Privacy Policy

PRIVACY POLICY OF THE LULA CLEANING PLATFORM

 

This Pri­va­cy Poli­cy (the „Poli­cy”) con­ta­ins infor­ma­tion abo­ut the pro­ces­sing of your per­so­nal data in con­nec­tion with your use of the „Lula Cle­aning” onli­ne plat­form, ava­ila­ble at https://lula.cleaning (the „Plat­form”).

Any capi­ta­li­sed terms not other­wi­se defi­ned in this Poli­cy have the meanings given to them in the Terms of Servi­ce, ava­ila­ble at: https://lula.cleaning/en/terms-and-conditions/.

 

Per­so­nal Data Controller

The con­trol­ler of your per­so­nal data is Lula Solu­tions sp. z o.o., with its regi­ste­red offi­ce in War­saw (regi­ste­red offi­ce address: ul. Hoża 29/31, 00 – 521 War­saw), ente­red into the Regi­ster of Entre­pre­neurs of the Natio­nal Court Regi­ster kept by the District Court for the Capi­tal City of War­saw in War­saw, 12^th Com­mer­cial Divi­sion of the Natio­nal Court Regi­ster under KRS no.: 0000977968, NIP (tax ID): 7011093598, REGON (sta­ti­sti­cal no.): 522355756, sha­re capi­tal: PLN 5,000 (the „Con­trol­ler”).

 

Con­tact with the Controller

For all mat­ters rela­ted to the pro­ces­sing of per­so­nal data you can con­tact the Con­trol­ler by ema­il at: sup­port A T lula . cleaning.

 

Per­so­nal data pro­tec­tion measures

The Con­trol­ler applies modern orga­ni­sa­tio­nal and tech­ni­cal safe­gu­ards to ensu­re the best possi­ble pro­tec­tion of your per­so­nal data and guaran­te­es that it pro­ces­ses them in accor­dan­ce with Regu­la­tion (EU) 2016/679 of the Euro­pe­an Par­lia­ment and of the Coun­cil of 27 April 2016 (the Gene­ral Data Pro­tec­tion Regu­la­tion, “GDPR”), the Polish Per­so­nal Data Pro­tec­tion Act of 10 May 2018, and other appli­ca­ble data pro­tec­tion laws.

 

Infor­ma­tion on pro­ces­sed per­so­nal data

Using the Plat­form requ­ires the pro­ces­sing of your per­so­nal data. Below you will find deta­iled infor­ma­tion on the pur­po­ses and legal bases of pro­ces­sing, as well as on the sto­ra­ge period and whe­ther pro­vi­ding the data is obli­ga­to­ry or voluntary.

