Printbox Privacy Policy

Publication date: November 2, 2026.

Introduction

This Privacy Policy sets out how Printbox Sp. z o.o. processes personal data, including how we collect, use and disclose it. It also explains your rights in connection with the processing of your personal data. Please read this Policy carefully – it is the main source of information that will help you make informed decisions about sharing your data and exercising your rights under data protection law. If you have any questions or concerns about the processing of your personal data or about privacy, please contact us:

by e-mail: gdpr@getprintbox.com
by post: Printbox Sp. z o.o., ul. Fabryczna 20A, 31-553 Kraków, Poland.

Data Protection Officer (DPO): We have appointed a Data Protection Officer, whom you can contact on all matters relating to the processing of your personal data and the exercise of your rights under data protection law. Contact the DPO:

by e-mail: dpo@getprintbox.com
by post to our registered office address above, marked “Data Protection Officer”.

#1 Who is the controller of your personal data?

The controller of your personal data is Printbox Sp. z o.o. (“Printbox”), a limited liability company with its registered office in Kraków, ul. Fabryczna 20A, 31-553 Kraków, Poland, entered in the Register of Entrepreneurs of the National Court Register (KRS) under number 0000484669, tax ID (NIP): 6762470210, share capital PLN 108,500.00. Printbox acts as a controller within the meaning of the GDPR where it determines the purposes and means of processing personal data on its own, in particular in connection with:

the use of our websites and the services provided through them by data subjects,
the processing of personal data for purposes related to creating, maintaining and improving our products and services,
our day-to-day operational and marketing activities in accordance with applicable law, including finding and contacting potential business customers (B2B).

Printbox websites:

The Masterpiece AI store (masterpiece-ai.getprintbox.com) (demo version) has its own privacy policy, available on that website.

When we are not the controller of your data

Printbox provides a platform and tools (including product editors, online stores and the Masterpiece AI application) to companies that sell personalised products – print shops, photo labs and online stores (our customers). If you order a product, create a design or upload photos in a store or application of one of our customers that runs on Printbox technology, that customer is the controller of your data.

In that case, Printbox processes your data – including uploaded photos, designs and order data – solely on the customer’s behalf, under a data processing agreement (Art. 28 GDPR), and does not use it for its own purposes. Information on how your data is processed and how to exercise your rights can be found in the privacy policy of the relevant store – please also direct your requests there. If you send such a request to us, please state the name of the store where you placed your order or created your design – without this information we will not be able to forward your request to the right store.

We make the list of entities to which we subcontract data processing within our platform (sub-processors), including providers of AI-based features, available to our customers.

Other privacy notices

We inform some groups of people about data processing in separate documents:

job and collaboration candidates – Privacy notice for candidates,
whistleblowers and persons concerned by a report – information on the “Whistleblowers Act” page,
employees and contractors – privacy notice provided when the contract is signed.

#2 On what legal basis, for what purposes and for how long do we process your personal data?

1. Taking steps prior to entering into a contract (e.g. preparing an offer, negotiations)

Purposes of processing:

Analysing enquiries, preparing proposals for cooperation and negotiating the terms of a future contract.
Keeping in touch with representatives of potential customers, contractors or business partners in connection with discussions about starting cooperation.
Verifying identity, authority to represent and intention to cooperate before a contractual relationship begins.
Documenting correspondence and pre-contractual arrangements, including for accountability and to protect the controller’s interests.

Legal basis:

Art. 6(1)(b) GDPR – processing is necessary to take steps at the request of the data subject prior to entering into a contract (e.g. preparing an offer, agreeing the scope of services, negotiating terms).
Art. 6(1)(f) GDPR – the controller’s legitimate interest in communicating and preparing offers as part of a standard sales or pre-sales process, including with representatives of legal entities.

Retention period:

We process the data for the duration of commercial talks or offer preparation and then – if no contract is concluded – for a maximum of 12 months from the last contact, unless the data subject has agreed to further marketing contact.
If these steps result in a contract, the data will be subject to the rules and retention periods applicable to the performance of the contract (e.g. for accounting, tax, complaints or archiving purposes).

2. Performing contracts and providing services

Purposes of processing:

Concluding and performing a contract with a customer, contractor or partner – including fulfilling orders, providing services, handling payments, invoicing, handling complaints and providing technical or subject-matter support.
Identifying the parties to the contract, day-to-day operational communication and documenting arrangements during the contractual relationship.
Fulfilling legal obligations, including tax, accounting and electronic services obligations.
Ensuring accountability for activities related to the performance of the contract and, where necessary, defending rights and pursuing claims arising from the contractual relationship.

Legal basis:

Art. 6(1)(b) GDPR – processing is necessary for the performance of a contract to which the data subject is party, or to take steps prior to entering into a contract.
Art. 6(1)(c) GDPR – compliance with legal obligations to which the controller is subject, in particular under tax, accounting and consumer complaints law.
Art. 6(1)(f) GDPR – the controller’s legitimate interest in ensuring the proper performance of the contractual relationship, communicating with the parties’ representatives and pursuing claims.

Retention period:

Personal data processed under Art. 6(1)(b) GDPR (necessity for the performance of a contract) is kept for the entire term of the contract and, after it ends, for the limitation period of any civil-law claims related to its performance.
Data processed to fulfil the controller’s legal obligations under Art. 6(1)(c) GDPR is kept for the period required by the relevant laws.
Data processed under Art. 6(1)(f) GDPR (the controller’s legitimate interest) – in particular to ensure continuity of contact with the parties’ representatives, secure communication, establishing facts or defending against claims – is kept until the purpose is achieved or an objection is successfully raised, but no longer than the limitation period for claims arising from the legal relationship.

3. Newsletter service

Purposes of processing:

Sending requested information (newsletter) to the e-mail address provided, i.e. commercial information, news, promotions, events and special offers.
Analysing the performance statistics of our e-mail campaigns (e.g. open and click rates) to optimise the content and format of the newsletter, and ensuring accountability for our activities (e.g. being able to demonstrate that consent was given and its scope).

Legal basis:

Art. 6(1)(a) GDPR – voluntary consent given when signing up for the newsletter.
Art. 6(1)(f) GDPR – analysing the effectiveness of e-mail campaigns (the controller’s legitimate interest).

Retention period:

We process the data until consent is withdrawn (unsubscribing from the newsletter). After that, we may keep it only to the extent necessary to demonstrate that the newsletter was sent lawfully (accountability).

4. Handling correspondence (electronic and traditional)

Purposes of processing:

Receiving, recording, archiving and responding to correspondence sent to us – including enquiries, requests, complaints, reports and official and business correspondence.
Ensuring continuity of communication, including identifying the sender and documenting the course of contact.
Ensuring accountability, in particular demonstrating facts related to the fulfilment of legal and contractual obligations.

Legal basis:

Art. 6(1)(f) GDPR – the controller’s legitimate interest in communicating, handling enquiries and documenting the course of contact.
Art. 6(1)(c) GDPR – where there is a legal obligation to retain certain types of correspondence (including under the Polish e-Delivery system).
Art. 6(1)(b) GDPR – where correspondence is conducted to take steps at the request of the data subject prior to entering into a contract or in connection with its performance.

Retention period:

We process the data for as long as necessary to respond and resolve the matter, and then for the period required by law or necessary to defend against possible claims.
Correspondence that is not subject to an archiving obligation is kept for a maximum of 12 months from the last contact, unless an objection to processing is raised earlier.

