Privacy Policy

Last updated: 3 September 2026

We take the protection of your privacy and your personal data very seriously. In this Privacy Policy, we inform you how and for what purposes we process your personal data in connection with your use of our websites and electronic services, your contacting us, our marketing communications, your participation in events and promotional activities, and the establishment and maintenance of business relationships. Please read this document carefully.

Who is responsible for your personal data?

We, Gamfi Sp. z o.o., with its registered office at Aleje Jerozolimskie 94, 00-807 Warsaw, registered with the District Court for the Capital City of Warsaw, 12th Commercial Division, under KRS number 0000351370, NIP 5342441276, REGON 142281049 (the "Company" or the "Controller"). We are the controller of the personal data processed in connection with the activities described in this Policy, including data you have provided to us, data collected automatically when you use our websites and systems, and data obtained from publicly available sources.

Data Protection Officer

The Controller has appointed a Data Protection Officer, Jacek Grabowski. You can contact the Officer at iod@gamfi.com. For all other matters concerning the processing of personal data, you can write to gdpr@gamfi.com.

For what purposes do we use your personal data?

We will process your personal data solely for the following purposes (the "permitted purposes"):

• Handling enquiries and other requests addressed to us, including conducting correspondence, arranging and delivering demo presentations, and making available and sending requested materials such as ebooks, presentations and other content, including materials offered in connection with signing up for marketing communications;
• Taking action at your request prior to entering into a contract, and concluding, performing and settling contracts;
• Fulfilling the Company's legal obligations, in particular tax, accounting and record-keeping obligations;
• Identifying individuals representing prospective business customers on the basis of business contact details obtained from publicly available sources, and contacting them in order to request consent to future marketing communications;
• Conducting direct marketing, including sending a newsletter and other commercial information about the Company's products, services, offers, events and projects — through the communication channel for which you have given your prior consent for this purpose;
• Profiling your preferences and interests in order to tailor our marketing communications and our product and service offering to your needs. Profiling may be based on information about the presentation, material or service you have requested and — in the case of cookies and similar technologies — also on information about your activity on our websites, processed after obtaining the required consent. Profiling may result in the marketing communications addressed to you, or the advertising displayed to you in the systems of the providers listed in the cookie banner, being adapted accordingly. Profiling does not lead to decisions being taken in respect of you that produce legal effects or similarly significantly affect you;
• Organising and running events, competitions and lotteries, including accepting entries, communicating with participants, enabling participation, and selecting and dealing with winners;
• Conducting surveys and market analyses and researching the needs of our audiences and the effectiveness of the Company's activities, in order to develop and improve the products and services we offer;
• Maintaining the security and protection of our services, websites and other systems, including preventing threats, fraud, abuse and other unlawful or harmful activities;
• Establishing, pursuing and defending against claims.

Legal bases for processing

The legal basis for processing your data depends on the purpose for which we use it:

