Loopique Platform Privacy Policy
This Privacy Policy (hereinafter: "Policy") contains information on the processing of your personal data in connection with the use of the "Loopique" platform, operating at the https://www.loopique.com/ website (hereinafter: "Platform").
Any capitalized terms not otherwise defined in the Policy shall have the meaning given to them in the Terms of Service, available at: https://www.loopique.com/legal/terms-of-service.
Table of Contents
- Personal data administrator
- Contact with the Administrator
- Personal data protection measures
- Information on the personal data processed
- Profiling
- Recipients of personal data
- Transfer of personal data to a third country
- Permissions
- Cookies
- Final provisions
Personal data administrator
The administrator of your personal data is LOOPIQUE Spółka z ograniczoną odpowiedzialnością with its registered office in Warsaw (registered office address: Opaczewska 43, 02-201 Warsaw, Poland), entered into the register of entrepreneurs of the National Court Register kept by the District Court for the Capital City of Warsaw in Warsaw, XIII Commercial Division of the National Court Register under KRS number: 0001180478, with NIP: 7011267466, REGON number: 542118696, with a share capital of 5,000 PLN (hereinafter: "Administrator").
Contact with the Administrator
In all matters related to the processing of personal data, you can contact the Administrator via:
a) e-mail - at: contact@loopique.com
Personal data protection measures
The Administrator applies modern organisational and technical safeguards to ensure the best possible protection of your personal data and guarantees that it processes them in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter: "GDPR"), the Act of 10 May 2018 on the Protection of Personal Data and Other Personal Data Protection Regulations.
Information on the personal data processed
The use of the Platform requires the processing of your personal data. Below you will find detailed information about the purposes and legal grounds of processing, as well as the period of processing and the obligation or voluntariness to provide them.
Conclusion and performance of Service Contract for the Buyer
| Purpose of processing | Personal data processed | Legal basis |
|---|---|---|
| Conclusion and performance of Service Contract for the Buyer | 1) name and surname 2) e-mail address 3) phone number 4) optionally - the company and the TIN (if the Buyer is an Entrepreneur or an Entrepreneur with Consumer rights) 5) bank account number 6) other data provided as part of the forms 7) additional information voluntarily provided by the Buyer to the Platform | art. 6 section 1 (b) GDPR (processing is necessary for the performance of a contract with the data subject or to take steps to conclude it) |
Providing the above-mentioned personal data is a condition for concluding and performing the Service Contract for the Buyer to the appropriate extent for the Buyers (providing them is voluntary, but the consequence of not providing them will be the inability to conclude and perform the above-mentioned agreement, including the creation of an Account). The catalogue of processed personal data may vary, depending on the selected application model, but it will always be data within the scope of the above.
The Administrator will process the above-mentioned personal data until the statute of limitations for claims resulting from the Agreements with the Buyer expires.
Conclusion and performance of Service Contract for the Seller
| Purpose of processing | Personal data processed | Legal basis |
|---|---|---|
| Conclusion and performance of Service Contract for the Seller | 1) name and surname 2) e-mail address 3) telephone number 4) TIN 5) relevant ID Number 6) other data provided as part of the forms 7) bank account number 8) additional information voluntarily provided by the User to the Platform | art. 6 section 1 (b) GDPR (processing is necessary for the performance of a contract with the data subject or to take steps to conclude it) |
Providing the above-mentioned personal data is a condition for concluding and performing the Service Contract for the Seller to the appropriate extent for the Sellers (their provision is voluntary, but the consequence of not providing them will be the inability to conclude and perform the above-mentioned agreement, including the creation of an Account).
The Administrator will process the above-mentioned personal data until the statute of limitations for claims under the Agreement expires.
Conclusion and performance of the Newsletter Delivery Agreement
| Purpose of processing | Personal data processed | Legal basis |
|---|---|---|
| Conclusion and performance of the Newsletter Delivery Agreement | 1) name and surname 2) e-mail address | art. 6 section 1 (b) GDPR (processing is necessary for the performance of the Contract for the provision of the Newsletter or Digital Content concluded with the data subject or to take steps to conclude it) and art. 6 section 1 (f) GDPR (processing is necessary for the purpose of the Administrator's legitimate interest, in this case informing about news and promotions available on the Platform) |
Providing the above-mentioned personal data is voluntary, but necessary in order to receive the Newsletter (the consequence of not providing them will be the inability to receive the Newsletter).
