: the country selected during registration, the Distributor assigned to a specific Device, the user role, the account identifier;
    7. Distributor account data: business name, e-mail address, telephone number, registered office address, postal code, town, country, tax identification number (NIP or the corresponding identification number), website address and the role or scope of authorisations of the person using the Distributor Account;
    8. Technical data contained in system logs: IP address, date and time of login, session identifier, device identifier, information about the operations performed, information necessary to activate devices, information concerning service tickets, data necessary to ensure the security of the Website;
    9. Data concerning declarations and consents: the content and version of the accepted document, the scope of the consent given, the date and time of it being given or withdrawn, and the identifier of the Account and the User.
  2. Account access passwords are stored in a form that makes them impossible to read and are not shared with Distributors, Ravenol DE or other recipients.

§8. Data recipients

  1. Data may be transferred to:
    • hosting service providers,
    • IT service providers,
    • entities providing servicing support,
    • entities providing accounting or legal services,
    • e-mail operators,
    • Ravenol DE and entities providing Newsletter distribution services to it – to the extent covered by the consent referred to in §17,
    • public authorities, where required by law,
    • providers of analytical tools – as regards the data collected using analytical cookies and only after the User has given consent.
  2. Users’ personal data may be entrusted or made available to the Distributor to the extent necessary to handle complaint tickets concerning the Devices assigned to that Distributor. If the Website enables the Distributor to create service tickets on its own, the Distributor may also receive the data necessary to create and handle such tickets.
  3. The data contained in a Quote Request are made available to the Distributor selected by the person completing the form, who processes them as a separate controller under the rules set out in §5(10) and (11).
  4. The extent to which the Distributor processes data as a processor acting on the Controller’s instructions and the extent to which it does so as a separate controller are set out in §5(6)–(11).
  5. The Controller is responsible for the lawfulness of entrusting and making personal data available to the Distributor, whereas the Distributor is responsible for the further processing of the data on its own account as a separate controller.
  6. We exchange data with Ravenol DE to the extent necessary to run the network of authorised Distributors, in particular the data of persons representing Distributors for whom we create accounts on the Website, and – to the extent covered by consent – the data of Users and Distributors necessary for Ravenol DE to conduct marketing communication, including sending the Newsletter.

§9. The Distributor’s role – information for the User

  1. The Distributor to which your device has been assigned may process your data to the extent necessary to take part in handling a complaint ticket concerning that Device. In this respect it acts on the basis of the Data Processing Agreement concluded with us and may not use your data for its own purposes, in particular marketing purposes. If a functionality is made available on the Website enabling the Distributor to create service tickets on its own concerning Devices within its distribution, the Distributor may also process the data necessary to create and handle such a ticket. This means that:
    • information about the processing of your data in connection with device support is provided by us, in this Policy – the Distributor does not have to maintain its own information notice in this respect;
    • if the Distributor starts using your data for its own purposes, on its own legal basis, it is an independent controller in this respect and will itself provide you with information about the processing – directly, for example in an e-mail message, in an information document, in a form or on its website;
    • you exercise your rights – access to data, rectification, erasure, restriction of processing, objection – towards us, as we remain the controller of those data; if you submit a request directly to the Distributor, it will forward it to us. This does not apply to the data you provide in a Quote Request – in this respect you exercise your rights towards the Distributor (clause 2).
  2. The situation is different with a Quote Request. When you send a quote request, your data go through the Website directly to the Distributor selected by you, and it handles that enquiry on its own account and for its own purpose – as an independent controller of your data. This means that in this respect it is the Distributor that decides how it uses your data and how long it stores them, it will itself provide you with information about their processing, and you exercise your rights – access to data, rectification, erasure, restriction of processing and objection – towards it. We are not responsible for the way in which the Distributor processes those data. We do, however, remain the controller of the data on the very fact that the enquiry was submitted, as recorded on the Website.
  3. Ravenol Polska sp. z o.o. agrees with Distributors the rules for using the data made available, in particular the permissible scope of use of the data, the obligation of confidentiality and the restrictions on using the data for marketing purposes. Those rules include an agreement on entrusting the processing of personal data to the extent referred to in §5(6). The rules concerning the data contained in Quote Requests, processed by the Distributor as a separate controller, are set out in §5(10) and (11).