Pur­po­se of processing	Per­so­nal data processed	Legal basis / Sto­ra­ge / Voluntariness
Conc­lu­sion and per­for­man­ce of the Landlord/Cleaning Com­pa­ny Acco­unt Servi­ce Agreement.	Ema­il address; first name; pho­ne num­ber; com­pa­ny name.	Art. 6(1)(b) GDPR (pro­ces­sing is neces­sa­ry for the per­for­man­ce of the Landlord/Cleaning Com­pa­ny Acco­unt Servi­ce Agre­ement conc­lu­ded with the data sub­ject, or to take steps at the requ­est of the data sub­ject prior to ente­ring into such agreement). Pro­vi­ding the abo­ve per­so­nal data is a con­di­tion for conc­lu­ding and per­for­ming the Landlord/Cleaning Com­pa­ny Acco­unt Servi­ce Agre­ement (pro­vi­ding them is volun­ta­ry, but the con­se­qu­en­ce of not pro­vi­ding them will be the ina­bi­li­ty to conc­lu­de and per­form the Agreement). The Con­trol­ler will pro­cess the abo­ve per­so­nal data until the limi­ta­tion periods for cla­ims ari­sing from the Landlord/Cleaning Com­pa­ny Acco­unt Servi­ce Agre­ement expire.
Conc­lu­sion and per­for­man­ce of the Plat­form Servi­ce Agreement.	Ema­il address; full name/company; pho­ne num­ber; NIP; REGON; regi­ste­red office/business/billing address.	Art. 6(1)(b) GDPR (pro­ces­sing is neces­sa­ry for the per­for­man­ce of the Plat­form Servi­ce Agre­ement conc­lu­ded with the data sub­ject, or to take steps at the requ­est of the data sub­ject prior to ente­ring into such agreement). Pro­vi­ding the abo­ve per­so­nal data is a con­di­tion for conc­lu­ding and per­for­ming the Plat­form Servi­ce Agre­ement (pro­vi­ding them is volun­ta­ry, but the con­se­qu­en­ce of not pro­vi­ding them will be the ina­bi­li­ty to conc­lu­de and per­form the Agreement). The Con­trol­ler will pro­cess the abo­ve per­so­nal data until the limi­ta­tion periods for cla­ims ari­sing from the Plat­form Servi­ce Agre­ement expire.
Conc­lu­sion and per­for­man­ce of the New­slet­ter or other Digi­tal Good Agreement.	Ema­il address; first name; sur­na­me; com­pa­ny; pho­ne number.	Art. 6(1)(b) GDPR (pro­ces­sing is neces­sa­ry for the per­for­man­ce of the New­slet­ter Agre­ement conc­lu­ded with the data sub­ject, or to take steps at the requ­est of the data sub­ject prior to ente­ring into such agre­ement), and Art. 6(1)(f) GDPR (pro­ces­sing is neces­sa­ry for the pur­po­ses of the Controller’s legi­ti­ma­te inte­re­sts, name­ly infor­ming abo­ut news and pro­mo­tions ava­ila­ble on the Platform). Pro­vi­ding the abo­ve per­so­nal data is volun­ta­ry but neces­sa­ry to rece­ive the New­slet­ter or other Digi­tal Good (the con­se­qu­en­ce of not pro­vi­ding them will be the ina­bi­li­ty to rece­ive the Newsletter/deliver the Digi­tal Good). The Con­trol­ler will pro­cess the abo­ve per­so­nal data until an effec­ti­ve objec­tion is lod­ged or the pur­po­se of pro­ces­sing is achie­ved, or until the limi­ta­tion periods for cla­ims ari­sing from the New­slet­ter or other Digi­tal Good Agre­ement expi­re (whi­che­ver occurs first).
Sen­ding ema­il notifications.	Ema­il address.	Art. 6(1)(f) GDPR (pro­ces­sing is neces­sa­ry for the pur­po­ses of the Controller’s legi­ti­ma­te inte­re­sts, name­ly infor­ming Users abo­ut actions taken in con­nec­tion with the pro­vi­sion of services). Pro­vi­ding the abo­ve per­so­nal data is volun­ta­ry but neces­sa­ry to rece­ive infor­ma­tion on actions rela­ted to the pro­vi­sion of servi­ces (the con­se­qu­en­ce of not pro­vi­ding them will be the ina­bi­li­ty to rece­ive such information). The Con­trol­ler will pro­cess the abo­ve per­so­nal data until an effec­ti­ve objec­tion is lod­ged or the pur­po­se of pro­ces­sing is achieved.