The Administrator will process the above-mentioned personal data until the effective objection is raised or the purpose of the processing is achieved, or until the claims under the Newsletter Delivery Agreement expire (whichever occurs first).
Conducting a complaint procedure
| Purpose of processing | Personal data processed | Legal basis |
|---|---|---|
| Conducting a complaint procedure | 1) name and surname 2) e-mail address 3) other data contained in the message to the Administrator | art. 6 section 1 (c) GDPR (processing is necessary for compliance with a legal obligation to which the Administrator is subject, in this case the following obligations: - responding to a complaint – Article 7a of the Consumer Rights Act; - exercising the Customer's rights resulting from the provisions on the Administrator's liability in the event of non-compliance of the Object of Digital Supply with the Contract applicable to it) |
Providing the above-mentioned personal data is a condition for receiving a response to the complaint or exercising the User's rights resulting from the provisions on the Administrator's liability in the event of non-compliance of the Subject of the digital service with the Agreement applicable to it (their provision is voluntary, but the consequence of not providing them will be the inability to receive a response to the complaint and the exercise of the above-mentioned rights).
The Administrator will process the above-mentioned personal data for the duration of the complaint procedure, and in the case of exercising the above-mentioned rights of the User – until their limitation expires.
Conducting a verification procedure and considering appeals against decisions on dealing with unacceptable content
| Purpose of processing | Personal data processed | Legal basis |
|---|---|---|
| Conducting a verification procedure and considering appeals against decisions on dealing with unacceptable content | 1) name and surname/business name 2) contact details, including e-mail address 3) other data contained in the message to the Administrator | art. 6 section 1 (c) GDPR (processing is necessary for compliance with a legal obligation to which the Administrator is subject, in this case the following obligations: - provide a mechanism for reporting inappropriate content (Article 16 of Regulation 2022/2065 on the single market for digital services and amending Directive 2000/31/EC (Digital Services Act) (hereinafter: "DSA"), - handling complaints (Article 20 of the DSA). |
Providing the above-mentioned personal data is a condition for receiving a response to the report or exercising the User's rights under the provisions of the DSA (their provision is voluntary, but the consequence of failure to provide them will be the inability to receive a response to the report and the exercise of the above-mentioned rights).
The Administrator will process the above-mentioned personal data for the duration of the complaint procedure, and in the case of exercising the above-mentioned rights of the User – until their limitation expires.
Handling inquiry submitted by Users
| Purpose of processing | Personal data processed | Legal basis |
|---|---|---|
| Handling inquiry submitted by Users | 1) name 2) e-mail address 3) other data contained in the message to the Administrator | art. 6 section 1 (f) GDPR (processing is necessary for the purpose of pursuing the legitimate interest of the Administrator, in this case responding to the inquiry received) |
Providing the above-mentioned personal data is voluntary, but necessary in order to receive a response to the inquiry (the consequence of failure to provide them will be the inability to receive an answer).
The Administrator will process the above-mentioned personal data until an effective objection is raised or the purpose of processing is achieved (whichever occurs first).
Sharing Service Reviews
| Purpose of processing | Personal data processed | Legal basis |
|---|---|---|
| Sharing Service Reviews | 1) name 2) optionally – other data included in the Review | art. 6 section 1 (f) GDPR (processing is necessary for the purpose of the legitimate interest of the Administrator, in this case making the Review available for information and promotional purposes) |
Providing the above-mentioned personal data is voluntary, but necessary in order to add an Review (the consequence of not providing them will be the inability to add an Review).
The Administrator will process the above-mentioned personal data until an effective objection is raised or the purpose of processing is achieved (whichever occurs first).
