Privacy and Cookies Policy

Short version – key information

We have prepared a short version of the most important rules related to the protection of privacy.

The basis for processing your personal data is the voluntary consent you have given to the processing of data in order to enable the provision of commercial information, including our offer, and to establish potential cooperation regarding the services we offer. Personal data will additionally be processed by us in order to enable us to fulfil the obligations arising from requests submitted by data subjects in connection with the processing of their personal data. In this case, the basis for processing the data is the legal obligations incumbent on the Controller.
By registering in our service, editing your profile, creating an account, booking a space, contacting us or filling in other forms, you provide us with your personal data. We treat it as confidential and protect it with the technical and organisational measures described below. To the extent necessary for HotDesks to operate, we use external providers, in particular providers of cloud infrastructure, communication services, security tools and technical monitoring. They are given access to data solely to the extent needed to deliver the services entrusted to them, and on the basis of appropriate legal bases and data protection arrangements. You will find the current list in our list of sub-processors.
We entrust the processing of personal data only to verified and trusted entities providing services related to the processing of personal data.
We use the Google Analytics analytical tools, which collect information about your visits to the site, such as the subpages you viewed, the time you spent on the site or the transitions between individual subpages. For this purpose, cookies of Google relating to the Google Analytics service are used. Within Google Analytics we collect demographic data and data on interests. By using our site available at hotdesks.pl, within the cookie settings you can decide whether or not you consent to the collection of such data about you. Refusing consent to statistics and marketing cookies does not restrict you in any way — the site and the application work exactly the same.
We use our own cookies to ensure the proper functioning of the site and the application, in particular signing in, maintaining the user session, booking spaces and managing your company within the hotdesks service. These cookies are strictly necessary to provide the service you have requested, so we do not ask for consent to them — without them you cannot sign in or keep a session. Consent covers only the statistics and marketing cookies described below, and you may withdraw it at any time. If the above information is not sufficient for you, you will find further details below.

Personal data

The controller of your personal data, within the meaning of the personal data protection regulations, is CODESPIRIT SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ (a Polish limited liability company), with its registered office at ul. Kazimierza Wielkiego 8/202, 20-611 Lublin, Poland, holding tax identification number (NIP) 7123419591, entered into the register of entrepreneurs kept by the District Court Lublin-Wschód in Lublin, with its seat in Świdnik, 6th Commercial Division of the National Court Register under number 0000904221, REGON: 389073747. The purposes, legal bases and period of processing of personal data are indicated separately in relation to each purpose of data processing (see: the description of individual purposes of personal data processing below).

When we are the controller and when we are the processor.

Depending on the purpose for which data is processed, CodeSpirit may act in different roles defined by the GDPR.

CodeSpirit is the controller to the extent that it independently determines the purposes and means of the processing, in particular in relation to:

the data of persons contacting us before the conclusion of an agreement,
the data of representatives and contact persons of clients,
the data necessary to conclude, settle and service an agreement with a client,
the data related to handling enquiries and requests addressed directly to CodeSpirit,
the data processed in order to ensure security, to pursue or defend claims and to fulfil CodeSpirit’s legal obligations, to the extent that CodeSpirit independently determines the purposes of such processing.

CodeSpirit is a processor acting on behalf of a client in relation to the data of users and of other persons entered into HotDesks by the client or by its users for the purpose of using the functions of the service, in particular data relating to employee accounts, the structure of the organisation, permissions and resource bookings.

In that respect the controller is the client, that is, the company which decided to use HotDesks in its organisation and which determines the purposes of processing the data of its employees or associates. The rules for processing data by CodeSpirit on behalf of a client are set out in Annex 1 to the Terms of Service.

Your rights.