5. Running social media profiles (e.g. Facebook, Instagram, LinkedIn, YouTube, X (Twitter))

Purposes of processing:

Running official profiles of Printbox Sp. z o.o. on social media to build and maintain our brand image, promote our business and inform about news, events and our services and products.
Interacting with users, including replying to comments and private messages and responding to shared content.
Analysing user activity (statistics, reach, campaign effectiveness) to optimise communication and tailor content to our audience.
Ensuring accountability for communication and marketing activities, including the ability to demonstrate consents, interactions or their absence in the event of a dispute.
Running Printbox profiles on review sites and software directories (Capterra, G2) and encouraging customers to leave reviews there. The operators of these sites are independent controllers of the data of people who visit our profile or leave a review.

Legal basis:

Art. 6(1)(f) GDPR – the controller’s legitimate interest in brand and communication activities, analysing the effectiveness of published content and building relationships with users.
Page statistics (e.g. Facebook Page Insights, LinkedIn Page Analytics): for the collection of data for statistics, we are joint controllers with the platform operator (Art. 26 GDPR) – Meta Platforms Ireland Ltd. and LinkedIn Ireland Unlimited Company. The platform operator, as an independent controller, is responsible for any other processing on the platform, including for handling your rights in that respect; it publishes the essence of the arrangement on its website.

Retention period:

We process personal data for as long as you follow our profiles, stay in contact or communicate with us, and for as long as the interactions (comments, messages) remain available on the social media platform.
For marketing or analytics – until the purpose of processing is achieved or an objection is successfully raised.
Data may also be processed for longer to the extent necessary to establish, pursue or defend claims (e.g. in the event of infringements, abuse or reports).

6. Statistical analysis and optimisation of websites/services

Purposes of processing:

Monitoring user activity on the website and within our services – based on aggregated, anonymised or pseudonymised data – to understand how content and features are used and identify areas for improvement.
Carrying out statistical analysis of user behaviour, visit trends and the performance of individual sections of the website or services – in a way that does not require identifying a specific individual.
Improving technical solutions, features and content structure – based on findings from analyses, A/B tests, click maps, user journeys, etc. For this purpose we also use session recordings (mouse movements, clicks and scrolling, with form field content masked) in Hotjar and Microsoft Clarity.
Ensuring the stable operation of the website and improving its security (e.g. detecting errors, abuse and patterns of automated activity).

Legal basis:

Art. 6(1)(f) GDPR – the controller’s legitimate interest in ensuring the stable and secure operation of the website – for server log data and data that does not require storing information on your device (without cookies or similar technologies).
Art. 6(1)(a) GDPR – the user’s voluntary consent given by accepting cookies and similar technologies for analytics, statistics and optimisation (via the consent banner or browser settings) – applies to all analytics tools based on cookies or similar technologies (Google Analytics, Hotjar, Microsoft Clarity).

Retention period:

Statistical and technical data obtained from cookies or analytics tools is kept for the period set in the settings of the given tool or until consent to its use is withdrawn.
The retention period may vary depending on the technology used, the type of cookie and the user’s browser settings, but does not go beyond the purpose for which the data was collected.
Anonymised data may be processed without time limits, provided it can no longer be linked to a specific individual.

7. Handling enquiries submitted through the contact form on our websites

Purposes of processing:

Receiving and handling enquiries submitted through the contact form, including responding, conducting correspondence and resolving the matter.
Identifying the sender of the enquiry and maintaining continuity of communication with the person contacting us.
Documenting communication for accountability, archiving or the possible defence of claims.
In some cases – taking steps towards concluding or performing a contract, where the enquiry concerns an offer or cooperation.
Protecting forms against spam and automated submissions (Google reCAPTCHA).

Legal basis:

Art. 6(1)(f) GDPR – the controller’s legitimate interest in handling enquiries, communicating with people interested in the offer or activities of Printbox Sp. z o.o. and keeping a record of contacts, as well as in protecting forms against abuse.
Art. 6(1)(b) GDPR – where the enquiry concerns steps towards concluding a contract or the direct provision of a service at the request of the data subject.

Retention period:

We process the data for as long as necessary to respond and resolve the matter, and then for the period required by law or necessary to secure possible claims.
For enquiries not followed by further action, the data may be deleted 12 months after the last contact, unless the user has agreed to further marketing communication or has objected to processing.

8. Finding and contacting potential business customers (B2B)

Purposes of processing:

Making first contact (by e-mail or via LinkedIn) to ask whether we may present our offer; messages may be personalised with the help of AI tools, and the decision to send is always made by a person.
Continuing the conversation, including by phone, if you agree to it or contact us yourself. We make phone calls in line with the laws of the recipient’s country – in Poland only after obtaining consent.
Searching for companies that may be interested in our services (e.g. companies similar to our current customers) and for the people in those companies responsible for the areas our offer relates to.
Supplementing data about these companies and people (e.g. job title, company profile, business contact details) and storing it in our CRM system.
Assessing how well a company fits our offer (scoring) and setting the order of contact.

Data categories: first and last name, job title, company name, business e-mail address, business phone number (for phone contact in line with the laws of the recipient’s country; in Poland only after obtaining your consent), professional profile URL (e.g. LinkedIn), information about the company you work for (industry, size, market), history of our contact.

Data sources: publicly available professional profiles (e.g. LinkedIn), company websites, public registers (e.g. the Polish KRS and CEIDG) and commercial business data providers and data enrichment tools (Clay Labs Inc., USA, together with the data providers available in Clay, including Findymail, LeadMagic, Prospeo, Datagma, Dropcontact, Wiza, Icypeas, Enrow, Ocean.io; Surfe – Growster SAS, France).

Legal basis:

Art. 6(1)(f) GDPR – the controller’s legitimate interest in acquiring business customers and conducting B2B communication. Before starting this processing, we assessed that it does not override your interests (balancing test).
We send commercial information by e-mail only to people who have given their prior consent (in Poland – Art. 398 of the Electronic Communications Law). We make marketing phone calls in line with the laws of the recipient’s country: in Poland and in countries that require it, only after obtaining consent; in other countries – only where the call relates to your professional role. You can ask us not to call you at any time. The first e-mail or LinkedIn message does not contain an offer, only a question whether you would like to receive one.

Information about the data source: in the first message we tell you who we are, where we obtained your data and how you can object. Every message tells you that you can opt out of further contact by replying “STOP”. After you opt out, we mark your data as “do not contact” and exclude it from further activities, including advertising lists.

Retention period: until you object, and no longer than 12 months from the last contact if we do not start working together. For people who have objected, we keep minimal data (e-mail address and date of objection) so that we do not contact them again.

9. Recruitment and starting cooperation

The detailed rules for processing the data of people taking part in our recruitment processes (employment contracts) and processes for starting cooperation (B2B, contracts of mandate) – including purposes, legal bases, retention periods, the use of AI-based tools and your rights – are set out in a separate Privacy notice for people taking part in recruitment and cooperation processes: getprintbox.com/disclosurerequirements. In the event of any discrepancy, the Privacy notice prevails.

In short:

we process candidates’ data to carry out recruitment or assess the possibility of cooperation (Art. 6(1)(b) and (c) GDPR, Art. 22¹ of the Polish Labour Code); data provided on your own initiative – on the basis of consent (Art. 6(1)(a) GDPR),
we may find your profile in publicly available professional sources ourselves and invite you to take part in a process (Art. 6(1)(f) GDPR) – we tell you the source of the data in the first message, and if you do not reply, we delete the data within 30 days,
we use AI tools that organise and summarise information about candidates and assign a supporting match score; decisions are always made by a person, and you may object – we will then consider your application without the use of AI,
we prepare transcripts and notes of online interviews (Notion AI Meeting Notes) only with your consent, without recording audio or video,
after the process ends, we delete active recruitment data within 30 days; we may keep a limited set of data for up to 3 years (counted from the end of the year in which the process ended) to defend against claims; with your consent for future processes – 12 months from when it was given.

