1. Data controller
The controller of your personal data is:
Double Digital Sp. z o.o.ul. Grzybowska 8700-844 Warsaw, PolandTax ID (NIP): 5273008411Email: contact@doubledigital.agencyreferred to below as “Double Digital”, the “Controller”, “we” or “us”.
This policy applies in particular to personal data processed in connection with:
- using the website doubledigital.agency and its subpages,
- submitting contact forms and requests for proposals,
- contacting us by phone, email or messaging apps,
- subscribing to a newsletter or other marketing communications,
- using free materials, reports and tools provided by Double Digital,
- interacting with our social media profiles,
- taking part in recruitment,
- concluding and performing contracts with Double Digital.
For some services we provide to our clients, Double Digital may process personal data on the client’s behalf as a processor rather than as a controller. In such cases the scope and rules of processing are set out in particular in the contract with the client, the client’s instructions and the relevant data processing agreement.
2. What data we may process
The scope of data depends on how you use our services or contact us. In particular, we may process:
Contact data
- first name and surname,
- email address,
- phone number,
- company name,
- job title,
- information you include in a message or form.
Our website contact form collects your first name, business email address, phone number (optional) and message. The form is delivered to our team by email.
Data related to cooperation
- data of persons representing a client or business partner,
- information related to concluding and performing a contract,
- billing data,
- correspondence history,
- information about the services provided.
Data on website use
Depending on the consents you give and the technologies used, this may include:
- IP address,
- online identifiers,
- information about your device and browser,
- approximate location derived from your IP address,
- the source of your visit,
- pages visited,
- time spent on the website,
- interactions with the website,
- information about completed conversions,
- advertising identifiers and information stored in cookies or similar technologies.
Data of job and cooperation candidates
We may process data contained in:
- a CV,
- a recruitment form,
- messages sent during recruitment,
- recruitment documents and tasks,
- publicly available professional profiles, where relevant to recruitment.
Please do not send data that is not needed for a given purpose, in particular special categories of personal data, unless this is genuinely necessary and there is an appropriate legal basis for processing it.
3. Purposes and legal bases of processing
Contact and requests for proposals
If you contact us for information, with a request or to start cooperation, we process your data in order to:
- reply to your message,
- prepare a proposal,
- hold discussions about cooperation,
- take steps prior to entering into a contract.
The legal basis may be:
- Article 6(1)(b) GDPR – where the data is necessary to take steps at your request prior to entering into a contract,
- Article 6(1)(f) GDPR – our legitimate interest in communicating and conducting business, in particular where you contact us as a company representative.
Performance of contracts
We process the data of contracting parties in order to conclude and perform the contract under Article 6(1)(b) GDPR.
We may process the data of employees, associates and representatives of our clients, suppliers and partners under Article 6(1)(f) GDPR – our legitimate interest in properly performing cooperation and maintaining business contact.
Accounting and legal obligations
Data may be processed in order to:
- issue and store accounting documents,
- fulfil tax obligations,
- fulfil other obligations arising from the law.
The legal basis is Article 6(1)(c) GDPR.
Establishing, pursuing and defending claims
We may store and use certain data to establish, pursue or defend against claims. The legal basis is Article 6(1)(f) GDPR – the Controller’s legitimate interest in protecting its rights.
Website security
We may process, among other things, IP addresses, technical logs and information about how the website is used in order to:
- ensure security,
- prevent abuse,
- diagnose errors,
- ensure that the infrastructure works correctly.
The legal basis is Article 6(1)(f) GDPR.
Analytics
If you give the relevant consent, we may use analytics tools to understand how our website is used, measure its effectiveness and improve our content and services. Where consent is required, the legal basis for processing personal data is Article 6(1)(a) GDPR.
Regardless of the GDPR legal basis, storing information on, or accessing information stored on, your device takes place in accordance with the Polish Electronic Communications Law.
Advertising, remarketing and campaign measurement
With your consent, we may use advertising technologies to, among other things:
- measure the effectiveness of ads,
- determine whether a user took a particular action after interacting with an ad,
- build audiences,
- run remarketing,
- limit how often an ad is shown,
- tailor ads to interests or previous interactions.
