1. Introduction

Data protection and information security have always been treated as a priority in the activities of SPOC S.A. As an example of a responsible and conscious organisation, we care about properly informing you about matters related to the processing of personal data, in particular in connection with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, hereinafter referred to as the “GDPR”, as well as the Polish Act on the Protection of Personal Data of 10 May 2018. We are aware that information has a certain value that must be protected appropriately. Bearing in mind the security of your data, in this document we present key information regarding the legal grounds for processing personal data, their use, and their acquisition.

2. Data Controller

The controller of personal data collected via this website is SPOC S.A. with its registered office at ul. Szyperska 14, 61-754 Poznań, hereinafter referred to as the “Company”.

We are the largest and most experienced ServiceNow partner in Poland. Since 2010, SPOC has been providing its customers with solutions supporting the management of business services and business processes.

You can contact us at the correspondence address indicated above, as well as by e-mail at: gdpr@spoc.eu

3. Purposes and legal grounds for processing

a) if you use our website’s contact form, your data is processed on the basis of the Controller’s legitimate interest (Article 6(1)(f) GDPR), namely responding to your question and conducting correspondence, or, if the correspondence is aimed at concluding a contract with us, for the performance of the contract or to take steps to conclude it at the request of the person providing their data (Article 6(1)(b) GDPR),

b) if you have expressed a wish to receive technical summaries of new ServiceNow releases from us, your data is processed on the basis of the consent you have given us to send commercial and marketing information to the indicated e-mail address (Article 6(1)(a) GDPR),

c) your data is also processed on the basis of consent if you have expressed a wish to receive our newsletter regarding webinars, events, expert materials, or information about our services (Article 6(1)(a) GDPR),

d) your data is also processed on the basis of consent if you have given it for telephone contact for commercial and marketing purposes (Article 6(1)(a) GDPR),

e) in the case of e-mail correspondence, your data is processed for the purpose of communicating with you, including answering questions you have asked us, which is our legitimate interest (Article 6(1)(f) GDPR),

f) if you register to participate in our webinar or download a recording, we process your data, i.e. your name and surname, e-mail address, and company name, on the basis of the consent you have given to receive commercial and marketing content, and for the purpose of confirming your identity (Article 6(1)(a) GDPR),

g) if you have concluded an agreement with us, we may send you satisfaction surveys in order to improve the quality of our services, which is our legitimate interest (Article 6(1)(f) GDPR),

h) we process the data of job applicants in order to assess the qualifications and skills required for the position for which you are applying. We will process your personal data, to the extent indicated in labour law provisions, in order to carry out the current recruitment process and, if applicable, to conclude an agreement (on the basis of Article 6(1)(b) and (c) GDPR). If you provide us with other data in your application documents, we will process it on the basis of consent (Article 6(1)(a) GDPR), which may be withdrawn at any time. By sending us your recruitment application, you consent to the processing of the data it contains. In addition, you have the option of giving us consent to process your data for the purposes of future recruitment processes.

i) The data of Users who have liked SPOC S.A.’s business profile available on Facebook, LinkedIn, and YouTube will be processed in order to administer and manage the above-mentioned business profile of SPOC S.A., to communicate with Users, including answering questions asked, to interact, to inform about organised events, interesting information, services and products offered by the Controller, and to build a community on the above-mentioned social media, on the basis of the consent given by following the profile (Article 6(1)(a) GDPR).

In this respect, SPOC S.A., as the Controller of the above-mentioned business profiles, may generate anonymous statistical data on persons visiting the pages using functions made available by the providers.

The User voluntarily decides to like/follow/interact with the profile/page/group on a given social networking site. The rules governing SPOC S.A.’s business profile on the providers’ platforms are set by the Controller; however, the rules for being present on social networking sites result from the regulations of the providers, who are joint controllers of the data.

You may stop following, or even block, the Controller’s profile on the social networking site at any time. Due to the specific nature of the platforms used by the Controller, only using the “block user” option will result in no content created by the Controller being displayed to you. Otherwise, the content available on a given social platform is of a general, publicly accessible nature.

The Controller processes publicly available personal data, such as, for example, first name, surname, and other information placed on Users’ profiles and publicly accessible.

