ProChase - Privacy Policy
1. Who is responsible for your data
The controller of your personal data is Palma Studio Łukasz Kaczmarski, ul. Stanisława Moniuszki 4a, 90-111 Łódź, Poland, VAT ID PL7292507843, REGON 380333900 ("we", "us"). For matters concerning personal data, write to info@palmastudio.pl. We have not appointed a data protection officer.
This policy covers the ProChase website, the trial download form, the newsletter, the activation page and the ProChase program's connections to our server. The program does not send us your files or information about what you are working on. Our services are intended for adults - we do not knowingly collect data from persons under 16, and if such data reaches us, we delete it.
Legal bases are given under the GDPR - the European Union's General Data Protection Regulation (2016/679).
2. Downloading the trial version
What we collect: the e-mail address entered in the form, the website language, the date and a hash of your IP address secured with a secret key.
Why: to send you the link to download the installer and to protect the form against abuse.
Legal basis: performance of the service you request (Article 6(1)(b) GDPR); as regards protecting the form - our legitimate interest in the security of the website (Article 6(1)(f) GDPR).
How long: the link is valid for 7 days. We delete the link record (e-mail address and download dates) 30 days after the link expires, and the log of sent messages after 12 months.
3. Newsletter (mailing list)
What we collect: e-mail address, language, the wording and version of the consent checkbox, the date of consent and a hash of your IP address secured with a secret key. On the list we also record the subscription status (awaiting confirmation, confirmed, unsubscribed), the dates of confirmation and unsubscription, and a hash of the IP address at the time of confirmation. We do not measure message opens or clicks.
Why: to send you information about ProChase and the Palma Studio offering - new versions, fixes, new products and offers.
Legal basis: your consent (Article 6(1)(a) GDPR). You can withdraw it at any time using the link included in every message. Withdrawal does not affect the lawfulness of earlier mailings.
How long: until you unsubscribe. After that, the address remains on the list as unsubscribed, so that no further messages are sent to it (Article 6(1)(f) GDPR). A subscription you do not confirm is removed from the list after 30 days. We keep the record of consent for as long as the consent is valid and for 3 years from the end of the year in which it was withdrawn, as proof that it was given (Article 6(1)(f) GDPR).
4. How the trial version works
The trial version connects to our server when it starts and while it is running.
What we collect: a computer identifier, which the program creates from characteristics of the computer. On the server we store it in a form secured with a secret key, together with the dates of the first and last connection and the number of connections. The program also stores on the computer information used to control the trial period; it remains after the program is uninstalled.
Why: so that the trial version works for 14 days from its first launch on a given computer.
Legal basis: performance of the trial terms of the licence agreement (Article 6(1)(b) GDPR); as regards counteracting circumvention of the trial period - our legitimate interest (Article 6(1)(f) GDPR).
How long: 36 months from the last connection.
5. Activating the full version
What we collect: on activation - in the program or on the activation page - the licence key, the computer identifier and the computer name, by which you will recognise the computer on the list of workstations (seats), are sent to us. On the server we store a hash of the key, the computer identifier and name, the method and date of activation and the date of the last check. The program may periodically check the validity of the licence, sending a hash of the key and the computer identifier. We also check the validity of the key with the seller, passing only the key to it.
Why: to perform the licence agreement - to keep track of the number of workstations, allow them to be released and counteract use of the program contrary to the licence.
Legal basis: performance of the licence agreement (Article 6(1)(b) GDPR); as regards counteracting abuse and pursuing claims - our legitimate interest (Article 6(1)(f) GDPR).
How long: workstation data - until the workstation is released; release dates - 12 months; event log (date of activation or release, key hash, part of the computer identifier) - 3 years from the end of the year in which the event occurred.
6. Purchase
ProChase is sold by a payment operator acting as the seller (merchant of record); its name is given on the purchase page and in the list of data recipients. It processes the data provided at purchase as a separate controller, under its own privacy policy.
Before going to the seller's system, you tick two boxes on our website: acknowledgement of the licence agreement and consent to the program being supplied before the withdrawal period expires. We record their wording, the date and time and the version of the licence agreement, and pass to the seller only an identifier linking them to the order. After the purchase we send you a confirmation of both statements and keep a copy of it. We also record the date and time when the download of the program began and when it was activated.
From the seller we receive information about the order, including your name or company name, e-mail address, order number and licence variant. We use it to process the order, contact you and perform the licence agreement, for example to inform you about updates.