§10. Data of persons representing Distributors, obtained from a source other than those persons

  1. Distributor accounts are created by the Controller on the basis of the data of persons representing the Distributor, transferred to the Controller by Ravenol DE. Those data are not obtained from the data subject. The Distributor does not register on the Website on its own.
  2. The controller of those data is the entity indicated in §2.
  3. The source of the data is Ravenol DE. The data do not come from publicly available sources. The rules for transferring those data are set out in the arrangement concluded between the Controller and Ravenol DE.
  4. Categories of data: first name and surname, business e-mail address, business telephone number and the data of the Distributor on whose behalf the person uses the Website, in particular its name.
  5. The recipients of the data are the entities indicated in §8.
  6. We store the data for the period during which the person represents a Distributor holding an account on the Website, and subsequently for the period indicated in §12 for data processed for the purpose of defending claims.
  7. The data subject has the rights described in §13, including the right to object described in §14.
  8. The Controller provides the information indicated in clauses 2–7 no later than within one month of receiving the data from Ravenol DE and, if the data are to be used to communicate with that person, no later than at the time of the first such communication, in particular in the message inviting them to activate the account.

§11. Transfers of data outside the European Economic Area

  1. The Controller transfers personal data outside the European Economic Area only where necessary and while ensuring the level of protection required by Chapter V of the GDPR.
  2. The User’s personal data may be transferred outside the EEA in connection with being made available to the Distributor indicated by the User, if that Distributor has its registered office in a third country. If the Distributor processes the data as a processor, the transfer takes place on the terms set out in the Data Processing Agreement and using a mechanism provided for in Chapter V of the GDPR, in particular standard contractual clauses. If the Distributor processes the data as a separate controller, in particular as regards a Quote Request, the transfer takes place using a mechanism provided for in Chapter V of the GDPR, in particular the standard contractual clauses applicable to transfers of data between controllers.
  3. Data are transferred outside the EEA, among other things, in connection with the use of Google Analytics 4 provided by Google LLC, where the User consents to analytical cookies. The following are transferred: the cookie identifier, a truncated IP address, information about the device and browser and about how the Website is used.
  4. The basis for the transfer referred to in clause 3 is Commission Implementing Decision (EU) 2023/1795 of 10 July 2023 on the adequate level of protection of personal data under the EU–US Data Privacy Framework (Article 45 of the GDPR), to the extent that the recipient is included on the list of participants in that framework. In the absence of such an entry, the transfer takes place on the basis of the standard contractual clauses adopted by the European Commission (Article 46(2)(c) of the GDPR).
  5. Transfers of data to the United Kingdom take place on the basis of Commission Implementing Decision (EU) 2021/1772 of 28 June 2021 (Article 45 of the GDPR), which under its Article 4 expires on 27 December 2031 unless its period of application is extended; the transfer does not require additional safeguards.
  6. If the Controller intends to transfer data outside the EEA in cases other than those indicated in clauses 2–5, it will provide information about this by updating the Policy before such transfers commence.

§12. Data retention period

  1. The period for which the Controller processes data depends on the type of service provided and the purpose of the processing. As a rule, data are processed for the duration of the service, until consent is withdrawn or until an effective objection is raised against the processing where the legal basis for the processing is the legitimate interest of the Controller. Data connected with device activation and the warranty – regardless of whether the account is deleted – are stored until the end of the warranty period and the expiry of the limitation period for claims. The basis for retaining those data after the Account is deleted is Article 17(3)(e) of the GDPR.
  2. The processing period may be extended where the processing is necessary to establish and pursue possible claims or to defend against claims, and thereafter only in the cases and to the extent required by law. After the processing period has elapsed, the data are irreversibly erased or anonymised. The retention period for the data contained in a Quote Request by the Distributor acting as a separate controller (§5(10) and (11)) is determined independently by that Distributor.
  3. We store the data concerning declarations and consents referred to in §7(9) until the expiry of the limitation period for claims, in order to demonstrate that they were given (Article 7(1) of the GDPR).