• For the purpose of handling enquiries and other requests addressed to us, conducting correspondence, arranging and delivering demo presentations, and making available and sending requested materials, we process data:
  • on the basis of Article 6(1)(b) GDPR — where we take action at your request prior to entering into a contract; or
  • on the basis of Article 6(1)(f) GDPR — where the processing is necessary to pursue our legitimate interest in conducting correspondence, providing responses, handling requests, delivering requested materials, and establishing and maintaining business relationships; or
  • on the basis of Article 6(1)(a) GDPR — where a given material is made available to individuals who sign up for marketing communications, and the content of the form clearly informs you of this before consent is given.
• For the purpose of taking action at your request prior to entering into a contract, and concluding, performing and settling contracts, we process data on the basis of Article 6(1)(b) GDPR. If you are not a party to the contract but act as a representative, employee or contact person of our counterparty, the basis for processing is Article 6(1)(f) GDPR, and our legitimate interest is the conclusion and proper performance of the contract, the conduct of business contacts and day-to-day cooperation with the counterparty.
• For the purpose of fulfilling the Company's legal obligations, in particular tax, accounting and record-keeping obligations, we process data on the basis of Article 6(1)(c) GDPR in conjunction with the applicable provisions of law.
• For the purpose of identifying individuals representing prospective business customers and requesting their consent to future marketing communications, we process business contact details obtained from publicly available sources on the basis of Article 6(1)(f) GDPR. Our legitimate interest is identifying prospective customers and initiating potential business relationships by submitting a request for consent to future marketing communications. Until the required consent is obtained, we do not use this data to send commercial information or to conduct direct marketing.
• For the purpose of conducting direct marketing, including sending a newsletter and other commercial information, we process data on the basis of your consent, in accordance with Article 6(1)(a) GDPR. The use for this purpose of electronic mail, the telephone or another means of electronic communication takes place on the basis of the prior consent required by Article 398 of the Polish Electronic Communications Law (ustawa – Prawo komunikacji elektronicznej).
• For the purpose of profiling your preferences and interests and tailoring our marketing communications and offering, we process data on the basis of your consent, in accordance with Article 6(1)(a) GDPR. Where profiling uses information originating from cookies or similar technologies, the storage of such information on your device or the access to information stored on it takes place after obtaining the consent required by Article 399 of the Polish Electronic Communications Law (ustawa – Prawo komunikacji elektronicznej). We do not take decisions based on profiling that produce legal effects in respect of you or similarly significantly affect you.
• For the purpose of organising and running events, surveys, competitions and lotteries, we process data:
  • on the basis of Article 6(1)(b) GDPR — where the processing is necessary to accept an entry, to enable participation, or to perform the rules set out in the applicable terms and conditions;
  • on the basis of Article 6(1)(c) GDPR — where the processing is necessary to fulfil legal obligations connected with organising a given event, competition or lottery; or
  • on the basis of Article 6(1)(f) GDPR — to the extent that we pursue our legitimate interest in the efficient organisation of the event, ensuring communication with participants, surveying their opinions and assessing the effectiveness of the activities undertaken.

Where, in connection with these activities, we send commercial information or conduct direct marketing, we apply the legal bases indicated above for direct marketing.

• For the purpose of conducting market analyses and researching the effectiveness of our activities, we process data on the basis of Article 6(1)(f) GDPR. Our legitimate interest is understanding the needs of our audiences, assessing the effectiveness of the Company's activities, and developing and improving the products and services we offer. Where such analyses use cookies or similar technologies, we apply them after obtaining the consent required by Article 399 of the Polish Electronic Communications Law (ustawa – Prawo komunikacji elektronicznej).
• For the purpose of maintaining the security and protection of our services, websites and other systems, and of preventing threats, fraud, abuse and other unlawful or harmful activities, we process data on the basis of Article 6(1)(f) GDPR. Our legitimate interest is ensuring the security of information and systems, the continuity of our services, and protecting the Company, its users and other individuals against abuse and harm.
• For the purpose of establishing, pursuing and defending against claims, we process data on the basis of Article 6(1)(f) GDPR. Our legitimate interest is protecting and exercising the Company's rights and defending against claims brought against the Company.

Where we process data on the basis of your consent, you may withdraw it at any time. Withdrawal of consent does not affect the lawfulness of processing carried out before it was withdrawn.

Scope of personal data

In particular, we may collect and process the following categories of personal data:

• Contact information, such as your full name, address, telephone number, mobile telephone number and email address;
• Information relating to your place of employment, such as your job title, the name of your employer, the size of the company, and so on;
• Further business-related information necessary for processing within a project or a contractual relationship, or information voluntarily provided by you, such as applications and projects;
• Professional and contact information collected from publicly available sources, in particular from organisations' websites, public registers and publicly available professional profiles;
• Technical data and information concerning your use of our websites and systems, such as your IP address, online identifiers and cookie identifiers, information about your device, browser and operating system, the date and time of your use of the website, information about the subpages visited and the features used, data contained in system logs, and information about the consent choices you have made;
• Information about the source of your visit to our website, such as marketing campaign parameters and advertising click identifiers assigned by advertising system providers. We record this information together with the enquiry submitted through a form and store it on your contact record in our CRM system;
• Approximate location information, in particular country, region and city, determined from your IP address by the analytics tools we use;
• Information about your use of our websites may be linked with your contact record in our CRM system if you have provided us with your contact details. Such linking takes place by means of cookies or similar technologies, after obtaining the required consent.

How do we collect personal data?