The GDPR grants you the following potential rights related to the processing of your personal data:

the right of access to personal data,
the right to rectification of personal data,
the right to erasure of personal data,
the right to restriction of the processing of personal data,
the right to object to the processing of personal data,
the right to data portability,
the right to lodge a complaint with a supervisory authority,
the right to withdraw consent to the processing of personal data, if you have given such consent. The rules related to the exercise of the indicated rights are described in detail in Art. 16–21 GDPR. We encourage you to read these provisions. For our part, we consider it necessary to explain that the rights indicated above are not absolute and will not apply to you in relation to all processing activities of your personal data. For your convenience, we have made efforts to indicate, within the description of individual personal data processing operations, the rights available to you in respect of those operations. We emphasise that one of the rights indicated above is always available to you – if you consider that, in processing your personal data, we have infringed the personal data protection regulations, you have the possibility of lodging a complaint with the supervisory authority (the President of the Personal Data Protection Office). You may also always contact us with a request to provide you with information about what data we hold about you and for what purposes we process it. Simply send a message to politykaprywatnosci@codespirit.pl. We have, however, made every effort to present the information you are interested in exhaustively in this privacy policy. You may also use the e-mail address provided above for any questions related to the processing of your personal data.

Security.

We maintain the confidentiality of the personal data provided to us. We apply the technical and organisational measures required by the personal data protection regulations, appropriate to the nature, scope and risk of the processing. Personal data is collected with due diligence and protected against access by unauthorised persons.

Data recipients.

Your data may be processed by our subcontractors, i.e. entities whose services we use when processing data and providing services to you or fulfilling orders. Providers are given access to data solely to the extent necessary to deliver the services entrusted to them, and on the basis of appropriate legal bases and data protection arrangements.

Where a provider processes, on behalf of CodeSpirit, data entrusted by a client, it is treated as a sub-processor. The current list of such entities is available in our list of sub-processors.

Google – the scope covers the operation of the Google Tag Manager, Google Analytics, Google Ads and Google reCAPTCHA services. The provider is, depending on the service and the applicable contractual terms, Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), Google LLC (1600 Amphitheatre Parkway, Mountain View, CA 94043, United States of America) or another relevant Google group entity. More information about Google’s privacy policy at https://policies.google.com/privacy
SendGrid is an e-mail sending service provided by Twilio Inc. For more information about SendGrid’s privacy practices, please visit the privacy policy at https://www.twilio.com/legal/privacy
Microsoft Corporation – the app.hotdesks.pl application is hosted in Azure services in the North Europe region. For information about the physical location of Microsoft Azure data centres, see: https://azure.microsoft.com/global-infrastructure/data-residency/. For information about the physical security of Microsoft Azure data centres, see: https://docs.microsoft.com/azure/security/fundamentals/physical-security. The company will take all reasonable steps to ensure data security in accordance with this Privacy Policy, and no transfer of personal data to any institution or country will take place unless appropriate safeguards exist – including for the security of personal data and other information about you. All entities to which we entrust the processing of personal data guarantee the application of appropriate personal data protection and security measures required by law.
Functional Software, Inc. d/b/a Sentry, 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA – the scope covers error monitoring for the app.hotdesks.pl application; the data is processed on servers in the European Union (Frankfurt, Germany); more information in Sentry’s privacy policy at https://sentry.io/privacy/
PayU S.A. with its registered office in Poznań, ul. Marcelińska 90, 60-324 Poznań – in the case of online payments we transfer the data necessary to carry out the transaction. The scope of data may include in particular the first name, surname and e-mail address of the person making the payment. PayU processes that data as a separate controller, for the purpose of carrying out the payment transaction, providing information about its status, handling complaints and fulfilling the legal obligations incumbent on PayU. The payment rules are described in the Payment Terms, available in Polish only, and detailed information about the processing of data by PayU is available in PayU’s privacy policy.
Google – in respect of the Firebase Cloud Messaging service, which we use to deliver push notifications. The technical identifiers needed to deliver the notification, together with its content, for example the number of the booked space and the location name, may be transferred to Google’s infrastructure. Firebase Cloud Messaging operates on Google’s global infrastructure, and therefore processing may also take place outside the European Economic Area, in accordance with the data transfer mechanisms provided for by the GDPR and with Google’s terms.

