Privacy Policy

We are very pleased that you have trusted us with your personal information. We would like to assure you that we will take all reasonable actions to protect your personal data. Below you will find details about how we process your personal information (hereinafter collectively referred to as the “Privacy Policy”) in the following situations:

• when you visit the website www.ailleron.com, www.livebank24.com (hereinafter referred to as the “Website”),
• when you contact us, including for example via contact forms on the Website, in person, by traditional mail, or by email,
• when you are a shareholder or perform management duties at Ailleron and Ailleron fulfills its legal obligations through the website www.ailleron.com.

Personal Data Administrator

The administrator of your personal data processed in accordance with this Privacy Policy is Ailleron Spółka Akcyjna, headquartered in Kraków, address: al. Jana Pawła II 43b, 31-864 Kraków, registered in the Register of Entrepreneurs of the National Court Register under the number KRS 0000385276 (hereinafter: “Ailleron”).

For matters concerning your personal data, you can contact us:

• by traditional mail or in person at the address al. Jana Pawła II 43b, 31-864 Kraków,
• or by email at: [email protected].

Purpose and Legal Basis of Processing

Your personal data, which we obtain in situations covered by this Privacy Policy, will be processed for the following purposes:

• responding to inquiries directed to us via contact forms or messages sent to our contact details – based on our legitimate interest as the data controller.
• fulfilling legal obligations incumbent on Ailleron as a joint-stock company listed on the Stock Exchange – based on national and European Union laws imposing such obligations, including regulations governing the functioning of commercial companies and their obligations towards shareholders and reporting obligations.
• fulfilling legal obligations incumbent on Ailleron related to the provision of intermediary services, including content moderation and receiving notifications of illegal content in provided services, in accordance with Article 16(1) of Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a single market for digital services and amending Directive 2000/31/EC (Digital Services Act) (“Notification”) or complaints about decisions made as a result of handling the Notification (“Complaint”) – based on the aforementioned European Union laws and national laws imposing such obligations.
• analyzing the use of the Website, as well as improving its functionality and security – based on our legitimate interest as the data controller.
• pursuing and defending against claims, before courts and administrative bodies, as well as outside of them – based on our legitimate interest as the data controller.
• direct marketing of products or services – based on our legitimate interest in the case of an existing business relationship, and based on your consent if we intend to establish such a relationship (from the time of consent until it is withdrawn).
• sending newsletters – based on our legitimate interest if you subscribe to our newsletter.
• archiving data and making backups – in connection with our obligation as the data controller to properly secure data and based on our legitimate interest as the data controller.

Data Processed for Contact Purposes – Scope of Processing

If you decide to contact us using the contact form available on our websites, provided email addresses, phone numbers, by traditional mail, or in person, as well as in situations where we have the right to contact you (e.g., for marketing purposes or if you are a shareholder of Ailleron), we will process such personal data that you give us or that are necessary to respond to your inquiry (including identification and contact details, as well as the IP address when using the contact form on our website), or that we have due to our existing relationship or have collected from publicly available sources. We process these data because they are necessary to fulfill the obligations arising from the aforementioned regulations or to pursue Ailleron’s legitimate interests, namely for the purpose of:

• responding to the message you sent to us and maintaining further contact with you,
• direct marketing of our own products and services as well as those of third parties (in situations where we do not have your consent to process data for marketing purposes),
• archiving and making backups of data in connection with our obligation as the data controller to properly secure data,
• if a Notification was made or a Complaint was filed regarding the content you submitted/provided – informing you of the decision made regarding such content.

Data Processed in Connection with Website Use – Scope of Processing

• When you use the Website, we record data such as: IP address, type and version of the device and browser you use, language, region, Website settings, cookie preferences, and how you use the Website. We may collect these data both in our Website server log and through additional technologies such as cookies. In most cases, we will not be able to identify you as a user and these data will be anonymous to us – our intention is not to collect your personal data. However, if we are able to link this information to you, which can happen when we have additional data from another source (e.g., we record such data when you contact us via the contact form on our Website), they become your personal data for us. We process these data:

• • because they are necessary for purposes arising from our legitimate interests, particularly:

• • • adjusting the way the Website is displayed and personalizing it,
    • saving data from forms to maintain session and facilitate the use of the Website,
    • analyzing behavior on the website to improve its functionality and protect against abuse,

• based on your consent – when these data are used for marketing purposes and we do not have an existing business relationship, or when they are collected to be shared with third parties.

