Privacy policy

§ 1. General information

1. This Privacy Policy sets out the principles governing the processing of personal data by SF-LABS sp. z o.o. and by Event Organizers using the System, as well as the rules regarding the use of Cookies and tracking technologies in connection with the operation of the Platform.

2. The Platform enables external Event Organizers to organize Events and operates as a Software as a Service (SaaS) tool. Depending on the role and the scope of the data processed, either SF-LABS or the Event Organizer may act as the Data Controller, in accordance with the provisions set out further in this Privacy Policy.

3. For the purposes of this Privacy Policy, the following terms shall have the meanings set out below:

1. Data Controller - the controller of personal data, i.e. the entity that independently determines the purposes and means of processing personal data. The Data Controller may be the Event Organizer and/or SF-LABS.
2. Cookies - IT data stored on the User's end device, used, among other things, to ensure the proper functioning of the Platform as well as for statistical and marketing purposes.
3. Personal Data - information about an identified or identifiable natural person, processed via the Platform,
4. Account - a set of resources and settings assigned to a given User or Organizer in the System, enabling access to the Platform's functionalities in accordance with granted permissions,
5. Organizer - an entity that holds an Account in the System and uses the Platform to organize Events. The Organizer is the Data Controller of the personal data of Participants of its Event,
6. Platform / System - the system enabling the organization of Events as well as the registration and management of Participants, available at www.sf-conference.com,
7. Payer - an entity making payment for services offered by the Organizer using payment services provided by SF-LABS on behalf of the Organizer,
8. Policy - this Privacy Policy,
9. GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation),
10. SF-LABS - SF-LABS sp. z o.o. with its registered office in Kraków (30-443) at ul. Józefa Marcika 6, Tax ID (NIP): 6793213075, National Business Registry Number (REGON): 388297924, entered into the register of entrepreneurs of the National Court Register maintained by the District Court for Kraków-Śródmieście in Kraków, 11th Commercial Division of the National Court Register under KRS number 0000886671,
11. Participant - an entity that has registered for an Event organized by the Organizer via the System or has been registered by another person (e.g., a representative), regardless of having an Account in the System,
12. Agreement - agreements concluded with Users,
13. User - any natural person using the Platform,
14. Demo Version - a functionally and time-limited version of the System, provided free of charge by SF-LABS to allow the Organizer to become familiar with the System's operation,
15. Event - an event, conference, meeting, seminar, competition, or other form of activity organized by the Organizer via the System, to which registration, communication, payment, or other functions performed under the Agreements relate.

4. The entity responsible for performing the tasks set out in this Privacy Policy is the Data Controller.

5. The personal data of Users is processed in accordance with:

1. the Act of 10 May 2018 on the Protection of Personal Data (Journal of Laws of 2018, item 1000, as amended),
2. the provisions of the GDPR,
3. the Act of 18 July 2002 on the Provision of Electronic Services (Journal of Laws of 2020, item 344, consolidated text),
4. the Act of 1 March 2018 on Counteracting Money Laundering and Terrorist Financing (Journal of Laws of 2018, item 723, as amended).

6. The provision of personal data by the User is voluntary; however, it is necessary for the conclusion of a contract and the provision of services by the Data Controller, in particular for event registration, ticket purchase, payment processing, and the fulfillment of accounting and legal obligations. Failure to provide the required data will prevent the use of the Platform's services.

§ 2. Data Controllers

1. The Data Controller of Users of the Platform, including Organizers, Participants, persons using contact forms, the Demo Version, and any data collected in connection with the operation of the System, is SF-LABS.

2. Event Organizers who use the Platform to manage registration and handle Participants of their Events act as independent Data Controllers of the personal data of those Participants. Organizers bear sole responsibility for fulfilling information obligations and ensuring the proper processing of Participants' personal data in accordance with GDPR requirements.

3. There is no joint controllership relationship between SF-LABS and the Event Organizer with respect to personal data. Each entity acts in its own name and is solely responsible for the data it processes.

4. For matters concerning the processing of personal data by SF-LABS, contact may be made via email at office@sf-labs.com or in writing to SF-LABS's registered office address.

5. For matters concerning the processing of data by the Event Organizer, Users should contact the Organizer directly - contact details are provided in the Organizer's documentation (e.g. event terms and conditions or registration form).

6. The System enables Organizers to publish their own privacy policies for participants of their events. In such cases, SF-LABS bears no responsibility for the content or the fulfillment of information obligations arising from those documents. The Organizer, as an independent Data Controller of Participants' personal data, is obliged to ensure that its own policy complies with applicable law, in particular the GDPR.

