When you contact us or use the Site or the Electronic Services we offer, we process your Personal Data.

We respect your privacy and strive in such cases to follow best practices in the area of processing your Personal Data - especially in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC, also known as the General Data Protection Regulation (GDPR).

This Privacy and Cookies Policy explains who we are, how we process your Personal Data, what cookies we use, your rights in this regard and how you can contact us if you need to.

The Privacy and Cookies Policy has been created for informational purposes only, which means that it is not a source of legal obligation for both you and AirCashBack (it does not constitute a contract). Consequently, we reserve the right to revise the Privacy and Cookies Policy from time to time. The current version of the Privacy and Cookies Policy will be available on the Site under the "Privacy Policy" tab.

TABLE OF CONTENTS

I. Glossary - basic terms. 1
II. Who is the controller of your personal data? 1
III. What Personal Data do we collect, what is the purpose, period and legal basis for its processing? 2
1. SITE VISITS 2
2. CLAIMS HANDLING AND POWERS OF ATTORNEY GRANTED 2
3. NEWSLETTER 4
4. CONTACTING US 4
5. SOCIAL MEDIA PROFILES 5
6. COMPETITIONS 6
7. BUSINESS RELATIONS 6
IV. Who has access to your Personal Information? 8
V. Your rights in connection with the processing of your Personal Data 8
VI. What are "cookies" and other similar technological solutions? How and for what purpose do we use them? 9

I. Glossary - basic terms

Personal Data - all information relating to you that we process. For example: name, surname, email address, phone number, etc.

Processing - all activities performed on Personal Data. For example: collecting, storing, updating, deleting data.

All capitalized words/terms used in the Privacy Policy and Cookies, not defined above, should be understood in the meaning ascribed to them by the Regulations, unless a different meaning is clear from the context in which they are used.

II. Who is the administrator of your personal data?

The administrator of your personal data is AirCashBack Poland Spółka z ograniczoną odpowiedzialnością with its registered office in Warsaw, at Tytusa Chałubińskiego 8, registered in the National Court Register under number 0000475344 by the District Court for the Capital City of Warsaw in Warsaw, the Company's share capital is PLN 114,800.00; NIP: 525-256-06-52; REGON: 146758821 (hereinafter referred to as "AirCashBack"), e-mail address: info@aircashback.com.

You may also contact our Data Protection Officer at e-mail address: iod@aircashback.com.

III. What Personal Data do we collect, what is the purpose, period and legal basis for its processing?

1. VISITS TO THE SERVICE

When you visit the Website, we may use cookies and other related technology (see Section VI of the Privacy and Cookies Policy for details), which allows us to maintain the proper operation of the Website, as well as to analyze information about your activity on the Website. We process this data to improve the quality of the services we offer and to improve the functioning of the Service. It may also happen that cookies (or similar) also help us to tailor the content available through the Service to your interests (profiling). We may use some cookies for marketing purposes, both within the Service and on the websites of our business partners.

The legal basis for the use of cookies and similar technologies is generally your consent.

However, the basis for the processing of data collected using cookie technology is our or a so-called "third party's" legitimate interest (Article 6(1)(f) of the RODO - among other things, the need to ensure the highest quality of the content presented, and sometimes also the marketing of our or our partners' products and services, in which case the partners are not involved in the processing of your data. To the extent that our partners may also have direct access to this information - the legal basis for such processing is your freely given consent (Article 6(1)(a) RODO).

We process Personal Data on the basis of your consent at most until you revoke it. Personal Data processed on the basis of our legitimate interest may be stored until you object to its processing, except where, despite your objection, we conclude that there are valid, legitimate grounds for processing that override your interests, rights and freedoms, or grounds for establishing, asserting or defending claims.

The above does not apply when the use of cookies and similar files is necessary for the proper operation of the Service (to provide you with a service provided electronically), where we rely on the law and, respectively, on the necessity of the processing for the performance of the contract for the provision of services (Article 6(1)(b) RODO). Your Personal Data is then processed for the period of time necessary for these purposes.

Information about the recipients of your Personal Data, including the possible transfer of your Personal Data to third countries (outside the European Economic Area), is detailed in Section IV below.

The rights you have in connection with the processing of your Personal Data are described in detail in Section V below.