10. Marketing and information activities

Purposes of processing:

Sending commercial information, offers, news, event invitations and content promoting the controller’s products or services – through the selected communication channel (e.g. e-mail, phone, push notifications, messaging apps).
Personalising marketing content based on the recipient’s preferences, interaction history or relationship with the controller.
Carrying out promotional and PR activities aimed at building brand awareness and relationships with customers or potential customers.
For communication addressed to representatives of legal entities – maintaining contact as part of standard business relationships (B2B).

Legal basis:

Art. 6(1)(a) GDPR – the data subject’s voluntary consent to receive marketing content and commercial information through the selected communication channel (e.g. e-mail, phone).
Art. 6(1)(f) GDPR – the controller’s legitimate interest in direct marketing to business partners or representatives of organisations (B2B).
Regardless of the GDPR legal basis, we send commercial information by e-mail, text message or phone only to people who have given their prior consent (Art. 398 of the Polish Electronic Communications Law). This also applies to company representatives.
Art. 6(1)(b) GDPR – to the extent that marketing communication is part of the service provided (e.g. under the scope of a contract or terms of service).

Retention period:

Data processed on the basis of consent is kept until consent is withdrawn, but no longer than 24 months from the last contact with the controller (e.g. opening a message, clicking a link, attending an event).
Data processed on the basis of the controller’s legitimate interest (e.g. B2B relationships) is processed for the duration of the business relationship or until an objection to processing for marketing purposes is successfully raised, but no longer than 12 months from the end of the business relationship or from the last contact.

11. Ensuring the security of IT services and systems and preventing abuse

Purposes of processing:

Monitoring and analysing events in IT systems to detect and prevent security incidents (e.g. unauthorised access, DDoS attacks, intrusion attempts).
Maintaining and updating technical security measures to minimise the risk of loss of confidentiality, integrity or availability of data.

Legal basis:

Art. 6(1)(f) GDPR – the controller’s legitimate interest in ensuring the security of the service and IT infrastructure, protecting personal data and resources against abuse and preventing incidents.
Art. 6(1)(b) GDPR – processing is necessary to provide IT services under a contract (e.g. maintaining the availability of IT systems, technical support).

Retention period:

Data and logs processed on the basis of legitimate interest (Art. 6(1)(f)) – until the interest ceases (e.g. monitoring of the given event ends) or an objection is successfully raised, but no longer than 3 years from when they were recorded.

12. Customer satisfaction surveys

Purposes of processing:

Carrying out satisfaction surveys after a service has been provided or a transaction completed – to learn customers’ opinions and assess the quality of our services.
Analysing survey and feedback form results – including statistical analysis and identifying areas for improvement.
Improving service processes, personalising business relationships and developing our services based on customers’ actual needs.

Legal basis:

Art. 6(1)(f) GDPR – the controller’s legitimate interest in conducting customer opinion surveys to improve service quality, develop relationships and implement quality standards.
Art. 6(1)(a) GDPR – the data subject’s voluntary consent – for surveys not directly related to the service, opinion surveys of potential customers or the use of identifying data (e.g. a signed quote from a review).
Art. 6(1)(b) GDPR – where the survey is part of the performance of a contract (e.g. an evaluation survey as part of a service, a quality report under a contract).

Retention period:

Data processed on the basis of legitimate interest (Art. 6(1)(f) GDPR) is kept for as long as necessary to analyse and use the results, but no longer than 12 months after the survey ends, unless the results are anonymised earlier.
Data processed on the basis of consent (Art. 6(1)(a) GDPR) – until consent is withdrawn, but no longer than 12 months from when it was given, unless the data has been anonymised earlier.
Where the survey is part of a contract (Art. 6(1)(b) GDPR) – for the term of the contract and the limitation period for claims.

13. Training courses, workshops and webinars

Purposes of processing:

Registering participants and handling registrations for training courses, workshops or webinars organised by Printbox.
Enabling participation in the event, organisational contact and providing event materials.
Handling payments and issuing accounting documents (for paid events).
Documenting the event (e.g. attendance lists, recordings of broadcasts) and its evaluation by participants.
Accountability to external bodies (e.g. co-financing, grants, institutions monitoring the quality of training).

Legal basis:

Art. 6(1)(b) GDPR – processing is necessary to perform a contract or take steps towards concluding it (participation in training on the basis of registration and terms and conditions).
Art. 6(1)(f) GDPR – the controller’s legitimate interest in organising educational events, communicating with participants and archiving data to document participation.
Art. 6(1)(c) GDPR – for legal obligations relating to issuing accounting documents (invoices, bills), archiving accounting records or reporting obligations (e.g. in EU projects).
Art. 6(1)(a) GDPR – the data subject’s voluntary consent – e.g. to recording participants’ image (e.g. in videos, promotional materials) or processing data beyond what is necessary to provide the service.

Retention period:

Data processed for the purposes of the event (Art. 6(1)(b) GDPR) is kept for as long as necessary to perform the contract and handle any claims.
Data processed on the basis of legitimate interest (Art. 6(1)(f) GDPR) – for no longer than 3 years, unless further retention is necessary to settle a project or is required by the grant provider’s rules.
Data processed to fulfil legal obligations (Art. 6(1)(c) GDPR) – for the period required by law (e.g. accounting documents – 5 years, under the Polish Accounting Act).
Data processed on the basis of consent (Art. 6(1)(a) GDPR) – until consent is withdrawn, but no longer than 24 months where the purpose was marketing communication or publishing event materials.

14. Reviews, testimonials and image in marketing materials

Purposes of processing: publishing customer reviews, testimonials and case studies with the name, job title, company name, quote or photo of the person representing the customer; publishing photos and recordings from our events, webinars and trade fair stands on our website and social media.

Legal basis: your consent (Art. 6(1)(a) GDPR) and, as regards your image, also your permission to distribute it (Art. 81 of the Polish Copyright and Related Rights Act). We may distribute the image of people who are only a detail of a larger whole (e.g. a crowd at an event) without consent, on the basis of our legitimate interest in promoting events (Art. 6(1)(f) GDPR).

Retention period: until consent is withdrawn. After it is withdrawn, we will remove the materials from the channels we manage; we cannot withdraw materials that have already been printed or shared further by others.

15. Trade fairs, conferences and industry events

Purposes of processing: establishing and continuing business contact with people we have met at trade fairs, conferences or industry events – based on a business card you gave us, a conversation at our stand or a contact made in the event app provided by the organiser. Only contacts we have actually spoken with are added to our CRM.

Data categories and source: first and last name, job title, company, business contact details, notes from the conversation. The data comes from you or from the event app in which you shared your profile. Notes from the conversation may be prepared with the help of automatic transcription of an employee’s voice note.

Legal basis: our legitimate interest in continuing contact made at the event (Art. 6(1)(f) GDPR). We send commercial information by e-mail or phone only after obtaining your consent (Art. 398 of the Polish Electronic Communications Law).

Retention period: until you object, and no longer than 12 months from the last contact, unless we start working together.

16. Referrals from business partners

If you ask one of our business partners (e.g. a printing equipment manufacturer) about solutions offered by Printbox, the partner may put us in touch with you. We receive your contact details from the partner only with your consent.

Data categories: first and last name, company, job title, business contact details, information on what the enquiry concerns.

Legal basis: taking steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR) and our legitimate interest in responding to an enquiry passed on by a partner (Art. 6(1)(f) GDPR). At first contact, we tell you who we received your data from.

Retention period: up to 12 months from the last contact if we do not start working together.