4. Processing period

SPOC S.A. processes personal data and stores it for a period dependent on the legal basis constituting the legal ground for processing personal data, i.e.:

If you have contacted us using the contact form on the website, we process your data until we provide you with a response. If you are interested in our commercial offer, your data is processed until an agreement is concluded with us or a decision not to proceed is made.

If you have expressed a wish to receive technical summaries of new ServiceNow releases from us, or have subscribed to our newsletter, your data is processed until you withdraw the consent given for the processing of personal data, i.e. until you unsubscribe from the newsletter.

If you have given us consent for telephone contact, your data is processed until you withdraw the consent given for the processing of personal data.

In the case of e-mail correspondence, your data is processed until the Controller’s legitimate interest ceases.

If you have participated in our webinar, your data will be processed until you withdraw the consent for the processing of personal data previously given.

Surveys are sent to you no later than one month after the end of the agreement.

We will process the data of job applicants for the duration of the given recruitment process, and after that period for the period during which either party may raise possible claims. Where you have given consent to participate in future recruitment processes, we will process your personal data until the consent is withdrawn, but no longer than 18 months after the end of the current recruitment process.

The data of Users who have liked SPOC S.A.’s business profile available on social networking sites (Facebook, LinkedIn, X, YouTube) will be processed for as long as you follow our above-mentioned profiles.

5. Rights of data subjects

Every person whose data we process has the following rights:

• the right of access to personal data,
• the right to rectification of personal data,
• the right to erasure of personal data,
• the right to restriction of processing,

as well as, where we process data on the basis of the Controller’s legitimate interest:

• the right to object for reasons related to your particular situation, unless we demonstrate the existence of compelling, legitimate grounds for processing that override your interests, rights and freedoms, or grounds for the establishment, exercise or defence of legal claims.

In addition, where we process data on the basis of your consent or for the performance of an agreement concluded with us, you have the right to data portability.

Where you have given consent to the processing of personal data, you have the right to withdraw your consent at any time, without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal.

You also have the right to lodge a complaint with the supervisory authority, i.e. the President of the Personal Data Protection Office (PUODO).

You may exercise the rights referred to above by contacting us at the e-mail address gdpr@spoc.eu or by post at: SPOC S.A., ul. Szyperska 14, 61-754 Poznań.

6. Requirements for providing personal data

Providing your data when submitting an enquiry via the contact form or when conducting e-mail correspondence is necessary in order to respond to your questions and for general communication.

Providing your data in order to receive technical summaries of new ServiceNow releases, our newsletter, and for telephone contact from us is voluntary.

Giving consent to the processing of personal data in connection with participation in a free webinar is voluntary; however, if such consent is not given, participation in the webinar and downloading the recording will not be possible.

Participation in the satisfaction survey is voluntary.

Providing personal data when applying to us for a job, i.e. name and surname, date of birth, contact details, education, professional qualifications, and employment history, is necessary for us to carry out the recruitment process, and failure to provide it will result in your candidacy not being able to be considered. Providing any other data is voluntary.

7. Data recipients

We disclose personal data to other entities on the basis of legal requirements or in connection with the performance of the purpose for which it was provided to us. In particular, data may be disclosed to our business partner, ServiceNow, in connection with your interest in the product. Where we use the services of our subcontractors, we declare that we only use the services of vetted entities, recognised on the local market, that provide guarantees of data security. The agreements under which we entrust the processing of personal data contain provisions on the protective measures we require, ensuring the confidentiality, integrity, and availability of the data transferred.

Your data may be disclosed to entities that provide IT and telecommunications services for us (including website hosting).

If you have expressed a wish to receive the newsletter, your data may be transferred to a company providing IT support services in order to perform the ordered service.

In addition, we use a tool for managing cookies: Cookiebot.

We also use the support of external providers of platforms for webinars and online training, as well as registration for them.

For all correspondence, including e-mail correspondence, we use tools provided by Microsoft.

For database management, we use solutions provided by ZOHO.

For satisfaction research, we use tools provided by ZOHO.