2. CLAIMS HANDLING AND POWERS OF ATTORNEY GRANTED

In order to establish a claims handling relationship, we will require certain Personal Information, e.g. your name, surname, email address and information necessary to properly authorize us to act on your behalf against an entity obligated to fulfill a claim on your behalf (e.g. an airline) including in the context of legal proceedings. Provision of all information is voluntary, but some data is necessary for the conclusion and performance of a contract, and failure to provide such information may mean that it will not be possible to conclude such a contract.

The purpose, as well as the legal basis for processing is the conclusion and proper performance of a contract (Article 6(1)(b) RODO) - e.g. handling your claims and representing you at the pre-court and court stage, in particular representing you in relation to third parties, conducting correspondence with them and taking legal action in relation to them on the basis of powers of attorney.

As a rule, we obtain Personal Data directly from you. However, it may happen that if you have expressed interest in our services with your consent, your telephone number, email address and identification data will be provided to us by another person, e.g. a fellow passenger on the flight to which your claim relates. In such a case, we may contact you in order to introduce you to our services and enable you to make a decision regarding our cooperation. We take such contact as an action leading to the conclusion of a contract (Article 6(1)(b) RODO). In such cases, if you decide to cooperate with us (this decision is always entirely up to you), e.g. by granting us a power of attorney, this notice in section 2 of the privacy policy also applies to you.

We ask you to keep in mind that if you grant us a power of attorney, e.g. as a parent or legal guardian of another person, the information in this document applies both to the Personal Data you provide to such person (we ask you to review this document from the perspective of protecting the interests and rights of the person you represent), as well as to your Personal Data, the processing of which is necessary for the proper performance of a contract, e.g. to demonstrate proper authorization to act in order to gain a claim before a contractor or before a court.

Your Data may also be processed for marketing activities, e.g. presenting you with advertisements and offers (discounts), also tailored to your interests based on profiling (legal basis for these activities: Article 6(1)(f) RODO, i.e. legitimate interest of the Administrator or a third party (Administrator's own marketing or partners).

We may also process your Personal Data for the purpose of detecting and preventing any privacy risks, fraud or other bad faith activity, and for the purpose of establishing, processing and pursuing claims that may arise under the relationship between you and the Administrator. In such case, the legal basis for processing is our legitimate interest (Article 6(1)(f) of the DPA).

We process your Personal Data only for the time necessary for the purposes for which they were originally collected. After that time, they will be deleted, except where we are obliged to continue processing such data in order to comply with legal obligations.

If you are a current or potential customer of ours, we will retain your Personal Data for a minimum of the term of the contract or the period necessary to enter into the contract, and then for a maximum period of: for current customers: 10 years, counting from the end of the year in which we finished providing services to you; for potential customers: 2 years from the last contact.

We process personal data processed on the basis of your consent until the consent is withdrawn, if any, or the purpose for which it was given is fulfilled.

The above periods may be extended, as necessary, in the case of possible claims and legal proceedings - by the duration of such proceedings and their settlement - and if the law in certain cases obliges us to process them longer.
Information about the recipients of your Personal Data, including the possible transfer of your Personal Data to third countries (outside the European Economic Area), is detailed in Section IV below.

The rights you have in connection with the processing of your Personal Data are detailed in Section V below.

3. NEWSLETTER

We may send you commercial information about us and our services (or our partners) through the communication channel of your choice, but only with your prior consent, also tailored to your interests based on profiling. The legal basis for processing your Personal Data for this purpose is our or our partners' legitimate interest (Article 6(1)(f) RODO) - our or a third party's marketing purposes.

Providing Personal Data is voluntary, but necessary to subscribe to the Newsletter.

We may also process your Personal Data for the purpose of handling and investigating claims - the legal basis for the processing is our legitimate interest, respectively (Article 6(1)(f) RODO).

We may process your Personal Data for the period in which it is necessary for our marketing activities, unless you object to its processing, the longer time is determined by its storage for possible claims by the limitation period set by law, in particular the Civil Code, or by the duration and settlement of legal proceedings. In any case, the longer period of storage of Personal Data is decisive.

