This document outlines the principles of personal data processing and privacy protection standards for users of the website pamios.pl (hereinafter referred to as the "Service"), operated on behalf of the Pamios non-food self-service kiosk software platform.
We respect your privacy. Pamios.pl is designed following the Privacy by Design standard – we do not use third-party commercial tracking, advertising, or profiling cookies. We do not place any unnecessary tracking identifiers on your device.
1. Data Controller
The Controller of your personal data under Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (GDPR) is:
Finterra sp. z o.o.
registered in Poland (owner of the Pamios brand and platform)
Contact email for data protection matters: kontakt@pamios.pl
2. Purposes, Legal Grounds, and Retention Periods
| Purpose of Processing | Legal Basis (GDPR) | Scope of Data | Retention Period |
|---|---|---|---|
| Handling business inquiries via the contact form or direct email | Art. 6(1)(b) GDPR (pre-contractual steps) and Art. 6(1)(f) GDPR (legitimate interests in B2B relationship building) | Full name, company name, email address, inquiry contents | For the duration of commercial correspondence and until the expiration of limitation periods (up to 3 years in commercial B2B relations) |
| Service security, DDoS mitigation, and anti-abuse | Art. 6(1)(f) GDPR (legitimate interest in safeguarding infrastructure availability) | IP address, request ID, timestamp, User-Agent header | Up to 30 days in edge Web Application Firewall (WAF) logs |
| Establishment, exercise, or defense of legal claims | Art. 6(1)(f) GDPR (legitimate interest in legal protection) | Correspondence records | Until final resolution of legal proceedings or expiration of claims |
3. Cookies and Tracking Technologies (Zero-Cookie Policy)
1. No commercial marketing or advertising cookies: Pamios.pl DOES NOT use tracking cookies, user profiling scripts, or advertising networks (such as Google Ads, Meta Pixel, or LinkedIn Insight Tag).
2. No cookie consent banner required: Pursuant to the ePrivacy Directive, the Service does not store non-essential identifiers on your terminal equipment. As a result, your browsing experience is clean, fast, and free of intrusive consent popups.
3. Cookie-free performance analytics: The Service utilizes Cloudflare Web Analytics. This privacy-first edge telemetry system records only aggregated, 100% anonymous performance metrics (such as page render speed, country of origin, and browser engine). It does not track individuals or assign persistent user identifiers.
4. Data Recipients and International Transfers
Your data may be shared with trusted technical infrastructure providers acting on behalf of the Controller:
- Cloudflare, Inc. (USA / EU): Provider of secure edge infrastructure (Cloudflare Workers, Cloudflare Pages, WAF, DNS, email routing). Transfers to the United States are governed by the EU-U.S. Data Privacy Framework (DPF) and European Commission-approved Standard Contractual Clauses (SCCs).
- Email Providers: OVHcloud (mail hosting located in the EU) and Google Ireland Limited (Google Workspace).
The Controller does not sell, rent, or trade your personal data to third parties for marketing purposes.
5. Your Rights as a Data Subject
Under the GDPR, you have the following rights:
- Right of access to your personal data (Art. 15 GDPR),
- Right to rectification of inaccurate data (Art. 16 GDPR),
- Right to erasure ("right to be forgotten" – Art. 17 GDPR),
- Right to restriction of processing (Art. 18 GDPR),
- Right to data portability (Art. 20 GDPR),
- Right to object to processing based on legitimate interests (Art. 21 GDPR).
To exercise your rights, please reach out to us at: kontakt@pamios.pl.
You also have the right to lodge a complaint with a supervisory authority: President of the Personal Data Protection Office (Prezes UODO), ul. Stawki 2, 00-193 Warsaw, Poland (uodo.gov.pl).
6. Technical Security
All data transmitted through the contact form is encrypted in transit using TLS 1.3 / HTTPS. Data at rest is protected in isolated edge key-value storage with strictly restricted administrative access.
7. Automated Decision-Making
Your personal data is not subject to automated decision-making or profiling under Article 22(1) and (4) of the GDPR.