§13. Rights of data subjects

  1. Every person has the right to (on the terms set out in Chapter III of the GDPR):
    • access to their data,
    • rectification of their data,
    • erasure of their data,
    • restriction of processing,
    • data portability,
    • object to the processing,
    • withdraw consent at any time,
    • lodge a complaint with the President of the Personal Data Protection Office.
  2. Requests may be addressed to the e-mail address or the registered office address of the Controller indicated in §2. To the extent that a request concerns processing carried out by the Distributor as a separate controller or by Ravenol DE, we forward it to the relevant entity and inform the person submitting the request accordingly.

§14. Right to object

  1. Irrespective of the above, a data subject is entitled to object to processing carried out on the basis of the legitimate interest of the Controller.
  2. In such a case:
    • if the personal data are processed for marketing purposes – the Controller will immediately cease such processing;
    • if the basis for the processing is an interest of another kind – the Controller will cease such processing unless it is demonstrated that that interest overrides the interests, rights and freedoms of the data subjects, or that there are grounds for the establishment, exercise or defence of claims.
  3. The right to object may be exercised in particular by sending a relevant statement to the registered office address or the e-mail address of the Controller.

§15. Complaint to the supervisory authority

  1. If a data subject considers that the processing of personal data infringes the applicable regulations, they may lodge a complaint with the supervisory authority, i.e. the President of the Personal Data Protection Office.
  2. The Controller has not appointed a data protection officer, as the conditions set out in Article 37(1) of the GDPR are not met. For all matters concerning the processing of personal data and the exercise of the rights described in §13, please contact the Controller at the address indicated in §2.

§16. Cookies

  1. What cookies are used for on the Website:
    • the Controller uses cookies primarily to enable the User to access the Website and to make it easier for the User to use it;
    • the Controller also uses cookies for analytical and marketing purposes – but only where the User consents to this on first entering the Website;
    • the Controller also uses other technologies and technical solutions allowing access to information stored on the User’s device or in the User’s browser.
  2. The basis for using cookies and similar technologies other than those necessary to provide the service is the User’s consent referred to in Article 399 of the Act of 12 July 2024 – Electronic Communications Law. Cookies necessary to provide the service requested by the User do not require consent.
  3. The User may manage cookie settings themselves using their web browser.
  4. Restricting the use of cookies may affect the operation of some functionalities of the Website.
  5. The User may at any time:
    • change the settings concerning cookies;
    • withdraw consent previously given;
    • delete stored cookies using their web browser settings.
  6. The Controller uses Google Analytics 4 to analyse how the Website is used and to optimise it. The tool is launched only after the User has consented to the use of analytical cookies. Withdrawing consent is as easy as giving it (Article 7(3) of the GDPR).