#3 Scope and sources of the personal data we collect

We collect only the personal data necessary for the stated purposes. We obtain it directly from you (e.g. when you provide it in a form or contact us), automatically (e.g. through cookies) and sometimes from third parties (e.g. from social media, if you interact with us there, or from business data providers – when acquiring B2B customers). Below are the categories of personal data we may process:

Identification and contact data: e.g. first and last name, e-mail address, phone number, company name, job title, country of residence/registered office, professional profile URL (e.g. LinkedIn). Providing this data is voluntary but necessary for us to respond to your enquiry, provide a service or enter into a contract with you (e.g. a service agreement or licence agreement).

Data on the use of our website and services (technical data): information collected automatically when you visit our websites, such as IP address and approximate device location (e.g. country or city based on IP), browser and device type, operating system, unique online identifiers (e.g. cookie ID), pages visited, time spent on the website, referral source (e.g. the website you came from), as well as information about your interaction with our content (e.g. clicks on links, opening our e-mails, etc.), mouse movements and scrolling (session recordings). This data is collected using cookies and similar technologies, and we use it to analyse website traffic, improve our services and ensure security.

Transaction and commercial data: information related to your interest in our services, history of contact with us, enquiries and, for customers, data on contracts concluded, services/licences purchased, payments, etc. (to the extent it relates to an individual, e.g. a sole trader or a contact person at a business customer).

Company and fit assessment data (B2B): the industry, size and market of the company you work for, and our internal assessment of how well the company fits our offer (scoring).

Recruitment data: if you apply for a job at Printbox or take part in a process for starting cooperation, we process the data contained in your application (CV, cover letter, etc.), such as information about your professional experience, education, qualifications and skills, as well as contact details for recruitment purposes. We may also obtain information about your professional experience from publicly available professional sources or through referrals. Details: Privacy notice for candidates.

Other information you voluntarily provide: any other personal data you choose to disclose to us, e.g. in the content of a message, in contact form fields or during a phone/video call. We process it only for the purpose for which it was provided.

Data sources

As a rule, we obtain data directly from you when you use our services or contact us. Data may come from channels such as website forms, chats, newsletter sign-ups, e-mail correspondence, phone calls, in-person or online meetings, messages sent via social media, etc.

We automatically collect technical data necessary for the operation and optimisation of the website, including:

cookies and similar technologies used to store preferences and analyse traffic,
server logs recording events such as IP addresses, access time, browser and operating system information, etc.

We obtain data from third parties to supplement information, for verification or to acquire business customers (B2B):

Public sources (e.g. the Polish National Court Register (KRS) and the Central Register and Information on Economic Activity (CEIDG)) – for data concerning businesses.
Social and professional networks (e.g. LinkedIn) – when you contact us via these platforms, as well as publicly available information from your professional profile (name, job title, company) – when we search for the responsible people at companies that may be interested in our offer.
Commercial business data providers and data enrichment tools (Clay Labs Inc., USA, together with the data providers available in Clay, including Findymail, LeadMagic, Prospeo, Datagma, Dropcontact, Wiza, Icypeas, Enrow, Ocean.io; Surfe – Growster SAS, France) – business contact details and company information, for the purpose described in #2 point 8.
Tools that identify companies visiting our website (Clay, Leadfeeder) – the name of the company the visit may come from, only after you consent to marketing cookies (details in #6).
Referrers – if you were referred by a customer or partner, we may receive basic contact details from them. In that case, we will tell you at first contact.

We do not obtain information unlawfully. If we obtained your data from a source other than you, we will inform you no later than at first contact (Art. 14 GDPR).

#4 What rights do you have in connection with the processing of your data?

The General Data Protection Regulation (GDPR) gives you a number of rights in connection with the processing of your personal data. As the controller of your data, we respect these rights and make it possible for you to exercise them.

Your rights are listed below:

1. Right of access (Art. 15 GDPR)

You have the right to obtain confirmation from us as to whether we process your personal data. If we do, you have the right to access it and to information about, among other things, the purposes of processing, the categories of data, the recipients, the planned retention period and your rights. You can also request a copy of your data.

2. Right to rectification (Art. 16 GDPR)

If you notice that the personal data we hold about you is inaccurate or incomplete, you have the right to have it rectified or completed without undue delay.

3. Right to erasure (“right to be forgotten”) (Art. 17 GDPR)

You have the right to request the erasure of your personal data if:

it is no longer necessary for the purposes for which it was collected or otherwise processed,
you have withdrawn the consent on which the processing was based (and there is no other legal ground for further processing),
you have objected to the processing (and there are no overriding legitimate grounds for the processing),
the data has been processed unlawfully,
erasure is required to comply with a legal obligation.

Please note that this right is not absolute and is subject to exceptions (e.g. where processing is necessary to establish, exercise or defend legal claims or to comply with a legal obligation).

4. Right to restriction of processing (Art. 18 GDPR)

You have the right to request the restriction of processing of your data in certain situations, e.g. where:

you contest the accuracy of the data (for a period enabling us to verify it),
the processing is unlawful but you oppose the erasure of the data and request the restriction of its use instead,
we no longer need the data for the purposes of processing, but you need it to establish, exercise or defend legal claims,
you have objected to processing under Art. 21(1) GDPR (pending verification of whether our legitimate grounds override yours).

5. Right to data portability (Art. 20 GDPR)

Where processing is based on your consent or on a contract and is carried out by automated means, you have the right to receive the data you provided to us in a structured, commonly used and machine-readable format. You also have the right to transmit this data to another controller without hindrance from us and to request that we transmit it directly to another controller, where technically feasible.

6. Right to object (Art. 21 GDPR)

You have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data based on our legitimate interest (Art. 6(1)(f) GDPR), including profiling. In that case, we will stop processing your data for those purposes unless we demonstrate compelling legitimate grounds for the processing which override your interests, rights and freedoms, or for the establishment, exercise or defence of legal claims.

Particularly important: if your personal data is processed for direct marketing purposes (including profiling to the extent that it is related to such marketing), you have the right to object to such processing at any time. The objection does not need to be justified. Once we receive it, we will stop processing your data for that purpose without delay. The easiest way is to reply “STOP” to our message or, for the newsletter, to click the “Unsubscribe” link in the e-mail.

7. Right to withdraw consent (Art. 7(3) GDPR)

Where the processing of your data is based on consent, you have the right to withdraw it at any time. Withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal. You can withdraw consent as easily as you gave it (e.g. by clicking the link in the newsletter or by contacting us).

8. Right to lodge a complaint with a supervisory authority (Art. 77 GDPR)

If you believe that the processing of your personal data infringes the GDPR or other data protection laws, you have the right to lodge a complaint with the competent data protection supervisory authority. In Poland, this is the President of the Personal Data Protection Office (PUODO). Contact details of PUODO: https://uodo.gov.pl/en/p/contact.

You can submit requests to exercise the above rights as follows:

Standard requests (e.g. updating data, withdrawing consent, unsubscribing from the newsletter) are best sent directly to us at: gdpr@getprintbox.com (or in writing to our postal address). This allows our team to handle your request as quickly as possible.
For all matters relating to the processing of your personal data, as well as complex enquiries or doubts about your rights, you can also contact our Data Protection Officer directly: dpo@getprintbox.com (or by post marked “Data Protection Officer”).

The controller will make every effort to respond to your request without undue delay and in any event within one month, or will inform you of the need to extend this period (by a maximum of two further months) together with the reasons for the delay. In some situations, the controller may ask for additional information to confirm your identity in order to verify your right to submit the request. This is part of appropriate security measures to ensure that personal data is not disclosed to an unauthorised person.

#5 Who is or may be a recipient of your personal data?