Data Processed in Connection with a Notification or Complaint – Scope of Processing

In case of making a Notification or filing a Complaint, we will process such personal data as the name and email address of the notifier/complainant, data regarding the entity on whose behalf the notifier/complainant is acting and its position (if applicable), other data provided in the Notification or Complaint, as well as the IP address and data contained in the content that is the subject of the Notification or Complaint. Please note that providing personal data is a statutory requirement. The lack of providing data may result in the inability to process the Application or Complaint. We process the data due to the fact that it is necessary for the fulfillment of our obligations, which include:

• receiving and considering the Notification and informing about the decision made regarding the Notification, as well as about the possibility of appealing our decision made regarding the Notification,
• receiving and considering the Complaint and informing about the decision made by us regarding the filed Complaint,
• identifying the notifier/complainant as a person authorized to represent the entity on whose behalf the Notification or Complaint was made (if applicable),
• informing law enforcement or judicial authorities of the interested Member State or interested Member States about the suspicion that a crime threatening the life or safety of a person, or persons has been committed, is being committed, or may be committed, and providing all available information on this matter.

Data Processing Period

Your personal data will be processed:

• for contacting you: from the day they are collected until the correspondence regarding the matter in which you contacted us is concluded,
• for marketing purposes: for the duration of our legitimate interest, that is, the duration of our relationship or until the withdrawal of consent, if it was given to us,
• for the purpose of pursuing and defending against claims: for no longer than the statute of limitations for claims or the duration of a specific proceeding, if one is initiated,
• for the purpose of fulfilling legal obligations: for no longer than necessary to demonstrate that these obligations were fulfilled by Ailleron,
• for the purpose of improving the functionality and security of the Website: for as long as these data are necessary to achieve this purpose, but no longer than until you effectively object to their processing,
• for sending newsletters: from the day of subscription until you effectively object to their processing (unsubscribe from the newsletter),
• for the purpose of archiving and making backups: for a period determined in accordance with Ailleron’s backup and archiving policy.

Data Recipients

We will exercise due diligence in selecting the entities to which we will transfer your data and, in the case of such selected entities, we will require them to protect your data with appropriate technical and organizational measures. Your personal data may only be disclosed to:

• third parties providing services to us that are needed for the purposes for which we process your data (e.g. IT services, recruitment, electronic communications, hosting),
• entities in the Ailleron Group (entities affiliated with Ailleron), in particular when they provide services to each other, or as part of the internal administrative purposes of the Ailleron Group (e.g., when this results from the organization of tasks within the Group),
• recipients to whom disclosure is required by applicable law or order of a court or other authority,
• other recipients if you consent to them or if the transfer of data is necessary to protect your vital interests or the vital interests of other individuals or for the public good.

We particularly use the services of the following third parties:

HubSpot

We use HubSpot for inbound marketing, improving sales, and customer service. Generally, HubSpot acts as our data processor, but in some limited cases, it may process your data as a separate data controller. This can concern data related to your use of our Website, which has first been anonymized or aggregated and does not allow for direct user identification. This may happen when you start using our Website and consent to cookies placed by HubSpot on our Website, or when you further interact with us (e.g., by contacting us or becoming our customer) – in such a case, the basis for processing will be our legitimate interest or HubSpot’s legitimate interest. The purpose of data processing by HubSpot (in addition to providing services to us) is to support specific features and functionalities of HubSpot’s products and services (which is HubSpot’s legitimate interest). Further and more detailed information on how HubSpot uses your data and your rights can be obtained by visiting HubSpot’s privacy policy (https://legal.hubspot.com/privacy-policy) or by contacting HubSpot directly (using the contact form available here: https://preferences.hubspot.com/privacy or by mail at the address: HubSpot, Inc., 25 First Street, 2nd Floor, Cambridge, MA 02141, Attention: Privacy and Data Protection Officer).

Google

We use Google Analytics, a web analytics service offered by Google that tracks and reports information about Website traffic. This information is then shared with Google, which may use it to contextualize and personalize ads. You can opt out of sharing information about your activity on our Website with Google by installing the browser add-on to disable Google Analytics (available for download from this page: https://support.google.com/analytics/answer/181881?hl=pl). This add-on prevents Google Analytics JavaScript from sharing information about your activity with Google Analytics. You can also disable ad personalization here: https://adssettings.google.com/.

Data collected via Google Analytics may then be shared and used by other tools in the Google suite that we use (Google Ads, Google Tag Manager, and Google Search Console).

We also use reCAPTCHA, a service by Google that helps protect websites from spam and abuse. “CAPTCHA” is a Turing test to distinguish humans from bots. By adding reCAPTCHA to our Website, we can block automated software. For the reCAPTCHA API to work, it collects information about hardware and software (which in some cases may be personal data), such as device and application data, and sends it to Google for analysis.

For more information about Google’s privacy practices, visit Google’s Privacy & Terms website: https://policies.google.com/privacy and https://policies.google.com/terms.

