Privacy
Policy

Last updated: 2 January 2026

This Privacy Policy sets out the rules for processing the personal data of Users of the website operated at https://papayainteractive.eu (the “Website”).

§1 Personal Data Controller

The personal data controller is: Papaya Interactive Spółka z ograniczoną odpowiedzialnością, ul. J. Dąbrowskiego 85/20, 02-503 Warsaw, Poland, KRS:0001208505, NIP: 5214142591, REGON: 543370297, District Court for the Capital City of Warsaw in Warsaw, 13th Commercial Division, share capital: PLN 5,000 (fully paid up).

Contact for matters related to personal data protection: office@papayainteractive.eu

The Controller has not appointed a Data Protection Officer.

§2 Scope of Data Processing

Depending on how the Website is used, the Controller may process:

  1. data provided by the User in correspondence (e.g. first name, surname, email address, telephone number, message content),
  2. technical data related to the use of the Website (e.g. IP address, browser and device information, data contained in server logs),
  3. data collected through cookies and similar technologies — in accordance with the consents given by the User.

§3 Purposes and Legal Bases for Data Processing

A. Handling enquiries submitted by Clients

If the User contacts the Controller via the contact form or by email, personal data is processed for the purpose of handling the enquiry and conducting correspondence. Legal basis: Article 6(1)(f) of the GDPR – the Controller’s legitimate interest in handling enquiries addressed to the Controller.

B. Proper Functioning and Security of the Website

Technical data (including the IP address and server logs) is processed to ensure the proper functioning of the Website, the security of IT systems and the prevention of abuse. Legal basis: Article 6(1)(f) of the GDPR – the Controller’s legitimate interest in ensuring the security and stability of the Website.

C. Analytics and Statistics

With the User’s consent, the Controller uses analytics tools, in particular Google Analytics 4, to analyse how the Website is used and to improve its functionality.
Legal basis: Article 6(1)(a) of the GDPR – the User’s consent.

D. Marketing in Advertising Systems

With the User’s consent, the Controller uses marketing tools such as Google Ads and Meta Pixel to measure the effectiveness of advertising campaigns and optimise marketing communications within the advertising systems of the respective providers. Legal basis: Article 6(1)(a) of the GDPR – the User’s consent.

Profiling

As part of the analytics and marketing tools used, profiling within the meaning of the GDPR may take place, consisting of the automated analysis of the User’s activity on the Website. Such profiling does not produce legal effects concerning the User or similarly significantly affect them. The Controller does not make decisions concerning Users based solely on automated processing of personal data within the meaning of Article 22 of the GDPR.

E. No Newsletter or Remarketing

As of the date of publication of this Privacy Policy, the Controller:

  • does not send a newsletter or conduct email marketing,
  • does not carry out remarketing activities.

§4 Recipients of Personal Data

Personal data may be disclosed to the following categories of recipients:

  1. hosting and IT infrastructure service providers – OVH,
  2. entities providing technical and administrative support for the Website,
  3. providers of analytics and marketing tools – Google and Meta, solely to the extent covered by the consents given,
  4. entities providing accounting and legal services to the Controller,
  5. public authorities – where required by applicable law.

§5 Transfer of Data Outside the European Economic Area

The use of Google and Meta tools may involve the transfer of personal data to third countries, in particular to the United States.
Such transfers are carried out subject to the safeguards provided for under the GDPR, in particular:

  1. Standard Contractual Clauses approved by the European Commission,
  2. other legally permitted data protection mechanisms.

At the User’s request, the Controller will provide information regarding the safeguards applied.
As of the date of preparation of this Privacy Policy, the Controller does not transfer data outside the EEA on a permanent basis, except in connection with the use of the aforementioned tools, where such use depends on the User’s consent.

§6 Data Retention Period

Personal data is processed for the following periods:

  1. in the case of correspondence – for the period necessary to handle the matter and, after its completion, until the expiry of the limitation period for any potential claims,
  2. in the case of technical data – for the period necessary to ensure the security and proper functioning of the Website,
  3. in the case of data collected on the basis of consent – until the consent is withdrawn or the cookies are deleted by the User.

§7 User Rights

The User has the right to:

  1. the right of access to personal data,
  2. the right to rectification of personal data,
  3. the right to erasure of personal data,
  4. the right to restriction of processing,
  5. the right to data portability,
  6. the right to object to the processing of personal data based on the Controller’s legitimate interests,
  7. the right to withdraw consent at any time,
  8. the right to lodge a complaint with the President of the Personal Data Protection Office.

§8 Cookies

The Website uses cookies and similar technologies for the following purposes:

  1. ensuring the proper functioning of the Website,
  2. analytics (Google Analytics 4),
  3. marketing (Google Ads, Meta Pixel).

Consent management is handled through the CookieYes tool, which allows the User to enable or disable individual categories of cookies (except for strictly necessary cookies). Cookie settings can be changed at any time via the consent panel available on the Website or through the web browser settings.

§9 Social Media

The Website does not use plugins or embedded content from social media platforms.
The Controller maintains profiles on social media, where personal data is processed in accordance with the rules established by the operators of those platforms and this Privacy Policy.

§10 Changes to the Privacy Policy

The Privacy Policy may be amended, in particular if the scope or manner of data processing changes. The current version of the document is published on the Website.