8. Transfer of data outside the European Economic Area

ServiceNow and ZOHO are registered outside the European Economic Area; however, your data is processed exclusively within the territory of the European Union. The same applies to Microsoft.

9. Profiling and automated processing

Profiling is a form of automated processing of personal data, which consists of using personal data to evaluate certain personal factors of a natural person, in particular to analyse or predict aspects concerning that person’s work, economic situation, health, personal preferences, interests, behaviour, location, or movements.

We carry out profiling in order to track online activity and identify your interest in our services.

By visiting our website, you provide us with your IP address. Thanks to this, we can see the traffic you generate on our website. If you use our contact form, the data provided in it is synchronised with the above-mentioned IP address. By tracking traffic on our website, we assign points to individual IP addresses for each activity performed on it. Once a specific number of points has been reached, and if you have used our contact form (i.e. after the data provided in it has been synchronised with the IP address), our sales representatives may decide to attempt to contact you in order to offer our services. If our contact form has not been used (i.e. there has been no data synchronisation), the points assigned to IP addresses are reset to zero after 30 days.

10. Cookies

To a limited extent, we may collect personal data automatically via cookies placed on our websites. Cookies are small computer data files that are saved and stored on a computer, tablet, or smartphone for the purpose of using websites. “Cookies” usually contain the name of the site they come from, the time they are stored on the device, and a unique number.

On the website, visitors will be presented with information about cookies in accordance with legal provisions, until this information is accepted/closed by the visitor. Data confirming acceptance of the information will be saved in cookies on the visitor’s computer.

Our website and the services it offers use cookies for the following purposes:

• statistical purposes,
• security purposes, bot identification, and protection against malicious software,
• configuration of the website and services (they allow us to provide features and services on the website),
• authentication – they may inform users (including you) that they are logged in, enabling the website to display the relevant information and features,
• analysing and studying your behaviour (as a user of the site) – this allows us to read preferences related to the services we provide, and thereby analyse, improve, and develop the products and services offered,
• advertising purposes – thanks to cookies, we are able to provide you with more interesting and personalised advertisements, which, after you visit our website, may be displayed to you in remarketing campaigns within: Meta Ads, LinkedIn Ads, Google Ads, X Ads, and Microsoft Clarity.

The information collected relates to your IP address, the type of browser used, language, type of operating system, internet service provider, time and date information, location, and information transmitted to the website via the contact form.

The data collected is monitored by us. For this purpose we use tools related to profiling contacts using our Marketing Automation system; to analyse the use of our website, we use Google Analytics tools, which record your traffic on the site.

Two types of cookies are used on the website: “session” cookies and “persistent” cookies. “Session” cookies are temporary files that are stored on the User’s end device until logging out, leaving the website, or closing the software (web browser). “Persistent” cookies are stored on the User’s end device for the period specified in the cookie’s parameters, or until they are deleted by the User.

The following types of cookies are used within the website:

a) “necessary” cookies, enabling the use of services available within the website;

b) cookies used to ensure security;

c) “analytical” cookies;

d) “functional” cookies, enabling the “remembering” of settings selected by the User and the personalisation of the User interface;

e) “advertising” cookies.

In many cases, the software used for browsing websites (web browser) by default allows cookies to be stored on the User’s end device. Users of the website may change their cookie settings at any time. These settings may be changed, in particular, in such a way as to block the automatic handling of cookies in the web browser’s settings, or to be informed each time cookies are placed on the User’s device. Detailed information on the possibilities and methods of managing cookies is available in the software (web browser) settings. Deleting or blocking cookies is always possible. The user of the website can do this personally in the appropriate settings of their browser.

Please note that restrictions on the use of cookies may affect some of the functionalities available on the website’s pages.

Cookies placed on the end device of the website’s User may also be used by advertisers and partners cooperating with us.

The full list of cookies currently in use, based on our Cookiebot scan, is set out below:

Source: Cookiebot scan report provided by the Company (20 July 2026).

11. Changes to this Privacy Policy

We undertake to regularly review this Privacy Policy and to amend it whenever this proves necessary or advisable due to: new legal regulations, new guidelines issued by authorities responsible for supervising personal data protection processes, and best practices applied in the field of personal data protection.