We may share your personal data with other entities only in accordance with applicable law. We never sell personal data to third parties. The categories of entities to which we may disclose your data are:

1. Companies in our group and related entities

We are part of a structure in which we work closely with other entities to provide and develop our services. Your data may be shared with:

Printbox LLC (USA) – our subsidiary, to the extent necessary to serve customers in the USA or support our business.
Phenomena Michał Czaicki Spółka Komandytowa – our key technology partner responsible for developing and maintaining Printbox software.

Uniform, high standards of data protection apply within our group and between related entities, and data is transferred on the basis of joint controller arrangements or data processing agreements (DPAs).

2. External service providers (processors)

In our day-to-day business, we rely on trusted subcontractors who may process your data on our behalf and on our instructions. These include:

Hosting and IT infrastructure providers – we store data on the servers of external providers (e.g. cloud service providers). We conclude agreements with them that guarantee the confidentiality and security of data.

Analytics and marketing tool providers – e.g. Google (Google Analytics, Google Ads, reCAPTCHA), Meta (Meta Pixel), Hotjar, Microsoft (Clarity), LinkedIn, OpenAI (ads in ChatGPT), Capterra (Gartner), Mailchimp (Intuit), Leadfeeder (Dealfront), CookieYes (cookie consent management), who support us with analytics and promotion. We conclude a data processing agreement in line with Art. 28 GDPR with every processor. Please note that some of these entities may, to a limited extent, also act as independent controllers (e.g. Meta, Google, LinkedIn and OpenAI when displaying ads and using data for their own purposes – details in #6).

CRM, e-mail and relationship management system providers – we use them to manage our customer and contact database (CRM) and to send e-mails. This means that your contact details may be stored on such a provider’s servers and processed to handle communication. We always choose providers that guarantee compliance with privacy requirements.

B2B prospecting and data enrichment tool providers – Clay Labs Inc. (USA) and Surfe (Growster SAS, France) – help us find companies and contact persons, supplement data and send first messages (#2 point 8). They process the data we entrust to them (e.g. our contact lists) on our behalf, under a data processing agreement. They provide contact data from their own databases to us as separate controllers. Data is transferred to Clay in the USA on the basis of standard contractual clauses.

Communication and customer service tool providers: entities providing systems for managing e-mail, contact forms and ticketing (helpdesk), as well as webinar and online meeting platforms.

AI-based tool providers – including Anthropic (Claude), OpenAI, Google (Gemini), Microsoft, Fathom (meeting notes) and collaboration tools with built-in AI features (e.g. Notion). They process data on our behalf under data processing agreements and do not use it to train their models (details in #11).

Payment partners – if you make a payment for our services, payment data (e.g. card number, bank account details) is handled directly by an external payment operator. In such cases, the operator acts as an independent controller of this financial data.

Accounting firms, law firms and auditors – where necessary, we may share some of your data with our advisers (e.g. lawyers in the event of a dispute, auditors reviewing our compliance, an accounting firm processing our invoices containing your data, etc.). Data is shared only to the extent necessary and on the basis of appropriate agreements.

Other subcontractors where necessary – e.g. a courier company (which will receive your address if we need to send you a contract or materials), SMS service providers (if we confirm something by text message), document archiving companies, external developers and consultants (when carrying out projects or providing services). In each case, the data shared is limited to the necessary minimum.

3. Independent recipients

There are situations in which the law requires or allows us to disclose your data to other controllers. Such recipients include:

Public authorities and law enforcement: if authorised bodies (e.g. the police, public prosecutor, court or supervisory authority) request us to disclose data on the basis of applicable law, we are obliged to provide it. Each time, we carefully verify the legal basis of the request and the scope of the information provided, ensuring security and proportionality.

Parties to corporate transactions: if in the future Printbox considers a restructuring, merger or sale of all or part of its business, your data could be transferred to a potential buyer/investor as part of due diligence, and then to the new owner of the company. In that case, the new entity would take over the obligations of the data controller and could use the data to ensure continuity of services, but still in accordance with this Policy.

Operators of advertising platforms and review sites: Meta Platforms Ireland Ltd., Google Ireland Ltd., LinkedIn Ireland Unlimited Company, Microsoft, OpenAI, G2 and Capterra – to the extent that they use data for their own purposes (e.g. displaying ads, running profiles and reviews), they act as independent controllers.

4. Your consent / your instruction

In some cases, you may ask us to transfer your data to a specific entity or consent to it. For example: if you ask us for a reference and agree to the disclosure of your data to another customer, we will do so. Or, if you authorise the flow of your data when using an integration of our services with another company’s service (e.g. signing in with a Google account), the data is transferred with your consent and in line with your intention.

We impose data protection requirements on all processors acting on our behalf – they must guarantee appropriate security measures, process data only for the purposes we specify and on our instructions, and delete or return the data after the service ends. We also make sure not to share any data without authorisation. We do not sell e-mail databases, do not share customer lists with marketing partners without a legal basis and do not disclose information about users to other customers. Each recipient receives only the data necessary for a specific purpose (data minimisation). If you have any doubts about a particular recipient, you can always ask us whether and to whom we have transferred your data.

#6 Cookies and similar tracking technologies

Our websites use cookies and similar technologies (such as pixels, browser local storage and monitoring scripts) to ensure they work properly, analyse traffic and support our marketing activities. Cookies are small text files stored on your device (computer, smartphone) when you visit a website. On subsequent visits, they allow the website to recognise your browser and, for example, remember your preferences.

The current, full list of cookies and tools, with the lifetime of each, can be found in the cookie settings (CookieYes banner) on our website. We activate analytics and advertising tools only after you consent to the relevant category.

Types of cookies we use:

1. Strictly necessary cookies

These cookies are necessary for our website and services to work properly. They enable basic functions such as navigation or remembering your privacy settings (e.g. whether you have consented to cookies). Without them, the website cannot function properly. Some of them are set by us (first-party cookies) – they do not track you outside our website.

CookieYes (CookieYes Limited, United Kingdom) – a consent management tool. It stores your choices in a cookie and keeps a record of the consents given with the provider (anonymised ID, date, scope of consent) so that we can demonstrate that consent was given. Legal basis: legal obligation to demonstrate consent (Art. 6(1)(c) in conjunction with Art. 7(1) GDPR).
Google reCAPTCHA (Google Ireland Ltd.) – protects forms on the website against spam and bots. It analyses, among other things, the IP address, browser and device data and the way you interact with the website. Legal basis: legitimate interest in protecting the website against abuse (Art. 6(1)(f) GDPR). Data may be transferred to Google LLC in the USA (Data Privacy Framework).

2. Analytics/performance cookies

These cookies allow us to collect aggregated information about how users use our websites – which pages they visit, how much time they spend on them and which features they click. They help us improve the structure and content of our websites and solve technical problems. We use, among others:

Google Analytics (Google Ireland Ltd.) – a popular tool for analysing website traffic statistics. The data we receive from Google Analytics takes the form of aggregated reports and statistics. It does not allow us to directly link information to a specific user. Typical information we analyse includes: general data about users’ operating systems and browsers, the popularity of individual pages of our website, average time spent on the website and its pages, users’ navigation paths, general information about traffic sources (e.g. search engines, other websites), approximate geographical location (e.g. country or city level), etc. Data processing in connection with Google Analytics cookies is based on your voluntary consent (Art. 6(1)(a) GDPR), which you give through our consent management tool (cookie banner). We use Google Analytics 4, which does not log or store the IP addresses of EU users – the IP address is used only to determine approximate location and is then discarded. Until you give consent, Google Analytics runs in a limited mode (Consent Mode): it does not set cookies and only sends a signal that consent has not been given. Remember that you are in control of cookies. You can withdraw your consent to Google Analytics cookies at any time by changing the settings in our consent management tool. In addition, most browsers offer settings that allow you to manage cookies, including blocking or deleting them. Google also provides information on how to opt out of data collection by Google Analytics (e.g. using special browser add-ons). We recommend reading Google’s official materials on this subject. More information about how Google uses data when you use its partners’ websites and apps, and about privacy in Google services, can be found in the company’s publicly available materials (e.g. its privacy policy).