§17. Newsletter and commercial information

  1. Ravenol DE may send Users and Distributors commercial information outside the Website, through electronic communication channels: e-mail — including in the form of the Newsletter. The Website serves solely to collect, record and transfer to Ravenol DE the relevant consents and the data covered by those consents. The Controller does not send commercial information to Users or Distributors and does not conduct its own marketing communication.
  2. The Newsletter is a form of commercial information sent by e-mail and contains commercial, marketing, technical and educational information concerning the Devices and the related products, services, accessories, consumables, promotions, training, events and other information connected with their use and with the RAVENOL brand offering in this respect.
  3. Sending Commercial Information requires the prior consent of the recipient, in accordance with Article 398(1) of the Act of 12 July 2024 – Electronic Communications Law. This requirement applies regardless of whether the recipient is a natural person or an entrepreneur. The basis for processing personal data for this purpose is consent (Article 6(1)(a) of the GDPR).
  4. Consent to receive commercial information, including the Newsletter, is given to Ravenol DE and covers sending it by e-mail. The consent is independent of acceptance of the Terms of Service, and giving it is voluntary and is not a condition for creating an Account or using the Website.
  5. Ravenol DE is the controller of the personal data processed for the purpose of sending Commercial Information, including the Newsletter, and independently performs the information obligations towards the recipient, in particular the obligation set out in Article 14 of the GDPR. The Controller processes those data solely in order to collect and record the consent, transfer it to Ravenol DE and handle its withdrawal.
  6. Consent is given when creating an Account or at the first login to the Account, and also at any time in the Account settings — by ticking a separate checkbox for each channel. In the case of a Distributor Account created by the Controller, consent may be given at the first login. Subscription to the Newsletter is available only to Users holding an Account on the Website.
  7. Providing an e-mail address or a telephone number when creating an Account does not constitute the consent referred to in Article 398(2) of the Electronic Communications Law. Those data are provided to the Controller in order to create and maintain the Account and not in order for Ravenol DE to send Commercial Information. Creating an Account or using the Website is not in itself treated as consent.
  8. In connection with the consent, the Controller processes the e-mail address, the first name and surname if provided, and the designation of the entrepreneur on whose behalf or for whose benefit the User acts.
  9. The Controller records the content and version of the consent clause, the channel covered by the consent, the date and time of it being given and withdrawn, as well as the identifier of the Account and the User, and transfers this information to Ravenol DE (Article 7(1) of the GDPR).
  10. The data of persons who have given consent are transferred to Ravenol DE to the extent covered by the consent. Making the address database available to Ravenol DE, including enabling it to be downloaded from the Distributor account maintained for Ravenol DE, covers only the data of persons who have given consent and only to the extent covered by the consent.
  11. Consent may be withdrawn at any time, as easily as it was given (Article 7(3) of the GDPR) — using the functionalities of the Website, using the unsubscribe link contained in the message, by a request addressed directly to Ravenol DE or by sending a request to the Controller’s e-mail address. Withdrawing consent does not affect the lawfulness of the processing carried out before its withdrawal.
  12. Withdrawing consent for one channel does not affect the consents given for the other channels.
  13. If consent is withdrawn, the Controller transfers this information to Ravenol DE in order to stop further mailings, and the User’s data are removed from the database used for mailings, except for the data necessary to demonstrate that consent was given and withdrawn and the data whose further storage is necessary under the law or for the establishment, exercise or defence of claims.
  14. Every item of Commercial Information sent by e-mail is clearly distinguished and marked in a manner leaving no doubt that it is commercial information, and includes the designation of Ravenol DE as the entity on whose behalf it is disseminated, together with its electronic addresses, in accordance with Article 9 of the Act on Providing Services by Electronic Means.
  15. Data processed for the purposes of Commercial Information, including the Newsletter, are stored until consent is withdrawn. Data confirming that consent was given and withdrawn are stored until the expiry of the limitation period for claims.

§18. System logs and security

  1. The Website records system logs. They may contain the IP address, information about the browser and device, the date and time of the event, and the account identifier – solely to the extent necessary to ensure the security of the website, protect the account, verify access, handle device activation and service tickets and perform the other functions of the website.
  2. The Website applies technical and organisational measures appropriate to the risk, in particular: role-based access control, limiting the number of concurrent sessions and trusted devices per account, storing ticket attachments in a non-public directory with verification of permissions on every download, verifying the actual content of uploaded files and encrypting transmissions.

§19. Final provisions

  1. The Controller has the right to make changes to the Privacy Policy, provided that the rights of Users are not limited.
  2. Information about the changes made will appear in the form of a notice available on the Website. The Controller also informs Users holding an Account about significant changes at the e-mail address assigned to the Account.
  3. In matters not regulated by this Privacy Policy, the provisions of the GDPR and Polish law apply.
  4. The Privacy Policy is effective from 4 September 2026.
  5. The Policy is available in the interface languages of the website. In the event of any discrepancy between the language versions, the Polish version prevails.