• We will collect your personal data primarily directly from you, for example through forms and similar means.
• Certain technical data and information about activity is collected automatically when you use our websites and systems, in particular by means of system logs, cookies and similar technologies. We apply technologies other than strictly necessary ones after obtaining the required consent. Detailed information about the technologies used, their providers, purposes and duration is available in the cookie banner.
• We may obtain business contact details from publicly available sources, in particular from organisations' websites, public registers and publicly available professional profiles. Where we obtain data in this way, we will provide you with the information required by Article 14 GDPR, including information about the source of the data. Before we begin sending commercial information, we will request the required consent.
• We sometimes obtain personal data from our partners or through tools that help us build databases in an automated manner.

How do we protect your personal data?

We maintain physical, electronic and procedural safeguards in line with state-of-the-art technical requirements and data protection law in order to protect your personal data against unauthorised access or intrusion. These safeguards include the implementation of specific technologies and procedures designed to protect your privacy, such as secure servers, firewalls and SSL encryption. We will always strictly comply with the applicable laws and regulations concerning the confidentiality and security of personal data.

Who will we share your personal data with?

We may share your personal data with:

• Entities that support us in conducting our business, in particular providers of hosting and cloud services, email, CRM systems and other IT tools, analytics, marketing and advertising services, as well as entities providing legal, accounting, audit, insurance, organisational or technical support. Depending on the nature of the services provided and the cooperation model adopted, these entities may process data on our behalf as processors or act as separate controllers. Entities processing data on our behalf may use it solely in accordance with our documented instructions and the agreements concluded with them. Separate controllers process data on the terms and legal bases applicable to their own activities.
• Any courts, law enforcement authorities, regulatory authorities or lawyers, where this is legally permitted and necessary to fulfil a legal obligation or to demonstrate the merits of, bring or defend against claims.

On the Cookies page you will find a list of the recipients that support the provision of services by the Controller.

Cookies and similar technologies

Detailed information about the cookies and similar technologies used, their providers, purposes and duration is available in the cookie banner. We apply technologies other than strictly necessary ones after obtaining consent, which you can change or withdraw at any time using the settings available on the website.

Where do we process your personal data?

Some service providers may process data outside the European Economic Area (the "EEA"). In such cases, we transfer data solely on the basis of a mechanism provided for in Chapter V GDPR, in particular a European Commission adequacy decision, the recipient's certification under the EU–US Data Privacy Framework — where applicable — or the European Commission's standard contractual clauses, supplemented where necessary by additional safeguards. Information about the mechanism applied, and the possibility of obtaining a copy of the relevant safeguards, is available at gdpr@gamfi.com.

Is providing personal data required?

Providing personal data is, as a rule, voluntary. In some cases, however, the data is necessary in order to carry out a specific activity or to achieve a specific purpose.

If you contact us, submit an enquiry, request a demo presentation or ask us to make a material available to you, providing the data marked as required is necessary in order to handle your request. Failure to provide this data may make it impossible for us to respond, to deliver the presentation or to provide the requested material.

If you intend to enter into a contract with us or are a party to one, providing certain data may be a condition of concluding or performing the contract. Failure to provide data necessary to perform the contract may make it impossible to conclude or perform it. To the extent that the law imposes on the Company an obligation to collect specific data, in particular for tax, accounting or record-keeping purposes, providing it may constitute a statutory requirement.

The decision whether to give marketing consent is yours. As a rule, the absence of consent means only that we will not be able to address marketing communications to you through the channel covered by that consent. However, if a given material is made available on condition of signing up for marketing communications, the absence of consent also means that we will not be able to provide that material through the form in question. You may withdraw your consent at any time; this does not affect the lawfulness of earlier processing.

Participation in surveys is voluntary. In the case of events, competitions or lotteries, providing the data indicated as required in the form or in the applicable terms and conditions may be a condition of participation; failure to provide it may make it impossible to accept an entry or to take part in the given undertaking.

Retention period for your personal data

The retention period depends on the purpose for which the data is processed:

• Data processed for the purpose of handling enquiries and other requests, conducting correspondence, arranging and delivering demo presentations and providing requested materials is retained until the handling of the given enquiry or request is completed. Thereafter we may retain it — solely to the necessary extent — until the expiry of the relevant limitation period for claims connected with the response given, the presentation delivered or the material provided. Where a material was provided in connection with marketing consent being given, further processing of the data for marketing purposes takes place for the period indicated below for direct marketing.
• Data processed in connection with taking action prior to entering into a contract is retained until those actions are completed. If a contract is concluded, we retain the data for the period of its performance and thereafter — to the extent necessary to establish, pursue or defend against claims — until the expiry of the relevant limitation period.
• Data processed in order to fulfil the Company's legal obligations, in particular data contained in tax, accounting and settlement records, is retained for the period required by the applicable provisions of law.
• Data processed for the purpose of direct marketing, sending a newsletter and other commercial information, and profiling for marketing purposes, is retained until consent is withdrawn, an objection to direct marketing is raised, or we cease such activities earlier.