Legal basis: performance of the contract (Article 6(1)(b) GDPR); as regards the confirmations of statements - our legitimate interest in being able to demonstrate them (Article 6(1)(f) GDPR).
How long: order data - for as long as we provide updates for the purchased major version and 3 years thereafter; confirmations of statements, together with the download and activation dates - 6 years from the end of the year of purchase.
In direct sales, we keep order and invoice data for 5 years from the end of the tax year (Article 6(1)(c) GDPR - tax law), and the contact details of persons representing the purchaser for the duration of our cooperation (Article 6(1)(f) GDPR).
7. Contact, support and complaints
What we collect: your e-mail address, the content of your message and its attachments, and any data you provide in them. For complaints and licence matters, we ask for the order number or licence key in order to find your purchase.
Why: to reply, provide technical support and handle complaints.
Legal basis: performance of the contract (Article 6(1)(b) GDPR), obligations relating to complaints (Article 6(1)(c) GDPR), and otherwise, including defence against claims - our legitimate interest (Article 6(1)(f) GDPR).
How long: 3 years from the end of the year in which the matter was closed.
8. Website and server security
Request rate limiting: hashes of the IP address and e-mail address secured with a secret key, and the time of requests; we delete them after one day at the latest.
Technical error log, which may contain an e-mail address: 90 days.
Server logs (IP address, date, address of the requested page, including the trial download link, referring page and browser data): the hosting provider records them daily, and we delete them after 30 days.
Backups: the hosting provider backs up the entire account, so deleted data may remain in backups until they are replaced by newer ones in the normal backup cycle. We use backups solely to restore data after a failure.
Legal basis: our legitimate interest in the security of the website and protection against abuse (Article 6(1)(f) GDPR).
9. Who we share data with
- a hosting provider based in Poland - hosting of the website, the form, the mailing list, the trial register, activation and the info@palmastudio.pl mailbox, from which we send all messages; processes data on our behalf;
- the seller (payment operator) - receives an identifier linking the order to your statements and the licence key to check its validity; processes data as a separate controller;
- an invoicing system provider based in Poland - for direct sales; processes data on our behalf;
- public authorities, where required by law.
Processors act on our behalf only under a data processing agreement and on our instructions. The names of the recipients, their locations and the bases for transfers outside the European Economic Area are given in the list of data recipients: prochase.palmastudio.pl/data-recipients/.
10. Transfers outside the European Economic Area
The seller may have access to data from outside the European Economic Area, including from the USA. Such data is protected by standard contractual clauses approved by the European Commission and, for US entities participating in the EU-US Data Privacy Framework, also by the Commission's adequacy decision. Details for each recipient are given in the list of data recipients, and a copy of the safeguards is available on request sent to info@palmastudio.pl.
11. Users outside the European Union
We apply the same rules to everyone, including people outside the European Union. We process your data in the Union and, in the cases described in section 10, also outside it. We do not sell personal data and do not share it for advertising purposes.
12. Your rights
Regardless of the country in which you live, you have the right to:
- access your data and receive a copy of it;
- have your data rectified;
- have your data erased;
- restrict processing;
- receive the data we process on the basis of consent or a contract in a portable format (data portability);
- withdraw your consent at any time.
Right to object: you may object at any time to processing based on our legitimate interest (Article 6(1)(f) GDPR). We will then stop processing that data, unless we demonstrate compelling legitimate grounds that override your interests, or the data is needed to establish, exercise or defend legal claims.
You also have the right to lodge a complaint with a supervisory authority: regardless of your country of residence - with the President of the Polish Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, and, if you live or work in another European Union country, also with the authority in that country.
We can find data stored as hashes only if you provide information that allows us to do so, for example your licence key.
Send requests to info@palmastudio.pl. We will reply within one month.
13. Do you have to provide data
Providing your e-mail address is voluntary, but without it we cannot send you the trial download link. Consent to receive information is voluntary and does not affect the download. The trial version does not work without a connection to our server, and the full version cannot be activated without sending the data described in section 5.
14. Automated decisions
The server checks the trial period and the number of workstations automatically, in accordance with the licence agreement. We do not carry out profiling.
15. Cookies, tracking and the Do Not Track signal
The website does not use cookies, nor scripts or resources from external servers. In your browser's memory we store only the selected website language. We do not track your activity on other websites and do not allow others to do so, which is why the "Do Not Track" signal does not change how the website works.
16. Changes to this policy
This policy bears a version number and date. The current version is available on the ProChase website in the legal documents section, together with earlier versions. We announce material changes on the website and also inform newsletter subscribers by e-mail.