§ 3. Categories of data and sources of their collection

1. The scope of personal data processed by SF-LABS or the Event Organizer depends on the nature of the relationship with the User and the purpose of processing. Personal data may be obtained directly from the User or from IT systems used by the Platform.

2. In particular, the following categories of personal data may be processed:

1. Identification and contact data of Participants or Organizers, provided during Account registration or participation in an Event:
   1. full name;
   2. email address;
   3. phone number,
   4. affiliation, job title,
   5. name and address of institution or company,
   6. correspondence address,
   7. country of residence,
   8. PESEL number or date of birth,
   9. nationality;
   10. identity document series and number;
   11. account login and password (stored in encrypted form),
   12. tax identification number (NIP - in the case of business activity),
   13. KRS number,
   14. IP address,
   15. electronic signature (if used).
2. Data relating to the use of the Platform and its functionalities:
   1. data provided in contact forms, quote requests, paper submission forms, consent forms, and invitation forms,
   2. registration and editing data of Events (e.g. event description, agenda, speaker names),
   3. session and activity history data (session duration, clicks, language preferences, Account settings),
   4. communication data (e.g. correspondence content, chats with Participants),
3. Data related to use of the demo version of the Platform:
   1. test data (e.g. fictitious Participants, test Events),
   2. technical data of test sessions and Accounts,
   3. organizer activity within the Demo Version,
   4. data entered by the Organizer.
4. Data collected automatically by the Platform's IT systems:
   1. IP address,
   2. operating system data, web browser, device type and identifier,
   3. system logs and diagnostic data (e.g. error messages, HTTP response codes),
   4. session identifiers and authentication tokens,
   5. data on Platform usage (response times, number of pages visited, traffic source).
5. Data collected via cookies and similar technologies:
   1. device identifiers,
   2. session data,
   3. user preferences (language, cookie consents),
   4. identifiers assigned by external tools (e.g. Google Analytics, Facebook Pixel, etc.). Detailed information is provided in § 9.
6. Data related to payment processing and SF-LABS payment activities as a payment institution:
   1. payer identification data (name, surname, email address, IP address),
   2. transaction data (order number, date, amount, operation status),
   3. payment instrument data (e.g. account number, card type, payment service provider data),
   4. KYC and AML procedure data (e.g. copies of identity documents, residential address, source of funds).

3. In the case of payments for participation in an Event, the following transaction-related data may also be processed:

1. identification data: name, surname, email address, phone number, bank account details, residential or business address, business entity data,
2. payment instrument data: last digits of card number, card type, expiry date, CVV/CVC code (if required - processed exclusively by the payment operator),
3. transaction data: transaction ID, amount, currency, date and time, payment status, payment title,
4. source of funds data: bank statements, screenshots, or other documents,
5. technical data: IP address, device information, system logs, session information,
6. AML/KYC data: PESEL number, citizenship, identity document (series and number), data of beneficial owners/authorized persons/representatives (if applicable), PEP status (or status of close associate/family member),
7. selected payment operator, payment method, transaction status.

4. The personal data indicated in paragraph 3 may be collected directly by payment operators (e.g. PayU, Przelewy24, imoje), in accordance with their privacy policies.

5. Personal data may be obtained:

1. directly from the User during registration or use of the Services,
2. via payment operators (e.g. PayU, Przelewy24, imoje),
3. from third parties (e.g. client representatives, external verification providers - within KYC procedures),
4. from publicly available databases or registers - to the extent necessary to fulfill AML obligations.

6. Personal data is processed in accordance with the principle of data minimization, within the scope necessary to achieve the purposes indicated in the following sections of the Policy.

§ 4. Purposes and Legal Bases for Processing

1. Personal data is processed by SF-LABS and Event Organizers for the purpose of performing specific Platform functions, on the basis of appropriate legal grounds in accordance with Article 6 of the GDPR.