Ful­fil­ment of tax obli­ga­tions (inc­lu­ding issu­ing VAT invo­ices, reta­ining acco­un­ting documentation).	Full name/company; home/registered offi­ce address; NIP (tax ID).	Art. 6(1)© GDPR (pro­ces­sing is neces­sa­ry for com­plian­ce with a legal obli­ga­tion to which the Con­trol­ler is sub­ject, name­ly obli­ga­tions under tax law). Pro­vi­ding the abo­ve per­so­nal data is volun­ta­ry but neces­sa­ry for the Con­trol­ler to ful­fil its tax obli­ga­tions (the con­se­qu­en­ce of not pro­vi­ding them will be the ina­bi­li­ty for the Con­trol­ler to ful­fil such obligations). The Con­trol­ler will pro­cess the abo­ve per­so­nal data for 5 years from the end of the year in which the deadli­ne for pay­ment of tax for the pre­vio­us year expired.
Per­for­man­ce of obli­ga­tions rela­ted to per­so­nal data protection.	First name; sur­na­me; con­tact deta­ils (ema­il address, cor­re­spon­den­ce address, pho­ne number).	Art. 6(1)© GDPR (pro­ces­sing is neces­sa­ry for com­plian­ce with a legal obli­ga­tion to which the Con­trol­ler is sub­ject, name­ly obli­ga­tions ari­sing from data pro­tec­tion regulations). Pro­vi­ding the abo­ve per­so­nal data is volun­ta­ry but neces­sa­ry for the pro­per per­for­man­ce by the Con­trol­ler of its obli­ga­tions ari­sing from data pro­tec­tion laws, inc­lu­ding the exer­ci­se of your rights under the GDPR (the con­se­qu­en­ce of not pro­vi­ding the data will be the ina­bi­li­ty to pro­per­ly exer­ci­se such rights). The Con­trol­ler will pro­cess the abo­ve per­so­nal data until the expi­ry of the limi­ta­tion periods for cla­ims for bre­ach of data pro­tec­tion regulations.
Esta­bli­sh­ment, exer­ci­se or defen­ce of legal claims.	Full name/company; ema­il address; home/registered offi­ce address; PESEL (Polish natio­nal ID); NIP (tax ID).	Art. 6(1)(f) GDPR (pro­ces­sing is neces­sa­ry for the pur­po­ses of the Controller’s legi­ti­ma­te inte­re­sts, name­ly the esta­bli­sh­ment, exer­ci­se or defen­ce of cla­ims that may ari­se in con­nec­tion with the per­for­man­ce of agre­ements conc­lu­ded with the Controller). Pro­vi­ding the abo­ve per­so­nal data is volun­ta­ry but neces­sa­ry for the esta­bli­sh­ment, exer­ci­se or defen­ce of such cla­ims (the con­se­qu­en­ce of not pro­vi­ding them will be the ina­bi­li­ty of the Con­trol­ler to under­ta­ke the­se actions). The Con­trol­ler will pro­cess the abo­ve per­so­nal data until the expi­ry of the limi­ta­tion periods for cla­ims that may ari­se in con­nec­tion with the per­for­man­ce of agre­ements conc­lu­ded with the Controller.
Ana­ly­sis of your acti­vi­ty on the Platform.	Date and time of visit; devi­ce IP address; devi­ce ope­ra­ting sys­tem type; appro­xi­ma­te loca­tion; web brow­ser type; time spent on the Plat­form; sub­pa­ges visi­ted and other actions per­for­med within the Platform.	Art. 6(1)(f) GDPR (pro­ces­sing is neces­sa­ry for the pur­po­ses of the Controller’s legi­ti­ma­te inte­re­sts, name­ly obta­ining infor­ma­tion abo­ut your acti­vi­ty on the Plat­form, inc­lu­ding ses­sion replay). Pro­vi­ding the abo­ve per­so­nal data is volun­ta­ry but neces­sa­ry for the Con­trol­ler to obta­in infor­ma­tion abo­ut your acti­vi­ty on the Plat­form (the con­se­qu­en­ce of not pro­vi­ding them will be the ina­bi­li­ty to obta­in such information). The Con­trol­ler will pro­cess the abo­ve per­so­nal data until an effec­ti­ve objec­tion is lod­ged or the pur­po­se of pro­ces­sing is achieved.
Admi­ni­stra­tion of the Platform.	IP address; server date and time; infor­ma­tion abo­ut the web brow­ser; infor­ma­tion abo­ut the ope­ra­ting system. The abo­ve data are auto­ma­ti­cal­ly recor­ded in server logs each time you use the Plat­form (admi­ni­stra­tion witho­ut server logs and auto­ma­tic recor­ding would not be possible).	Art. 6(1)(f) GDPR (pro­ces­sing is neces­sa­ry for the pur­po­ses of the Controller’s legi­ti­ma­te inte­re­sts, name­ly ensu­ring the pro­per func­tio­ning of the Platform). Pro­vi­ding the abo­ve per­so­nal data is volun­ta­ry but neces­sa­ry to ensu­re the pro­per ope­ra­tion of the Plat­form (the con­se­qu­en­ce of not pro­vi­ding them will be the ina­bi­li­ty to ensu­re the pro­per ope­ra­tion of the Platform). The Con­trol­ler will pro­cess the abo­ve per­so­nal data until an effec­ti­ve objec­tion is lod­ged or the pur­po­se of pro­ces­sing is achieved.

