Privacy policy of the sse.lodz.pl website

This policy explains what data we collect when you use the sse.lodz.pl website, why we need it, who we share it with and what you can do about it.

1. Who manages your data

The controller of your data is Łódź Special Economic Zone S.A., with its registered office in Łódź at ul. Ks. Biskupa Wincentego Tymienieckiego 22G, 90-349 Łódź, entered in the register of entrepreneurs of the National Court Register kept by the District Court for Łódź-Śródmieście in Łódź, 20th Commercial Division of the National Court Register, under KRS number 0000014128, NIP (tax identification number) 725-14-86-825, REGON (statistical number) 471537330, share capital PLN 24,927,000, fully paid up (the “Zone” or “we”).

2. Data Protection Officer

We have appointed a Data Protection Officer. They are your first point of contact when you want to exercise your rights or ask a question.

Write to iod@sse.lodz.pl or send a letter to the Zone’s registered office address, marked “Inspektor Ochrony Danych” (Data Protection Officer).

3. What data we collect

The data we collect depends on what you do on the website:

• Contact form: first name and surname, e-mail address, phone number, company and company size (if you provide them), subject and content of the message.
• Offer enquiries (warehouses, offices, event rooms, land, site visits, a meeting about the tax exemption, consultations on business development services): first name and surname, company, e-mail address, phone number, content of the enquiry; for event rooms and events, also the type of event, the planned date and the number of guests.
• Submitting land: whether you are submitting as a municipality or public office or as a private owner or company, the location and area of the land, first name and surname, e-mail address or phone number, a description of the land, and any map or photos you attach.
• Partner programme application (Partner Zone): first name and surname, company name, website, what you do, e-mail address, phone number, a description of what you offer investors.
• Careers: first name and surname, e-mail address, phone number, area or position, your CV and any other documents you attach.
• Event registrations and applications to calls: the data specified in the form for the given event or call, usually first name and surname, company, position, e-mail address, phone number; in the GrowMania programme for school students, also the student’s first name and surname, school and class.
• Newsletter: e-mail address, date and source of the sign-up, IP address at the time of sign-up and confirmation of the sign-up.
• Sending the calculator result: e-mail address, calculation parameters (location, company size, type and cost of the investment) and whether you agree to marketing contact, when you request the result of the tax-relief calculator as a PDF file.
• Technical data: IP address, date and time of the connection, address of the requested page, browser and device type. They are recorded automatically in the server logs when you browse the website.
• Data on your activity on the website (which subpages you visit, where you come to us from, whether you click our ads): only if you consent to analytics or marketing cookies.

Required fields in the forms are marked with an asterisk. You fill in the rest only if you want to. We do not ask for data we do not need to handle your matter.

4. Why we process your data and on what legal basis

Each purpose has its own legal basis under the GDPR. We list them together so it is clear what follows from what.

Answering your question. When you write to us through the contact form or by e-mail, or call us, about a matter that does not concern entering into a contract, we process your data on the basis of our legitimate interest, which is handling correspondence and answering you (Article 6(1)(f) GDPR).

Offer enquiries and steps before entering into a contract. When you ask about a warehouse, office, event room, investment area, site visit, a meeting about the tax exemption or a consultation on business development services, submit land or apply to the partner programme with your company, we process your data to take steps at your request before entering into a contract and, where applicable, to conclude it (Article 6(1)(b) GDPR). If you write on behalf of a company or institution, the basis is our legitimate interest, which is contact with a counterparty’s representative (Article 6(1)(f) GDPR).

Taking part in events. When you register for an event, we process your data to perform the contract for participation in the event: to confirm your registration, prepare the list of participants and name badges, and inform you of changes (Article 6(1)(b) GDPR). For paid events, there is also the obligation to issue an invoice and keep accounting records (Article 6(1)(c) GDPR). The terms of participation, including the cancellation rules, are set out in the rules of the given event.

Applications to calls and programmes. When you apply to a call or programme run by the Zone, we process your data to assess your application and conduct the call (Article 6(1)(b) GDPR). If the programme is funded from public or EU funds, we also process your data for its settlement, reporting and audit (Article 6(1)(c) GDPR). Details are given in the rules or the information clause of the given call.