Hotjar (Hotjar Ltd) – an analytics and feedback tool that helps us understand how users navigate the website. Hotjar may anonymously record mouse clicks, cursor movements, scrolling and interactions with selected interface elements. This helps us detect usability problems and optimise the layout of content. Hotjar also collects information about the user’s device (device type, browser, approximate country-level location). Hotjar does not record text entered in forms and does not record the screen in a way that would reveal your personal data. Text fields are automatically suppressed (characters entered are masked). Hotjar data is stored on servers in the European Union (AWS eu-west-1 region, Ireland). You can also opt out of Hotjar tracking on all websites that use it by visiting the Hotjar opt-out page: https://www.hotjar.com/legal/compliance/opt-out. More information about how Hotjar processes data can be found on its privacy page: https://www.hotjar.com/legal/policies/privacy/. We activate Hotjar only after you consent to analytics cookies.

Microsoft Clarity (Microsoft Corporation, USA) – a tool for analysing behaviour on the website: heatmaps, session recordings, scrolling and frustration signals (e.g. repeated clicks on the same element). It collects user and session IDs (cookies _clck, _clsk), IP address (to determine approximate location), device and browser data, pages visited, clicks, mouse movements and scrolling. Text entered in form fields is masked. Session recordings are kept for 30 days and heatmaps for up to 13 months. We activate Clarity only after you consent to analytics cookies (Art. 6(1)(a) GDPR). Data may be transferred to the USA on the basis of the Data Privacy Framework. More: https://privacy.microsoft.com/privacystatement

3. Advertising/marketing cookies

These cookies are set by us or our advertising partners (third parties) to track user activity and display personalised ads for our products on other websites (behavioural advertising, retargeting). In other words, if you have visited our website and shown interest in specific content or a product, these cookies may later show you our ad – e.g. on Facebook, Instagram, WhatsApp, LinkedIn, ChatGPT, in Google search results or on websites in the Google advertising network – tailored to your interests. We use, among others:

Meta Pixel (Facebook/Instagram) – a piece of code (tracking pixel) provided by Meta Platforms Ireland Ltd., embedded on our websites. The Pixel stores cookies on your device that identify you on Facebook/Instagram (if you have an account there). It tells us whether you have visited our website and what actions you took on it (e.g. whether you filled in the contact form). We may also send Meta encrypted (hashed) lists of e-mail addresses or other identifiers of our customers or subscribers (if they have given appropriate consent) to create custom audiences. This allows Meta to find these people on its platforms and show them ads or create lookalike audiences.

Based on Pixel data, we may show you our ads on Facebook/Instagram (retargeting) and create anonymous statistics on the effectiveness of these ads (e.g. we learn how many people visited our website after clicking an ad and took a specific action). We do not receive any of your personal data from your profile from Meta – we only receive aggregated reports. However, the Pixel itself sends Meta certain information about your device and behaviour (address of the page visited, cookie ID, IP address, browser information, etc.), which Meta may link to data from your Facebook/Instagram account and also use for its own purposes. At the stage of collecting data through the Pixel and transmitting it to Meta, we are joint controllers with Meta Platforms Ireland Ltd. (Art. 26 GDPR; terms: https://www.facebook.com/legal/controller_addendum). Further processing of this data by Meta, including for displaying ads, is the responsibility of Meta as an independent controller. Our ads may be displayed in Meta services: Facebook, Instagram, Messenger, WhatsApp (Updates tab) and Audience Network. More information can be found in Facebook’s privacy policy. In EU countries, we use the Pixel only with your explicit consent (consent to marketing cookies). Consent is voluntary – you can withdraw it at any time. Once withdrawn, the Pixel will be disabled in your browser and we will no longer track your actions or show you personalised ads. More information about data processing by Meta can be found in Meta’s Privacy Policy and Cookies Policy.

Google Ads – our websites may use Google Ads remarketing code, which sets cookies that allow us to show you our ads in the Google advertising network (e.g. on YouTube, Google Search or Google AdSense partner websites) based on your activity on our websites. For example, if you visited a specific product page on our website, a remarketing cookie may cause you to see an ad for that product while browsing another website. Like the Pixel, this mechanism is activated in the EU only with your consent to marketing cookies.

Visit source (UTM, gclid) – if you consent to marketing cookies, we store information in your browser about how you reached our website: campaign parameters (UTM, e.g. “newsletter”, campaign name) and the Google ad click identifier (gclid). When you submit a form, we send this information together with your enquiry to our CRM system (Pipedrive) so that we know which campaign the enquiry came from. Without your consent, we do not store this information in your browser – the visit source can then only reach us if it is included in the address of the page from which you submit the form.

LinkedIn Insight Tag – our websites may use the LinkedIn Insight Tag – a piece of JavaScript code provided by LinkedIn (LinkedIn Ireland Unlimited Company) that enables conversion tracking, audience building and analysis of the effectiveness of advertising campaigns on LinkedIn. The Insight Tag stores cookies in the user’s browser that allow us to recognise visitors to our website as LinkedIn users (if they have an account there) and to monitor their interactions with our website. The data collected includes, among other things: pages visited, URL, browser type, IP address, device information and timestamp. This data is then sent to LinkedIn and may be used to create personalised advertising campaigns and analyse the effectiveness of our marketing. The Insight Tag is activated only after you give your explicit consent to marketing cookies. You can withdraw it at any time through our consent management tool. We may also send LinkedIn lists of companies and e-mail addresses of contact persons at companies (in hashed form) to show these companies and people our ads (LinkedIn Matched Audiences). We do this on the basis of our legitimate interest (Art. 6(1)(f) GDPR) in marketing our services to business customers. You can object to this at any time by writing to dpo@getprintbox.com. More information about LinkedIn cookies can be found in its Cookie Policy: https://www.linkedin.com/legal/cookie-policy.

OpenAI – ads in ChatGPT (OpenAI pixel) – we display ads for our services in ChatGPT. To measure their effectiveness, our website uses the OpenAI pixel, which collects the ad click ID, cookie and device identifiers, IP address, browser information, pages visited and events (e.g. form submission). We activate it only after you consent to marketing cookies (Art. 6(1)(a) GDPR), which you can withdraw at any time in the cookie settings. OpenAI processes data from the pixel as a separate controller; data of people in the European Economic Area is processed by OpenAI Ireland Limited. More: https://openai.com/policies/privacy-policy

Capterra (Gartner) – we have a paid profile in the Capterra software directory. The Capterra pixel (Gartner Digital Markets) on our website measures how many people come from Capterra and submit a form. It collects browser and click identifiers, IP address, browser information, pages visited and conversion events; it stores some information in the browser’s local storage (localStorage). We activate it only after you consent to marketing cookies. Data may be transferred to Gartner, Inc. in the USA on the basis of the Data Privacy Framework.

Mailchimp – we use the Mailchimp platform to manage newsletters and analyse the effectiveness of e-mail campaigns. Mailchimp uses “web beacons” (tracking pixels) embedded in e-mails and tracked links. These technologies make it possible to track only information such as: whether a message was opened, link clicks, date and time of interaction, IP address, browser type and device data. The data collected is sent to Mailchimp and used for analytics – e.g. campaign performance reporting, audience segmentation and marketing automation. We do not receive any data from Mailchimp that would identify a user unless they have previously agreed to subscribe to the newsletter. Mailchimp may process user data on servers in the United States – data is transferred on the basis of standard contractual clauses and certification under the EU–U.S. Data Privacy Framework. We do not use Mailchimp scripts or cookies on our website. Mailchimp only tracks opens and clicks in newsletter e-mails – this is part of the newsletter service you signed up for (#2 point 3). You can also unsubscribe from the newsletter by clicking the “Unsubscribe” link in every e-mail. More information about data processing and cookies by Mailchimp can be found in its privacy policy: Global Privacy Statement | Intuit.