 

Pro­fi­ling

To cre­ate your pro­fi­le for mar­ke­ting pur­po­ses and to direct direct mar­ke­ting tailo­red to your pre­fe­ren­ces, the Con­trol­ler will pro­cess your per­so­nal data in an auto­ma­ted man­ner, inc­lu­ding pro­fi­ling; howe­ver, this will not pro­du­ce any legal effects con­cer­ning you or simi­lar­ly signi­fi­can­tly affect your situation.

The sco­pe of pro­fi­led per­so­nal data cor­re­sponds to the sco­pe indi­ca­ted abo­ve with respect to ana­ly­sing your acti­vi­ty on the Plat­form and the data you save in your account.

The legal basis for pro­ces­sing for the abo­ve pur­po­se is Art. 6(1)(f) GDPR, under which the Con­trol­ler may pro­cess per­so­nal data for the pur­po­ses of its legi­ti­ma­te inte­re­sts, name­ly con­duc­ting mar­ke­ting acti­vi­ties tailo­red to the pre­fe­ren­ces of reci­pients. Pro­vi­ding the abo­ve per­so­nal data is volun­ta­ry but neces­sa­ry to achie­ve the abo­ve pur­po­se (the con­se­qu­en­ce of not pro­vi­ding them will be the ina­bi­li­ty of the Con­trol­ler to con­duct mar­ke­ting acti­vi­ties tailo­red to reci­pients’ preferences).

The Con­trol­ler will pro­cess per­so­nal data for pro­fi­ling until an effec­ti­ve objec­tion is lod­ged or the pur­po­se of pro­ces­sing is achieved.

 

Reci­pients of per­so­nal data

The reci­pients of per­so­nal data may inc­lu­de the fol­lo­wing exter­nal enti­ties coope­ra­ting with the Controller:

hosting servi­ces provider;

doma­in provider;

ema­il sys­tem provider;

onli­ne pay­ment sys­tem providers;

Face­bo­ok social networ­king servi­ce provider;

Apple servi­ce provider;

onli­ne meeting sche­du­ling provider;

CRM sys­tem provider;

webi­nar sys­tem provider;

pro­vi­der of tools ena­bling the auto­ma­tic trans­la­tion of mes­sa­ges exchan­ged by Users into other languages;

com­pa­nies pro­vi­ding tools used to ana­ly­se acti­vi­ty on the Plat­form and to deli­ver direct mar­ke­ting to its users (inc­lu­ding Google Ads);

acco­un­ting office.

In addi­tion, per­so­nal data may be trans­fer­red to public or pri­va­te enti­ties if such an obli­ga­tion results from gene­ral­ly appli­ca­ble law, a final and bin­ding court judg­ment or a final and bin­ding admi­ni­stra­ti­ve decision.

 

Trans­fers of per­so­nal data to third countries

In con­nec­tion with the Controller’s use of servi­ces pro­vi­ded by Google LLC, your per­so­nal data may be trans­fer­red to the fol­lo­wing third coun­tries: the Uni­ted King­dom, Cana­da, the Uni­ted Sta­tes, Chi­le, Bra­zil, Isra­el, Sau­di Ara­bia, Qatar, India, Chi­na, South Korea, Japan, Sin­ga­po­re, Taiwan (Repu­blic of Chi­na), Indo­ne­sia and Australia.

