Privacy policy
Controller
The controller of personal data processed in connection with the operation of the website restonim.com and the running of the waiting list is Jarosław Olejarz, conducting business activity under the business name KANCELARIA RADCY PRAWNEGO JAROSŁAW OLEJARZ, ul. Marii Skłodowskiej-Curie 44/3, 40-057 Katowice, Poland, NIP: 6281521276.
Contact with the Controller on personal data protection matters: office@restonim.com.
The Controller has not appointed a data protection officer. On personal-data matters you can also write to the Controller’s postal address. The company planned for the future development of RESTONIM is not a data controller.
Scope of this policy
This policy covers the website restonim.com, including the RESTONIM waiting list. It does not cover the RESTONIM software, for which separate information will apply.
Purposes, legal bases and data
- Use of the website — IP address, date and time, the page visited and browser information, processed by the hosting provider in order to deliver the website and keep it secure (for example, protection against attacks). Basis: our legitimate interest (Article 6(1)(f) GDPR). We keep no visitor logs or statistics of our own.
- Waiting list — performance of a contract — e-mail address, chosen language, dates of sign-up and confirmation, sign-up status, the version of the declarations made and hashes of the confirmation and unsubscribe links, processed in order to accept the sign-up, send the confirmation messages and run the list under the Terms. Basis: performance of a contract (Article 6(1)(b) GDPR).
- Commercial information about RESTONIM — e-mail address and language, processed in order to send commercial information, including offers, relating exclusively to the RESTONIM software, in particular information about its availability. Basis: your consent (Article 6(1)(a) GDPR), given also as consent to receiving commercial information by e-mail (Article 398 of the Polish Act of 12 July 2024 — Electronic Communications Law).
- Protection against abuse — a hash of the IP address, calculated from the IP address and a secret key (the IP address itself is not stored in the list database), and attempt counters, processed in order to limit the number of sign-ups and protect the form. Basis: our legitimate interest (Article 6(1)(f) GDPR).
- Accountability — records of events (sign-up, confirmation, unsubscription, deletion) with their date and the version of the declarations, without the e-mail address, and a delivery log without the recipient address, processed in order to demonstrate the course of the sign-up and that consent was given and withdrawn (Article 7(1) GDPR) and to detect delivery errors. Basis: our legitimate interest (Article 6(1)(f) GDPR).
- Correspondence — the data contained in messages sent to us, including replies to waiting-list messages and automatic non-delivery notifications, processed in order to deal with them. Basis: our legitimate interest (Article 6(1)(f) GDPR) and, where the message concerns the contract, its performance (Article 6(1)(b) GDPR).
Waiting list
You can join the waiting list on the Waiting list page. The form contains two separate boxes, not ticked by default: acceptance of the Terms and consent to receiving commercial information about RESTONIM. Accepting the Terms is not marketing consent. Both boxes are required because the list consists solely of sending information about RESTONIM. The list is intended only for people aged 18 or over: we do not collect dates of birth; being at least 18 is confirmed in the box accepting the Terms. If we learn that a minor has signed up, we will delete their data without delay.
After you submit the form, you will receive a message with a confirmation link valid for 48 hours. Your sign-up becomes active only after you confirm it (double opt-in). We delete unconfirmed sign-ups automatically, within 72 hours of the form being submitted at the latest.
You can withdraw your consent and end the contract at any time — using the “Unsubscribe” link in every message (also with one click in your e-mail program, if it supports this) or by writing to office@restonim.com. Once you unsubscribe, we remove your address from the list without delay. Withdrawing consent does not affect the lawfulness of processing carried out before its withdrawal.
The data of people on the waiting list are not transferred to the planned company merely because it is established. Any change of data controller requires a separate legal assessment and informing you in advance and, where the law so requires, your consent.
Recipients of data
The following providers process data on our behalf under data processing agreements: Cloudflare, Inc. (USA) — website hosting, server functions and the waiting-list database, located in the European Union; Microsoft Ireland Operations Limited (Ireland) — the Microsoft 365 (Exchange Online) service through which we send and receive e-mails.
E-mails are delivered to the provider of your mailbox. We may disclose data to public authorities where the law requires it. We do not sell data and do not share them with other parties for marketing purposes.
Transfers outside the European Economic Area
Although the waiting-list database is located in the European Union, our providers may also process data outside the European Economic Area — in particular, Cloudflare handles connections in a global network of data centres, and both providers have affiliates in the USA. Data are transferred on the basis of an adequacy decision of the European Commission (EU–US Data Privacy Framework — for organisations participating in it) or standard contractual clauses adopted by the European Commission (Articles 45 and 46 GDPR). You can obtain a copy of the safeguards by writing to office@restonim.com.
Retention periods
- Unconfirmed sign-ups — at most 72 hours after the form is submitted (deleted automatically every hour).
- Confirmed sign-ups — until you unsubscribe or withdraw consent, no longer than 24 months after confirmation. The availability of RESTONIM does not end the list.
- IP address hashes and attempt counters — up to 24 hours.
- Ordinary security and technical logs kept by us: the delivery log (without recipient addresses) and the log of actions in the administration panel — 30 days.
- Event records serving as evidence that consent was given and withdrawn (without the e-mail address) — for as long as the sign-up exists and, after it is deleted, for 36 months after the last event; once the sign-up is deleted, they do not make it possible to establish whom they concerned.
- Documentation of personal data breaches (if any occur) — for 3 years after the matter is closed, unless longer storage is necessary to establish, pursue or defend claims.
- Database copies in the provider’s recovery mechanism — data deleted from the list may remain in them for up to 30 days. The copies are used only to restore the database after a failure; after a restore we delete again the data of people who unsubscribed or whose sign-ups expired.
- Correspondence — for as long as needed to deal with it and then until any potential claims become time-barred; automatic non-delivery notifications — 30 days at most.
- Data in the providers’ technical logs (Cloudflare, Microsoft) — for the period set by those providers’ settings and policies, no longer than necessary for the security and operation of the services.
Provision of data
Providing an e-mail address and making both declarations in the form is voluntary, but necessary to join the waiting list. Providing data in correspondence is voluntary, but without them we cannot reply to your message.
Your rights
You have the right of access to your data, to rectification, erasure, restriction of processing and portability (for data processed by automated means on the basis of consent or a contract), the right to object to processing based on our legitimate interest and the right to withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal. Requests can be sent to office@restonim.com; we reply without undue delay and within one month at the latest. You also have the right to lodge a complaint with a supervisory authority — in Poland, the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw), or the authority in the Member State of your habitual residence.
Automated decisions
We do not take decisions about you based solely on automated processing, including profiling.
Security
We use encrypted connections (HTTPS) and double opt-in, store only hashes of the confirmation and unsubscribe links and limit the number of sign-ups; only authorised persons, authenticated with a one-time code, have access to the list data.
Cookies and browser storage
This website does not use cookies, including on the waiting list.
If you choose a language using the language selector, we save that choice in your browser’s storage (localStorage, key “restonim.lang”) so that the website is shown in your chosen language on your next visit. A notice next to the selector tells you that the choice will be remembered. The saved choice is never sent to the server.
You can delete the saved choice with the button below or by clearing this website’s data in your browser settings.
Changes to this policy
We will inform people on the waiting list by e-mail about material changes to this policy concerning the list. The current version of this policy is always available on this page.