Transfers outside the European Economic Area.

As a rule, we aim to process HotDesks data within the European Economic Area. If the use of a particular provider involves a transfer of data outside the EEA, it takes place solely on the basis of a mechanism permitted by the GDPR, in particular an adequacy decision or the appropriate safeguards provided for in Chapter V GDPR.

Information about providers and about the location of data processing is available in our list of sub-processors.

Purposes and processing activities

User account.

When creating a user account, you must provide the data necessary to create the account, such as an e-mail address. Providing data is voluntary but necessary to create the account. As part of editing your account data, you may provide further data. If you create an account using Google, your e-mail address and avatar will be collected from the data assigned to your Google profile. If you create an account using a Microsoft account, your e-mail address and avatar will be collected from the data assigned to your Microsoft profile. The data provided to us in connection with the creation of the account is processed for the purpose of creating and maintaining the account on the basis of the agreement for the provision of electronic services concluded through account registration (Art. 6(1)(b) GDPR). We process the data contained in the account for as long as the account operates. A user account within an organisation is managed by an administrator on your employer’s side: they may withdraw your access to the company, in which case your future bookings are cancelled. Booking history remains in the system, because it serves your employer’s reporting and settlement purposes. At any time you have the possibility of rectifying the data contained in the account. If you submit a request concerning your data, we will handle it in accordance with the applicable law: the appropriate operation may be the erasure or anonymisation of the data, except for data whose further storage is required or permitted under the law. You also have the right to data portability referred to in Art. 20 GDPR. Creating an account requires registration by filling in the form in the application available at app.hotdesks.pl or by accepting an invitation from another user. Your data within a company user account is always processed for the purpose of performing the agreement for maintaining a company account and this is also the legal basis for processing this data. In the case of a company account, the scope of data available in the service includes your company profile together with the structure configured by you and the address data provided. All information about the company is available only to members of your organisation.

Booking a workspace.

When booking a desk, a meeting room or a parking space in HotDesks, you use resources made available by your employer: your employer deployed the system and your employer decides on the purposes and scope of processing its employees’ personal data, which makes it the controller of that data. We then act as a processor, on your employer’s documented instructions, on the terms set out in Annex 1 to the Terms of Service. The scope of data shown in a booking follows from the configuration adopted by your company; if you have previously provided data in your user account, it is inserted automatically and you can always change it. We store booking data for the term of the agreement with your employer and, once that agreement ends, we delete or return the data in accordance with it. Questions about why your company collects booking data and how long it keeps it should be addressed to your employer — as the controller, it sets those rules.

Invoices.

If, in connection with the use of the service, we issue or deliver an invoice to you, we process your personal data to the extent necessary to issue the invoice for this purpose. The legal basis for processing your data in this case is the fulfilment of the legal obligation to issue an invoice. Moreover, all issued invoices are included in the accounting records, and therefore your data will naturally be processed within these records for the period of time required by law.

If you wish to subscribe to the newsletter, you must provide us with your e-mail address via the newsletter sign-up form. Providing data is voluntary but necessary to subscribe to the newsletter. You can subscribe to the newsletter by checking the box during registration or by enabling this option in the user account settings. We do not send a newsletter today — we collect consent so that we are able to do so in the future, and until then the address remains unused in the database. You may withdraw your consent at any time, whether or not sending has already started. The data provided to us when subscribing to the newsletter is used for the purpose of sending you the newsletter, and the legal basis for its processing is your consent (Art. 6(1)(a) GDPR) given when subscribing to the newsletter. The data will be processed for the duration of the newsletter’s operation, unless you unsubscribe earlier, which will result in the deletion of your data from the database. At any time you may rectify your data stored in the newsletter database, as well as request its deletion by unsubscribing from the newsletter. You also have the right to data portability referred to in Art. 20 GDPR.

