Privacy Policy
1. DEFINITIONS
1.1. Controller – Fras Design sp. z o.o., with its registered office in Wrocław 53-023 at ul. Szronowa 7, registered in the National Court Register under number 0000653322, Tax ID (NIP): 8992804928, National Business Registry Number (REGON): 366095735.
1 .2. Personal data—all information relating to an identified or identifiable natural person based on one or more specific factors that define the person’s physical, physiological, genetic, mental, economic, cultural, or social identity, including the device’s IP address, location data, online identifier, and information collected through cookies and other similar technologies.
1.3. Policy – this Privacy Policy.
1.4. GDPR – Regulation (EU) (EU) 2016/679 of April 27, 2016, on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.
1 .5. Website – the website operated by the Administrator at befiro.pl
1.6. User – any natural person visiting the Website or using one or more of the services or features described in this Policy.
2. DATA PROCESSING IN CONNECTION WITH THE USE OF THE WEBSITE
2.1. In connection with the User’s use of the Website, the Administrator collects data to the extent necessary to provide the specific services offered, as well as information about the User’s activity on the Website. The detailed rules and purposes of processing personal data collected while the User uses the Website are described below.
3. PURPOSES AND LEGAL BASES FOR DATA PROCESSING ON THE WEBSITE: USE OF THE WWW.BEFIRO.PL WEBSITE
3.1. The personal data of all individuals using the Website (including IP addresses or other identifiers, as well as information collected through cookies or other similar technologies), who are not registered Users (i.e., individuals who do not have a profile on the Website) are processed by the Controller:
3.1.1. for the purpose of providing electronic services related to making content collected on the Website available to Users and providing contact forms—in which case the legal basis for processing is the necessity of processing for the performance of a contract (Article 6(1)(b) of the GDPR);
3.1.2. to process purchases made without registering on the Website—in which case the legal basis for processing is that processing is necessary for the performance of a contract (Article 6(1)(b) of the GDPR);
3.1.3. to handle complaints—in which case the legal basis for processing is that processing is necessary for the performance of a contract (Article 6(1)(b) of the GDPR);
3.1.4. for analytical and statistical purposes—in which case the legal basis for processing is the Controller’s legitimate interest (Article 6(1)(f) of the GDPR), which consists of analyzing Users’ activity and preferences in order to improve the functionalities and services provided;
3.1.5. for the purpose of potentially establishing and pursuing claims or defending against them—the legal basis for processing is the Controller’s legitimate interest (Article 6(1)(f) of the GDPR) consisting in the protection of its rights;
3.1.6. for the marketing purposes of the Administrator and other entities, in particular those related to the display of behavioral advertising—the rules for processing personal data for marketing purposes are described in the “MARKETING” section.
The User’s activity on the Website, including their personal data, is recorded in system logs (a specialized computer program used to store a chronological record containing information about events and activities related to the IT system used by the Administrator to provide services). The information collected in the logs is processed in connection with the provision of services. The Administrator also processes this information for technical purposes; in particular, data may be temporarily stored and processed to ensure the security and proper functioning of IT systems, e.g., in connection with creating backup copies, testing changes to IT systems, detecting irregularities, or protecting against abuse and attacks.
PLACING ORDERS
3.5. Placing an order (for goods or services) by a Website User involves the processing of their personal data. Providing data marked as mandatory is required to accept and process the order, and failure to provide such data will result in the order not being fulfilled. Providing the remaining data is optional.