Other advertising tools – depending on our marketing campaigns, we may from time to time use other advertising platforms (such as LinkedIn Ads, Twitter Ads, etc.), which work in a similar way – by placing the relevant advertising script/pixel and related cookies on our website. We activate each such tool only after you consent to marketing cookies, and we add its cookies to the list in the cookie settings (CookieYes banner). When we introduce a tool that changes the purposes or scope of processing, we also update this Policy.

Other tracking technologies

In addition to traditional cookies, our websites may also use other tracking technologies that allow us to analyse how the website is used, optimise its performance and carry out marketing activities. These technologies do not always rely on storing information in the browser in the form of cookies – they may work through mechanisms such as localStorage, pixel tags (tracking pixels), browser fingerprinting or IP address analysis for approximate geolocation of the user. Some of these solutions make it possible to identify visitors even if they do not provide their contact details or express explicit preferences while browsing. For this purpose, we use, among others:

Clay – identifying companies visiting the website – the Clay Labs Inc. (USA) script uses the IP address and visit data (pages visited, time, browser) to determine which company a visit may come from. The result is checked manually by our sales team and may be added to our CRM as company information. We do not identify specific individuals in the EEA in this way. We activate the script only after you consent to marketing cookies. Legal basis: our legitimate interest (Art. 6(1)(f) GDPR) in acquiring business customers. Data may be transferred to the USA on the basis of standard contractual clauses. More: https://www.clay.com/privacy

Leadfeeder (Dealfront) – the “website visitors” feature in our Pipedrive CRM; a European tool that identifies companies visiting our website based on their IP address; it sets the _lfa cookie and sends information about the pages visited to the provider. We activate it only after you consent to marketing cookies.

#7 How long cookies are stored

Cookies may be session cookies (deleted automatically when you close your browser) or persistent cookies (remaining on your device for a set period or until you delete them manually). Our website uses both session and persistent cookies. Strictly necessary and preference cookies are usually session or short-term cookies, while analytics and marketing cookies may remain active longer. For example, standard Google Analytics cookies (_ga) may remain on your device for up to 2 years, and user-level data in statistics may be kept for up to 14 months (in line with the default data retention settings in GA). Some Google advertising cookies (e.g. Google Ads remarketing cookies) may remain valid for up to 540 days unless the user deletes them earlier. Microsoft Clarity cookies: _clck – up to 1 year, _clsk – 1 day. Detailed information on the lifetime of individual cookies can be found in the settings of the cookie management banner on our websites or in your browser settings.

#8 Managing cookies

You are in control of the cookies used by our websites. Below we describe how you can manage cookies and tracking preferences:

1. Cookie banner / Preference centre

On your first visit to our website, we display a cookie banner in which you can accept or reject individual categories of cookies (except strictly necessary cookies, which are always active). You can change your choices at any time – click the cookie settings link (e.g. “Privacy settings” or the shield icon) on our website and adjust your consents there.

2. Browser settings

You can also manage cookies at browser level. Most browsers allow you to delete stored cookies, block new ones and set preferences for selected websites. Please note, however, that if you block all cookies (including strictly necessary ones), you may lose access to some features of our website or cause it to malfunction. Instructions for managing cookies can be found in your browser’s documentation or help pages. For convenience, a few examples:

in Google Chrome: menu ⟶ Settings ⟶ Privacy and security ⟶ Third-party cookies / Site data (where you can clear browsing data and set blocking rules),
in Safari (macOS): Safari menu ⟶ Settings ⟶ Privacy (cookie options),
in Mozilla Firefox: menu ☰ ⟶ Settings ⟶ Privacy & Security ⟶ “Cookies and Site Data” section (where you can clear and manage cookies).

3. Opting out with third-party providers

In addition to the above, you can also use opt-out options offered directly by some of our third-party partners. For example:

To disable personalised Google ads (remarketing), go to Google Ad Settings: https://adssettings.google.com/ and change the ad personalisation settings for your Google account.
To opt out of behavioural advertising on Facebook/Instagram, go to the ad settings in your Facebook account (Settings & privacy ⟶ Settings ⟶ Ads) and change your ad preferences, or use the YourAdChoices option available at aboutads.info/choices.
For Hotjar – as mentioned above, a global opt-out option is available. You can visit Hotjar’s official opt-out page (Hotjar Opt-out) and, with one click, disable Hotjar’s collection of data about your visits on all websites that use the tool.
LinkedIn – ad settings in your LinkedIn account (Settings ⟶ Advertising data).

Please note that changing your cookie settings or withdrawing consent does not automatically delete existing cookies from your device. You can always delete them yourself in your browser settings. If you have any questions or problems with cookies on our website, please contact us – we will be happy to help.

#9 Do we transfer your data to third countries?

Printbox operates internationally, so your personal data may be transferred to countries outside the European Economic Area (EEA). This applies in particular to:

transfers within our group – e.g. to Printbox LLC in the USA (serving US customers, technical support),
the use of providers from outside the EEA – many of our IT tools are provided by companies based in the USA or with servers there (e.g. Google, Meta/Facebook, Microsoft, LinkedIn, OpenAI, Anthropic, Fathom, Clay, Mailchimp (Intuit), Capterra (Gartner), etc.),
situations where you are outside the EEA and use our services (e.g. you are in the USA and send us data – the data naturally reaches us from a third country).

EU law requires such transfers to ensure a level of protection equivalent to European standards. Therefore:

If the European Commission has decided that a country ensures an adequate level of data protection (has issued an adequacy decision), we base the transfer on that decision. Countries with such a decision include, for example, Israel, Japan and the United Kingdom.

For the USA: since July 2023, an adequacy decision has applied to the EU-US Data Privacy Framework. Some of our providers may be certified under this framework, which means that transfers to them are permitted as if they took place within the EEA. We check our providers’ status on an ongoing basis.

If a country does not have an adequacy decision (this applies, among others, to the USA for non-certified entities, as well as to other countries such as India, Brazil, etc.), we use appropriate contractual safeguards, primarily the standard contractual clauses (SCCs) approved by the European Commission (in line with Art. 46 GDPR). SCCs oblige the recipient of data outside the EEA to protect the data in line with EU standards. In addition, where necessary, we implement supplementary measures, e.g. data encryption, limiting the scope of data transferred and strict access rules.

For transfers within the Printbox group (Poland – USA), we also use appropriate mechanisms (e.g. we have concluded a data processing agreement with standard contractual clauses between Printbox Sp. z o.o. and Printbox LLC). As a result, even data transferred to the USA remains protected by this agreement.

In exceptional situations, we may base a transfer on a derogation provided for in Art. 49 GDPR (e.g. where the transfer is necessary for the performance of a contract with you or for the establishment or defence of legal claims) – however, we primarily rely on the safeguards described above.

At your request, we will tell you the legal basis on which we transfer data to a particular provider and provide a copy of the safeguards applied.

#10 Profiling, behavioural advertising and automated decision-making

Profiling means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that person’s preferences, interests, behaviour, location, etc. At Printbox, some activities may be considered profiling. However, we do not make decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you (in line with Art. 22 GDPR). This means that we do not leave decisions affecting your rights or opportunities to algorithms (e.g. we do not automatically refuse to conclude a contract without human involvement).