4. GETTING IN TOUCH

When you contact us, e.g. using email, available forms, social media, etc., examples of Personal Data that we may process are: Personal Data that identifies you (e.g., email address, IP number, etc.), metadata about your contact (e.g., date of contact, duration of our conversation), and the content of our communications (e.g., content of emails). Your Personal Data is processed for the purpose of answering your question, improving our communication, enhancing our customer service, as well as for marketing purposes. The purpose of the processing depends on the purpose of our communication, hence sometimes your Personal Data will be used to enter into a relevant contract with you, or, if we already have a contract, to provide you with appropriate care as part of our cooperation (e.g., processing your complaint).

In such cases, the legal basis for processing depends on the context of the communication. If you contact us only for the purpose of obtaining general information, e.g. regarding the Service, we process your Personal Data based on our legitimate interest (derived from the purposes mentioned above; Article 6(1)(f) RODO). However, in case your inquiry leads to the conclusion of a contract, the relevant legal basis for the processing will be Article 6(1)(b) RODO - taking action at the request of the data subject prior to the conclusion of a contract. If we are already connected by a contract, and you contact us about its performance, the basis for our actions will be Article 6(1)(b) RODO - necessity for the performance of the contract.

We may also process your Personal Data for the purpose of processing and asserting claims - the legal basis for processing is, respectively, our legitimate interest (Article 6(1)(f) RODO).

Provision of Personal Data is voluntary, but necessary to communicate with us effectively.

If your Personal Information has been collected only in connection with our current communication, we may process it, depending on the category of the particular information, for a period ranging from a few days to several months (more detailed inquiries and conversations that may be relevant to our future contact).

Personal Data processed on the basis of our legitimate interest may be kept until you object to its processing, except where, despite your objection, we conclude that there are compelling legitimate grounds for processing that override your interests, rights and freedoms, or grounds for establishing, asserting or defending claims.

The rules for the protection and use of Personal Information by social media that you may use when contacting us are described in their privacy policies. For example, information on the processing of Personal Data by Facebook can be found at: https://www.facebook.com/policy.php.

Information about the recipients of your Personal Data, including the possible transfer of your Personal Data to third countries (outside the European Economic Area), is detailed in Section IV below.

The rights you have in connection with the processing of your Personal Data are described in detail in Section V below.

Information about the recipients of your Personal Data, including the possible transfer of your Personal Data to third countries (outside the European Economic Area), is detailed in Section IV below.

The rights you have in connection with the processing of your Personal Data are detailed in Section V below.

5. SOCIAL MEDIA PROFILES

Your Personal Data, including that which you leave by visiting our social media profiles (including but not limited to comments, likes, web IDs) is or may be processed for the following purposes:

1. enabling you to be active on your profile, effectively running our profile by presenting you with information about our initiatives and other activities, and in connection with our promotion of various events, services and products, including those of our partners - legal basis: article 6(1)(f) RODO, i.e. the legitimate interest pursued by the Administrator or a third party in the form of promoting the brand and improving the quality of services provided;

2. marketing activities of the Administrator or our partners, e.g. presenting you with advertisements and offers (discounts), also tailored to your needs based on profiling. Legal basis for the aforementioned activities: Article 6(1)(f) RODO, i.e. the legitimate interest of the Administrator or a third party (the Administrator's own marketing of ours or partners);
Provision of Personal Data is voluntary, but may be necessary to fully use the functionality of our social media profiles.

Your Personal Data will be processed for the period of time necessary for the fulfillment of the aforementioned purposes or until you effectively raise an objection, as well as for the time required by law (e.g. tax, accounting), unless a longer period is due to their retention in case of possible claims, for the limitation period specified by law, in particular the Civil Code. In any case, the longer period of storage of Personal Data is decisive.

Information about the recipients of your Personal Data, including the possible transfer of your Personal Data to third countries (outside the European Economic Area), is detailed in Section IV below.

The rights you have in connection with the processing of your Personal Data are detailed in Section V below.

