I. PURPOSE AND SCOPE OF THE POLICY

1. 1. This Privacy Policy outlines the principles of personal data processing for Students, Users, and Plugin Users by UNIPERKS in every case, including their contact with UNIPERKS (including before entering into a contract), the use of the Platform and Plugin, during the contract conclusion, during the contract's execution, to fulfil the contract, and for contract termination, as well as after the contract termination. It applies solely to Students, Users, and Plugin Users.
   2. Acceptance of the Policy occurs without any reservations and is a condition for the Student's and User's use of the Platform and the Plugin User's use of the Plugin.

II. DEFINITIONS

Whenever the following term is used in the Policy, it shall be understood to mean:

1) cookies - text files placed by the Platform on the end device from which the Student or User accesses the Platform, as well as other similar technologies;

2) personal data - any information relating to an identified or identifiable natural person, in particular based on an identifier such as a name and surname, identification number, location data, internet identifier, or one or more specific factors determining the physical, physiological, genetic, mental, economic, cultural, or social identity of a natural person;

3) account - a set of Platform functionalities not available to the User, provided to the Student ("Student Account") and the Partner ("Partner Account"), which enable the use of services provided electronically by UNIPERKS, including allowing the Student access to content posted on the Platform that is not available to the User, access to which is obtained by providing a login and password;

4) Offer - a proposal by a Student holding a coupon obtained on the Platform to enter into a service provision or goods purchase agreement (i.e., any named or unnamed agreement) with a Partner, published on the Platform;

5) Data subject - Student, User, and Plugin User;

6) Partner - a third party that has agreed with UNIPERKS, under which it may publish Offers on the Platform;

7) Third country - a country outside the European Economic Area;

8) Platform - the web application provided by UNIPERKS to the Student and User at the address uniperks.pl and operated via a browser, as well as the mobile application under the trade name "UNIPERKS" for mobile devices running iOS and Android operating systems;

9) Policy - this Privacy Policy for Students and Users;

10) profiling - any automated processing of personal data allowing the assessment of personal aspects of a natural person, in particular analyzing or predicting aspects concerning work performance, economic situation, health, personal preferences or interests, reliability or behavior, location or movement of the data subject;

11) processing - any operation or set of operations performed on personal data or sets of personal data in an automated or non-automated manner, such as collection, recording, organization, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure, or destruction;

12) browser - software used to display web pages, run on an end device;

13) Legal Provisions - the provisions of the law in force in the territory of the Republic of Poland, as well as other legal provisions applicable to UNIPERKS and the legal provisions of the country in which the data subject resides and in which the Student is a student of the institution;
studentem uczelni;

14) Regulations - the Platform Regulations available at www.uniperks.pl; 15)

15) GDPR - Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC;

16) Student - a natural person who has a Student account on the Platform;

17) UNIPERKS - UNIPERKS P.S.A. with its registered office in Kielce, 6 Karola Olszewskiego St., 25-663 Kielce, registered in the commercial register held by the District Court in Kielce, X Economic Division of the National Court Register under KRS no. 0000996081, tax identification no. (NIP): 9592056340, REGON: 52337368000000, share capital: PLN 245,000.00;

18) end device - an electronic device from which, respectively, the Student or User accesses the Platform, or on which the browser with the installed Plugin is running;

19) User - a natural person who uses the Platform without having an account;

20) Plugin User - a natural person who has installed the Plugin in their browser and may simultaneously and independently from their Plugin User status be a Student or a User;

21) Plugin - a computer program extending the functionalities of the browserbrowser extensionunder the trade name "UNIPERKS" offered by UNIPERKS, through which UNIPERKS provides a service consisting of informing the Plugin User about Offers related to the websites they are viewing in that browser, particularly those published by a Partner operating the website.

III. DATA CONTROLLER AND DATA PROTECTION OFFICER

The data controller is UNIPERKS. Contact with the controller is possible via:

1) Email: support@uniperks.pl

2) Adress: ul. Karola Olszewskiego 6, 25-663 Kielce, Poland.

UNIPERKS has appointed a Data Protection Officer (DPO) – Karol Kocur, who can be contacted at support@uniperks.pl.

In all cases where contact with UNIPERKS is mentioned, it should be done using the details provided in this section.

IV. COLLECTION OF PERSONAL DATA

UNIPERKS collects personal data of the Student and User through the following means:

1) From the Student or User – the personal data is provided directly to UNIPERKS by the Student or User.

2) From third parties – personal data of the Student or User is obtained from third parties only with the Student's or User's consent or after ensuring that the third party has the right to share such data.

3) Automated means–through cookies and other technical tools the Platform uses.

UNIPERKS collects the personal data of the Plugin User automatically by reading these data from the browser via the Plugin.

V. DATA PROCESSED BY UNIPERKS

Below, UNIPERKS lists the categories of personal data it processes. The purposes mentioned may overlap, i.e., personal data may be processed for multiple purposes.

