SECURITY OF PERSONAL DATA

The Administrator makes every effort to ensure that personal data are properly secured. We do not sell, rent, license or lend personal data to anyone. Personal data may be disclosed only to: (a) entities that process data on our behalf (data processors and service providers listed in the section “Recipients of personal data”), on the basis of data processing agreements; (b) our clients, where we process data on their behalf; (c) authorised public authorities, where we are legally required to do so. Every person authorised by SEMIDEA Sp. z o.o. to process personal data is bound by confidentiality. The Administrator applies appropriate technical and organisational measures, including encrypted connections (HTTPS/TLS), restricted and role-based access, and secure storage of access credentials.

DATA OBTAINED FROM META PLATFORMS (FACEBOOK, INSTAGRAM)

SEMIDEA Sp. z o.o. operates the application “APP Semidea.pl” (Meta App ID: 1206740204615615), which connects to Meta Platforms (Facebook, Instagram) through Facebook Login for Business and the Meta Marketing API. We use the application solely to provide digital marketing services to our clients – managing and optimising advertising campaigns, reporting and analytics, and automating marketing processes. SEMIDEA Sp. z o.o. is responsible for the data (“Platform Data”) we receive from Meta. Where we process data on behalf of a client, we do so under an agreement with that client.

What data we receive from Meta

  • Basic public profile data of the person who logs in or grants access: name, Meta user ID, profile picture (public_profile permission);
  • Access tokens issued by Meta, enabling the application to act within the scope of permissions granted;
  • Data on business assets to which access has been granted: ad accounts, Facebook Pages, Instagram accounts, campaigns, ad sets and ads, together with their settings, budgets, spend and aggregated performance statistics;
  • [Only if used:] Leads submitted through Meta Lead Ads forms (e.g. name, e-mail address, telephone number and answers to form questions), where our client has authorised us to transfer them to the client’s systems.

Purposes and legal basis

  • authenticating users of the application – Art. 6(1)(b) GDPR (performance of a contract);
  • creating, managing and optimising our clients’ advertising campaigns – Art. 6(1)(b) GDPR;
  • preparing reports and analytics for our clients, using aggregated data – Art. 6(1)(b) and (f) GDPR;
  • [Only if used:] delivering leads to our clients’ CRM or e-mail systems – on behalf of and on the instructions of the client, who is the controller of that data;
  • ensuring the security of the application and defending against claims – Art. 6(1)(f) GDPR (legitimate interest).

What we do not do with Platform Data

We do not sell, license or purchase Platform Data; we do not use it to discriminate against people, to make eligibility decisions (e.g. about credit, housing, employment or insurance) or for surveillance; we do not use it to build or enrich user profiles for third parties; and we do not share it with anyone other than the recipients listed below. We process Platform Data in accordance with the Meta Platform Terms and Meta Developer Policies.

Recipients of personal data (data processors and service providers)

  • Hostinger International Ltd. – hosting of servers and applications (data centres in the EU: Lithuania, Netherlands);
  • ADRIAN ZAJĄC sdc.pl – IT, analytics and advertising support (Poland);
  • Vercel Inc. – hosting of web applications (United States);
  • Google Cloud Poland Sp. z o.o. / Google – cloud infrastructure and data processing (Poland, United States).

Data may also be made available to the client on whose behalf we manage a given advertising account.

Transfers outside the European Economic Area

Some of our service providers (Vercel Inc., Google) may process data in the United States. In such cases, transfers are based on the EU–US Data Privacy Framework (where the recipient is certified) and/or Standard Contractual Clauses approved by the European Commission (Art. 46(2)(c) GDPR). You may obtain a copy of the applicable safeguards by contacting us at bok@semidea.pl.

Retention period

  • Access tokens – until access is revoked in Meta or until our cooperation with the client ends, whichever comes first;
  • Campaign data and statistics – for the duration of cooperation with the client and up to [12 months] after it ends, for reporting and settlement purposes;
  • [Only if used:] Leads – only as long as necessary to deliver them to the client, no longer than [30 days];
  • Data may be retained longer only where required by law or necessary to establish, pursue or defend claims.

How to request deletion of your data (Data Deletion Instructions)

You can at any time remove the access of “APP Semidea.pl” to your data and request that we delete the data we have received from Meta:

  1. Remove the application in Facebook: go to Settings & privacy → Settings → Business integrations (or Apps and websites), find “APP Semidea.pl” and click Remove. This immediately revokes the application’s access to your data. If access was granted at business level, you can also remove it in Meta Business Suite → Settings → Integrations / Partners.
  2. Request deletion of data already received: send an e-mail to bok@semidea.pl with the subject “Meta data deletion request”, giving your name and, if possible, the Facebook account or ad account concerned.

We will delete the data within 30 days of receiving the request and confirm the deletion by e-mail, unless we are legally obliged to retain certain data (in which case we will inform you).