6. COMPETITIONS

If you choose to participate in a contest organized by the Administrator, your Personal Data is or may be processed for the following purposes:

1. conducting the contest, selecting the winners and issuing the prizes - legal basis: article 6.1.b of the RODO, i.e. the necessity to perform the agreement you conclude with us by entering the contest;

2. fulfillment of the Administrator's legal obligations, in particular those arising from the regulations governing tax obligations - legal basis: article 6.1.c of RODO, i.e. necessity to fulfill the Administrator's legal obligation;

3. marketing activities of the Administrator or our partners, e.g. presenting you with advertisements and offers (discounts), also tailored to your needs based on profiling. Legal basis for the aforementioned activities: Article 6(1)(f) RODO, i.e. the legitimate interest of the Administrator or a third party (the Administrator's own marketing of ours or partners);
Provision of Personal Data is voluntary, but it is necessary in order to participate in the competition.

We will process your data for the period necessary to carry out the contest, select the winners and issue the prizes, and in the case of marketing activities - until you raise an objection, unless the law (tax, accounting - as far as the winners are concerned) obliges us to process the data longer, or we will keep the data longer in case of potential claims, for the period of their limitation period defined by the law, in particular the Civil Code. In any case, the longer period of storage of Personal Data will be decisive.

Information about the recipients of your Personal Data, including the possible transfer of your Personal Data to third countries (outside the European Economic Area), is detailed in Section IV below.

The rights you have in connection with the processing of your Personal Data are detailed in Section V below.

7. BUSINESS RELATIONS

We may process your Personal Data when:
- you are our potential or actual supplier or contractor, or
- you have an interest in our business (e.g., as a media);
- you are acting on behalf of any of the above entities, including if you are an employee or associate of any of them.

Your Personal Data may therefore be processed in connection with a number of situations:
- if you have provided us with your Personal Data personally through various communication channels (e.g., by addressing an inquiry/offer by email or telephone);
- as part of our cooperation during the signing or execution of a contract, including when your personal data has been disclosed to us as a contact for the purpose of executing contracts;
- when we have obtained your personal data from other sources (e.g., from a company with which you cooperate and which is our contractor / customer, or from publicly available industry portals).

The scope of the personal data we process depends on what information is necessary in connection with our relationship - this primarily includes the content of documents, correspondence/communication, and possibly other information that we have obtained from publicly available professional sources (e.g., industry portals).

These include, in particular:
- name,
- information on professional activity, including place of work, position or department, professional entitlements;
- contact information, including mailing address, telephone number, e-mail address or other contact information.

Thus, we obtain the above personal data directly from you or from others, such as your employers/contractors, or from publicly available sources.

If we process your data in connection with a contract with you, the purpose of the processing is to seek to conclude and perform the contract. The legal basis for their processing will be Article 6(1)(b) of the RODO (necessity to perform the contract or to take steps prior to its conclusion at the request of the data subject).

If you contact us on your own behalf, including, for example, providing us with your business card with a request to send you certain information, we will process your data in order to respond to your inquiry or to carry out other activities you have agreed to. The legal basis for processing your data for the above purposes will be your consent (Article 6(1)(a) of the DPA).

In the case of data processing on the basis of consent, we remind you that you may withdraw your previously granted consent at any time, without affecting the legality of the processing already carried out on that basis.

If you are acting on behalf of our client or supplier or another entity, we process your data in order to carry out the contact, in the context in which you are acting on behalf of a third party, and to conclude or execute a contract with that third party or execute a joint venture. The basis for processing your personal data for this purpose, will be our legitimate interest (Article 6(1)(f) of the RODO) - building and maintaining a relationship with the third party on whose behalf you are acting, including entering into and executing relevant agreements with it, as well as the intention to build our positive image.

Notwithstanding the above, your personal data, i.e. primarily your name and mailing address or e-mail address, may be used by us to send you occasional correspondence (e.g. thanks or holiday greetings). The basis for processing your personal data for this purpose, will be our legitimate interest (Article 6(1)(f) RODO) - the intention to maintain our relationship and build a positive image.

In addition, in the case of processing your personal data for:
defense against potential claims, as well as for the purpose of possible referral of claims, the basis for processing your personal data for this purpose will be our legitimate interest (Article 6(1)(f) RODO);
to fulfill the administrator's legal obligations (e.g. tax, accounting), the basis for processing your personal data for this purpose, will be the fulfillment of legal obligations imposed on the administrator (Article 6(1)(c) RODO).