3.6. Personal data is processed:
3.6.1. to fulfill the order placed—the legal basis for processing is the necessity of processing for the performance of the contract (Article 6(1)(b) of the GDPR); with regard to data provided on an optional basis, the legal basis for processing is consent (Article 6(1)(a) of the GDPR);
3.6.2. to fulfill the statutory obligations incumbent upon the Controller, arising in particular from tax and accounting regulations—the legal basis for processing is a legal obligation (Article 6(1)(c) of the GDPR);
3.6.3. For analytical and statistical purposes – the legal basis for processing is the Controller’s legitimate interest (Article 6(1)(f) of the GDPR), consisting in analyzing Users’ activity on the Website, as well as their purchasing preferences, in order to improve the Website’s functionality;
3.6.4. for the purpose of potentially establishing and pursuing claims or defending against them – the legal basis for processing is the Controller’s legitimate interest (Article 6(1)(f) of the GDPR), which consists of protecting its rights. CONTACT FORMS
3.7. The Controller provides the option to contact it using electronic contact forms. Using the form requires providing the personal data necessary to contact the User and respond to the inquiry. The User may also provide other information to facilitate contact or the handling of the inquiry. Providing the data marked as required is necessary to receive and process the inquiry; failure to provide such data will result in the inability to process the inquiry. Providing any additional information is voluntary.
3.8. Personal data is processed:
3.8.1. to identify the sender and handle their inquiry submitted via the provided form—the legal basis for processing is that processing is necessary for the performance of a contract for the provision of services (Article 6(1)(b) of the GDPR);
3.8.2. for analytical and statistical purposes – the legal basis for processing is the Controller’s legitimate interest (Article 6(1)(f) of the GDPR), which consists of maintaining statistics on inquiries submitted by Users via the Website in order to improve its functionality.
3.8.3. To return a call if a phone number is provided in the form via the Ledreactor app
3.8.4. To send guides and other requested materials when a form from Getresponse is used.
4. MARKETING
4.1. The Controller processes Users’ personal data to carry out
marketing activities, which may include:
4.1.1. sending email notifications about interesting offers or content, which in some cases may contain commercial information;
4.1.2. conducting other types of activities related to the direct marketing of goods and services (sending commercial information electronically and telemarketing activities).
4.2. In order to carry out marketing activities, the Controller uses profiling in certain cases. This means that, through automated data processing, the Controller evaluates selected factors relating to individuals in order to analyze their behavior or make predictions about the future.
5. SOCIAL MEDIA PLATFORMS
5.1. The Administrator processes the personal data of Users who visit the Administrator’s profiles on social media platforms (Facebook, YouTube, Twitter, Google+, Slideshare). This data is processed exclusively in connection with maintaining the profile, including to inform Users about the Controller’s activities and to promote various events, services, and products, as well as to communicate with Users via features available on social media. The legal basis for the processing of personal data by the Administrator’s
for this purpose is its legitimate interest (Article 6(1)(f) of the GDPR), which consists of promoting its own brand and building and maintaining a brand-related community.
6. COOKIES AND SIMILAR TECHNOLOGIES
6.1. Cookies are small text files installed on the device of a User browsing the Website. Cookies collect information that facilitates the use of the website—for example, by remembering the User’s visits to the Website and the actions they take.
“SERVICE” COOKIES 6.2. The Controller uses so-called service cookies primarily to provide the User with electronically delivered services and to improve the quality of those services. Accordingly, the Administrator and other entities providing analytical and statistical services on its behalf use cookies to store information or access information already stored on the User’s telecommunications terminal device (computer, phone, tablet
, etc.). Cookies used for this purpose include:
6.2.1. cookies containing data entered by the User (session ID) for the duration of the session (user input cookies);
6.2.2. authentication cookies used for services requiring authentication for the duration of the session;
6.2.3. cookies used to ensure security, e.g., to detect authentication abuse (user-centric security cookies);
6.2.4. multimedia player session cookies (e.g., Flash player cookies) for the duration of the session;
6.2.5. persistent cookies used to customize the User’s interface for the duration of the session or slightly longer (user interface customization cookies),
6.2.6. cookies used to remember the contents of the shopping cart for the duration of the session
(shopping cart cookies);
6.2.7. cookies used to monitor website traffic, i.e., data analytics, including Google Analytics cookies (these are cookies used by Google to analyze how Users use the Website and to generate statistics and reports regarding the Website’s performance). Google does not use the collected data to identify the User nor does it combine this information to enable identification. Detailed information about the scope and rules of data collection in connection with this service can be found at the following link: https://www.google.com/intl/pl/policies/privacy/partners.
