Privacy and cookie policy

1. General information

This Privacy Policy sets out the rules for processing the personal data of people who use the www.amakoexpo.eu website, who contact GRUPA AMAKO Sp. z o.o., who send requests for quotation, and who are interested in the services offered under the AMAKO EXPO brand.

The Policy also describes how cookies and similar technologies are used on the website, in particular in connection with web analytics, measuring the effectiveness of advertising campaigns, and remarketing.

2. Data controller

The controller of personal data is:

GRUPA AMAKO Spolka z ograniczona odpowiedzialnoscia
ul. Gdynska 19-21
31-323 Krakow, Poland
KRS: 0000377476

referred to below as the "Controller", "Grupa Amako" or "AMAKO EXPO".

For matters concerning the protection of personal data, the Controller can be reached at:

e-mail: biuro@grupaamako.pl
postal address: ul. Gdynska 19-21, 31-323 Krakow, Poland.

3. Scope of the data processed

Depending on how you contact the Controller, we may process in particular:

• first name and surname,
• job title or professional role,
• company or organisation name,
• business e-mail address,
• telephone number,
• country or city,
• information provided in the body of your enquiry,
• information about your planned participation in a trade fair or another event,
• information about the location, dates, floor space, character and requirements of the exhibition stand to be designed,
• the history of correspondence and commercial contacts,
• information about the offers prepared and the negotiations conducted,
• IP address,
• information about your device, browser and operating system,
• information about how you use the website,
• information about the source of your visit and the effectiveness of an advertising campaign,
• cookie identifiers and other online identifiers, where their use is consistent with your consent settings.

The Controller does not expect special categories of data to be submitted through the website forms, such as information about health, religious beliefs, political opinions or other sensitive data.

4. Sources of the data

We obtain personal data primarily directly from the person the data concerns, in particular:

• through the forms available on www.amakoexpo.eu,
• by e-mail,
• during a telephone conversation,
• during direct business contacts,
• through actions you take in connection with Grupa Amako or AMAKO EXPO advertising on Google, Facebook, Instagram or LinkedIn,
• at trade fairs, conferences, meetings and other industry events.

5. Contact forms and requests for quotation

The data provided in a contact or quotation form is used in order to:

• reply to your enquiry,
• contact the interested person,
• establish the scope of a possible project,
• prepare a quotation or an offer,
• prepare a delivery concept,
• conduct negotiations,
• take other steps aimed at establishing cooperation.

If a person contacts the Controller on their own behalf with a view to concluding a contract, the legal basis may be Article 6(1)(b) GDPR, that is, taking steps at the request of the data subject prior to entering into a contract.

If the person making contact acts as an employee, a representative or a contact person of another business, the basis for processing is Article 6(1)(f) GDPR, that is, the legitimate interest of the Controller in handling business enquiries, preparing offers, and establishing and maintaining B2B relationships. The GDPR provides for both pre-contractual steps and legitimate interest as separate bases for lawful processing. EUR-Lex

Data sent through the forms on www.amakoexpo.eu is delivered to the Controller's e-mail accounts and then handled by authorised staff responsible for commercial contact and offer preparation.

6. Concluding and performing a contract

If the contact leads to cooperation, the data may be processed further in order to:

• conclude and perform the contract,
• prepare and deliver the project,
• organise production,
• coordinate transport, assembly and dismantling,
• communicate with the client and its representatives,
• settle the delivery,
• meet tax and accounting obligations,
• establish, pursue or defend legal claims.

The legal bases may be, respectively:

Article 6(1)(b) GDPR, performance of a contract,
Article 6(1)(c) GDPR, compliance with a legal obligation,
Article 6(1)(f) GDPR, the legitimate interest of the Controller, including proper service of a business partner and protection against claims.

7. Marketing of our own services

The Controller may process the data of clients and potential clients in order to promote its own services, in particular services relating to:

• exhibition stand design,
• stand production and construction,
• assembly and dismantling,
• trade fair logistics,
• delivery of complete exhibition projects in Poland and across Europe.

The basis for processing personal data for the purpose of marketing our own services may be the legitimate interest of the Controller, Article 6(1)(f) GDPR.

Where marketing is to be carried out through specific electronic communication channels, for example e-mail or telephone, the Controller additionally observes the requirements of the Polish Electronic Communications Law.

8. E-mail and telephone marketing

The Controller does not treat the mere sending of a request for quotation as automatic consent to future e-mail or telephone marketing unrelated to that enquiry.