The provision of personal data by you is voluntary, however, sometimes it may be necessary for purposes related to our cooperation, e.g. necessary to conclude or execute a contract or to respond to an inquiry addressed to us, or for the purpose of correspondence. This means that their failure to do so may sometimes constitute grounds for refusal to establish cooperation or for us to take legal steps to terminate a possible contract.

We process your personal data only for the time that is necessary for the purposes for which they were originally collected. After that time, they will be deleted, except where we are obliged to continue processing such data in order to comply with legal obligations.

We process personal data processed on the basis of your consent until it is revoked, if any, or the purpose for which it was given is fulfilled.

The above-mentioned periods may be extended, as appropriate and necessary, in the case of possible claims and legal proceedings - by the duration of such proceedings and their settlement - and if the law in certain cases obliges us to process them longer.

Information about the recipients of your Personal Data, including the possible transfer of your Personal Data to third countries (outside the European Economic Area), is detailed in Section IV below.

The rights you have in connection with the processing of your Personal Data are described in detail in Section V below.

IV. Who has access to your Personal Information?

Access to your Personal Information is granted to entities that support us in operating the Service under relevant contracts, such as entities that provide IT services or tools to enable our communications, marketing campaigns, our advisors, including legal advisors, entities that provide accounting and payment processing services, and entities that support us in performing claims handling services for you, such as legal advisors and attorneys. Recipients may also include companies in the corporate group to which the Administrator belongs.

All of these entities have access only to information necessary for their operations.

Some of the entities providing us with solutions may be based outside the European Economic Area (EEA). Whenever we transfer data outside of the EEA, we apply the required security measures, including, for example, standard data protection clauses adopted under a decision of the European Commission, with appropriate safeguards. You can obtain a copy of the safeguards we apply to the transfer of personal data to a country outside the EEA by contacting us.

V. Your rights regarding personal data

For the efficient exercise of your rights, please address any requests to the email address indicated in the glossary by writing "RODO request" in the title and specifying in the body which right you wish to exercise. The instructions given in the preceding sentence are only a recommendation, not a requirement. Making a request in any other way does not lead to the loss of the rights listed below.

At any time you have the right to:
a. access your Personal Data (including, for example, to receive information about which Personal Data is processed or a copy of it);
b. request rectification and restriction of processing (e.g., if the Personal Data is incorrect) or deletion of Personal Data (e.g., if it has been processed unlawfully);
c. to transfer Personal Data that you have provided to the Administrator and that is processed by automated means and that is processed on the basis of consent or on the basis of a contract, e.g. to another administrator;
d. revoke any consent you have provided to the Administrator at any time, whereby revocation of consent does not affect processing carried out by the Administrator in accordance with the law prior to its revocation;
e. object to the processing of Personal Data performed for the purposes of the legitimate interests of the Administrator or a third party (if there are no other valid legitimate grounds for processing that override your interests). If your Personal Data is processed for direct marketing purposes, you have the right to object at any time to the processing of your Personal Data for such marketing, including profiling, to the extent that the processing is related to such direct marketing, in which case your Personal Data may no longer be processed for such purposes.
f. lodge a complaint to the President of the Office for Personal Data Protection (a detailed description of the procedure for lodging a complaint is available at: https://uodo.gov.pl/pl/83/155). Of course, if you wish to make comments about the way we operate, we encourage you to contact us in advance.
g. You can find a list of local data protection authorities in the European Union and contact information at: https://edpb.europa.eu/about-edpb/board/members_en.

VI. What are "cookies" and other similar technological solutions? How and for what purpose do we use them?

Cookies are small data files that are stored on your device when you visit the Website and, for example, store information about your use of the Website. We use cookies and other technological solutions to recognize you as a returning User, to improve the quality of our service and to collect statistical data, and for marketing purposes. We also process them to analyze the popularity and effectiveness of our offers.

The cookie technology we use (or similar functionality) collects information about each visitor to the Service. Please note that the following information refers to individuals who use the Service.

The information collected in cookies does not always constitute Personal Data within the meaning of the RODO. However, some information, depending on its content and how it is used, may be associated with a specific person (attribution of certain behaviors to a specific person, e.g. by linking it to the data provided when filling out forms), and thus be considered Personal Data.

Of course, you can change the way you use cookies, including blocking them completely or deleting them through your browser settings. However, you must keep in mind that this type of operation may prevent or significantly impede the proper operation of our Website, if only by significantly slowing down its operation, so we recommend not disabling their use.