To what extent we use profiling:

Mainly for the marketing and analytics purposes described in the previous sections. Examples:

We analyse your behaviour on the website (e.g. which pages you visit, what materials you download) to infer which products or topics may interest you. Based on this, we may tailor the content of the newsletter or offers we send you (e.g. if you often read about photo books, we may send you a case study of a photo book customer).
If you have consented to advertising cookies, tools such as the Facebook Pixel or Google Ads (as well as LinkedIn and OpenAI) will profile you within their platforms – e.g. assign you to a group of people interested in e-commerce software – so that you are shown relevant ads.
We segment customers in our CRM – e.g. we distinguish between active and inactive customers, potential customers (leads) and those with a contract – to tailor our sales communication accordingly.
In recruitment, AI tools may assign a supporting score for how well a candidate’s profile matches the job requirements or recommend profiles; decisions are always made by a person (details in the Privacy notice for candidates).
We assess how well companies fit our offer (scoring) based on company data (e.g. industry, size, market) and search for companies similar to our current customers – to decide whom to contact and in what order (#2 point 8).
If you consent to marketing cookies, we use the IP address to determine which company a visit to our website may come from (Clay, Leadfeeder). We do not identify specific individuals in this way.
The content of first messages to potential B2B customers may be personalised with the help of AI tools based on information about the recipient’s company and job title; every message is approved by a person.

Your rights related to profiling:

You have the right to object at any time to the processing of your data for direct marketing purposes, including profiling to the extent that it is related to such marketing (Art. 21(2) GDPR). If you object, we will stop such profiling or sending you marketing. In addition, if you believe that profiling based on our legitimate interest infringes your rights or legitimate interests, you may also object on those grounds (Art. 21(1) GDPR) – we will accept your objection unless we demonstrate compelling legitimate grounds that override your interests.

Behavioural (targeted) advertising:

As mentioned, as part of our marketing activities we use ads tailored to users’ interests. This is done through partners such as Google, Meta, LinkedIn and OpenAI, who use cookies and online identifiers to match ad content to your online profile. We make sure that these ads relate only to our own services and products (we do not share your data with other companies to advertise unrelated products to you). You can opt out of behavioural advertising from our website at any time – instructions can be found in #8.

#11 Do we use AI-based tools?

Yes. In our day-to-day work, we use AI-based tools, including language models. We use them as work tools – they are not a separate purpose of processing, but a way of achieving the purposes described in #2.

What we use AI for:

preparing, editing and translating texts, offers, documents and correspondence,
summarising and organising information (e.g. notes, tickets, project documentation),
creating and developing software and handling technical tickets,
personalising first messages to potential B2B customers (#2 point 8),
notes, transcripts and recordings of online meetings with customers (Fathom) – only where participants have been informed in advance and have given their consent; the note-taking tool is visible in the meeting as a participant,
supporting recruitment – on the terms described in the Privacy notice for candidates.

What data may be entered into AI tools: data that we process for the given purpose anyway – most often business contact details and the content of correspondence or documents. We do not enter special category data (e.g. health data), payment card data or passwords into AI tools, and other data only to the extent necessary for the given task.

Legal basis: the same as for the purpose for which we process the data (#2) and, as regards the use of the tool itself, our legitimate interest in carrying out our work efficiently and reliably (Art. 6(1)(f) GDPR). Meeting transcripts – on the basis of consent (Art. 6(1)(a) GDPR).

How we keep it secure:

we use only internally approved tools, in business versions – not free versions for private use,
providers process data on our behalf, under data processing agreements, and do not use it to train their models,
only authorised people have access to the tools and their output; internal rules on the use of AI apply to us,
the output of AI tools is reviewed by a person; we do not use them to make decisions based solely on automated processing that would produce legal effects concerning you or similarly significantly affect you (Art. 22 GDPR).

Transfers outside the EEA: some AI providers are based in or have servers in the USA. Transfers take place on the terms described in #9 (Data Privacy Framework or standard contractual clauses).

If you would like to know whether and how AI tools were used in processing your data, write to us: gdpr@getprintbox.com.

#12 How do we protect your personal data?

We make every effort to ensure the security of your personal data and to protect it against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or access. Printbox has implemented appropriate technical, physical and organisational measures in line with applicable law and industry standards to protect the data we process. These include modern solutions to secure our IT infrastructure (firewalls, intrusion detection systems), encryption of data in transit (HTTPS/SSL for connections to our website), regular software updates and monitoring of systems for vulnerabilities. We store personal data on secure servers in professional data centres that meet high protection standards.

Only authorised people who need access to perform their duties – our employees or trusted subcontractors – have access to your personal data. All of them are bound by confidentiality and must comply with Printbox’s internal security policies. We regularly train our team in data protection and apply the principle of least privilege (each person sees only the data needed for their role). We also have procedures for handling security incidents (including potential personal data breaches) – in the event of such an incident, we will promptly take steps to resolve it and minimise its effects and, where required, notify the competent authorities and the data subjects (in line with Art. 33–34 GDPR). Despite the measures taken, please remember that no system can guarantee 100% security. The internet as a communication environment carries certain risks – e.g. be careful when sending information by e-mail or through online forms (especially on public Wi-Fi). Printbox constantly improves its security to meet new threats, but cannot completely rule out, for example, the effects of very advanced attacks. We assure you, however, that within our capabilities we apply industry best practice to keep your data safe with us. If you have any further questions about the security of your data, please contact us: gdpr@getprintbox.com.

#13 System logs

System logs are automatically created records of events on our servers that capture basic information about how users use our websites. When you visit any Printbox website, our IT system may automatically record in logs data such as: your device’s IP address, the date and time of the visit, the URL of the requested page (the specific HTTP request), information about your browser and operating system (the User-Agent header sent by your browser) and possibly other technical data, e.g. the referring page address (referrer), application errors, etc. The server collects this information automatically in the background – for all users visiting the website, whether or not they are logged in.

System logs are used mainly for administrative and security purposes. They allow us, for example, to monitor the proper functioning of the website, diagnose technical problems (by analysing error entries) and protect our IT systems – logs help us detect abuse (e.g. intrusion attempts, DDoS attacks) and analyse any incidents. The legal basis for processing log data is our legitimate interest (Art. 6(1)(f) GDPR) in ensuring the security and proper functioning of the website. We do not use server log data to identify specific individuals or for marketing purposes. These records are used mainly by IT administrators, and access to them is strictly limited.

How long do we keep logs? We keep the data contained in server logs for a limited time, in line with the principle of data minimisation. We usually delete or anonymise logs no later than 36 months after they were recorded. Logs may exceptionally be kept longer – e.g. if log entries are needed as evidence in ongoing proceedings or to defend against claims (in such a case, we may keep selected logs until the matter is resolved or the proceedings are finally concluded). After the retention period, logs are securely deleted or anonymised. Log information, as technical data, is not disclosed to unauthorised parties. It may only be provided to authorised bodies (e.g. the police or public prosecutor) on the basis of the law, or used by us to protect our rights in accordance with applicable law.

#14 Can this Privacy Policy change?

The law and the scope of our business may change, so we update this Privacy Policy from time to time to keep it in line with applicable law and our practice. You will find the date of publication/last update at the top of this document.

In the event of significant changes (e.g. changes to the purposes of processing, the introduction of new services that significantly affect the way data is processed, or changes affecting your rights), we will take additional steps to inform you. This may be an e-mail notification (if we have your e-mail address in our database) or a clear notice on our website on your next visit.

We encourage you to review this Privacy Policy periodically to stay informed about how we protect your data. For full transparency, all previous versions of the privacy policy are available below.