1.General Information and Declarations
This document sets forth the Privacy Policy rules applicable to the website operated at dataoctopus.io. It contains information regarding the method of processing personal data in connection with the use of the Website and the provision of services by the Personal Data Administrator.
Hereinafter in this document, the dataoctopus.io website will be referred to as the “Website” or “Data Octopus”.
Other capitalized terms have the meanings assigned to them in the Terms and Conditions of the dataoctopus.io website and the provision of Data Octopus Services, available on the Website (“Terms and Conditions”).
The Administrator of the personal data of Users and Clients (hereinafter referred to as: the “Administrator”) is Data Octopus spółka z ograniczoną odpowiedzialnością with its registered office in Kraków, at ul. Wadowicka 8A, 30-415 Kraków, entered into the Register of Entrepreneurs of the National Court Register kept by the District Court for Kraków-Śródmieście in Kraków, XI Commercial Division of the National Court Register, under KRS number: 0001010501, NIP: 6793256417, REGON: 524025419, with a share capital of PLN 10,500.00.
The Privacy Policy is available on the Website in a manner that allows for obtaining, reproducing, and recording its content by printing or saving it on a storage medium.
Personal data collected by the Administrator are processed in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, p. 1), hereinafter referred to as: the “GDPR”.
The Administrator's Services are addressed to individuals over 16 years of age. The Administrator does not knowingly collect personal data of children under 16 years of age. If such data is provided without the required confirmation of consent from a parent or legal guardian, the Administrator will take steps to promptly delete it.
The Administrator makes every effort to protect the privacy and information provided to it by Clients and Users utilizing Data Octopus services. Due to the nature of the services provided, the Administrator also processes personal data for which it is not an administrator within the meaning of the GDPR, but acts as a processor. This applies in particular to data entrusted by Users, such as data of their clients or business partners. The rules for entrusting the processing of personal data to the Administrator are regulated in a separate agreement concluded between the parties. The Administrator, within the means available to it, takes all possible actions to ensure the highest standard of services provided, including the adequate protection of entrusted personal data.
The Administrator selects and implements adequate technical and organizational measures with the utmost care, in particular software solutions, to ensure the protection of the processed data. In particular, it protects them against being made available to unauthorized persons, unauthorized disclosure, loss, or destruction.
If a User, as part of Data Octopus functionalities, requests an offer or other information from Promo Traffic sp. z o.o. with its registered office in Kraków, that company will also become an independent administrator of their personal data. Information regarding the processing of such data will be provided to the User directly by Promo Traffic in separate correspondence.
The Website may use so-called plug-ins and other social media tools, including in particular those enabling a Client who holds an Account to log into that Account using accounts from social networking and similar services, such as: Facebook.com and Google.com. Providers of these services may also process personal data as independent administrators. In such case, the Administrator and the plug-in provider are joint administrators of the personal data.
2.Contact with the Administrator
Contact with the Administrator regarding personal data matters is available via:
- electronic mail, at the e-mail address: hello@dataoctopus.io,
- postal mail, sent to the address: ul. Wadowicka 8A, 30-415 Kraków.
3.Personal Data
The personal data Administrator processes personal data for the following purposes, scope, and based on the following legal provisions:
Legal basis
Art. 6(1)(b) GDPR – for the performance of a contract, as well as taking steps at the request of the data subject prior to entering into a contract, and where processing is necessary for the purposes of the legitimate interests pursued by the Administrator or by a third party – the Administrator processes personal data pursuant to Art. 6(1)(f) GDPR.
Purpose
contacting the data subject at their request in order to present a Service demonstration or offer, schedule a meeting, or enable such person to place an order for the Service, or directly conclude an Agreement between the Parties;
Agreeing upon the details of the Service and concluding the Agreement, covering data provided by the data subject when establishing contact;
- Scope
- name and surname, email address, phone number, IP address.