We always provide information, which explains precisely which cookies we use and for what purposes, to our customers during their first visit to our Service.

We use two types of cookies on the Website: session cookies, which remain stored on your computer or mobile device until you log out of the Website or turn off your software (web browser), and permanent cookies, which remain on your device for the time specified in the parameters of the cookies or until they are manually deleted in your web browser.

Depending on the case, we may use the following types of cookies in particular:
technical - necessary for the proper operation of the Website and the functionalities available within the Website; these cookies are not used to track visitors to the Website;
analytical/performance cookies - used to analyze your behavior within the Service, for statistical and analytical purposes; they help us achieve our legitimate goals of improving the way our site works; for example, by providing Users with the ability to easily find what they are looking for;
marketing - used to analyze your behavior; provide information that identifies you, including for marketing purposes on third-party websites; we will use this information, taking into account your choices and preferences, to make our site more relevant to you. We may also share this information with third parties for this purpose.

A detailed description of the cookies we use is provided below.

Name	Type	Essencial	Function	Lifetime	Source
acb-cookie-info	Technical	yes	Cookie information	6M	Internal
i18n_redirected	Technical	yes	Redirection to previously selected language	12M	Internal
ln_or	Analitical/Marketing	no	Collection of statistical data	24H	Internal

It may happen that we cooperate with other companies for their marketing (advertising) or analytical activities. For the purposes of this cooperation, your browser or other software installed on your device, may also store cookies from entities conducting such activities, which may become the controller of your Personal Data (these are so-called third party cookies - i.e. third party cookies). The cookies sent by these entities are intended to ensure that you are presented with only those advertisements that meet your individual needs. We believe that displaying personalized information may be more attractive to you than advertising that is unrelated to your needs. Without these cookies, this would not be possible, as it is the companies working with us that provide advertising content for you.

For a list of third party cookies and the entities that provide them, along with information about their privacy policies, see below:

Name	Type	Source	Function	Essencial?	Lifetime
_dc_gtm_UA-43314647-6	Analitical	Google Analytics	Counting requests to the service	no	1h
_dc_gtm_UA-97436296-1	Analitical	Google Analytics	Counting requests to the service	no	1h
_fbp	Analitical / Marketing	Facebook Ads	User ID	no	3m
_fbc	Marketing	Facebook Ads	User click ID	no	24m
_ga	Analitical	Google Analytics	User session ID	no	13m
_ga_BJZ6QHYEPV	Analitical	Google Analytics	User session ID	no	13m
_ga_KRWPW90G16	Analitical	Google Analytics	User session ID	no	13m
_gcl_au	Analitical / Marketing	Google Adsense	Tracking conversion	no	3m
_gid	Analitical	Google Analytics	Counting user views	no	24h
_hjAbsoluteSessionInProgress	Analitical	Hotjar	User session ID	no	1h
_hjFirstSeen	Analitical	Hotjar	user's first session's time	no	30m
_hjIncludedInSessionSample_475889	Analitical	Hotjar	Data sampling	no	1h
_hjSession_475889	Analitical	Hotjar	User session ID	no	90m
_hjSessionUser_475889	Analitical	Hotjar	User ID	no	12M
_uetsid	Analitical / Marketing	Bing Ads	User session ID	no	24h
_uetvid	Analitical / Marketing	Bing Ads	User Id	no	13M

We use the Google Analytics tool. The provider is Google LLC. (1600 Amphitheatre Parkway, Mountain View, CA 94043, USA). The activities in this regard are carried out based on the legitimate interest under Article 6(1)(f) of the RODO, which is the creation of statistics and their analysis for further optimization of the Site.

The purpose and scope of data collection, their use and processing by Google's administrator, but also the rights you have regarding your data and the possibility to make settings to ensure the protection of your privacy are described in Google's privacy policy, which you can read here: https://support.google.com/analytics/answer/6004245

The aforementioned entities, in connection with the use of their own cookies on the Website, may become controllers of your Personal Data. For more information on the cookies of the aforementioned entities, please refer to their privacy policies.

Last update of the Privacy and Cookies Policy: [04.09.2023]

Case Study