Commercial information and direct marketing by e-mail, telephone or other terminal telecommunications equipment are carried out where the Controller has the basis required by law for using the channel in question.

Article 398 of the Polish Electronic Communications Law prohibits the use of terminal equipment to send commercial information, including direct marketing, unless the subscriber or end user has given prior consent. ELI

Consent, once given:

• is voluntary,
• is not a condition of receiving a reply to a request for quotation,
• may be withdrawn at any time,
• may cover e-mail and telephone communication separately.

9. Google Analytics 4

The www.amakoexpo.eu website uses Google Analytics 4, a tool for analysing traffic and the way the website is used.

Google Analytics may collect, among other things:

• information about the device and browser,
• approximate location,
• session information,
• the subpages visited,
• information about user interactions with the website,
• the source of the visit.

Google confirms that GA4 uses first-party cookies including _ga and _ga_<identifier> to distinguish users and sessions. Google Help

To the extent that using Google Analytics requires storing information on your device or accessing information already stored there, this takes place in line with your choice regarding analytics cookies.

10. Google Tag Manager

The website uses Google Tag Manager, which serves to manage the tags and scripts used on the site.

Google Tag Manager may be used to manage tools including:

• Google Analytics 4,
• Google Ads,
• Meta Pixel,
• LinkedIn Insight Tag.

Using a tag management system does not in itself change the rules on consent. The individual analytics and marketing tools launched through it should respect your choices regarding the relevant categories of technology.

11. Google Ads and measuring advertising effectiveness

The Controller may use Google Ads tools in order to:

• run advertising campaigns,
• measure conversions,
• analyse campaign effectiveness,
• determine which campaigns lead to requests for quotation,
• run remarketing.

Where Google Analytics is linked to Google advertising services, additional advertising identifiers may be used. Google states that the use of advertising features requires the relevant user consent choices to be taken into account. Google Help

For European data, the relevant Google entity is as a rule Google Ireland Limited. Business Data Responsibility

12. Meta Pixel

The website uses Meta Pixel in connection with campaigns run on Facebook and Instagram, among others.

Meta Pixel may be used in particular to:

• measure campaign effectiveness,
• record events relating to use of the website,
• measure conversions,
• build audiences,
• run remarketing,
• optimise advertising campaigns.

Meta may receive information about user activity outside Meta services from partners using business tools, including Meta Pixel. Meta Business Tools

For users in the European region, Meta services are provided by Meta Platforms Ireland Limited. Meta

The Controller treats Meta Pixel as a marketing tool, which should respect your consent for that category of technology.

13. LinkedIn Insight Tag

The website uses LinkedIn Insight Tag in connection with advertising activity on LinkedIn.

This tool may be used to:

• measure conversions,
• analyse advertising effectiveness,
• build remarketing audiences,
• obtain aggregated information about the website's audience.

LinkedIn states that the Insight Tag may collect information including the URL, the referrer, the IP address, device and browser characteristics, and the time of the visit. LinkedIn also uses cookies in connection with the operation of the Insight Tag. LinkedIn

For users in the EU and EEA, the data controller within LinkedIn services is LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland. LinkedIn

LinkedIn Insight Tag is treated as a marketing tool and should be launched in line with your choice regarding that category of technology.

14. Cookies and similar technologies

The website uses cookies and similar technologies.

The technologies used can be divided into the following categories:

Necessary, required for the correct and secure operation of the website. Their use does not depend on consent where they are genuinely necessary to deliver the service you requested.

Analytics, used to study website traffic and the way individual subpages are used, in particular through Google Analytics 4.

Marketing, used to measure campaigns, for remarketing and for ad targeting, in particular through Google Ads, Meta Pixel and LinkedIn Insight Tag.

The Polish Electronic Communications Law requires that clear information be provided in advance and that consent be obtained for storing information on, or gaining access to information on, a user's device, subject to the exceptions set out in the act. ELI

You may change your preferences at any time using the "Cookie settings" mechanism available on the website.

15. Recipients of the data

Personal data may be passed to entities that support the Controller in running its business, in particular:

• the hosting and e-mail provider, WEBD.PL / Globtel Internet Szymon Hersztek,
• IT service providers,
• entities that maintain and develop the website,
• Google, in connection with the use of Google Analytics, Google Tag Manager and Google Ads,
• Meta, in connection with the use of Meta Pixel and Meta advertising services,
• LinkedIn, in connection with the use of LinkedIn Insight Tag,
• entities supporting the Controller in marketing activities,
• legal, tax and accounting advisers,
• entities providing services necessary to perform the contracts concluded,
• public authorities, where the obligation to hand over the data follows from applicable law.