The legal basis for processing personal data for these purposes is Article 6(1)(a) GDPR.
Newsletter and direct marketing
If you subscribe to a newsletter or consent to receiving commercial information, we may use the contact details you provide to send:
- newsletters,
- educational materials,
- information about new publications,
- information about Double Digital services or offers.
Where required by law, marketing communications are sent only after obtaining your prior consent, in particular in accordance with Article 398 of the Polish Electronic Communications Law. You may withdraw your consent at any time.
Recruitment
Data provided during recruitment may be processed in order to:
- conduct the current recruitment process,
- assess the candidate’s qualifications,
- contact the candidate about the recruitment,
- take steps prior to entering into the relevant contract.
Depending on the type of planned cooperation and the scope of data, the legal basis may be Article 6(1)(b), (c) or (a) GDPR and the applicable provisions of labour law. We process data for future recruitment processes only if the candidate gives separate consent.
5. Analytics and advertising tools
Depending on the website configuration and the consents you give, we may use services of external technology providers related to, among other things:
- web analytics,
- conversion measurement,
- online advertising,
- remarketing,
- social media,
- consent management,
- content hosting,
- forms and communication.
These may in particular be solutions provided by companies from groups such as Google, Meta, Microsoft, LinkedIn or other marketing technology providers currently used by Double Digital. The technologies enabled depend on the choices you make in the consent panel. Not every technology mentioned in this policy has to be used on every visit or every page.
6. Profiling and automated decision-making
In connection with the use of analytics and advertising technologies, data about user activity may be used to:
- build audiences,
- analyse interests,
- estimate the likelihood of certain actions,
- tailor communications and ads.
These activities may constitute profiling within the meaning of the GDPR. However, Double Digital does not make decisions about users based solely on automated processing that produce legal effects concerning them or similarly significantly affect them within the meaning of Article 22 GDPR.
7. Use of artificial intelligence and automation
In running our business we may use tools based on artificial intelligence, language models and other automation mechanisms. Such tools may support, among other things:
- analysing information,
- marketing and SEO analysis,
- preparing draft versions of content,
- editing and optimising materials,
- summarising information,
- automating repetitive processes,
- data analysis,
- preparing recommendations and working materials.
Using an AI tool is not in itself a separate legal basis for processing data. Where personal data is processed using such a tool, we apply the legal basis appropriate to the purpose for which the data is used.
When using AI tools, we aim to limit the data shared to what is necessary for the given purpose and, where justified, to anonymise or pseudonymise information. Where an AI tool provider processes personal data on our behalf, we use it subject to appropriate data protection rules, contractual terms and required safeguards.
For data entrusted to us by a client, we act within the scope of the entrustment, the client’s instructions and the agreed rules of cooperation.
We do not use AI tools to make decisions about individuals based solely on automated processing that produce legal effects or similarly significantly affect them, unless this is expressly stated in the future and there is an appropriate legal basis.
8. Where we may obtain data from
In most cases we receive data directly from the person it concerns. In certain cases we may also receive basic professional or business data:
- from the organisation you represent,
- from our client or contractor,
- from a business partner,
- from publicly available sources,
- from professional websites and profiles,
- in connection with a referral or recommendation.
In such cases we mainly process your first name and surname, job title, company name, business contact details and information about the professional or business relationship. We use such data only to the extent that there is an appropriate legal basis and it relates to a legitimate business purpose.
9. Who we may share data with
We may use the services of external entities that support our business. Data may be shared in particular with:
- hosting and IT infrastructure providers,
- email and communication tool providers,
- CRM and project management tool providers,
- analytics system providers,
- advertising platforms,
- marketing automation tool providers,
- newsletter and form system providers,
- providers of tools based on artificial intelligence and automation,
- consent management tool providers,
- accounting, legal and administrative service providers,
- subcontractors performing specific services for Double Digital,
- cloud infrastructure providers,
- public authorities, where the law requires us to share data.
Depending on the circumstances, these entities may act as processors on our behalf, independent controllers or joint controllers. We entrust data to processors to the extent necessary to perform specific services and, where required, on the basis of appropriate agreements.
10. Transfers outside the European Economic Area
Some technology providers we use are part of international groups or use infrastructure located outside the European Economic Area (EEA). As a result, personal data may in certain cases be transferred outside the EEA.