Recruitment. When you send an application through the Careers form, we process the data required by the Labour Code to conduct the recruitment (Article 6(1)(c) GDPR in conjunction with Article 22¹ of the Labour Code). We process any additional data you provide, for example in your CV, on the basis of your consent, given by sending it (Article 6(1)(a) GDPR). If you tick the separate consent in the form to take part in future recruitments, we will keep your application for that purpose for 12 months; this consent is voluntary and you can withdraw it at any time. Details are given in the Information clause for job candidates.

Sending the calculator result. When you request the result of the tax-relief calculator as a PDF file, we process your e-mail address and the calculation parameters to provide this service at your request (Article 6(1)(b) GDPR). We calculate the result on the server and send it from our mailbox; we do not store the parameters on the website. A copy of the request (e-mail address, a summary of the result and information about the marketing consent) goes to our team in the Zone’s mailbox.

Newsletter and information about the Zone’s offer. We send them only if you sign up or tick a separate, voluntary consent in a form. The legal basis is your consent (Article 6(1)(a) GDPR and Article 398 of the Electronic Communications Law of 12 July 2024). Consent is not a condition for handling the matter you contact us about. You can withdraw it at any time: using the link in every message containing the newsletter, or by writing to iod@sse.lodz.pl. Withdrawing consent does not affect the lawfulness of messages sent before the withdrawal.

Statistics and improving the website. We run statistics tools (Google Analytics 4) only after you consent to analytics cookies (Article 399(1) of the Electronic Communications Law and Article 6(1)(a) GDPR). Without your consent, we do not measure your activity on the website. Our legitimate interest does not replace this consent.

Security and operation of the website. Server logs (IP address, time, page address, browser data) and anti-abuse mechanisms (a hidden form field and a limit on the number of submissions from one IP address) work regardless of consent, on the basis of our legitimate interest, which is ensuring the security and proper operation of the website and detecting abuse (Article 6(1)(f) GDPR).

Marketing and ad measurement. We run advertising tools (Google Ads, LinkedIn, Meta) only after you consent to marketing cookies (Article 399(1) of the Electronic Communications Law and Article 6(1)(a) GDPR). They are used to check whether our ads lead to visits and enquiries, and to target ads at people who have visited the website. When you submit a form after giving this consent, the website’s server sends Meta and LinkedIn information about the submission, without its content, together with the identifiers from those services’ cookies, and to Meta also your IP address and browser data. If you also select “Advanced matching” in the consent panel, we add your hashed e-mail address, and for Meta also your hashed phone number, first name and surname. This lets those services establish which ad led to the submission.

Videos from external services. We load YouTube videos only after you consent to external media (Article 399(1) of the Electronic Communications Law and Article 6(1)(a) GDPR), because the player connects your browser to Google’s servers.

Demonstrating that consent was given. We keep proof of your consent to the newsletter and to information about the offer (date, source and wording of the consent, IP address at the time of sign-up), because the law requires us to demonstrate that the consent was valid (Article 6(1)(c) GDPR in conjunction with Article 7(1) GDPR). We record your cookie decision (date, selected categories, panel version) in a cookie on your device.

Establishing, pursuing and defending claims. If a dispute arises, we process your data on the basis of our legitimate interest (Article 6(1)(f) GDPR).

5. Cookies and the consent panel

Cookies are small files that the website stores in your browser. We also use a similar technology: pixels. We divide them into categories, the same as in the consent panel:

• Necessary: needed for the website to work and to remember your consent decision. They work without consent (Article 399(3) of the Electronic Communications Law) and cannot be switched off.
• Analytics: let us measure how the website is used (Google Analytics 4).
• Marketing: let us measure how effective our ads are and target them at people who have visited the website (Google Ads, LinkedIn Insight Tag, Meta Pixel). When you submit a form, we send these services information about the submission, without its content.
• Advanced matching (an additional option in the Marketing category): we send Meta and LinkedIn hashed data from the submitted form, that is your e-mail address, and to Meta also your phone number, first name and surname.
• External media: let us display YouTube videos embedded in the website. We load the player from the youtube-nocookie.com domain.

We run cookies and tools outside the Necessary category only after you consent. In the panel they are switched off by default. Not consenting does not limit your access to the website’s content or to the forms; YouTube videos are displayed once you consent to external media. Until then, you see information about the required consent in place of the video.

The consent panel is part of the website; we do not use an external panel provider. The panel appears on your first visit and lets you allow all categories, reject all except the necessary ones, or save your own selection. Your decision, together with the date you made it and the panel version, is stored in the lsse-www_consent cookie on this device for 6 months. After that time we will ask you again; we will also ask you earlier if we change the scope of the tools described in the panel. We do not store your decision on our servers.