WEBD.PL operates as a brand of Globtel Internet Szymon Hersztek and provides hosting services, among others. WEBD.PL

Depending on the nature of the service provided, individual recipients may act as processors on behalf of the Controller, as separate controllers, or, in the cases provided for by law or by the terms of a given platform, as joint controllers.

16. Transfers outside the European Economic Area

Because we use the services of global technology providers, data may also be processed outside the European Economic Area, in particular in the United States.

In that case, transfers take place using the mechanisms provided for by the GDPR, depending on the provider and the service, in particular:

• an adequacy decision of the European Commission,
• the relevant mechanisms of the EU-U.S. Data Privacy Framework, where applicable,
• standard contractual clauses approved by the European Commission,
• other mechanisms provided for by law.

LinkedIn states explicitly that European data may be transferred to the United States and uses adequacy decisions and standard contractual clauses for that purpose, among others. LinkedIn

Google likewise provides in its terms for mechanisms covering European transfers and SCCs. Business Data Responsibility

17. Profiling and automated decision-making

In connection with the use of advertising tools, users may be assigned to particular audiences, for example people who visited a given page or performed a given action on the website.

Such activity may be used for remarketing and for better targeting of advertising campaigns.

The Controller does not take decisions about users based solely on automated processing that would produce legal effects concerning them or similarly significantly affect them.

18. Retention periods

Personal data is kept no longer than is necessary for the purpose of processing.

In particular:

Requests for quotation that did not result in a contract: as a rule for no longer than 36 months from the last meaningful contact, unless the purpose of processing ends earlier, the person effectively objects, or further retention is justified on another legal basis.

Data concerning clients and contracts concluded: for the duration of the cooperation and, after it ends, for the period needed to meet obligations under tax and accounting law and until the relevant limitation periods for claims expire.

Data used for direct marketing: until an effective objection is raised, the relevant consent is withdrawn, or the purpose of processing ends.

Records confirming that consent was given or withdrawn may be kept for the period needed to demonstrate that the Controller acted lawfully and to defend against possible claims.

Data from analytics and advertising tools is kept in line with the configuration of each service and the retention periods applied by the providers. Google Analytics allows the Controller to set the retention period for user and event data; Google describes these settings in the GA4 documentation. Google Help

19. Rights of data subjects

Depending on the basis for processing, a person whose data is processed may have the right to:

• access their data,
• receive a copy of their data,
• have their data rectified,
• have their data erased,
• restrict processing,
• data portability,
• object to processing based on legitimate interest,
• withdraw consent at any time, where consent is the basis for processing,
• lodge a complaint with the President of the Personal Data Protection Office.

Where data is processed for direct marketing purposes, a person has the right to object at any time, and once that objection is raised the data may no longer be processed for that purpose. The GDPR establishes this right in Article 21. EUR-Lex

To exercise your rights, you can contact the Controller at:

biuro@grupaamako.pl

20. Providing data is voluntary

Providing data in the forms available on the website is voluntary.

Providing the data marked as required is, however, necessary in order to reply to an enquiry or prepare an offer.

Not consenting to marketing does not prevent you from sending an enquiry, receiving a reply or having an offer prepared.

21. Data security

The Controller applies appropriate technical and organisational measures to protect the data processed against:

• loss,
• accidental destruction,
• unauthorised access,
• disclosure,
• modification,
• other unlawful processing.

Access to the data is given to people who need it to perform their duties relating to client service, sales, marketing, administration or project delivery.

22. Server logs

Using the website may result in certain information being recorded automatically in the server logs, including:

• the IP address,
• the date and time of the connection,
• the resource requested,
• information about the browser and the device,
• information about technical errors.

This information may be used to ensure the correct and secure operation of the website, to diagnose errors and to protect the IT infrastructure.

The basis for processing is the legitimate interest of the Controller, Article 6(1)(f) GDPR.

23. Changing cookie settings

You may change or withdraw your consent for optional cookie technologies at any time.

A "Cookie settings" mechanism should be available on the website, allowing the consent panel to be reopened and an earlier choice to be changed.

Changing your consent does not affect the lawfulness of actions carried out before the change.

24. Changes to this Privacy Policy

The Controller may update this Policy from time to time, in particular where there is:

• a change in the law,
• a change in how the website works,
• the introduction of new analytics or marketing tools,
• a change of service providers,
• a change in how data is processed.

The current version of the Policy is always published on www.amakoexpo.eu.