PRIVACY POLICY

Covers the website, subdomains, app, marketplace, B2B, Social, AI, advertising and partner services of Eight Gate.

Version 1.2
Effective date: 1 October 2026
If a feature is made available earlier, the relevant provisions apply from the date it is made available.

1. About this Policy

This Policy explains how Eight Gate processes personal data across the Eight Gate ecosystem. It covers eightgate.pl, subdomains, user and business panels, the mobile app, and the Commerce / EightGate Select, B2B and dropshipping, Real Estate, Automotive, Travel, Business & Banking, Insurance, Trading & Investments, Social, AI, advertising, security and analytics modules.

Features may be released in stages. If a particular feature has not yet been activated for a user, processing described solely for that feature does not occur until activation. The Policy is drafted for the target scope of services planned for the ecosystem launch. From 1 October 2026 the following are available: the Account, the Shop (Commerce) including reviews, and B2B/dropshipping sales – for the Polish market only. The other modules described in this Policy and sales to the United Kingdom are not yet provided; processing described solely for them will begin only once they are launched.

Eight Gate is the single controller for its own services. In certain processes, other entities — such as a bank, insurer, payment provider, broker, travel provider or another partner — may act as independent controllers. In that case, the user receives their own privacy information when entering their service.

1.1 Legal framework and purpose of this Policy

This Policy is intended, in particular, to fulfil the transparency and information duties under Articles 12–14 GDPR. It does not replace the Platform Terms or the controller’s internal data-protection documentation. Each legal instrument applies only to the extent that a given Eight Gate feature, role or processing activity falls within its scope.

• GDPR: Regulation (EU) 2016/679 of 27 April 2016, in particular Articles 5–7, 12–14, 15–22, 25, 28, 30, 32–35, 37 and 44–49.
• UK GDPR: the United Kingdom data-protection regime, including the UK GDPR and the Data Protection Act 2018, to the extent Eight Gate offers goods to individuals in the United Kingdom. For this scope Eight Gate designates a UK representative under Article 27 UK GDPR.
• Polish Personal Data Protection Act: Act of 10 May 2018 on the Protection of Personal Data (Journal of Laws 2018 item 1000, as amended), including the national supervisory framework and the President of the Personal Data Protection Office.
• Polish Electronic Communications Law: Act of 12 July 2024 – Electronic Communications Law (Journal of Laws 2024 item 1221), in particular Article 398 on commercial communications/direct marketing and Article 399 on cookies and access to information stored on terminal equipment.
• Polish Act on Providing Services by Electronic Means: Act of 18 July 2002 on Providing Services by Electronic Means (consolidated text announced in Journal of Laws 2024 item 1513), including Article 5 and other rules applicable to electronically supplied services.
• Digital Services Act: Regulation (EU) 2022/2065, in particular Article 26 on advertising transparency, Article 27 on recommender-system transparency and Article 28 on protection of minors.
• AI Act: Regulation (EU) 2024/1689 on artificial intelligence, in particular Article 50 where applicable, together with the Polish Act of 3 July 2026 on Artificial Intelligence Systems (Journal of Laws 2026 item 1003), insofar as applicable to Eight Gate.
• Polish Consumer Rights Act: Act of 30 May 2014 on Consumer Rights, as amended, insofar as it governs distance sales, consumer communications, complaints and information duties.
• Accounting and tax rules: Polish Accounting Act of 29 September 1994, including Article 74, and the Polish Tax Ordinance Act of 29 August 1997, including Article 70, for mandatory documentation retention and tax-related limitation periods.

If any of the above legal instruments is amended or replaced, references in this Policy are to be read as references to the then-current provisions or their successor rules, provided that this does not reduce users’ statutory rights.

2. Controller and contact

Legal reference: Articles 12–14 GDPR (transparency and information duties).

For questions about personal data, data-subject rights or this Policy, contact privacy@eightgate.pl. If a Data Protection Officer is appointed or required in the future, the relevant contact details will be made available as required by law.

2.1 United Kingdom representative (UK GDPR)

Eight Gate is established in Poland. To the extent Eight Gate targets the sale of goods through Commerce / the marketplace to individuals in the United Kingdom, the UK GDPR may apply to the relevant processing operations.

Eight Gate's representative in the United Kingdom under Article 27 UK GDPR is BARON'S WHOLESALE PLATFORM LIMITED, Company No. 16217441, at 318 Wood Green Hall Of Residence, Brabant Road, London, England, N22 6UZ. The representative is designated in writing to act in matters relating to Eight Gate's UK GDPR compliance and to liaise with the Information Commissioner's Office (ICO) and data subjects.

The UK-targeted scope is limited to purchases through Commerce / the marketplace. Social, Real Estate, Automotive and the other Platform modules are not directed to the UK market unless Eight Gate expressly makes them available there in the future.