Complaints and withdrawal from the agreement.

Reports concerning the operation of the system — faults, remarks, complaints and suggestions for changes — are accepted primarily from your company’s administrator: by e-mail or through the reporting form available in the application. We then process the data contained in the report itself: the first name and surname of the person reporting, the e-mail address and the description of the matter. Providing this data is voluntary, but without it the report cannot be examined or answered.

The legal basis is the performance of the agreement concluded with your employer (Art. 6(1)(b) GDPR) and our legitimate interest in clarifying the matter and defending against potential claims (Art. 6(1)(f) GDPR). We keep reports and the related correspondence until the limitation period for claims under the agreement has expired. You have the right to object to processing based on legitimate interest, on grounds relating to your particular situation (Art. 21 GDPR).

If, in a particular case, you are entitled to a statutory right of withdrawal from the agreement, we give effect to it under the rules arising from the applicable law and from the terms of service, and we process the data contained in the statement of withdrawal in order to examine and document it.

E-mail contact and the contact form.

Data provided in an e-mail message or through the contact form is processed in order to handle the enquiry and to conduct correspondence. The legal basis is Art. 6(1)(b) GDPR where the contact is aimed at concluding or performing an agreement with the data subject, or Art. 6(1)(f) GDPR in other cases. Our legitimate interest is handling enquiries and communicating about our services.

We may also retain correspondence in order to evidence the course of arrangements and to establish, pursue or defend claims. The legal basis for this processing is Art. 6(1)(f) GDPR.

Surveys, enquiries and other forms.

Various types of surveys, enquiries and other forms may be available in the service, within which you may enter personal data. If you fill in and submit such a form, the personal data contained in it will be processed solely for the purpose of handling the survey, enquiry or other purpose of the form. The content of correspondence may be subject to archiving.

Cookies and other tracking technologies

Our service, like almost all other websites, uses cookies. Cookies are small pieces of text information stored on your terminal device (e.g. computer, tablet, smartphone) that can be read by our ICT system (own cookies) or by the ICT system of third parties (third-party cookies). Some of the cookies we use are deleted after the end of the web browser session, i.e. after it is closed (so-called session cookies). Other cookies are retained on your terminal device and enable us to recognise your browser on your next visit to the site (persistent cookies). You will find more details below.

During your first visit to the site, information about the use of cookies is displayed to you. Thanks to a special tool, you have the possibility of managing cookies from the level of the site. In addition, you can always change the cookie settings from the level of your browser or delete cookies altogether. Browsers manage cookie settings in different ways. In the help menu of your web browser you will find explanations regarding changing cookie settings. Please remember that disabling or limiting the handling of cookies may cause difficulties in using our site, as well as many other websites that use cookies.

A list of the cookies stored by hotdesks.pl, together with their purpose and storage period, is available in the cookie policy. There, and using the „Ustawienia cookies” (cookie settings) button in the site footer, you can change or withdraw your consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal.

Own cookies.

We use our own cookies to ensure the proper functioning of the site, in particular the ordering and login process for the user account and the use of the hotdesks application.

Third-party cookies.

Our site, like most modern websites, uses functions provided by third parties, which involves the use of cookies originating from third parties. The use of this type of cookie is described below.

Google Analytics.

We use the Google Analytics tool provided by Google. On the hotdesks.pl site the tool is loaded through Google Tag Manager only if you consent to statistics cookies. The legal basis for processing is your consent (Art. 6(1)(a) GDPR in conjunction with Art. 399 of the Act of 12 July 2024 – Electronic Communications Law). Google Analytics automatically collects information about your use of our site, such as the subpages viewed, the time spent on the site or the entry source, and we use it to create statistics and analyse them in order to optimise our site. Within Google Analytics we also collect demographic data and data on interests. Google Analytics does not record or store your IP address. The information collected may be transferred to Google LLC in the United States. Google LLC participates in the EU-US Data Privacy Framework, in respect of which the European Commission has found an adequate level of personal data protection. You may withdraw your consent at any time using the „Ustawienia cookies” (cookie settings) button in the site footer. If you are interested in details related to data processing within Google Analytics, we encourage you to read the explanations prepared by Google: https://support.google.com/analytics/answer/6004245.