Purpose
performance of Services, provision of functionalities – regardless of the method and scope of the concluded contract. This applies both to Services and functionalities carried out and provided using Data Octopus IT resources, as well as any other services and performances rendered by the Administrator.
- Scope
- name and surname, email address, phone number, address details, tax identification number (NIP), payment details, IP address, and in the case of logging in to an Account in Data Octopus via an account in external services – also data from those services such as: user's name and surname.
Purpose
Performance of Services by providing the Data Octopus Product Audit functionality (application) (presenting the user with advertising reports and statistics regarding products, brands, and categories in the store's offering. Additionally, recommendations related to optimization potential and the use of Data Octopus).
Data Octopus Product Audit is based solely on data from Google Ads regarding product campaigns for the last 90 days. List and scope of data necessary to perform Data Octopus Product Audit:
brand– brand namecategory– category nametotalRevenue– total generated revenue.productCount– total number of unique products.totalCost– total net advertising cost.- gadsconversions – total number of conversions.
gadsImpressions– total number of ad impressions.gadsClicks– total number of ad clicks.cpc– cost per click (cost / clicks).roas– return on ad spend (revenue / cost).cos– cost of sales (cost / revenue).
Description of functionality (application): The Client/user registers with Data Octopus (free of charge) by creating an account. Next, the Data Octopus application is authenticated with the Google Ads account from which data is to be analyzed. The OAuth standard is used for this (https://developers.google.com/identity/protocols/oauth2?hl=pl).
The Administrator downloads the data contained therein to BigQuery within Google Cloud, uses it to prepare the report, and displays it in the application, which the client/user accesses via the account previously created by them. The application uses the Google Ads API to review advertising campaign performance data. The data is not shared with third parties, nor is it used for advertising.
The data is retained for the period necessary to provide the application's functionality, and then according to the rules set out in the section _“Personal data will be deleted in the following cases”. The Client/user may object to data processing at any time, or the data will be deleted after disconnecting the Google account from the application.
Additionally, the Client/user may revoke access to Google Ads data at any time via their Google account security settings.
The application also allows exporting the report generated by the Client/User in JSON format. The JSON file can then be uploaded to the Echo assistant (custom Gem) provided by the Administrator, which offers support and indicates specific data activation strategies using Data Octopus. By downloading and using this Gem, the Client/User accepts the provisions of Google's policy (Google's general terms: https://policies.google.com/terms) and the Gemini privacy notice (https://support.google.com/gemini/answer/13594961?sjid=13388990599102269462-EU#privacy_notice). From that point forward, the Administrator bears no responsibility for the actions of the Client/User, who should use AI tools in accordance with the aforementioned Google documents. Additionally, the Administrator holds a paid Google Workspace license, which means they independently comply (within professional access) with enterprise-grade privacy protection and security features and models. Chats and files submitted in Gemini-powered applications will not be reviewed by human reviewers or otherwise used to train generative AI models.
Purpose
providing Services and functionalities to a given person that do not require any contact, i.e., browsing the website pages of the Service, content search engine, or Services.
- Scope
- personal data concerning activity on the Website, i.e., data concerning viewed content or Services, device session data, operating system, browser, location, and unique ID, IP address.
- Administrator's legitimate interest
- In the case of personal data processing for the above purposes, the legitimate interest pursued by the Administrator consists in building and maintaining positive relationships with data subjects, including in particular responding to their inquiries, as well as building and maintaining a proper image of the Administrator itself and raising the standard of Services offered and provided.
Legal basis
Art. 6(1)(f) GDPR – processing is necessary for the purposes of the legitimate interests pursued by the Administrator or by a third party.
Purpose
determining the scope and maintaining statistics on the use of particular Data Octopus functionalities and Services, facilitating or optimizing the use of the Website or other Services, ensuring the IT security of the Website and the Services themselves.