Individuals in the UK may contact the representative at the postal address above or contact Eight Gate directly at privacy@eightgate.pl. Using one route does not restrict the right to use the other.

3. Core privacy principles

Legal reference: Article 5 GDPR (processing principles) and Article 25 GDPR (data protection by design and by default).

• we collect data that is proportionate to a defined purpose and do not use it incompatibly with that purpose;
• we distinguish data needed to provide the service from optional analytics, advertising and marketing;
• we do not sell user databases to advertisers or partners;
• Travel, Banking, Insurance and Trading partners generally receive user data only when the user enters the partner service and provides the data directly;
• private messages are not used for ad targeting or commercial cross-sell;
• special-category data is not used for advertising profiling;
• we do not show profiling-based ads to users whom we know with reasonable certainty are minors;
• higher-risk processing is subject to appropriate risk assessment, access controls and security safeguards.

4. Categories of data

• account data: name, surname, email, phone number, protected password, date of birth and optionally country/address;
• profile data: username, photo, bio, location/city, visibility choices and business-profile data;
• transaction and delivery data: orders, products, amounts, delivery addresses, recipient details, order notes, returns and complaints;
• B2B data: company name, tax and registry numbers, address, representatives, company users and integration details;
• listing data: descriptions, price, location, property/vehicle details, optional VIN, photos, videos, maps, plans and uploaded documents;
• activity and preferences: searches, alerts, favourites, basket, viewed categories, reactions, followed profiles and recommendation signals;
• Social content: posts, comments, photos, videos, groups, events, reactions, reports and — as required for the feature — private messages;
• location data: precise GPS location where the user grants device permission; we do not maintain a persistent history of precise GPS location;
• security and technical data: active-session information, device type, security events, blocks, reports, session identifiers and, in limited cases, IP data processed temporarily by security/infrastructure layers;
• analytics and advertising data: pseudonymous identifiers, browser/device, conversion and usage data, subject to consent settings;
• data supplied by other people: e.g. gift/shipping recipient details, or end-customer delivery data supplied by a B2B store.

Do not place sensitive information — such as health data, political or religious views, sexual-life information or identity-document data — in free-text fields such as order notes unless it is strictly necessary for the requested service.

5. Sources of data

• directly from the user when registering, purchasing, posting, listing or contacting Eight Gate;
• from a company-account administrator who creates or manages staff access;
• from a B2B client when it supplies the details of an end customer solely for order fulfilment;
• from payment providers and affiliate partners, generally as technical status/conversion information rather than full financial data;
• from public business registers if automated business verification is used;
• from the device/browser where technically necessary or covered by an applicable consent.

6. Purposes and legal bases

Where processing relies on legitimate interests, the user may object on grounds relating to their particular situation. An objection to direct marketing, including related profiling, is absolute.

7. Eight Gate account and sign-in

The core registration data are name, surname, email, phone number, password and date of birth. Address and country may be optional unless needed for a specific feature. Email is verified. Phone number is required at registration but does not have to be SMS-verified unless an additional security control is introduced.

Users may sign in through selected external identity providers. We receive only the data authorised by the user and made available by the provider.

One Eight Gate account is used across multiple modules. Users may view and terminate active sessions. In case of suspected account takeover, Eight Gate may invalidate a session, require a new sign-in or request additional verification.

8. Age rules

Legal reference: Article 8 GDPR where child consent for information-society services is relevant, and Article 28 DSA for online protection of minors.

Most transactional and legally restricted services are intended for users aged 18+. Social may be available from age 16. Users aged 16–17 may browse public offers and content but may not use features reserved by law or the Terms for adults.

Date of birth is declared during registration. If there are reasonable doubts about age, access may be restricted pending clarification. Adult-level access may be enabled automatically when the user turns 18.

Profiling-based advertising is disabled for minors. Additional privacy and safety measures may apply, and public indexing or profile visibility may be restricted where required by law or platform safety rules.

9. Commerce / EightGate Select

Eight Gate is the seller to the consumer. A supplier or wholesaler may ship directly to the customer on Eight Gate’s behalf. Guest checkout is available.

For customers in the United Kingdom, Eight Gate targets only the Commerce / marketplace purchasing function to that market; the other Platform modules are not directed to the UK.

We process recipient and delivery information, product and payment information and order notes. Users may voluntarily save one or more delivery addresses and may provide another recipient’s details for a gift or shipment.

Delivery data may be shared with the wholesaler, supplier and logistics provider to the extent necessary for delivery. Depending on the process, this can include recipient name, address, email and phone number. Some suppliers may be outside the EEA, including China; see section 27.

