We care about your privacy. Below we explain what personal data we process, for what purpose, to whom we entrust it and what rights you have under the GDPR.
1. Personal data controller
The controller of your personal data is Agnieszka Saladra prowadząca jednoosobową działalność gospodarczą pod firmą Luno-Group, ul. Emilii Plater 53, lok. 1439, 00-113 Warszawa, NIP 9151711413 (hereinafter: the 'Controller', 'we').
In all matters relating to the protection of personal data you may contact us:
- e-mail: kontakt@luno-group.com,
- telephone: +48 514 111 416,
- in writing: ul. Emilii Plater 53, lok. 1439, 00-113 Warszawa.
We have not appointed a Data Protection Officer - for matters concerning data processing, please contact us at the e-mail address above.
2. What data we process, for what purpose and on what basis
The scope of the data depends on how you use our services. We process data for the following purposes and on the following legal bases (GDPR - Regulation (EU) 2016/679):
- Handling enquiries (contact form, e-mail, telephone) - contact and identification data (first name, surname, e-mail, telephone, company name). Purpose: responding to the enquiry and presenting an offer. Basis: Article 6(1)(b) GDPR (steps prior to entering into a contract) and (f) (legitimate interest - communication with interested parties).
- Provision of accounting, HR and payroll services - Client data and data contained in the documentation provided (including data of the Client's employees and contractors and, with regard to personnel files, also special categories of data, e.g. relating to health). Purpose: performance of the service contract and fulfilment of accounting and tax obligations. Basis: Article 6(1)(b) and (c) GDPR (including the Accounting Act, the Tax Ordinance, tax and insurance laws), and for special categories of data - Article 9(2)(b) GDPR.
- Settlements and issuing invoices - data necessary for documentation and settlements. Basis: Article 6(1)(c) GDPR.
- Data collected automatically (cookies, server logs, statistical data) - in order to ensure the functioning and security of the website and to analyse traffic. Basis: Article 6(1)(f) GDPR. Details are described in the Cookie Policy.
- Marketing of our own services - to the extent of maintaining contact with you regarding our services. Basis: Article 6(1)(f) GDPR (legitimate interest); if you subscribe to the newsletter - Article 6(1)(a) GDPR (consent).
- Pursuit or defence of claims - for the limitation period. Basis: Article 6(1)(f) GDPR.
3. Contact form
When using the contact form, you provide us with the data entered in its fields (including first name, e-mail address, message content). We use it solely to handle your enquiry and to present an offer where applicable. The form is protected by an anti-spam mechanism (honeypot). We do not require you to provide data other than that necessary to respond.
4. Cookies and data collected automatically
Our website uses cookies and collects technical data (e.g. IP address, browser type, traffic data). The purposes, types of cookies and how to manage consents are described in a separate Cookie Policy. Consents to non-essential cookies are handled in accordance with the consent mechanism (Consent Mode).
5. Data recipients and processors
We may entrust or disclose your data to:
- providers of website hosting and server infrastructure,
- providers of e-mail and office tools (Google Ireland Ltd. - the Google Workspace service),
- providers of analytics and advertising tools (Google Ireland Ltd. - Google Tag Manager, Google Analytics 4, Google Ads) and of form protection (Google reCAPTCHA) - to the extent of the data collected with consent or necessary to protect against abuse,
- providers of accounting software and the Client panel system,
- entities providing us with IT support,
- authorised authorities and institutions (including tax offices, ZUS - the Social Insurance Institution, GUS - Statistics Poland) - to the extent required by law,
- advisers (e.g. legal, tax) - to the extent necessary.
With entities that process data on our behalf, we conclude data processing agreements in accordance with Article 28 GDPR.
6. Transfer of data outside the European Economic Area (EEA)
As a result of using tools provided by entities based outside the EEA (including Google services), your data may also be processed outside the EEA, including in the United States. Transfers take place using the appropriate safeguards provided for in the GDPR - in particular a European Commission adequacy decision (the Data Privacy Framework) or standard contractual clauses (SCC) - ensuring an adequate level of data protection.
7. How long we keep data
- Data related to accounting services and tax documentation - for the period required by law, as a rule for 5 years counting from the end of the calendar year in which the tax payment deadline expired, and with regard to employee documentation - for the periods resulting from labour law and social insurance regulations.
- Data from enquiries and correspondence - for the time necessary to handle the matter, and subsequently until the expiry of the limitation period for any claims.
- Data processed on the basis of consent - until it is withdrawn.
8. Your rights
In connection with the processing of data, you have the following rights:
- to access your data and to receive a copy of it,
- to rectify (correct) the data,
- to erase the data ('right to be forgotten') - to the extent that this does not conflict with legal obligations,
- to restrict processing,
- to data portability,
- to object to processing based on legitimate interest, including to marketing,
- to withdraw consent at any time - without affecting the lawfulness of processing carried out before its withdrawal.
To exercise your rights, write to: kontakt@luno-group.com.
9. Right to lodge a complaint
If you consider that we process your data unlawfully, you have the right to lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl).
10. Voluntary nature of providing data
Providing data is voluntary, but necessary in order to respond to an enquiry and to conclude and perform the service contract. With regard to accounting and tax obligations, providing certain data is a requirement arising from the law, and failure to provide it makes the proper performance of the service impossible.
11. Profiling and automated decisions
We do not make decisions concerning you based solely on automated processing, including profiling, that would produce legal effects or similarly significantly affect you.
12. Data security
We apply appropriate technical and organisational measures to protect data against unauthorised access, loss or destruction - including an encrypted connection (SSL/HTTPS), access control over documents and regular backups. Access to the data is granted only to authorised persons, who are bound to maintain confidentiality.
13. Changes to the privacy policy
We may update the privacy policy, e.g. in connection with changes to legislation or the scope of services. The current version is always published on this page together with its effective date.
14. Contact
For matters concerning the protection of personal data, contact us: kontakt@luno-group.com, tel. +48 514 111 416, ul. Emilii Plater 53, lok. 1439, 00-113 Warszawa.