The legal basis for trans­fer­ring data to the abo­ve third coun­tries is as follows:

• for the Uni­ted King­dom, Cana­da, Isra­el and Japan – Euro­pe­an Com­mis­sion ade­qu­acy deci­sions con­fir­ming an ade­qu­ate level of data pro­tec­tion in each of tho­se third countries;
• for the Uni­ted Sta­tes, Chi­le, Bra­zil, Sau­di Ara­bia, Qatar, India, Chi­na, South Korea, Sin­ga­po­re, Taiwan (Repu­blic of Chi­na), Indo­ne­sia and Austra­lia – con­trac­tu­al clau­ses ensu­ring an ade­qu­ate level of pro­tec­tion, in line with the stan­dard con­trac­tu­al clau­ses set out in Com­mis­sion Imple­men­ting Deci­sion (EU) 2021/914 of 4 June 2021 on stan­dard con­trac­tu­al clau­ses for the trans­fer of per­so­nal data to third coun­tries under Regu­la­tion (EU) 2016/679.

You may obta­in from the Con­trol­ler a copy of the data that are trans­fer­red to a third country.

 

Your rights

In con­nec­tion with the pro­ces­sing of per­so­nal data, you have the fol­lo­wing rights:

• the right to be infor­med which of your per­so­nal data are pro­ces­sed by the Con­trol­ler and to rece­ive a copy of tho­se data (the right of access). The first copy is free of char­ge; for addi­tio­nal copies, the Con­trol­ler may char­ge a fee;
• if the pro­ces­sed data beco­me out­da­ted, incom­ple­te or other­wi­se inac­cu­ra­te, you have the right to requ­est the­ir rectification;
• in cer­ta­in situ­ations, you may requ­est the Con­trol­ler to era­se your per­so­nal data, for exam­ple whe­re: (i) the data are no lon­ger needed by the Con­trol­ler for the pur­po­ses abo­ut which you were infor­med; (ii) you have effec­ti­ve­ly with­drawn your con­sent to the pro­ces­sing – pro­vi­ded that the Con­trol­ler has no other legal basis for pro­ces­sing; (iii) the pro­ces­sing is unlaw­ful; or (iv) the era­su­re is requ­ired for the Con­trol­ler to com­ply with a legal obligation;
• whe­re per­so­nal data are pro­ces­sed by the Con­trol­ler on the basis of con­sent or for the per­for­man­ce of a con­tract conc­lu­ded with the Con­trol­ler, you have the right to data portability;
• whe­re per­so­nal data are pro­ces­sed by the Con­trol­ler on the basis of your con­sent, you have the right to with­draw that con­sent at any time (the with­dra­wal does not affect the law­ful­ness of pro­ces­sing based on con­sent befo­re its withdrawal);
• if you con­si­der that your per­so­nal data are inac­cu­ra­te, the­ir pro­ces­sing is unlaw­ful, or the Con­trol­ler no lon­ger needs cer­ta­in data, you may requ­est that, for a neces­sa­ry period (e.g. to veri­fy the accu­ra­cy of the data or to establish/defend cla­ims), the Con­trol­ler refra­in from per­for­ming any ope­ra­tions on the data and only sto­re them (restric­tion of processing);
• you have the right to object to the pro­ces­sing of per­so­nal data whe­re the legal basis for pro­ces­sing is the Controller’s legi­ti­ma­te inte­re­sts. If the objec­tion is effec­ti­ve, the Con­trol­ler will cease pro­ces­sing the per­so­nal data for that purpose;
• you have the right to lod­ge a com­pla­int with the Pre­si­dent of the Per­so­nal Data Pro­tec­tion Offi­ce (Pre­zes Urzę­du Ochro­ny Danych Oso­bo­wych) if you con­si­der that the pro­ces­sing of per­so­nal data infrin­ges the GDPR.

 

Cookies

The Plat­form uses “cookies”, which are instal­led on your ter­mi­nal devi­ce. The­se are small text files that can be read by the Controller’s sys­tem, as well as by sys­tems belon­ging to other enti­ties who­se servi­ces the Con­trol­ler uses (e.g. Face­bo­ok, Google).