- Scope
- personal data concerning Users' activity on the Website, including data on the use of Data Octopus infrastructure and its individual components, the amount of time spent on each subpage, search history, clicks, location, IP address, device ID, data concerning the User's web browser and operating system – in the case of a User who merely visits the Website. In the case of Clients with an active Service, the scope of processed data is extended to include information on the Service being provided and its use by such Client.
Purpose
establishing, asserting, and enforcing claims, and defending against claims in court proceedings or before other enforcement authorities.
- Scope
- personal data provided by the User on the Website, data obtained when contacting the Administrator, including when ordering a Service, including data for the purposes of entering into the Agreement or in connection with it, data concerning the use of Services or functionalities (including data provided or collected in individual sections and resources of the Website), and other data necessary to prove the existence of a claim or data resulting from legal provisions.
- Administrator's legitimate interest
- the ability to establish, assert, and enforce claims, and defend against claims in proceedings before courts and other public authorities, improving the quality of Services provided and the efficiency and security of the Website, as well as building and maintaining positive relationships with Users.
Legal basis
Art. 6(1)(f) GDPR and Art. 6(1)(a) GDPR – processing is necessary for the purposes of legitimate interests pursued by the Administrator or by a third party; the consent of the data subject was also required to process personal data;
Art. 6(1)(b) GDPR – personal data is processed for the performance of a contract, as well as taking steps at the request of the data subject prior to entering into a contract;
Scope: personal data provided by the data subject when ordering the Service, data concerning the person's activity on the Website, including data recorded and stored via cookies, and in particular the history of activity and actions in Data Octopus, including data concerning the Service being provided, payment data, history and activity related to communication with the Administrator, and in the case of subscribing to the Newsletter, including ordering a digital service or digital content – also data provided during such subscription/order;
Purpose
market research, opinion polls, conducting measurements and maintaining statistics by the Administrator itself or its partners or suppliers.
- Scope
- data such as: order information or information provided when ordering Services.
Legal basis
Art. 6(1)(f) GDPR and Art. 6(1)(b) GDPR – strictly necessary cookies;
Art. 6(1)(a) GDPR – Analytical, Functional, Performance, and Advertising cookies.
Purpose
use of cookies by the Administrator on the Website.
More information on this subject can be found in the provisions regarding cookies, specified in a separate document governing the use of cookies, which is available on the Website.
Legal basis
performance of the Agreement, as well as where data processing is necessary for the purposes of legitimate interests pursued by the Administrator or by a third party – legitimate interest of the Administrator, i.e., based on Art. 6(1)(f) GDPR and based on Art. 6(1)(b) GDPR.
Purpose
handling complaints, grievances, and requests, and responding to Users' inquiries
- Scope
- personal data in the contact form, in chat, and in other forms on the Website, in emails, SMS, complaints, grievances, and requests, as well as questions submitted in any other form. For this purpose, the Administrator also processes certain personal data concerning the ordering of Services and other Services provided on the Website that are the subject of the complaint, grievance, or request, questions, and data contained in documents attached to complaints, grievances, requests, and questions;
- Administrator's legitimate interest
- the ability to legally handle complaints, respond to Users' comments or inquiries, as well as improving the level of provided Services and building positive relationships with them.
Legal basis
Art. 6(1)(c) GDPR – processing is necessary for compliance with a legal obligation to which the Administrator is subject.
Purpose
compliance with a legal obligation to which the Administrator is subject, in particular consisting of the fulfillment by the Administrator of obligations imposed by tax law regulations.
- Scope
- personal data provided by the data subject in order to place and settle orders for Services and functionalities/Agreements, and their performance.
Legal basis
Art. 6(1)(f) GDPR and Art. 6(1)(b) GDPR – performance of the Agreement, as well as where processing is necessary for the purposes of legitimate interests pursued by the Administrator or by a third party – legitimate interest of the Administrator.
Purpose
performance of the contract, as well as taking steps at the request of the data subject prior to entering into a contract;
running profiles operated by the Administrator on social media, providing information about the activities conducted by the Administrator, sharing reviews and opinions expressed about the Administrator.