Meta (formerly Facebook)

We use the Facebook Pixel provided by the social network Facebook, operated by Meta Platforms, Inc., 1 Hacker Way, Menlo Park, CA 94025, USA, or if you are an EU resident, by Meta Platforms Ireland Ltd., 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland (hereafter “Facebook”). The Facebook Pixel is a mechanism (a piece of JavaScript code) for tracking your activity on our Website to identify you as a target audience for our ads on Facebook. The Facebook Pixel also helps us track the effectiveness of our ads for statistical and market research purposes by checking if users visited our Website after seeing our ad on Facebook (conversion tracking). The Facebook Pixel stores a cookie on your device – if you log into Facebook or visit Facebook, your visit to our Website will be noted on your Facebook profile. By using the Facebook Pixel, we gain access to analytical data (which very rarely may be sufficient to identify you and become your personal data). Facebook collects and processes your data, which are associated with your Facebook profile (or sometimes with other data if you do not have a Facebook profile). Thus, we and Facebook are considered joint controllers concerning the aforementioned processing. The joint controllership agreement between Us and Facebook is available here: https://www.facebook.com/legal/controller_addendum.

More information about the Facebook Pixel can be found here: https://www.facebook.com/business/help/742478679120153?id=1205376682832142.

Information on how Facebook processes your personal data can be found here: https://www.facebook.com/privacy/explanation.

Transfer of Personal Data to Third Countries

Your personal data may be transferred to entities we cooperate with. Whenever your personal data is transferred outside the European Economic Area (EEA) or to countries that do not provide the same or an adequate level of personal data protection, we will ensure that it is done based on a valid legal basis and with the use of legally required safeguards.

Links to Third-Party Websites

The Website contains links to third-party websites. For visitors to these sites, different rules apply than those described here concerning the processing of personal data, and the data controller of the data processed there is different. We recommend familiarizing yourself with the personal data processing rules published by the administrators of these sites.

Social Media

Social Media Plugins

The Website includes social media plugins. By using the Website, the IP address of your device and the identifier of the browser you are using are transmitted to the providers of these social media platforms. Through this integration, the providers receive information that your browser has accessed our Website, even if you do not have a profile with the respective provider or are not currently logged in. Clicking on social media plugins also establishes a direct connection to the servers of these providers, who may collect other data from your device. Please note that we have no control over what data is collected by social media platforms after clicking on their buttons. For more information regarding the purpose and scope of data collected by these entities, and how your personal data is processed, used, protected, including your rights and privacy protection options, please visit:

• Facebook – Information on how Facebook processes personal data is available here: https://www.facebook.com/privacy/explanation. Please note that along with Facebook Ireland Limited (“Facebook”), Ailleron acts as joint controller regarding data processing for statistical purposes. Information about the terms of joint data processing by Ailleron and Facebook can be found here: https://www.facebook.com/legal/terms/page_controller_addendum. Information on how Facebook processes personal data for statistics purposes is available here: https://www.facebook.com/legal/terms/information_about_page_insights_data.

• Twitter, Inc., USA – Information on how Twitter processes personal data is available here: https://twitter.com/en/privacy.

We also manage our corporate profiles on social media platforms:

• In accordance with the agreement available at this address: https://www.facebook.com/legal/controller_addendum, we, together with Facebook, are joint controllers of your data processed through this profile. Facebook processes personal data in accordance with its privacy policy: https://www.facebook.com/privacy/explanation. Facebook is the main entity responsible for how as a Facebook user you can manage your own data protection rights.
• LinkedIn (managed by LinkedIn Corporation, 2029 Stierlin Court, Mountain View, 94043, USA, or if you are an EU resident, by LinkedIn Ireland Unlimited Company). Information on the rules applicable to us and LinkedIn under the agreement with LinkedIn, and how it affects your rights, can be found here: https://www.linkedin.com/legal/l/dpa.

Regarding our corporate profile, we have access to the first and last name of the registered person using the profile, their publicly visible photo, and other publicly designated information. In practice, these are elements that are accessible to all registered users. You may also provide us with other personal data in your comments or messages, such as requests for customer service through the aforementioned portals. Details on how we process such data are provided in point 3.

Rights

Regarding each of the rights listed below, you can contact us using the contact details provided in section 1 of the Privacy Policy. You have the following rights:

• Right to information, access to data, and obtaining a copy of data: You have the right to request information about your personal data that we store or to which we have access at any time. Upon your request, you will be provided with a free copy of your personal data undergoing processing. For any further copies requested, we may charge a reasonable fee based on administrative costs.
• Right to withdraw consent: Whenever your data is processed based on consent given, you have the right to withdraw that consent at any time. However, the withdrawal of consent will not affect the lawfulness of data processing based on consent before its withdrawal.
• Right to rectify personal data: We take reasonable steps to ensure that your personal data is correct, complete, and up-to-date. If changes to this data are necessary, please notify us accordingly.
• Right to data portability: You have the right to receive the personal data concerning you, which you have provided to us, in a structured, commonly used, and machine-readable format, and have the right to transmit those data to another controller where the processing is based on consent.
• Right to erasure of data and restriction of processing: In certain circumstances defined by data protection regulations, you have the right to request the erasure of your personal data. However, this right is not absolute, and there may be situations where we are entitled to continue processing your personal data. You may also request restriction of further processing of your data.
• Right to object to processing: In circumstances specified by law, you have the right to object to further processing of your data where processing is based on our legitimate interest.
• Right to lodge a complaint with a supervisory authority: You have the right to lodge a complaint with the supervisory authority responsible for data protection. As a rule, this will be the President of the Office for Personal Data Protection.