The Con­trol­ler uses cookies for the fol­lo­wing purposes:

• ensu­ring the pro­per ope­ra­tion of the Plat­form – cookies make it possi­ble for the Plat­form to ope­ra­te smo­oth­ly, for you to use its featu­res and to move conve­nien­tly betwe­en subpages;
• impro­ving your brow­sing expe­rien­ce on the Plat­form – cookies make it possi­ble to detect errors on some sub­pa­ges and to con­ti­nu­ously impro­ve them;
• com­pi­ling sta­ti­stics – cookies are used to ana­ly­se how Users use the Plat­form. This allows the Plat­form to be con­ti­nu­ously impro­ved and adap­ted to Users’ preferences;
• con­duc­ting mar­ke­ting acti­vi­ties – cookies allow the Con­trol­ler to direct adver­ti­se­ments tailo­red to Users’ preferences.

The Con­trol­ler may pla­ce both per­si­stent and ses­sion cookies on your devi­ce. Ses­sion cookies are usu­al­ly dele­ted when you clo­se your brow­ser, whi­le clo­sing the brow­ser does not remo­ve per­si­stent cookies.

Infor­ma­tion abo­ut the cookies used by the Con­trol­ler is display­ed in the panel loca­ted at the bot­tom of the Platform’s websi­te. Depen­ding on your cho­ice, you can ena­ble or disa­ble cookies in indi­vi­du­al cate­go­ries (except for neces­sa­ry cookies) and chan­ge the­se set­tings at any time.

Data col­lec­ted via cookies do not allow the Con­trol­ler to iden­ti­fy you.

The Con­trol­ler uses the fol­lo­wing cookies or tools that use cookies:

TOOL	PROVIDER	FUNCTIONS AND SCOPE OF DATA COLLECTED	OPERATING PERIOD
Neces­sa­ry cookies	Con­trol­ler	The ope­ra­tion of the­se cookies is neces­sa­ry for the pro­per func­tio­ning of the Platform’s websi­te, the­re­fo­re you can­not disa­ble them. Thanks to the­se cookies (which col­lect, among other things, the IP num­ber of your devi­ce), it is possi­ble, among other things, to log in and use the Plat­form, as well as to col­lect infor­ma­tion abo­ut your acti­vi­ty on the Plat­form, inc­lu­ding ses­sion replay.	Most neces­sa­ry cookies are ses­sion cookies, but some rema­in on your ter­mi­nal devi­ce for up to 2 years or until they are deleted;
Google	Google	This tool allows regi­stra­tion and log­ging in using the Google but­ton (if you use this form of log­ging in).	Up to 2 years or until they are dele­ted (whi­che­ver occurs first)
Face­bo­ok	Face­bo­ok	This tool allows regi­stra­tion and log­ging in using the Face­bo­ok but­ton (if you use this form of log­ging in).	Up to 2 years or until they are dele­ted (whi­che­ver occurs first)
Apple	Apple	This tool allows regi­stra­tion and log­ging in using the Apple but­ton (if you use this form of log­ging in).	Up to 2 years or until they are dele­ted (whi­che­ver occurs first)

Thro­ugh most com­mon­ly used brow­sers you can check whe­ther cookies have been instal­led on your ter­mi­nal devi­ce, remo­ve instal­led cookies and block the Plat­form from instal­ling them in the futu­re. Howe­ver, disa­bling or restric­ting cookies may cau­se sub­stan­tial dif­fi­cul­ties in using the Plat­form, e.g. the need to log in on eve­ry sub­pa­ge, lon­ger loading times, and limi­ta­tions in using cer­ta­in functionalities.

 

Final pro­vi­sions

To mat­ters not regu­la­ted by this Poli­cy, gene­ral­ly appli­ca­ble data pro­tec­tion laws apply.

This Poli­cy has been in for­ce sin­ce 1 July 2023.