You can change or withdraw your consent at any time: click “Privacy and cookie settings” in the website footer. Once you withdraw consent, the tools covered by it stop running, and the website deletes the cookies those tools stored in its domain (listed in the table below). Cookies that providers stored in their own domains, for example the remaining LinkedIn cookies, stay in your browser until they expire or until you delete them in your browser settings. Withdrawing consent does not affect the lawfulness of processing before the withdrawal.

Cookies stored in the website’s domain:

You can also set your browser to block cookies or to notify you when they are stored. Some website features may then work differently.

6. Which tools we use and who we share data with

We do not sell your data. We use the services of providers who process data on our instructions under a data processing agreement, and the tools of providers who decide for themselves, to some extent, how they use the data (in that case their privacy policy also applies). Below are the tools used on the website.

Website hosting (Vercel)

• Provider: Vercel Inc., United States. The application runs on servers in the Frankfurt region (European Union); ready pages and files are delivered by a worldwide network of intermediary servers, including in Europe
• What we use it for: Keeping the website running, handling form submissions, server logs; storing the investment areas map tiles that your browser downloads, and backups of the website’s content
• What data the provider receives: IP address, time, page address, browser data; the content of forms at the time of submission
• Provider’s role and when it runs: Processor under the data processing agreement in the service terms; always

Content management system (Sanity)

• Provider: Sanity AS, Oslo, Norway. Data stored in a Google Cloud data centre in Belgium (European Union)
• What we use it for: Storing the website’s content and images; your browser downloads images from the provider’s servers; the website search processes the text of the query you type
• What data the provider receives: IP address and browser data when images are downloaded; the text of search queries
• Provider’s role and when it runs: Processor under the data processing agreement in the service terms; always

E-mail and documents (Microsoft 365)

• Provider: Microsoft Ireland Operations Limited, Ireland
• What we use it for: Messages from the forms go to the Zone’s staff mailboxes in Microsoft 365; that is where we handle correspondence and keep submissions; from the same service we send confirmations of receipt and the calculator result as a PDF file
• What data the provider receives: The content of forms and correspondence; e-mail address and calculation parameters when the PDF is sent
• Provider’s role and when it runs: Processor; with every submission and e-mail

Newsletter (GetResponse)

• Provider: GetResponse S.A., al. Grunwaldzka 413, 80-309 Gdańsk
• What we use it for: Newsletter sign-up with e-mail confirmation, sending messages, recording marketing consents from forms
• What data the provider receives: E-mail address, date, source and wording of the consent, IP address at the time of sign-up, confirmation, open and click statistics
• Provider’s role and when it runs: Processor; after you sign up or tick the consent

Google Tag Manager

• Provider: Google Ireland Limited, Ireland
• What we use it for: Managing the scripts of the analytics and advertising tools; it does not store cookies itself
• What data the provider receives: IP address and browser data in the logs when the container is downloaded
• Provider’s role and when it runs: Independent controller for its own logs; after you consent to analytics or marketing cookies (Consent Mode)

Google Analytics 4

• Provider: Google Ireland Limited, Ireland
• What we use it for: Number of visits, traffic sources, pages viewed, devices
• What data the provider receives: Events on the website, approximate location, device data, the identifier in the _ga cookies. Google does not log or store the IP addresses of users in the European Union: the IP address is used only to determine the approximate location on servers in the EU and is discarded immediately
• Provider’s role and when it runs: Processor (measurement) and independent controller for its own services; after you consent to analytics cookies

Google Ads

• Provider: Google Ireland Limited, Ireland
• What we use it for: Measuring whether Google ads lead to visits and enquiries; targeting ads at people who have visited the website
• What data the provider receives: The address of the page visited, events (e.g. a form submission), ad click identifiers in cookies
• Provider’s role and when it runs: Independent controller under Google’s terms; after you consent to marketing cookies

LinkedIn Insight Tag and Conversions API

• Provider: LinkedIn Ireland Unlimited Company, Ireland
• What we use it for: Measuring the effectiveness of ads on LinkedIn and targeting ads at people who have visited the website
• What data the provider receives: The address of the page visited, technical browser data, the IP address, which LinkedIn truncates or hashes; LinkedIn deletes direct identifiers within 7 days and the remaining pseudonymous data within 180 days. After a form is submitted, the website’s server sends information about the submission and the click identifier from the li_fat_id cookie, and, if you consented to advanced matching, also your hashed e-mail address
• Provider’s role and when it runs: Independent controller under LinkedIn’s terms; after you consent to marketing cookies