Cookies Policy and Use of Other Similar Technologies

The website uses cookies (small text files that are handled by the Website and stored on your device) and other similar technologies (including tools from Google Inc.: Google reCAPTCHA v3, Google Analytics, Google Ads, Google Search Console, and Google Tag Manager, from HubSpot, Inc., as well as tools for so-called pixel tracking – Facebook Pixel and LinkedIn InsightTag). The entity utilizing these tools is the administrator of the Website, namely Ailleron S.A. with its registered office in Kraków, address: al. Jana Pawła II 43b, 31-864 Kraków, entered into the register of entrepreneurs kept by the District Court for Kraków-Śródmieście in Kraków, Commercial Division XI of the National Court Register under KRS number 0000385276.

The Website uses the mentioned tools for various purposes, including:

• adjusting the display of the Website to users’ devices, software, and preferences, as well as their selected settings,
• monitoring how users interact with the Website and improving its functionality,
• personalizing the content offered,
• directing more tailored content to users through other websites.

We use the following types of cookies:

• analytical cookies that analyze user behavior on the Website,
• functional cookies that allow remembering user settings and personalization (e.g., regarding language chosen or acceptance of cookie settings),
• third-party cookies – cookies from other entities may also be stored on devices used, such as marketing cookies used to tailor displayed ads to preferences. Our partners – Google, Facebook, and LinkedIn use cookies for advertising and remarketing purposes. They may use cookies to show users content, including ads, tailored to their preferences.

Cookies and other tools used by us are not used for processing or storing personal data by default and are not intended for direct user identification. They also do not change the settings of the user’s browser or device configuration. Exceptional situations where data collected via cookies may be considered your personal data, and related rights, are detailed in the relevant section of the Privacy Policy.

Ways to disable cookies:

When visiting our Website, you have the option to consent to the use of cookies other than necessary ones, particularly cookies for marketing purposes and those from third parties. Even if you have already given consent, you can use the options described below. Each user can disable cookies in their web browser. To facilitate cookie management, below are links to some browser pages:

• Google Chrome –  https://support.google.com/chrome/answer/95647?Every=GENIE.Platform%3DDesktop&hl=en
• Opera – https://help.opera.com/en/latest/web-preferences/#cookies
• Firefox –  https://support.mozilla.org/en-US/kb/enable-and-disable-cookies-website-preferences
• Apple Safari –  https://support.apple.com/en-us/guide/safari/manage-cookies-and-website-data-sfri11471/mac
• Windows Internet Explorer –  https://support.microsoft.com/fil-ph/help/17442/windows-internet-explorer-delete-manage-cookies

Users can also configure their browser to independently accept cookies each time. In this case, the browser will ask the user for consent to access cookies each time, giving the user control over what is stored on their device. However, this may slow down the user’s ability to navigate the Website and other websites.

Each user can opt out of receiving targeted ads in the following ways:

• by using the NAI tool (www.networkadvertising.org/choices), which allows opting out of viewing targeted ads from us and other NAI-approved member companies,
• through the Digital Advertising Alliance (www.aboutads.info/choices), which follows the Self-Regulatory Principles for Online Behavioral Advertising developed by this organization,
• through the European Interactive Advertising Digital Alliance (www.youronlinechoices.com). We adhere to the guidelines for online advertising developed by this organization.

When using the opt-out options through the tools described above, please note:

• we may still collect certain data about user online activities for purposes other than marketing,
• opt-out options from other advertising companies may function differently from ours,
• at any time, you can opt out of us tracking your activities for advertising purposes by using the “Do Not Track” option. We respond to “DNT” signals sent from the user’s browser. If a “DNT” signal is received on one of our advertiser’s sites during a user’s visit, we will not link the data collected with the user’s browser identifier during that visit, so new data collected about the user cannot be used by us for targeted advertising purposes, but previously collected data about the user may still be used,
• there is always the possibility to modify the browser settings regarding cookies. Limiting the use of cookies may lead to restrictions on some features available on our Website.

You have the option to disable the transmission of your data for analytical and statistical purposes using Google Analytics. To do so, you can install a browser extension following the instructions provided at this address: https://support.google.com/analytics/answer/181881?hl=en.