- Scope
- personal data (in particular: identifiers, content of comments, reviews) concerning individuals (users) visiting profiles run by the Administrator on social media or other services (for example Facebook, Instagram, Google).
- Administrator's legitimate interest
- building the Administrator's image, providing information on conducted activities, building positive relationships with users, the ability to assert or defend against potential claims.
Legal basis
Art. 6(1)(f) GDPR and Art. 6(1)(b) GDPR – performance of the Agreement, as well as where processing is necessary for the purposes of legitimate interests pursued by the Administrator or by a third party – legitimate interest of the Administrator.
Purpose
performance of the Agreement and legitimate interest of the Administrator and its counterparty. In connection with concluding contracts as part of its business activities, the Administrator obtains data, as well as receives from clients or counterparties data of individuals involved in the performance of such contracts (e.g. contact persons, persons cooperating in the provision of Services, etc.).
- Scope
- personal data of personnel members of counterparties or clients cooperating with the Administrator.
- Administrator's legitimate interest
- the ability to properly and effectively perform the Agreement.
Legal basis
Art. 6(1)(f) GDPR and Art. 6(1)(b) GDPR – performance of the Agreement, as well as where processing is necessary for the purposes of legitimate interests pursued by the Administrator or by a third party – legitimate interest of the Administrator.
Purpose
processing of data collected in the course of business contacts;
initiating and maintaining business contacts.
- Scope
- personal data such as: name and surname, contact details.
- Administrator's legitimate interest
- networking, building relationships, fostering a positive image in connection with business operations.
Legal basis
Art. 6(1)(b) GDPR and Art. 6(1)(f) GDPR – performance of the Agreement, as well as where processing is necessary for the purposes of legitimate interests pursued by the Administrator or by a third party – legitimate interest of the Administrator.
Purpose
organizing events and training sessions;
identifying participants of the event or training session, contacting them;
handling participation in the event or training session;
assessing satisfaction with participation in the event or training session, for statistical purposes;
providing participants with relevant certificates of attendance, completion certificates, etc.
- Scope
- personal data such as: name and surname, contact details. In connection with organizing events, including online events or training sessions, the Administrator collects personal data from individuals registering for and participating in events or training sessions. The scope of provided data is in each case limited to what is necessary for organizing the event and usually does not include information other than the participant's name and surname and email address.
- Administrator's legitimate interest
- organizing the event in connection with the submitted registration of participation in the event, as well as collecting information and conducting analyses related to evaluating satisfaction with participation in the event or training session, and for general statistical purposes.
Events or training sessions may be recorded – in such a case, the participant will be informed of this fact, in particular via a notice displayed within the tool used by the Administrator to organize the online event or training session, or by being informed prior to the start of an on-site training session or event. Recordings may be made available in particular to the participants of the event.
The purposes, scope, and rules governing the collection and further processing of personal data by these entities can be found in their privacy policies. The Administrator encourages reviewing them, among others, at the following addresses:
4.Categories of personal data
The Personal Data Administrator processes the following categories of personal data:
- contact details;
- data concerning activity on the Website;
- data concerning orders for Services and functionalities;
- data concerning provided Services;
- data concerning billing – payments;
- data concerning complaints, claims, and requests;
- data concerning contractors or partners,
- data of employees, associates.
5.Voluntary provision of personal data
The provision of the required personal data by the data subject is voluntary, but constitutes a necessary condition for the provision of Services by the Administrator.
6.Data Processing Period
The period of data processing by the Administrator depends on the type of Service provided and the purpose of processing. The data processing period may also arise from applicable statutory law when it constitutes the legal basis for processing. In the case of data processing based on the Administrator's legitimate interest – e.g. for security reasons – data is processed for a period enabling the realization of this interest or until an effective objection to the data processing is raised. If the processing is carried out on the basis of consent, data is processed until it is withdrawn. When the basis for processing is the necessity to conclude and perform an agreement, the data is processed until its termination or expiration.