2. In the case of SF-LABS, personal data is processed for the following purposes:

1. providing electronic services and ensuring the functionality of the Platform - on the basis of Article 6(1)(b) GDPR (necessity for the performance of a contract),
2. ensuring technical security and operation of the System, including creation of technical logs and maintaining operation records - on the basis of Article 6(1)(f) GDPR (legitimate interest of the Controller),
3. handling inquiries submitted via contact forms, requests, and email correspondence - on the basis of Article 6(1)(f) GDPR or Article 6(1)(a) GDPR (consent, where required),
4. conducting marketing activities related to SF-LABS' own products and services, including sending newsletters - on the basis of Article 6(1)(a) GDPR (consent) or Article 6(1)(f) GDPR (legitimate interest),
5. performing analyses and statistics on Platform usage in order to improve and develop it - on the basis of Article 6(1)(f) GDPR,
6. fulfilling legal obligations arising from tax, accounting, and payment service regulations (in particular when acting as a Small Payment Institution) - on the basis of Article 6(1)(c) GDPR,
7. providing payment services, including transaction processing, payment instrument data handling, ensuring transaction security, and settlements - on the basis of Article 6(1)(b) and 6(1)(c) GDPR and provisions of the Payment Services Act,
8. fulfilling obligations under the Anti-Money Laundering and Counter-Terrorist Financing Act (AML), including customer identification and verification (KYC procedures), transaction monitoring, AML risk assessment, and reporting suspicious transactions to the General Inspector of Financial Information (GIIF) - on the basis of Article 6(1)(c) GDPR,
9. preventing payment fraud, detecting and blocking unauthorized transactions, and counteracting abuse - on the basis of Article 6(1)(f) GDPR,
10. handling complaints and requests regarding transactions - on the basis of Article 6(1)(f) GDPR,
11. pursuing or defending against claims - on the basis of Article 6(1)(f) GDPR,
12. conducting technical tests and Platform development using test data, anonymized data, or - to a minimal extent - real operational data - on the basis of Article 6(1)(f) GDPR,
13. preventing abuse, ensuring payment security, blocking unauthorized access, and detecting hacking attempts or unauthorized use of the System - on the basis of Article 6(1)(f) GDPR (legitimate interest of the Controller),
14. enabling password reset and user identity verification in case of suspected unauthorized access - on the basis of Article 6(1)(b) or 6(1)(f) GDPR,
15. fulfilling tax and accounting obligations, including archiving transaction documentation - on the basis of Article 6(1)(c) GDPR.

3. In the case of the Event Organizer, personal data is processed for the following purposes:

1. registration of Participants and management of the Event (including payment handling, communication, and invoicing) - on the basis of Article 6(1)(b) GDPR (performance of a contract) or Article 6(1)(c) GDPR (legal obligation),
2. fulfilling information obligations towards Participants - on the basis of Article 6(1)(c) GDPR,
3. communicating with Participants regarding organizational matters - on the basis of Article 6(1)(f) GDPR (legitimate interest of the Organizer),
4. handling inquiries submitted via contact forms, requests, and email correspondence - on the basis of Article 6(1)(f) GDPR or Article 6(1)(a) GDPR (consent, where required),
5. conducting statistics and reporting on the Event - on the basis of Article 6(1)(f) GDPR,
6. conducting marketing activities related to the Organizer's products and services, including sending newsletters - on the basis of Article 6(1)(a) GDPR (consent) or Article 6(1)(f) GDPR (legitimate interest).

4. Where processing is based on consent, the User has the right to withdraw consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.

5. To the extent necessary for the proper functioning of the Platform, its features, and the correct execution of payment operations, the Platform uses User metadata. Metadata refers to the process by which the IT system reads and recognizes the configuration and components of the User's computer in order to adapt the website to its capabilities and establish a secure connection between the User's device and the Platform. Importantly, such metadata cannot lead to User identification and is not in any way harmful to data stored on the device. Nevertheless, the User has the right to withdraw consent for metadata processing at any time by appropriately configuring their browser or installing a relevant plugin provided by the browser manufacturer. For this purpose, the User should consult the software provider and its recommendations.

§ 5. Processors and Data Recipients

1. Personal data processed within the Platform may be entrusted to external service providers acting on behalf of SF-LABS or Event Organizers, in accordance with Article 28 of the GDPR.

2. In the case of SF-LABS, data may be processed by entities providing:

1. hosting and data storage services (e.g. Amazon Web Services),
2. email delivery and communication automation services (e.g. Mailgun, Brevo),
3. technical support and Platform analytics services,
4. administrative maintenance of internal systems and tools.

3. In the case of online payments made by Event Participants, personal data may be transferred to payment service providers - such as PayU S.A., PayPro S.A. (Przelewy24), or ING Bank Śląski S.A. (imoje) – to the extent necessary to process transactions.

4. SF-LABS may use further data processors (sub-processors), whose categories or names are made available on the Privacy Policy website. All processors act under appropriate data processing agreements and ensure at least an equivalent level of security and GDPR compliance.

5. Event Organizers, acting as independent Data Controllers, may transfer Participants' personal data to their own processors (e.g. accounting firms, mailing service providers, payment service providers) solely under their own responsibility and in accordance with concluded data processing agreements. SF-LABS bears no responsibility for the actions of such entities.