The Platform may offer favourites, wishlist, saved basket, price/availability alerts, purchase history, reviews and loyalty benefits. Eight Gate does not operate a cash wallet or hold user funds.

10. Payments and sales documents

Payments are handled by external payment providers. Eight Gate does not store full card numbers or CVV codes and does not save cards for future use. Payment providers may act as independent controllers for regulatory, payment and anti-fraud purposes.

Eight Gate receives technical information needed to confirm and account for payments and may display payment/order history. Refunds are reviewed and approved before execution.

Sales documents are generated in accordance with law and sent by email. Invoice data are not automatically saved as a permanent billing profile. Accounting records are retained for statutory periods even after account deletion.

11. B2B and dropshipping

B2B accounts are for registered businesses. We may process company name, tax/registry identifiers, address, representatives, contact persons, company users and integration details. We verify the business and authority to represent it and may request documents or authorisation where justified.

A company account may have multiple users with role-based permissions managed by the company administrator. Eight Gate may internally analyse transaction volume, order frequency, product popularity and related metrics to operate and develop B2B services.

Where a B2B store sends us an end customer’s delivery data, we primarily use it to fulfil the specific order and provide it to the relevant supplier. Depending on the processing step, Eight Gate may act as a processor for the store or as an independent controller for its own legal/security obligations.

If you receive a parcel from another online store using Eight Gate B2B infrastructure, that store may be the source of your data. The data scope is limited to what is needed for fulfilment.

12. Real Estate

Real Estate supports private and professional advertisers, including agents, agencies, developers and property managers. The advertiser selects which contact details are public and may use internal messaging instead of displaying phone/email.

Listings may contain a full or approximate address, photos, videos, floor plans, maps and documents. Uploaded files may be processed to remove metadata, validate file types and detect malicious content.

Users may save offers and searches, set alerts and receive recommendations. Eight Gate does not provide a permanent user-facing history of every property viewed, but may process limited behavioural events such as repeat interest, budget, location and search criteria for recommendation and analytics purposes.

13. Automotive

Automotive supports private sellers, dealers, fleets and leasing companies. Users control the visibility of their contact details and vehicle location; business details may be published where required or selected.

VIN is optional. If the user chooses a vehicle-history service, VIN and necessary technical data may be sent to the relevant partner. Eight Gate may receive a conversion signal for affiliate settlement.

The Platform may use make/model, budget, vehicle type, location and behavioural signals to suggest finance, insurance, VIN reports, inspections, assistance, parts, tyres, service and related offers. A permanent user-facing history of viewed vehicles is not maintained.

14. Travel

Eight Gate acts as a search and affiliate layer. It does not take payment for flights/hotels/travel services and does not collect passenger or travel-document data required for booking. Booking takes place directly with the partner.

Search parameters such as destination, dates, party size, budget, airport, hotel standard and preferences may be processed. Saved alerts/trip plans are kept for the user-selected period and normally no longer than 60 days without renewed activity.

Partners may return technical affiliate conversion data such as anonymous ID, product type, value, status and date. Eight Gate does not receive passenger data for booking fulfilment.

15. Banking & Finance

Banking & Finance displays partner offers, comparisons, widgets and affiliate links. Eight Gate does not accept credit applications, conduct KYC/AML for partner products, or collect personal identifiers, income/employment data or other data used by a bank for credit assessment.

Parameters such as amount, term or financing purpose may be processed transiently in a session only to sort offers and are not saved as a financial application. The user supplies application data directly to the partner.

Eight Gate may receive technical conversion data needed to calculate affiliate remuneration. We do not store a credit decision as part of the user profile and do not decide whether finance is granted.

16. Insurance

Insurance operates on an affiliate basis. Eight Gate does not collect health information or the data required by an insurer to calculate a premium. Users provide such data directly to the partner.

Context from Eight Gate modules may be used to display an appropriate category of insurance, such as vehicle, property or travel insurance. The partner may return product type, status, value or commission in accordance with the affiliate agreement. Refusal information is not stored as a user-profile characteristic.

17. Trading & Investments

Trading & Investments is informational, educational and affiliate-based. Eight Gate does not open investment accounts, conduct KYC, collect wealth/experience information or perform appropriateness tests.

We may show brokers, account types, tools, market rankings and educational content. AI is not intended to issue personalised instructions to buy or sell a specific financial instrument. Onboarding, KYC, appropriateness and contracting are performed by the licensed partner.

A partner may return affiliate data necessary for settlement, including commission amount or activation status. Eight Gate does not store this as the user’s investment history.

18. Social

Social runs in a separate technical environment based on an external community system but remains part of Eight Gate services under the same controller. Social access is linked to the Eight Gate account through single sign-on/account synchronisation and the minimum profile information required for access is synchronised.