“MARKETING” COOKIES
6.3. The Administrator also uses cookies for marketing purposes. To this end, the Administrator stores information or accesses information already stored on the User’s telecommunications terminal device (computer, phone, tablet, etc.). The use of cookies and the personal data collected through them for marketing purposes requires the User’s consent. This consent may be given by configuring the browser accordingly and may be withdrawn at any time, in particular by clearing the cookie history and disabling cookies in the browser settings.
6.4. Information on managing cookies and changing web browser settings can be found by following the links below: 1) Internet Explorer
a) information in Polish: http://windows.microsoft.com/pl-pl/windows7/how-to-manage-cookies-in-internet-explorer-9
b) information in English: http://windows.microsoft.com/en-GB/windows7/How-to-manage-cookies-in-Internet-Explorer-9
2) Mozilla
a) information in Polish: http://support.mozilla.org/pl/kb/W%C5%82%C4%85
czanie%20i%20wy%C5%82%C4%85czanie%20obs%C5%82ugi%20ciasteczek
b) Information in English: http://support.mozilla.org/en-US/kb/cookies-information-websites-store-on-your-computer?redirectlocale=en-US&redirectslug=Cookies
3) Google Chrome:
a) information in Polish: https://support.google.com/chrome/answer/95647?hl=pl
b) Information in English: https://support.google.com/chrome/answer/95647?hl=en
PERIOD OF PERSONAL DATA PROCESSING
7.1. The duration of data processing by the Controller depends on the type of service provided and the purpose of processing. As a general rule, data is processed for the duration of the service or order fulfillment, until consent is withdrawn or a valid objection to data processing is raised in cases where the legal basis for data processing is the Controller’s legitimate interest.
7.2. The data processing period may be extended if processing is necessary to establish, assert, or defend against potential claims, and after that time only to the extent required by law. Upon expiration of the processing period, the data is permanently deleted or anonymized.
USER RIGHTS
8.1. Data subjects have the following rights:
8.1.1. Right to information regarding the processing of personal data – on this basis, the Controller provides the person making such a request with information regarding the processing of personal data, including, above all, the purposes and legal grounds for processing, the scope of the data held, the entities to which personal data is disclosed, and the planned date of its deletion;
8.1.2. Right to obtain a copy of the data – on this basis, the Controller provides a copy of the processed data concerning the person making the request;
8.1.3. Right to rectification – on this basis, the Controller corrects any inaccuracies or errors in the personal data being processed, and supplements or updates it if it is incomplete or has changed;
8.1.4. Right to erasure – under this right, you may request the erasure of data whose processing is no longer necessary for any of the purposes for which it was collected;
8.1.5. Right to restriction of processing – on this basis, the Controller ceases
to perform operations on personal data, with the exception of operations to which the data subject has consented and the storage of such data in accordance with established retention policies, or until the grounds for restricting data processing cease to exist (e.g., a decision is issued by a supervisory authority authorizing further data processing);
8.1.6. Right to Data Portability – on this basis, to the extent that data is processed in connection with a concluded contract or expressed consent, the Controller shall provide the data supplied by the data subject in a machine-readable format. It is also possible to request that this data be transferred to another entity—provided, however, that the technical capabilities exist for this purpose on the part of both the Data Controller and that other entity;
8.1.7. Right to object to data processing for marketing purposes—the data subject may object at any time to the processing of personal data for marketing purposes, without having to justify such an objection;
8.1.8. Right to object to other purposes of data processing—the data subject may at any time object to the processing of personal data based on the Controller’s legitimate interest (e.g., for analytical or statistical purposes or for reasons related to the protection of property). Such an objection must be substantiated and is subject to the Controller’s assessment;
8.1.9. Right to withdraw consent – if data is processed based on consent, the data subject has the right to withdraw it at any time; however, this does not affect the lawfulness of the processing carried out prior to the withdrawal of such consent;
8.1.10 Right to lodge a complaint – if the data subject believes that the processing of personal data violates the provisions of the GDPR or other regulations concerning the protection of personal data, the data subject may lodge a complaint with the President of the Personal Data Protection Office.