Google Ads.

We use the Google Ads service provided by Google. We use it to measure the effectiveness of our advertisements displayed in Google search and the Google display network, and to display advertisements again to people who have visited our site (remarketing). The tool is loaded through Google Tag Manager only if you consent to marketing cookies. The legal basis for processing is your consent (Art. 6(1)(a) GDPR in conjunction with Art. 399 of the Electronic Communications Law). Google Ads stores cookies on your device which make it possible to link a visit to the site with a click on an advertisement. Google may combine this information with other data about you if you are logged in to a Google account, under the terms described by Google: https://policies.google.com/technologies/ads. The information may be transferred to Google LLC in the United States under the EU-US Data Privacy Framework. You may withdraw your consent at any time using the „Ustawienia cookies” (cookie settings) button in the site footer.

Google reCAPTCHA.

In order to protect against spam and automated submissions (bots), we use the Google reCAPTCHA tool provided by Google. We use it to protect the login and registration forms in the app.hotdesks.pl application and the contact form on the hotdesks.pl site. On hotdesks.pl the tool loads only once you start filling in the form — merely visiting the page causes no request to Google. The tool analyses the user’s behaviour on the site (including IP address, device and browser parameters, time spent on the site) and stores a cookie (_grecaptcha) on your device in order to distinguish human-generated traffic from bot traffic. This data is processed by Google solely on our instructions, as a data processor, in order to verify whether the form is being filled in by a human. The legal basis for processing is our legitimate interest (Art. 6(1)(f) GDPR), consisting in protecting the service against abuse.

Server logs

Using the site involves sending requests to the server on which the site is stored. Each request directed to the server is saved in the server logs. The logs include, among others, your IP address, the server date and time, and information about the web browser and operating system you use. The logs are saved and stored on the server. The data saved in the server logs is not associated with specific persons using the site and is not used by us for the purpose of identifying you. Server logs constitute solely auxiliary material used for administering the site, and their content is not disclosed to anyone other than persons authorised to administer the server.

Application error monitoring (Sentry)

In order to detect and fix errors and to ensure the stable and secure operation of the app.hotdesks.pl application, we use the Sentry service provided by Functional Software, Inc. d/b/a Sentry, 45 Fremont Street, 8th Floor, San Francisco, CA 94105, USA, as a processor acting on our instructions.

When an error occurs in the application, only technical data is sent to Sentry: the description of the error and its location in the code, the application version, the address of the application subpage, the type and version of the browser and of the operating system, the last technical steps preceding the error (transitions between screens, addresses of server calls without their content, diagnostic messages) and internal identifiers: of the user, of the company and a random browser tab identifier. Sentry also receives information on whether a session of using the application ended with an error – this serves to assess the stability of successive releases.

We do not send to Sentry your first name, surname, e-mail address, the content you enter in forms, or screen recordings. Your IP address is not recorded. The service does not use cookies or any other mechanism for storing data in your browser.

The legal basis for processing is our legitimate interest (Art. 6(1)(f) GDPR), consisting in ensuring the correct and secure operation of the service. The data is stored on servers in the European Union (Frankfurt, Germany) for no longer than 90 days, after which it is deleted automatically. If, in connection with the provision of the service, data were to be transferred outside the European Economic Area, this takes place on the basis of the European Commission’s decision on the EU-US Data Privacy Framework or on the basis of standard contractual clauses. You have the right to object to this processing on grounds relating to your particular situation (Art. 21 GDPR), as well as the other rights described in this policy.

Pliki cookies