Meta Pixel and Conversions API

• Provider: Meta Platforms Ireland Limited, Ireland
• What we use it for: Measuring whether ads on Facebook and Instagram lead to visits and enquiries; targeting ads
• What data the provider receives: Pages visited, events, technical browser data, identifiers in the _fbp and _fbc cookies; if you have a Meta account, Meta may link this data to your account. After a form is submitted, the website’s server sends information about the submission, the IP address and browser data, and, if you consented to advanced matching, also your hashed e-mail address, phone number, first name and surname
• Provider’s role and when it runs: Joint controller for the collection and transmission of data by the pixel; after you consent to marketing cookies

YouTube

• Provider: Google Ireland Limited, Ireland
• What we use it for: Displaying videos embedded in the website
• What data the provider receives: Once the player has loaded: IP address, browser data, playback information, YouTube’s own cookies
• Provider’s role and when it runs: Independent controller; after you consent to external media. Until then, you see information about the required consent in place of the video

Website developer and technical maintainer

• Provider: Kryptonum sp. z o.o., ul. Żwirki i Wigury 15/9, 02-143 Warszawa
• What we use it for: Maintaining and developing the website; access to the content management system and to form submissions to the extent needed for technical support
• What data the provider receives: Data in the content management system and in the logs, to the extent of maintenance work
• Provider’s role and when it runs: Processor; during maintenance work

We also share data with entities to which we must make it available under the law (for example, audit authorities for programmes funded from public funds), and with the co-organisers and partners of events, if the rules of the given event provide for this.

7. Transfers of data outside the European Economic Area

We store the website’s data in the European Union: the application runs on servers in Frankfurt, content and images are stored in Belgium, the newsletter in Poland, and e-mail in Microsoft 365 in the European Union.

Data may be transferred outside the European Economic Area in two cases. First, when you consent to analytics or marketing cookies: the providers of those tools (Google, Meta, LinkedIn) may also process data in the United States. Second, for the operation of the hosting platform (server logs, technical support), Vercel Inc. may process data in the United States. The transfer is based on the European Commission’s decision of 10 July 2023 finding an adequate level of protection (EU-U.S. Data Privacy Framework). Google LLC, Meta Platforms, Inc., Microsoft Corporation, LinkedIn Corporation and Vercel Inc. have active entries on the list of participants in this framework kept by the U.S. Department of Commerce (as of 14 October 2026). If any provider’s certification lapses, the basis is the standard contractual clauses adopted by the European Commission, with additional safeguards. You can obtain a copy of the safeguards by writing to the Data Protection Officer.

8. How long we keep data

We keep data for as long as it is needed for the purpose for which we collected it. After that we delete or anonymise it.

9. Your rights

The GDPR gives you specific rights over your data. You can exercise them at any time by writing to the Data Protection Officer.

You have the right:

• of access: to check what data we hold about you and to receive a copy of it,
• to rectification: to correct data that has changed or is wrong,
• to erasure: to ask us to delete your data,
• to restriction of processing: to suspend processing while the matter is being clarified,
• to data portability: to receive the data you provided to us in a format you can take elsewhere,
• to object: to object to processing based on our legitimate interest, on grounds relating to your particular situation,
• to withdraw consent: at any time, without affecting the lawfulness of processing before the withdrawal.

We respond to every request within one month. If the matter is complex and we need more time, we will let you know.

10. Complaint to the President of the UODO

If you believe that we process your data unlawfully, you can lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stanisława Moniuszki 1A, 00-014 Warszawa, uodo.gov.pl  (opens in a new tab or window). Before you do, write to us. We usually clear things up faster.

11. Do you have to provide your data

Providing your data is voluntary. However, without the data marked with an asterisk we cannot handle your submission or sign you up for an event or the newsletter. Marketing consents are separate and voluntary; not giving them does not affect how we handle your matter.

We do not make decisions about you based solely on automated processing, including profiling, that would produce legal effects concerning you or similarly significantly affect you.

12. Changes to this policy

We change this policy when the law, the tools used on the website or the scope of our services change. The version published on the website, dated at the top of the document, applies. We inform newsletter subscribers of changes that concern them by e-mail.