1. 1. Use of the Platform by the User

The following categories of personal data are processed:

1) A unique User identifier created by UNIPERKS,

2) Approximate location of the end device,

3 )Information on how the Platform is used, e.g., interactions of the Student (User) with the Platform (e.g., how the Platform is used, actions of the Student (User) on the Platform, reactions of the Student (User) to specific content displayed to them, Offers used by the Student, interests of the Student (User) inferred from reactions and actions).

The data is collected automatically. Providing this data is voluntary but may be necessary for UNIPERKS to provide services electronically.

1. 2. Use of the Platform by the Student

The following categories of personal data are processed:
1) Personal data such as: first name, last name,
2) Contact information such as: email address,
3) Login and password
4. Data about the university where the Student is enrolled.

UNIPERKS requires the Student to verify their student status according to Legal Provisions. This is done by:

1) Authorizing UNIPERKS to verify this status through a third-party service. In this case, the following will also be processed:

a) A unique identifier identifying the Student in the third-party service

b) The Student's email address in the university domain;

2) Providing the Student's email address in the university domain and verifying it. In this case, the Student's email address in the university domain will also be processed.

UNIPERKS will expect regular verification. UNIPERKS decides how the Student can verify their status.

Data is provided by the Student or obtained from third parties with their consent. Providing personal data, including verification in one of the above ways, is voluntary but necessary for entering into and performing the contract, including providing services electronically. Refusal to verify may, in particular, prevent the Student from using Offers and may result in the inability to conclude a contract or its termination.

The following categories of personal data, which are collected automatically, are also processed:

1) Information on how the Platform is used, e.g., the Student's interactions with the Platform (e.g., how the Platform is used, the Student's actions on the Platform, the Student's reactions to specific content displayed to them, Offers used by the Student, the Student's interests inferred from reactions and actions),

2) A unique identifier created by UNIPERKS for the Student.

1. 3. Displaying Personalized Ads While Using the Platform by the Student and User

The following categories of personal data are processed:

1) Information about the end device and internet connection, such as the IP address of the end device, type of end device, software running on the end device, including technical parameters of the end device browser, identifiers (e.g., advertising or cookie identifiers), other technical information such as screen resolution,

2) Approximate location of the end device,

3 )Information on how the Platform is used, e.g., interactions of the Student User with the Platform (e.g., how the Platform is used, actions of the Student (User) on the Platform, reactions of the Student (User) to specific content displayed to them, Offers used by the Student, interests of the Student (User) inferred from reactions and actions).

Student and User data may be shared with third parties to display personalized ads, understood as ads whose content is tailored to the Student and User based on the collected personal data.

The data is collected automatically. Providing personal data is voluntary but necessary for displaying personalized ads. The Student and User can withdraw their consent, in which case ads will not be tailored to the Student and User, although they will still see them.

1. 4. Analytics, statistics, promotion, ensuring security, and improving the functioning of the Platform and Plugin

The categories of personal data indicated in points 1-3 and 9, as well as data on malfunctions in the operation of the Platform and Plugin on the end device, are processed, which are collected automatically.

1. 5. Contact with the Student, User, and Plugin User for marketing purposes (newsletter service)

The following categories of personal data are processed:
1) Data mentioned in points 1 and 2,
2) Other personal data provided to UNIPERKS by the Data Subject.

Providing personal data is voluntary but necessary to contact the Data Subject for marketing purposes.

1. 1. 6. Contact with the Student, User, and Plugin User for handling inquiries, complaints, and other requests

The following categories of personal data are processed:

1) Personal data such as: first name, last name,

2) Contact information such as email address, mailing address, and phone number;

3) Other data provided in the inquiry, complaint, or request.

Providing personal data is voluntary but necessary to contact UNIPERKS.

7. Establishing, Pursuing, and Defending Claims

The following categories of personal data are processed: personal data obtained following the Policy and other personal data obtained by Legal Provisions, adhering to the principle of data minimization.

Providing personal data is a legal requirement.

1. 8. Compliance with legal obligations related to data protection, tax, and their legal regulations

The following categories of personal data are processed: personal data obtained following the Policy and other personal data obtained by Legal Provisions, adhering to the principle of data minimization.

1. 9. Use of the Plugin by the Plugin User

The following categories of personal data are processed:

1) Information about the end device and internet connection, such as the IP address of the end device, type of end device, software running on the end device, including technical parameters of the end device browser, identifiers (e.g., advertising or cookie identifiers), other technical information such as screen resolution,

2) Information about the website displayed in the browser, in particular, the exact address of the displayed website,

3) Interactions of the Plugin User with the Plugin and Offer, in particular, visiting the displayed Offer.

VI. LEGAL BASES AND PURPOSES OF PERSONAL DATA PROCESSING

In each case where UNIPERKS processes personal data based on the legitimate interest of the controller, if UNIPERKS no longer has justification for processing the personal data of the Data Subject, the data will be deleted or anonymized.