8.2. A request to exercise the rights of data subjects may be submitted:
8.2.1. in writing to the following address: Fras Design sp. z o.o., with its registered office in Wrocław 53-023, ul. Szronowa 7
8.2.2. via email to: biuro@befiro.pl
8.3. The request should, as far as possible, specify precisely what the request concerns, i.e., in particular:
8.3.1. which right the person submitting the request wishes to exercise (e.g., the right to receive a copy of the data, the right to have the data erased, etc.);
8.3.2. which processing activity the request concerns (e.g., use of a specific service, activity on a specific website, receipt of emails containing commercial information at a specific email address, etc.);
8.3.3. what processing purposes the request concerns (e.g., marketing purposes, analytical purposes, etc.).
8.4. If the Controller is unable to determine the content of the request or identify the person submitting the request based on the submission, it will ask the requester for additional information.
8.5. A response to the request will be provided within one month of receipt. If it is necessary to extend this deadline, the Administrator will inform the requester of the reasons for such an extension.
8.6. A response will be sent to the email address from which the request was sent, and in the case of requests submitted by mail, by regular mail to the address provided by the requester, unless the content of the letter indicates a desire to receive a response via email (in which case, an email address must be provided).
9. DATA RECIPIENTS
9.1. In connection with the provision of services, personal data will be disclosed to third parties, including, in particular, service providers responsible for maintaining IT systems, entities such as banks and payment processors, entities providing accounting, legal, audit and consulting services, couriers (in connection with order fulfillment), marketing companies (in connection with marketing services), and entities affiliated with the Controller (e.g., pickup locations).
9.2. If the User’s consent is obtained, their data may also be made available to other entities for their own purposes, including marketing purposes.
9.3. The Controller reserves the right to disclose selected information regarding the User to competent authorities or third parties who request such information, based on an appropriate legal basis and in accordance with applicable law.
TRANSFER OF DATA OUTSIDE THE EEA
10.1. The level of protection for personal data outside the European Economic Area (EEA) differs from that provided by European law. For this reason, the Controller transfers personal data outside the EEA only when necessary and with an adequate level of protection, primarily through: 10.1.1. cooperation with entities processing personal data in countries for which the European Commission has issued an appropriate decision; 10.1.2. the use of standard contractual clauses issued by the European Commission; 10.1.3. applying binding corporate rules approved by the competent supervisory authority; 10.1.4. in the event of data transfers to the U.S. – cooperation with entities participating in the Privacy Shield program, approved by a decision of the European Commission. 10.2. The Controller always informs data subjects of its intention to transfer personal data outside the EEA at the time of collection.
10. SECURITY OF PERSONAL DATA
11.1. The Controller conducts ongoing risk assessments to ensure that personal data is processed securely—primarily ensuring that access to the data is restricted to authorized persons and only to the extent necessary for the performance of their duties. The Controller ensures that all operations involving personal data are logged and performed only by authorized employees and associates.
11.2. The Controller takes all necessary measures to ensure that its subcontractors and other collaborating entities also guarantee the application of appropriate security measures whenever they process personal data on behalf of the Controller.
CONTACT INFORMATION
12.1. The Data Controller can be contacted via email at biuro@befiro.pl or by mail at Fras Design sp. z o.o., Wrocław 53-023, ul. Szronowa 7,
12.2. The Controller has appointed a Data Protection Officer, who can be contacted via email at biuro@befiro.pl regarding any matter concerning the processing of personal data.
13. CHANGES TO THE PRIVACY POLICY
13.1. This policy is reviewed on an ongoing basis and updated as necessary.
Publication date: March 25, 2026; Update date: March 25, 2026