Privacy Policy

Last updated: February 20, 2026.

This Privacy Policy is provided pursuant to Articles 13(1)–(2) and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the General Data Protection Regulation, “GDPR”).

I Personal data Controller

The Controller of personal data is Pretius Software sp. z o.o., with its registered office in Warsaw, ul. Żwirki i Wigury 16a, 02-092 Warszawa, registered with the District Court for the Capital City of Warsaw in Warsaw, XIV Commercial Division of the National Court Register, under KRS number 0000935719, NIP: 5272657685, REGON: 142980511 (hereinafter referred to as the „Controller”, „we” or „us”).

II Source of contact (point of contact)

The Controller has designated a contact person for data protection matters.

You might contact us:

• by email at rodo@pretius.com;
• by post at the address above.

III Purposes and legal bases of processing

We process personal data for the following purposes:

1. Establishing and maintaining business relationships.
2. Marketing and promotional activities.
3. Correspondence management and communication.

Below we explain the purposes and corresponding legal bases in detail.

Establishing and maintaining business relationships

We process personal data of customers, business partners and potential clients in order to establish and maintain business relationships, identify and contact potential clients, provide information about our services, conduct pre-contractual communication, perform contracts.

Legal bases: processing necessary to take steps at your request prior to entering into a contract or for the performance of a contract – Article 6(1)(b) GDPR; compliance with legal obligations, in particular tax and accounting obligations – Article 6(1)(c) GDPR; the Controller’s legitimate interest in establishing, exercising or defending legal claims – Article 6(1)(f) GDPR. We also collect personal data during business meetings and industry events. Such data is processed solely for the purpose of fostering business relationships within our professional network, based on our legitimate interest (Article 6(1)(f) GDPR).

For business development purposes, we may also collect data from publicly available sources (e.g., search engines, LinkedIn) to present cooperation proposals via email, social media, or telephone. This is based on our legitimate interest in expanding our business network (Article 6(1)(f) GDPR) or based on your consent (Article 6(1)(a) GDPR). You may object to such processing at any time.

Providing your personal data is voluntary but necessary to conclude and perform the contract.

Marketing and promotional activities

We process personal data in order to inform you about our services, products and special offers; promote our brand and activities; conduct industry-related analyses to better tailor our offer.

Legal bases: the Controller’s legitimate interest in direct marketing and brand promotion – Article 6(1)(f) GDPR; your consent, to the extent specified in its content – Article 6(1)(a) GDPR. This also applies to users visiting our social media profiles. Data is processed in connection with the operation of these profiles, including publishing content, informing users about our activities and promoting events, based on our legitimate interest – Article 6(1)(f) GDPR.

Providing data for marketing purposes is voluntary. You may use your browser’s incognito/private mode to browse our website without sharing visit information; this does not affect your ability to use our services.

Correspondence management and communication

If you contact us via email, our website, social media or traditional mail, we process your personal data in order to respond to your inquiry; ensure effective and continuous communication in ongoing matters.

Legal bases: the Controller’s legitimate interest in handling correspondence and communication – Article 6(1)(f) GDPR; or, where applicable, Article 6(1)(a) GDPR, if you choose to provide additional information not necessary for the primary inquiry.

Providing data is voluntary but necessary for us to respond. Failure to provide data may make it difficult or impossible to process your request.

IV Period of data processing

Personal data is processed for the following periods:

• based on legitimate interest, until that interest ceases to exist (e.g. expiration of limitation periods) or until an effective objection is raised, where applicable;
• based on a contract, for the duration of the contract and thereafter for the period required by applicable regulations, e.g., accounting and bookkeeping;
• based on a legal obligation, for the period required by applicable law;
• based on consent, until the purpose of processing is fulfilled or consent is withdrawn, whichever occurs first; without affecting the lawfulness of processing based on consent before its withdrawal.

After the above periods, data may be stored to a limited extent for evidentiary or claims-related purposes, where permitted by law.

V Sources of personal data

We process personal data that we receive from you, for example, via email, submitted through our website, or via cookies. In these cases, you have full control over how much information you choose to share.

We may also process personal data provided to us by third parties (e.g., our clients) or obtained from publicly available sources (e.g., Internet search engines). The categories of personal data we process may include: name, professional position, employer, business contact details, publicly available information about professional experience.

VI Recipients of personal data and transfer of personal data to third countries

Personal data may be transferred to third parties that process personal data on behalf of the Controller, e.g., IT service providers, partners providing internal management tools. These entities process data based on an agreement with us and in accordance with our instructions.

Personal data may also be disclosed to other recipients if it is necessary for the performance of a specific processing purpose, e.g., postal operators, banks, mobile phone operators. Additionally, personal data may also be disclosed to entities authorized under legal provisions, including judicial authorities.

Where data is transferred outside the European Economic Area (EEA), for example to providers of Jira, Confluence, HubSpot or MailerLite, such transfers are carried out in accordance with the GDPR, in particular on the basis of Standard Contractual Clauses or adequacy decisions of the European Commission.

VII Your rights

You have the following rights under the GDPR:

• the right of access to your data;
• the right to rectification of inaccurate data;
• the right to erasure (Article 17 GDPR);
• the right to restriction of processing (Article 18 GDPR);
• the right to data portability, where applicable;
• the right to object to processing based on legitimate interest, including an absolute right to object to processing for direct marketing purposes;
• the right to withdraw consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal;
• the right to lodge a complaint with the President of the Personal Data Protection Office (Poland).

VIII Social media and external business services processing

We process personal data in connection with our social media profiles on platforms such as Facebook, LinkedIn, X (formerly Twitter) and YouTube in order to:

• manage our profiles and pages;
• publish content and promote our activities;
• communicate with users;
• analyse user activity using tools provided by social media platforms.

We also process personal data on external business platforms such as Clutch and Oracle for the purposes of managing our profile, communicating with users of these platforms and analysing activities carried out on our profile.

This processing is based on our legitimate interest in brand promotion and communication – Article 6(1)(f) GDPR.

The independent data controllers on these platforms include, among others, Meta Platforms Ireland Limited (Facebook/Instagram), LinkedIn Ireland Unlimited Company (LinkedIn), Twitter International Company (X, formerly Twitter), Google Ireland Limited (YouTube).

IX Automatic data collection

Cookies are small text files placed on your device by websites you visit. They help websites function properly, improve performance, and provide information to site owners.

We use the following categories of cookies:

• necessary cookies – required for the operation of the website;
• functional cookies – enable personalisation and additional features;
• analytical and performance cookies – help us analyse website traffic and performance;
• marketing (advertisement) cookies – used to measure the effectiveness of marketing activities.

The use of non-necessary cookies requires your consent, which may be withdrawn at any time via the cookie consent management platform.

We use third-party tools such as GA4 (Google Analytics), Google Tag Manager, Facebook Pixel, LinkedIn Insight Tag, Leadfeeder and Dripify. These tools may process IP addresses and other online identifiers, which may constitute personal data within the meaning of the GDPR.

We also use social media plug-ins. Data collected through these plug-ins is transferred only between your browser and the selected social media operator and is not accessible to us. We do not have access to this data, so we encourage you to consult the privacy policies of the respective social media platforms.

X Changes to privacy policy

We may update this Privacy Policy from time to time, in particular due to changes in law, technology or our operations. The current version will always be available on our website.