Personal data will be erased in the following cases:
- when the data subject requests their erasure or withdraws the consent granted;
- when the data subject takes no action for more than 10 years (inactive contact);
- upon obtaining information that the stored data is outdated or inaccurate;
- after 30 days from the date of termination of cooperation (completion of the provision of Services);
- when the data subject removes the authentication of the Data Octopus connection with their Google account in the settings of that account.
Certain data may be processed during the period in which it may be necessary to pursue potential claims or defend against claims, for evidentiary purposes in terms of claims related to the provision of Services by the Administrator, as well as for the purposes of handling complaints, grievances, or other requests – until the limitation period for claims expires. This data will not be used by the Administrator for marketing purposes.\]
Data regarding orders for paid Services, to the extent covering data necessary for keeping accounting books and settlements, will be stored for the necessary period – arising from applicable provisions of law, including in particular accounting and bookkeeping regulations.
Data collected as part of cookie mechanisms and other online identifiers is stored by the Administrator for a period corresponding to the lifecycle of cookies stored on devices or until they are deleted from the User's device by the User themselves. Details on the lifespan of a given cookie file can be found in the provisions on cookies specified in a separate document governing the rules for the use of these files, which is available on the Website.
7.Recipients of personal data
Due to the necessity of concluding and performing Contracts and the provision of Services, including Services provided electronically, personal data processed by the Administrator may be transferred to the following categories of recipients:
- public authorities, e.g. the public prosecutor's office, the Police, the President of the Personal Data Protection Office (PUODO), if they request it from the Administrator, indicating the legal basis for their requests;
- service providers with whom the Administrator cooperates, in particular to perform its Services, i.e. within the scope of providing Services as well as processing payments, enabling the use of the Website – providers responsible for the proper operation of the Administrator's IT resources and ICT systems, entities providing accounting services to the Administrator, Google Inc. based in the USA or Google Ireland Ltd. based in Ireland, as well as other external entities cooperating with the Administrator within the scope of its business activities. Depending on contractual arrangements and circumstances, these entities act upon instructions or independently determine the purposes and means of processing;
- personal data may also be transferred to other entities – providers of tools whose cookies are used. Information on these entities and the purposes of using cookies is contained in a separate document regarding cookies.
A detailed list of providers may be made available by the Administrator upon request of the data subject.
The aforementioned providers are established mainly in countries of the European Economic Area (EEA). The Administrator of personal data may outsource specific activities to recognized subcontractors operating outside the territory of the EEA. Personal data transferred outside the EEA will be protected by appropriate legal safeguards so that the providers receiving them guarantee a high level of personal data protection. These guarantees arise in particular from the obligation to apply standard contractual clauses adopted by the Commission (EU) or binding corporate rules duly approved by the supervisory authority within the meaning of the GDPR. The method of data protection complies with the principles set out in Chapter V of the GDPR. The data subject may contact the Administrator to provide additional information on the safeguards applied in this regard, obtain a copy of these safeguards, and information on where they are made available. Additionally, the Administrator will inform about the intention to transfer personal data outside the EEA at the stage of collecting personal data.
8.Automated decision-making
As part of the Service, the Administrator undertakes actions aimed at monitoring the activity of Service Users and analyzing these actions, but does not engage in automated decision-making with a significant effect within the meaning of the GDPR, including profiling.