6. Personal data may also be disclosed to authorized public authorities where such an obligation arises from mandatory legal provisions.

§ 6. Data Transfers Outside the EEA

1. Personal data processed within the Platform may be transferred outside the European Economic Area (EEA) only where it is necessary for the performance of services provided by SF-LABS or its processors - in particular when using tools offered by providers established outside the EEA (e.g. Google LLC, Mailgun Technologies, Inc.).

2. In the cases referred to in paragraph 1 above, data transfers are carried out in accordance with Chapter V of the GDPR, in particular on the basis of:

1. standard contractual clauses adopted by the European Commission (SCCs),
2. an adequacy decision issued by the European Commission,
3. binding corporate rules, or other legally permitted safeguard mechanisms.

3. SF-LABS ensures that all entities processing data outside the EEA guarantee an adequate level of protection of personal data and comply with the requirements of the GDPR.

4. The Controller always informs Users about the intention to transfer personal data outside the EEA at the time of its collection.

§ 7. Data Retention Period

1. Personal data processed by SF-LABS is stored for the period necessary to achieve the purposes for which it was collected, and thereafter for the period required by law or justified by the legitimate interests of the Controller, including in particular:

1. data of Users holding an Account - until the Account is deleted by the User or deactivated by SF-LABS in the event of inactivity or termination of cooperation,
2. technical data and system logs - for a period not exceeding 12 months, unless applicable law provides otherwise,
3. data entered within the Demo Version - stored for up to 30 days from the creation of the demo Account or the last login,
4. data of Organizers - for the entire duration of the cooperation and for the period necessary to settle services and secure potential claims (as a rule, up to 6 years after termination of cooperation),
5. personal data of Payers and Organizers processed in connection with payment services - for at least 5 years from the date of transaction or termination of the business relationship, in accordance with Article 49 of the Act on Counteracting Money Laundering and Terrorist Financing,
6. data related to accounting and financial documentation - for 10 years from the end of the financial year to which it relates, in accordance with tax and accounting regulations,
7. data collected within KYC procedures - for at least 5 years from the termination of the business relationship or from the date of an occasional transaction, in accordance with the Act on Counteracting Money Laundering and Terrorist Financing.

2. Personal data of Event Participants processed by Organizers as independent Controllers is stored in accordance with their internal privacy policies and applicable law - SF-LABS is not responsible for the retention periods determined by Organizers.

3. After the periods indicated in paragraph 1 expire, personal data is permanently deleted or anonymized in a manner that prevents identification of the data subject, unless further retention is required by law.

§ 8. Rights of Data Subjects

1. Each person whose data is processed in connection with the use of the Platform is entitled to the rights provided for under the GDPR, in particular:

1. the right of access to their data and to receive a copy thereof,
2. the right to rectification (correction) of data,
3. the right to erasure of data ("right to be forgotten"),
4. the right to restriction of processing,
5. the right to data portability to another Controller,
6. the right to object to the processing of data,
7. the right to withdraw consent to data processing - where processing is based on consent.

2. To exercise their rights, the User should:

1. in the case of data processed by SF-LABS - contact the Controller at: office@sf-labs.com or in writing to SF-LABS's registered office address,
2. in the case of data processed by the Event Organizer - contact the Organizer directly, whose contact details are provided in the Event documentation (e.g. event terms and conditions or registration form).

3. Every data subject also has the right to lodge a complaint with the President of the Personal Data Protection Office if they believe that the processing of their personal data violates GDPR provisions.

§ 9. Cookies and Tracking Technologies

1. Cookies are defined as IT data, in particular text files, stored on Users' end devices (usually on a computer hard drive or mobile device), used to store specific settings and data in the User's browser for the purpose of using websites. These files allow the User's device to be recognized and the website to be properly displayed, ensuring a comfortable browsing experience. Storing Cookies therefore enables appropriate customization of the website and its content according to the User's preferences - the server recognizes the User and remembers, among other things, preferences such as visits, clicks, and previous actions.

2. Cookies contain in particular the name of the website domain from which they originate, the storage time on the end device, and a unique number used to identify the browser used to connect to the website.

3. Cookies are used for:

1. adapting website content to User preferences and optimizing website usage,
2. creating anonymous statistics which help determine how Users use the website, enabling improvement of its structure and content,
3. delivering advertising content tailored to Users' interests.