Fulfilling tax obligations
| Purpose of processing | Personal data processed | Legal basis |
|---|---|---|
| Fulfilling tax obligations (m.in. issuing a VAT invoice, storing accounting documentation) | 1) name and surname/company 2) address of residence/registered office 3) TIN and other registration data 4) relevant ID number 5) bank account ID 6) sales data (in the case of Sellers) 7) data on the country in which the Seller is a tax resident | art. 6 section 1 (c) GDPR (processing is necessary to comply with a legal obligation to which the Administrator is subject, in this case obligations under tax law) |
Providing the above-mentioned personal data is voluntary, but necessary for the Administrator to meet its tax obligations (the consequence of failure to provide them will be the Administrator's inability to meet the above-mentioned obligations).
The Administrator will process the above-mentioned personal data for a period of 5 years from the end of the year in which the deadline for payment of tax for the previous year expired.
Compliance with obligations related to the protection of personal data
| Purpose of processing | Personal data processed | Legal basis |
|---|---|---|
| Compliance with obligations related to the protection of personal data | 1) name and surname 2) contact details provided by you (e-mail address; correspondence address; telephone number) | art. 6 section 1 (c) GDPR (processing is necessary to comply with a legal obligation to which the Administrator is subject, in this case the obligations resulting from the provisions on the protection of personal data) |
Providing the above-mentioned personal data is voluntary, but necessary for the proper performance by the Administrator of the obligations resulting from the provisions on the protection of personal data, m.in. the exercise of the rights granted to you by the GDPR (the consequence of failure to provide the above-mentioned data will be the inability to properly exercise the above-mentioned rights).
The Administrator will process the above-mentioned personal data until the expiry of the limitation periods for claims for violation of personal data protection regulations.
Establishing, exercising or defending against legal claims
| Purpose of processing | Personal data processed | Legal basis |
|---|---|---|
| Establishing, exercising or defending against legal claims | 1) name and surname/company 2) e-mail address 3) address of residence/registered office 4) relevant ID number 5) TIN | art. 6 section 1 (f) GDPR (processing is necessary for the purpose of pursuing the legitimate interest of the Administrator, in this case establishing, investigating or defending against claims that may arise in connection with the performance of contracts concluded with the Administrator) |
Providing the above-mentioned personal data is voluntary, but necessary in order to establish, pursue or defend against claims that may arise in connection with the performance of contracts concluded with the Administrator (the consequence of failure to provide the above-mentioned data will be the inability of the Administrator to take the above-mentioned actions)
The Administrator will process the above-mentioned personal data until the expiry of the limitation periods for claims that may arise in connection with the performance of contracts concluded with the Administrator.
Analysis of your activity on the Platform
| Purpose of processing | Personal data processed | Legal basis |
|---|---|---|
| Analysis of your activity on the Platform | 1) date and time of the visit 2) IP number of the device 3) device operating system type 4) approximate location 5) type of web browser 6) time spent on the Platform 7) visited subpages and other activities undertaken within the Platform | art. 6 section 1 (f) GDPR (processing is necessary for the purpose of the legitimate interest of the Administrator, in this case obtaining information about your activity within the Platform) |
Providing the above-mentioned personal data is voluntary, but necessary for the Administrator to obtain information about your activity on the Platform (the consequence of failure to provide them will be the Administrator's inability to obtain the above-mentioned information).
The Administrator will process the above-mentioned personal data until an effective objection is raised or the purpose of the processing is achieved.
Platform Administration
| Purpose of processing | Personal data processed | Legal basis |
|---|---|---|
| Platform Administration | 1) IP address 2) server date and time 3) web browser information 4) operating System Information The above data are saved automatically in the so-called server logs, each time the Platform is used (it would not be possible to administer it without the use of server logs and automatic saving). | art. 6 section 1 (f) GDPR (processing is necessary for the purpose of pursuing the legitimate interest of the Administrator, in this case ensuring the proper operation of the Platform) |
Providing the above-mentioned personal data is voluntary, but necessary to ensure the proper operation of the Platform (the consequence of failure to provide them will be the inability to ensure the proper operation of the Platform).
The Administrator will process the above-mentioned personal data until an effective objection is raised or the purpose of the processing is achieved.