Where such a transfer takes place, the appropriate legal mechanisms required by the GDPR are applied, depending on the case, in particular:
- a European Commission adequacy decision,
- the EU-U.S. Data Privacy Framework, for entities covered by it,
- standard contractual clauses approved by the European Commission,
- other mechanisms provided for in Chapter V GDPR.
You may contact us for more information about the safeguards applied to a specific transfer.
11. How long we keep data
We do not keep data longer than necessary for the purpose for which it was collected, unless a longer period results from a legal obligation or the need to secure claims. In particular:
Requests and correspondence
We keep data for the duration of the contact and, after it ends, for the period needed to demonstrate the communication history or to secure possible claims.
Contract-related data
We keep it for the duration of the contract, then for the period required by law and until potential claims become time-barred.
Accounting records
Kept for the period required by applicable tax and accounting regulations.
Marketing and newsletter
Data processed on the basis of consent is used until consent is withdrawn or the marketing purpose ends. After consent is withdrawn, we may keep a limited set of information where this is needed to demonstrate that consent was obtained or withdrawn, or to defend against claims.
Recruitment
Data for a specific recruitment process is kept for the duration of that process and the period needed to secure possible claims. If a candidate consents to future recruitment processes, the data may be processed until consent is withdrawn or for the period stated when consent was given.
Cookies and analytics data
The lifetime of individual technologies depends on their type and provider.
Technical logs
Kept for the period necessary to ensure security, diagnostics and protection of the website, and longer where necessary in connection with a security incident or the pursuit of claims.
12. Is providing data mandatory?
Providing data is, as a rule, voluntary. It may, however, be necessary to:
- receive a reply to your request,
- receive a proposal,
- conclude or perform a contract,
- take part in recruitment,
- receive a newsletter,
- use a specific material or feature.
Where providing data is required by law or necessary to conclude a contract, failure to provide it may make the relevant action impossible.
13. Your rights
Depending on the legal basis and the way your data is processed, you have the right to:
- access your data,
- obtain a copy of your data,
- rectify your data,
- erase your data,
- restrict processing,
- data portability, in the cases set out in the GDPR,
- object to processing based on legitimate interest,
- object to processing for direct marketing purposes,
- withdraw consent at any time.
Withdrawing consent does not affect the lawfulness of processing carried out before its withdrawal.
To exercise your rights, write to contact@doubledigital.agency or kontakt@double-digital.pl. We may ask for additional information to confirm the identity of the person making the request where this is necessary to protect data against unauthorised disclosure.
14. Right to lodge a complaint
If you believe that we process your data in breach of the law, you have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO) in Poland. You may also lodge a complaint with the supervisory authority in the EU member state of your habitual residence or place of work.
16. External links and content
Our website may contain:
- links to external websites,
- video content,
- maps,
- forms,
- social media widgets,
- other content provided by third parties.
Once you go to an external website, your data is processed under the rules set by its operator. For elements embedded directly on our website that require access to your device or use technologies other than necessary ones, enabling them may depend on your consent.
17. Data security
We apply appropriate technical and organisational measures to protect the data we process, taking into account:
- the nature of the data,
- the scope of processing,
- the context and purposes of processing,
- the risk to the rights and freedoms of natural persons.
Access to data is given only to persons and entities who need it to perform specific tasks.
18. Changes to this privacy policy
This policy may be updated in particular in connection with:
- changes in the law,
- changes to the technologies used on the website,
- the introduction of new services,
- changes in how data is processed.
The current version of this policy is published at doubledigital.agency/privacy-policy together with the date of the last update.
19. Contact
For matters related to privacy, the processing of personal data and the exercise of your rights, you can contact us at:
Double Digital Sp. z o.o.ul. Grzybowska 8700-844 Warsaw, Polandcontact@doubledigital.agency
15. Social media
Double Digital runs profiles on social media platforms. If you follow our profiles, comment on posts, send messages or otherwise interact with our profiles, we may receive information you share on the given platform.
The platform provider also processes data under its own privacy policy. For certain statistical data about the use of Double Digital profiles, we may act jointly with the platform operator on the terms set by that operator.