4. Cookies do not serve to identify Users, and their identity is not determined on their basis.

5. The basic classification of Cookies is as follows:

1. Necessary Cookies - strictly required for the proper functioning of the website or features the User wishes to use, as without them many services could not be provided. Some also ensure the security of electronically provided services.
2. Functional Cookies - important for website operation because:
   1. they enhance website functionality; without them the website will still function, but will not be tailored to User preferences,
   2. they ensure a high level of functionality; without them functionality may be reduced, but access is still possible,
   3. they support most website features; blocking them may cause selected functions to stop working properly.
3. Business Cookies - enable the business model under which the website is provided; blocking them will not make the website fully unavailable but may reduce service quality due to the inability to generate revenue supporting its operation (e.g. advertising cookies).
4. Configuration Cookies - allow configuration of functions and services on websites.
5. Security and reliability Cookies - enable authentication verification and optimization of website performance.
6. Authentication Cookies - indicate when a User is logged in, allowing the website to display appropriate information and features.
7. Session state Cookies - store information about how Users use the website, such as most visited pages or error messages. They help improve services and browsing comfort.
8. Process Cookies - support the proper functioning of the website and its features.
9. Advertising Cookies - enable display of more relevant ads to Users and more valuable ads for publishers and advertisers; they may also be used for ad personalization and displaying ads outside the website.
10. Location Cookies - allow tailoring displayed information to the User's location.
11. Analytics, research, and audience measurement Cookies - allow website owners to better understand User preferences and improve products and services through analysis. Typically, aggregated anonymous data is collected without identifying individual Users.
12. Harmless Cookies - necessary for proper website operation and functionality; they do not involve tracking Users.
13. Tracking Cookies - used to track Users, but do not contain information enabling identification of a specific User without additional data.

6. Using Cookies to tailor website content to User preferences does not generally involve collecting information enabling User identification, although such information may occasionally constitute personal data. Personal data collected via Cookies is used solely to perform specific functions for the User. Such data is encrypted in a way that prevents unauthorized access.

7. Cookies used by this website are not harmful to Users or their devices, therefore it is recommended not to disable them for proper functioning of the service. In most cases, browser software allows Cookies and similar technologies by default. Users may change Cookie settings at any time in their browser; instructions depend on the specific browser used.

8. Cookies are also used to facilitate login to the Organizer Account and to allow navigation between subpages without repeated login. They are also used for security purposes, such as preventing unauthorized access.

9. Within Cookie technology, the Controller may use tracking pixels or clear GIF files to collect information about how Users interact with services and marketing emails. A pixel is a software code embedded on a page, usually a one-pixel image, which enables tracking User behavior on websites. After consent is given, the browser automatically connects to the server hosting the pixel; processing is then governed by the privacy policy of the relevant partner.

10. The Controller may use web logs (containing technical data such as IP address) to monitor traffic, troubleshoot technical issues, detect and prevent fraud, and enforce User Agreement terms.

11. The Controller informs that the website does not respond to Do Not Track (DNT) signals. However, Users may disable certain forms of tracking, including analytics and personalized advertising, by adjusting cookie settings or using consent tools (if applicable).

12. Detailed information on changing and managing Cookies in popular browsers is available in their help sections, including:

1. Google Chrome
2. Mozilla Firefox
3. Microsoft Edge
4. Opera
5. Safari macOS
6. Safari iOS/iPad OS

13. Information on managing Cookies on mobile devices can be found in the device's instruction manual.

§ 10. Changes to the Privacy Policy

1. SF-LABS reserves the right to amend this Privacy Policy at any time, in particular in the event of:

1. changes in legal regulations concerning personal data protection or electronic services,
2. implementation of new Platform functionalities,
3. the need to clarify provisions or improve their transparency,
4. changes in technology, tools, or external services used.

2. Users will be informed of any material changes to the Policy in advance - at least 14 days before they take effect - via:

1. a notice displayed on the Platform or website,
2. an email message (if the User has provided an email address for communication),
3. an updated version of the document indicating the effective date.

3. Archived versions of the Privacy Policy will be made available for review on the Platform's website or upon request submitted to SF-LABS.

4. Continued use of the Platform after the effective date of the changes will be deemed acceptance of the updated Privacy Policy.

§ 11. Contact Details and Final Provisions

1. In case of any questions, requests, or demands regarding the processing of personal data by SF-LABS, Users may contact us via email at: office@sf-labs.com

2. For matters concerning data processed by the Event Organizer, contact should be made directly with that Organizer - contact details should be provided in the documentation for the relevant Event or in its registration form.

3. This Policy is effective as of the date of its publication on the Platform's website. The current version of the document is available under the "Privacy Policy" section.