Fulfilling DAC7 obligations
| Purpose of processing | Personal data processed | Legal basis |
|---|---|---|
| Fulfilling DAC7 obligations | 1) name and surname/company 2) address of residence/registered office 3) NIP and other registration data 4) Date of birth 5) Bank account ID 6) sales data (in the case of Sellers) 7) data on the country in which the Seller is a tax resident 8) other data required by DAC7 | art. 6 section 1 (c) GDPR (processing is necessary to comply with a legal obligation to which the Administrator is subject, in this case obligations under tax law) |
Providing the above-mentioned personal data is voluntary, but necessary for the Administrator to meet its obligations under the DAC7 directive (the consequence of failure to provide them will be the Administrator's inability to meet the above-mentioned obligations).
The Administrator will process the above-mentioned personal data for a period of 5 years from the end of the year in which the deadline for payment of tax for the previous year expired.
Profiling
In order to create your profile for marketing purposes and direct marketing tailored to your preferences, the Administrator will process your personal data in an automated manner, including profiling them – however, this will not have any legal effects on you or significantly affect your situation in a similar way.
The scope of profiled personal data corresponds to the scope indicated above in relation to the analysis of your activity on the Platform and the data that you save on the Account.
The legal basis for the processing of personal data for the above purpose is Article 6(1)(f) of the GDPR, according to which the Administrator may process personal data in order to pursue its legitimate interest, in this case to conduct marketing activities tailored to the preferences of recipients. Providing the above-mentioned personal data is voluntary, but necessary to achieve the above-mentioned purpose (the consequence of not providing them will be the Administrator's inability to conduct marketing activities tailored to the preferences of recipients).
The Administrator will process personal data for the purpose of profiling them until an effective objection is raised or the purpose of processing is achieved.
Recipients of personal data
The recipients of personal data will be the following external entities cooperating with the Administrator:
a) Railway corporation – hosting company;
b) Vercel Inc. – hosting company;
c) Cloudflare Inc. – hosting company.
d) Cashdirector S.A. – a company providing accounting services;
e) Resend (Plus Five Five, Inc.) – newsletters & email provider;
f) Stripe Inc. – payment processor;
g) Clerk Inc. – user registration and login system support;
h) Turso (CHISELSTRIKE INC.) – database and backups;
i) PostHog Inc. – analytical services for tracking User activity on the Platform;
j) Axiom Inc. – logging and monitoring services;
In addition, personal data may also be transferred to public or private entities, if such an obligation results from generally applicable law, a final court judgment or a final administrative decision.
Transfer of personal data to a third country
In connection with the Administrator's use of the services provided by Google LLC, Meta, Turso, Clerk, Stripe and PostHog your personal data may be transferred to the following third countries: Great Britain, Canada, USA, Chile, Brazil, Israel, Saudi Arabia, Qatar, India, China, South Korea, Japan, Singapore, Taiwan (Republic of China), Indonesia and Australia. The basis for the transfer of data to the above-mentioned third countries are:
-
in the case of the United Kingdom, Canada, Israel and Japan - a decision of the European Commission stating an adequate level of protection of personal data in each of the above-mentioned third countries;
-
for the USA, Chile, Brazil, Saudi Arabia, Qatar, India, China, South Korea, Singapore, Taiwan (Republic of China), Indonesia and Australia, adequacy contractual clauses in line with the standard contractual clauses set out in Commission Implementing Decision (EU) 2021/914 of 4 June 2021 on standard contractual clauses for the transfer of personal data to third countries under Regulation (EU) 2016/679 of the European Parliament and of the Council.
You can obtain from the Administrator a copy of the data transferred to a third country.