9.Rights of the data subject
Under the GDPR, the data subject has the right to:
request access to their personal data – Article 15 GDPR
The data subject may obtain information from the Administrator as to whether their personal data are being processed and, if they are processed, has the right to:
- access the data;
- obtain information on the purposes of the processing, the categories of personal data concerned, the recipients or categories of recipients of the data, the envisaged period for which the data will be stored or the criteria used to determine that period, the rights granted under the GDPR and the right to lodge a complaint with a supervisory authority, the source of the data, automated decision-making, including profiling, and the safeguards applied in connection with the transfer of such data outside the European Union;
- obtain a copy of their personal data;
request rectification of their personal data – Article 16 GDPR
If personal data are inaccurate, the data subject may request the Administrator to rectify them without undue delay. They may also request the Administrator to complete the data. It is also possible to update the data independently in the Customer Account;
request erasure of their personal data, the so-called “right to be forgotten” – Article 17 GDPR
The data subject may request their erasure where:
- their personal data are no longer necessary in relation to the purposes for which they were collected or otherwise processed;
- they have withdrawn a specific consent, to the extent that the personal data were processed based on their consent;
- their personal data have been unlawfully processed;
- they have objected to the processing of their personal data in connection with processing necessary for the performance of a task carried out in the public interest or processing necessary for the purposes of legitimate interests pursued by the Administrator or a third party;
request restriction of processing of personal data – Article 18 GDPR
The data subject may request this where:
- they contest the accuracy of their personal data – the personal data Administrator will restrict the processing of their personal data for a period enabling the verification of the accuracy of the data;
- the processing of their data is unlawful, and instead of erasing the personal data, the data subject has requested the restriction of processing of their personal data;
- their personal data are no longer needed for the purposes of the processing, but they are required for the establishment, exercise or defence of legal claims;
- they have objected to the processing of personal data – pending verification whether the legitimate grounds of the personal data Administrator override the grounds specified in their objection;
object to the processing of personal data – Article 21 GDPR
The data subject may object at any time to the processing of their personal data, including profiling, in connection with:
- processing necessary for the performance of a task carried out in the public interest or processing necessary for the purposes of legitimate interests pursued by the Administrator or a third party;
the right to request personal data portability – Article 20 GDPR
The data subject has the right to receive from the Administrator their personal data in a structured, commonly used and machine-readable format and have the right to transmit those data to another personal data administrator, or request that the Administrator transmit their personal data directly to another administrator (where technically feasible);
the right to lodge a complaint with a supervisory authority
If the data subject considers that the processing of their personal data infringes the GDPR, they have the right to lodge a complaint with a supervisory authority, which is the President of the Personal Data Protection Office (PUODO).
10.How to exercise rights
You may exercise all of your rights by contacting the Administrator at the contact details indicated in this Policy. The Administrator will, without undue delay, provide information on actions taken in connection with the request submitted by the individual.
11.Use of Google User Data
Our application uses Google user data solely to provide or improve its functionality. We do not use this data for marketing, advertising, analytics, or profiling purposes. We do not sell, share, or combine Google user data with other sources for commercial purposes.
Data may be transferred only in cases required by law or when necessary to provide the application's functionality (e.g., server operations, security).
Our processes comply with the Google API Services User Data Policy.
12.Data Security and Protection Mechanisms for Google User Data
We implement comprehensive technical and organizational measures to secure sensitive data obtained via Google APIs:
1. Encryption Standards:
- Data in transit: All communication between the user's environment, Data Octopus, and Google APIs is encrypted using industry-standard Transport Layer Security (TLS 1.2/1.3) protocols over HTTPS.
- Data at rest: Any Google user data stored within our infrastructure (such as Google Cloud BigQuery) is encrypted at rest using industry-standard AES-256 encryption.
2. Access Control and Authorization:
- Access to raw data from Google APIs is subject to strict principles of the principle of least privilege (PoLP) and role-based access control (RBAC).
- Only automated internal processes necessary to perform the Data Octopus product audit have access to this data. Personnel access is restricted, logged, and protected via multi-factor authentication (MFA).
3. Infrastructure and Isolation:
- Data is stored in secure Google Cloud Platform (GCP) data centers that maintain industry-standard security certifications (such as ISO 27001, SOC 2).
4. Retention and Secure Deletion:
- Google user data is retained only for as long as necessary to provide the requested services.