UNIPERKS may anonymize any personal data of the Data Subject for research, statistical, or other analytical purposes. In such a case, the data will cease to be personal data. As a rule, UNIPERKS assumes that this will take place no later than 3 years from the date of termination of the contract with the Data Subject.

VII. RECIPIENTS OF PERSONAL DATA

1. Personal data may be disclosed to external recipients, including:

a) UNIPERKS business partners, including Partners (especially when a Student uses the Offers).

b) UNIPERKS service providers, particularly those providing accounting, IT, legal, technological, and other services used by UNIPERKS.

c) Providers of external IT technologies and analytical tools.

d) Individuals cooperating with UNIPERKS within the Platform, based on issued authorizations or data processing agreements.

e) State authorities, including prosecutors, police, other law enforcement agencies, regulatory bodies, and courts—when required by law or to defend and pursue the rights of UNIPERKS or others.

In every case, the personal data shared will be limited to what is necessary for the external recipient.

VIII. AUTOMATED DECISION MAKING

UNIPERKS uses personal data for automated decision-making through profiling to fulfill the contract made with the Student and User by tailoring the content displayed to them on the Platform, including Offers, to their preferences, and showing personalized ads.

UNIPERKS analyzes the personal data of the Student and User, as indicated in the Policy, to assess which content best matches their preferences. The result of this process is the selection of content displayed to the Student and User to align with their preferences.

The Student and User have the right to request human intervention from UNIPERKS, express their position, and challenge the decision by contacting UNIPERKS.

IX. THIRD COUNTRIES

1. Generally, personal data of Data Subjects will not be transferred outside the European Economic Area.
2. Data transfers are carried out based on appropriate mechanisms ensuring the security of data processing. In cases where data is transferred outside the European Economic Area, the transfer may be based on a decision of the European Commission determining an adequate level of protection. If data is transferred to a third country for which the European Commission has not issued such a decision, UNIPERKS will apply appropriate legal safeguards, including the so-called Standard Contractual Clauses (adopted by the European Commission or a supervisory authority and approved by the European Commission according to the review procedure) that ensure an adequate level of protection according to applicable regulations. If the European Commission has not issued an adequacy decision, or UNIPERKS has not provided adequate legal safeguards, personal data may be transferred to a third country based on one of the conditions listed in Article 49(1) of the GDPR.
3. When transferring personal data to an entity located in a third country, UNIPERKS is required to register each instance of personal data export in the data processing activities register.

X. RIGHTS OF THE DATA SUBJECT

The Data Subject has the right to:

a) Access personal data.
b) Request correction of personal data.
c) Request deletion of personal data.
d) Request restriction of processing of personal data.
e) Object to the processing of personal data if the processing is based on the legitimate interest of UNIPERKS.
f) Data portability.

— under the conditions set out in the GDPR.

If personal data is processed based on consent, the Data Subject has the right to withdraw consent at any time. This does not affect the lawfulness of the processing carried out based on consent before its withdrawal.

If personal data is processed based on Article 6(1)(f) GDPR, i.e., the legitimate interest of the controller, the Data Subject may object to the processing of their personal data. In this case, UNIPERKS will no longer be allowed to process the personal data unless it demonstrates compelling legitimate grounds for the processing that override the interests, rights, and freedoms of the Data Subject or for the establishment, exercise, or defense of legal claims.

If personal data is processed for direct marketing purposes, the Data Subject has the right to object at any time to the processing of their personal data for such marketing, including profiling to the extent that it is related to such direct marketing. In this case, personal data can no longer be processed for such purposes.

Data Subjects can exercise their rights by contacting UNIPERKS.

XI. PERSONAL DATA PROTECTION

UNIPERKS strives to protect personal data from misuse, interference, loss, unauthorized access, modification, or disclosure.

To achieve this, UNIPERKS takes actions that include implementing physical safeguards (such as access control), administrative safeguards (such as requiring appropriate authorizations for processing personal data and limiting access to personal data to employees, collaborators, and other entities to the necessary extent), and technical safeguards (such as encryption) to protect IT environments, including ensuring the anonymization of personal data where possible.

XII. COOKIES

UNIPERKS uses cookies on the Platform, including both its own and third-party cookies. Personal data contained in cookies is processed in accordance with the provisions of the Policy. Detailed information is provided in the Cookie Policy available on the Platform.

XIII. RIGHT TO LODGE A COMPLAINT WITH A SUPERVISORY AUTHORITY

The Data Subject has the right to lodge a complaint with the supervisory authority, which is the President of the Office for Personal Data Protection, ul. Stawki 2, 00-193 Warsaw.

XIV. FINAL PROVISIONS

UNIPERKS may change the Policy at any time, particularly due to the need to adapt the Policy to legal regulations and due to changes introduced on the Platform and in the Plugin (e.g., providing new services and offering new functionalities). The privacy policy is posted on the Platform and available at any time for the Student, User, and Plugin User.