Permissions
In connection with the processing of personal data, you have the following rights:
-
the right to be informed what personal data concerning you is processed by the Administrator and to receive a copy of this data (the so-called right of access). Issuing the first copy of the data is free of charge, for subsequent copies the Administrator may charge a fee;
-
if the processed data becomes outdated or incomplete (or otherwise incorrect), you have the right to request its rectification;
-
in certain situations, you can ask the Administrator to delete your personal data, e.g. when: a. the data will no longer be needed by the Administrator for the purposes of which it has informed; b. you have effectively withdrawn your consent to the processing of data - unless the Administrator has the right to process the data on another legal basis; c. the processing is unlawful; d. the need to delete the data results from a legal obligation to which the Administrator is subject;
-
if personal data is processed by the Administrator on the basis of the consent granted to the processing or in order to perform the Agreement concluded with him, you have the right to transfer your data to another administrator;
-
if personal data is processed by the Administrator on the basis of your consent to the processing, you have the right to withdraw this consent at any time (the withdrawal of consent does not affect the lawfulness of the processing that was carried out on the basis of consent before its withdrawal);
-
if you believe that the processed personal data are incorrect, their processing is unlawful, or the Administrator no longer needs certain data, you can request that for a specified period of time (e.g. checking the correctness of the data or pursuing claims) the Administrator does not perform any operations on the data, but only stores them;
-
you have the right to object to the processing of personal data based on the legitimate interest of the Administrator. In the event of an effective objection, the Administrator will cease to process personal data for the above-mentioned purpose;
-
you have the right to lodge a complaint with the President of the Office for Personal Data Protection if you believe that the processing of personal data violates the provisions of the GDPR.
Cookies
-
The Administrator informs that the Platform uses "cookies" installed on your end device. These are small text files that can be read by the Administrator's system, as well as by systems belonging to other entities whose services are used by the Administrator (e.g. Facebook, Google).
-
The Administrator uses cookies for the following purposes: a. ensuring the proper operation of the Platform – thanks to cookies, it is possible for the Platform to operate efficiently, use its functions and conveniently move between individual subpages; b. increasing the comfort of using the Platform – thanks to cookies, it is possible to detect errors on some subpages and constantly improve them; c. creating statistics – cookies are used to analyse the way users of the Platform use the Platform. This makes it possible to constantly improve the Platform and adapt its operation to the preferences of users; d. conducting marketing activities – thanks to cookies, the Administrator can direct advertisements to users tailored to their preferences.
-
Your administrator can place both permanent and temporary (session) files on your device. Session cookies are usually deleted when you close your browser, but closing your browser does not delete persistent cookies.
-
Information about cookies used by the Administrator is displayed in the panel located at the bottom of the website/footer of the Platform. Depending on your decision, you can enable or disable cookies of particular categories (except for necessary cookies) and change these settings at any time.
-
The data collected by means of cookies do not allow the Administrator to identify you.
-
The Administrator uses the following cookies or tools using them:
| Tool | Supplier | Functions and scope of downloaded data | Duration |
|---|---|---|---|
| Strictly necessary cookies | Administrator | The operation of these files is necessary for the proper functioning of the Platform/Platform website, therefore you cannot disable them. Thanks to these files (collecting, m.in, the IP number of your device), it is possible to inform you about cookies operating on the Platform. | Most of the necessary cookies are session cookies, but some remain on your end device for a period of 12 months or until they are deleted; |
| Authentication cookies | Clerk Inc. | Manages user authentication, login sessions, and account security. Collects session identifiers and security tokens. Strictly necessary for the proper functioning of the Platform/Platform website. | Up to 30 days or until logout |
| Facebook Pixel | This tool also allows you to determine that you have opened the Platform, to target you with advertisements displayed on Facebook and Instagram social networks and to measure their effectiveness. | up to 3 months or until they are removed (whichever comes first) | |
| PostHog Analytics | Posthog Inc. | Analyzes user behavior on the Platform, tracks page views, user interactions, and Platform usage patterns for improvement purposes | up to 12 months or until they are removed (whichever comes first) |
- Through most commonly used browsers, you can check whether cookies have been installed on your end device, as well as delete installed cookies and block their installation in the future by the Platform. However, disabling or limiting the use of cookies may cause quite serious difficulties in using the Platform, e.g. in the form of the need to log in on each subpage, longer loading period of the Platform, restrictions in the use of certain functionalities.
Final provisions
To the extent not regulated by the Policy, the generally applicable provisions on the protection of personal data shall apply.
The policy is effective from 6th October 2025.