Once consent has been withdrawn or an objection raised, we will not use the data for marketing purposes. We may, however, retain to a limited extent information about consent having been given and withdrawn, or about an objection having been raised, where this is necessary to demonstrate the lawfulness of our activities, to defend against claims and to ensure that we do not address marketing communications to you against your wishes. We retain this information for the period necessary to achieve those purposes.

• Business contact details of individuals representing prospective business customers, obtained from publicly available sources, are retained for no longer than 120 days from the date they were obtained. During that period we may use them solely in order to request consent to future marketing communications. If we do not obtain the required consent and no other basis for further processing arises, we delete the data. In the event of refusal, withdrawal of consent or an objection being raised, we may retain a minimal set of data on a suppression list where this is necessary to respect the wishes of the individual concerned and to prevent unwanted communications being addressed to them again.
• Data of participants in events, competitions and lotteries is retained for the period necessary to organise, run and settle them and thereafter — to the extent necessary to establish, pursue or defend against claims — until the expiry of the relevant limitation period. Data covered by tax, accounting or other legal obligations is retained for the period required by the applicable provisions.
• Data processed in connection with surveys, market analyses and research into the needs of our audiences and the effectiveness of our activities is retained until the given study or analysis is completed and its results prepared. Thereafter we delete or anonymise the data, unless its further retention is necessary to establish, pursue or defend against claims.
• Data contained in system logs and other security-related records is retained for the period resulting from the retention schedules in force at the Company, and no longer than is necessary to ensure the security of our systems, to detect and analyse incidents and to prevent abuse. Where the data relates to a security incident, fraud or another breach, we may retain it until the matter has been clarified and thereafter until the expiry of the relevant limitation period for claims or the conclusion of the proceedings conducted.
• Data processed for the purpose of establishing, pursuing or defending against claims is retained until the expiry of the relevant limitation period for claims and, where proceedings have been initiated, until their final conclusion and the enforcement of the decision issued.
• Information about the duration of individual cookies and similar technologies is available in the cookie banner. Information documenting the giving, changing or withdrawal of cookie consent is retained for the period necessary to demonstrate the lawfulness of our activities.

Your data protection rights

In the cases and on the terms set out in the GDPR, you have the following rights:

• the right to access your personal data and to obtain a copy of it;
• the right to have your personal data rectified where it is inaccurate, and completed where it is incomplete;
• the right to request the erasure of your personal data;
• the right to request the restriction of the processing of your personal data;
• the right to the portability of your personal data;
• the right to object to the processing of your personal data — in the cases described below.

Objection to processing based on legitimate interest

Where we process your personal data on the basis of our legitimate interest, you may object at any time on grounds relating to your particular situation. Upon receiving your objection, we will cease processing the data unless we demonstrate the existence of compelling legitimate grounds for its further processing which override your interests, rights and freedoms, or grounds for establishing, pursuing or defending against claims.

Objection to direct marketing

Where we process your personal data for the purposes of direct marketing, including profiling connected with such marketing, you may object at any time without having to give a reason. Upon receiving your objection, we will no longer process your personal data for those purposes.

Withdrawal of consent

Where we process your personal data on the basis of consent, you may withdraw it at any time. Withdrawal of consent does not affect the lawfulness of processing carried out on that basis before it was withdrawn.

Right to lodge a complaint

If you consider that the processing of your personal data infringes data protection law, you have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych). You can find more information at uodo.gov.pl.

How to contact us?

If you have any questions, wish to share your opinion or want to exercise your rights, please contact us at gdpr@gamfi.com.

Changes to the Privacy Policy

We may update this Policy, in particular in the event of changes in the law, in the technologies applied or in the ways data is processed. The current version is published on gamfi.com together with the date of the most recent update. We will notify you of material changes in a manner appropriate to the circumstances.