Who is the controller
The controller is Auraco sp. z o.o., Solec 81B/73A, 00-382 Warsaw, Poland, entered in the Polish register of entrepreneurs under KRS number 0000516759. For data protection matters please write to gdpr@auraco.pl.
What data we collect
You browse this site anonymously. We collect personal data only when you give it to us, through the enquiry form, a job application or when booking a call.
Visit statistics – Article 6(1)(f) GDPR, our legitimate interest in knowing which content is read and whether the forms work. We run statistics in Matomo installed on our own server (analityka.auraco.pl), so the data does not go to external analytics providers. They come from two sources: server logs (IP address, date and time, page address, browser type, referring page) and information recorded by the server itself when someone submits a form, requests a material, downloads it or uses the site search. The latter contains no e-mail address, name or message content, and search phrases are stored without e-mail addresses or strings of digits. We truncate the IP address by its last two bytes before it enters the statistics and remove from page addresses any parameters that could point to a person. We use no cookies and no scripts running in your browser, and we do not build visitor profiles. You may object to this processing by writing to gdpr@auraco.pl. Because we truncate the IP address before the data enters the statistics, we cannot find your earlier visits in them (Article 11 GDPR). For the future, we can exclude a fixed IP address you indicate from the statistics.
Cookies
This site does not use cookies. Visit statistics are produced on the server side and store nothing on your device. The only thing it stores in your browser is your answers in the NIS2 self-assessment tool (in Polish). Once you start it, the tool keeps them in session storage so that reloading the page does not lose your progress. The answers are never sent to our server, and your browser deletes them when you close the tab. Under Article 399 of the Polish Electronic Communications Law, storage that is strictly necessary for a service you have explicitly requested needs no consent, so the site shows no consent banner.
Recipients of the data
Data may be entrusted to IT service providers under processing agreements compliant with Article 28 GDPR. Categories of recipients are listed in the individual notices.
How long we keep the data
We keep correspondence for as long as the matter requires, then until claims become time-barred. Application documents are deleted once recruitment closes, unless you consented to future processes.
Visit statistics – data on individual page views and events, with a truncated IP address, is deleted after 180 days. Only aggregate figures remain, from which no individual visit can be reconstructed.
Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and objection. You can send a request, including an objection, to gdpr@auraco.pl or submit it through the form at our contact point. You may also lodge a complaint with the President of the Polish Personal Data Protection Office. You may object at any time, without giving reasons, to the processing of your data for direct marketing; once you do, we stop processing it for that purpose (Article 21(2) and (3) GDPR). We send commercial e-mails only with your consent under Article 398 of the Polish Electronic Communications Law.