Privacy Policy

The controller of personal data processed through this website is Halcyon Waters spółka z ograniczoną odpowiedzialnością, registered office at pl. Solny 2/3, 50-060 Wrocław, Poland, entered in the Register of Entrepreneurs of the National Court Register (KRS) kept by the District Court for Wrocław-Fabryczna in Wrocław, 6th Commercial Division, KRS 0001245653, NIP 8971973382, REGON 544943051, share capital PLN 5,000.00.

For any matter concerning personal data, write to enquiries@halcyonwaters.com or to the postal address above. We have not appointed a Data Protection Officer, as we are not required to.

Full company details are in the Legal Notice.

We collect personal data when:

• you browse this website;
• you subscribe to Soundings or to our updates by submitting your e-mail address;
• you contact us through the contact form, by e-mail or by post;
• you follow or interact with our professional social media profiles.

We may also obtain data from publicly available sources, including official registers such as the National Court Register (KRS), where we need to verify a business counterparty.

This website does not offer user accounts. We do not collect identity documents, beneficial ownership information or payment data here.

• Operating and securing the website, including server logs and technical diagnostics, based on our legitimate interest, Article 6(1)(f) GDPR.
• Audience measurement through analytics, based on your consent, Article 6(1)(a) GDPR. Strictly necessary cookies are set automatically under Article 399(3)(2) of the Act of 12 July 2024, Electronic Communications Law. Analytics cookies are set only if you consent, and that consent is optional.
• Sending Soundings and company updates, based on your consent, Article 6(1)(a) GDPR, together with the separate consent to receive commercial information by electronic means required under the Act of 18 July 2002 on Providing Services by Electronic Means and the Act of 12 July 2024, Electronic Communications Law. You may withdraw either consent at any time, including through the unsubscribe link in every message. Withdrawal does not affect the lawfulness of processing before it.
• Responding to your enquiry and taking steps at your request before entering into a contract, Article 6(1)(b) GDPR, or our legitimate interest in handling correspondence, Article 6(1)(f) GDPR.
• Compliance with legal obligations, in particular accounting and tax law, Article 6(1)(c) GDPR.
• Establishing, exercising or defending legal claims, based on our legitimate interest, Article 6(1)(f) GDPR.

Providing your data is voluntary. Without an e-mail address we cannot send you Soundings or reply to your enquiry.

• Visitors: IP address, approximate location derived from it, browser and device information, pages viewed, and data stored by cookies where you have consented.
• Subscribers: e-mail address, the date, source and record of your consent, and delivery and engagement metadata such as whether a message was delivered, opened or its links clicked.
• Enquiries: your name, e-mail address, and anything you choose to include in your message.
• Social media: your public profile information and any interaction with our posts.

We do not process special categories of data under Article 9 GDPR, and we ask you not to send them to us.

• Server logs, including IP addresses, for as long as needed for security and diagnostics, normally no longer than 60 days, unless a longer period is needed to investigate a specific incident.
• Cookie data, for the period stated in section 9.
• Subscriber data, until you withdraw consent or unsubscribe. We keep a minimal record of the consent itself, and of its withdrawal, for the limitation period for claims, so that we can demonstrate compliance.
• Correspondence, for as long as needed to handle the matter and afterwards for the limitation period for claims.
• Data we must keep under tax and accounting law, for the periods those laws require.

We disclose personal data to the following categories of recipient, each acting on our instructions under a data processing agreement:

• cloud hosting and data storage provider (Amazon Web Services EMEA SARL);
• newsletter and e-mail delivery providers (UAB MailerLite; Amazon Web Services EMEA SARL for Amazon SES);
• our e-mail service provider, which delivers messages sent through the contact form;
• analytics provider (Google Analytics 4, Google Ireland Limited);
• legal and accounting advisers, to the extent necessary for their services;
• public authorities, where disclosure is required by law.

We do not sell personal data and we do not share it with data brokers.

Some recipients, in particular analytics and infrastructure providers, are established outside the European Economic Area, including in the United States. Where we transfer personal data outside the EEA we ensure adequate safeguards, including standard contractual clauses adopted by the European Commission under Article 46(2)(c) GDPR, an adequacy decision under Article 45 GDPR where applicable, or other safeguards recognised under the GDPR.

Where required, we carry out transfer impact assessments and apply supplementary measures. You may request a copy of the applicable safeguards by writing to enquiries@halcyonwaters.com.

In relation to our processing of your personal data you have the right to:

• Access the data we hold about you and obtain a copy of it.
• Rectification of inaccurate or incomplete data.
• Erasure of your data where one of the grounds in Article 17 GDPR applies.
• Restriction of processing in the cases set out in Article 18 GDPR.
• Data portability, where processing is based on consent or a contract and is carried out by automated means.
• Object at any time to processing based on our legitimate interest, and at any time and without giving reasons to processing for direct marketing.
• Withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal.

To exercise any of these rights, write to enquiries@halcyonwaters.com. You also have the right to lodge a complaint with the Polish supervisory authority, the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, or with the supervisory authority of your habitual residence.

Cookies are small pieces of information stored on your device. Similar technologies, such as values held in browser storage, may serve comparable purposes without writing a persistent file.

Strictly necessary. Required for the site to work and to keep it secure. These cannot be switched off and, under Article 399(3)(2) of the Act of 12 July 2024, Electronic Communications Law, they do not require your consent.

Analytics. We use Google Analytics 4 (measurement ID G-4YFE69W61P) to understand how the site is used in aggregate. It sets the cookies _ga (2 years) and _ga_<container> (2 years), which distinguish visitors and maintain session state. These are set only if you consent, and you may withdraw consent at any time through your browser settings or by clearing cookies.

We do not use advertising or cross-site tracking cookies on this website.

We do not take decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you, within the meaning of Article 22 GDPR. We do not build advertising profiles.

We do measure, at the level of an individual subscriber, whether our messages were delivered, opened and whether their links were clicked. We use this to judge whether what we publish is worth reading and who to follow up with. You may object to this at any time.

We process the personal data of people who follow or interact with our profiles on LinkedIn (LinkedIn Ireland Unlimited Company) and X (Twitter International Unlimited Company). Those platforms process data under their own privacy policies and act as controllers in their own right for that processing.

Data may be transferred outside the EEA by those entities on the basis of standard contractual clauses under Article 46(2)(c) GDPR. Questions about their transfers should be addressed to them directly.

This policy may be improved or updated. The current version is always published on this page and dated below.