Users may post text, comments, photos, videos, polls and links, join or create groups/events, follow profiles, react, use 1:1 and group messaging and, if enabled, live streaming.

Social profiles are configurable. Users decide whether to show a real name or username, profile photo, bio, location and contact data and whether content is public, logged-in-only, follower-only or otherwise restricted. Public content may be indexed by search engines unless privacy settings or law require otherwise.

Private messages are intended for conversation participants and are not used for advertising or commercial recommendations. Eight Gate does not routinely read them. If a message or conversation is reported, the content needed to assess the report may be made available to moderators. We do not claim end-to-end encryption unless it is actually implemented for a specific version of the feature.

Users can block accounts and report profiles, posts, comments, groups, messages and other content. Reported content can be auto-hidden pending moderation. Significant permanent account action can be reviewed by a human and appealed.

After account deletion, some public contributions may remain detached from the profile, e.g. under “Deleted user”, where needed for discussion continuity, rights of other users or legal claims, subject to GDPR rights.

19. AI, recommender systems and profiling

Legal reference: Article 4(4), Articles 21–22 GDPR; Article 27 DSA; Article 50 AI Act, as applicable to the relevant feature.

AI is an integral Eight Gate feature. It may use searches, favourites, alerts, basket activity, purchases, viewed categories, Social reactions/follows, location shared by the user and cross-module activity to understand current intent and suggest a next step.

Temporary interest categories may be created. They are not retained indefinitely and generally expire 30–180 days after the last meaningful signal, depending on the decision cycle; shorter periods are used for short-term intent such as travel and longer periods for property or vehicle decisions.

Public posts and comments may be analysed for content recommendations, interest detection and safety. Special-category data revealed in content is not used for ad targeting. Private messages are excluded from commercial profiling.

Recommendations may appear in the AI agent in real time. Users can close suggestions, use neutral sorting where available and exercise GDPR objection rights where applicable. The main recommender parameters are explained in plain language in the interface or relevant terms.

AI conversations are not persistently stored by Eight Gate after the session. They may influence recommendations within the current session. External model providers receive only the minimum context necessary and, by design, no direct identifiers such as name, email, phone or address unless a user intentionally requests an operation requiring specific context and law permits it.

We do not use identifiable AI-chat content to train external models. Eight Gate systems may be improved using anonymous, aggregated or appropriately minimised data. AI does not set a personalised base price; personalised discounts or coupons may be offered where lawful.

20. Advertising, sponsorship and affiliate activity

Legal reference: Article 26 DSA, including the restriction on profiling-based ads using special-category data; Article 28(2) DSA for minors; Article 9 GDPR for special categories of data.

Eight Gate may display its own advertising, programmatic ads, sponsored results and partner offers. Paid content is labelled so users can identify its commercial nature, e.g. “Advertisement”, “Sponsored” or “Partner”.

For adult users, ads may be tailored to non-sensitive interests and activity where the processing and tracking technology have an appropriate legal basis. We do not create advertising segments from health, religion, political views, sexual orientation or other special-category data, and private messages are not used for targeting.

Advertisers do not receive lists of individual users merely because users are in an Eight Gate segment. They may receive aggregate performance reports. A click on an affiliate/ad link may pass a technical click ID/subID needed for attribution.

Profiling-based ads are disabled for users aged 16–17. Contextual ads may be shown where lawful and age-appropriate.

21. Marketing communications

Legal reference: Article 6(1)(a), Article 7 and Article 21(2)–(3) GDPR; Article 398 of the Polish Electronic Communications Law.

Eight Gate may use email, SMS, push notifications and messaging services such as WhatsApp for marketing. Telephone marketing is not planned. Marketing permissions are voluntary, are not a condition of account creation and are not pre-ticked.

Preferences are managed by communication channel. Consent can be withdrawn at any time through settings, an unsubscribe link, STOP function, device settings or contact with Eight Gate. Withdrawal does not affect the lawfulness of earlier processing.

Contractual and security messages — such as email verification, password reset, order confirmation, shipment status and security alerts — are not marketing and may be sent regardless of marketing choices.

User-activated price/availability/real-estate/vehicle/travel alerts are a requested service. Promotional additions require a separate legal basis. Partners do not receive user contact databases for their own marketing.

22. Location

With device permission, the app may use precise GPS location, including in the background, for nearby offers/services, airports, Social events, local recommendations, geofencing and safety features. Core Platform use remains possible after location permission is denied, although local features may be unavailable.

Eight Gate does not maintain a persistent history of precise GPS location. Location is processed transiently for the requested function. Users can disable access at any time in device settings.

23. Cookies and similar technologies

Legal reference: Article 399 of the Polish Electronic Communications Law and, where personal data are processed, the applicable GDPR provisions, including Articles 6 and 7.

Eight Gate uses cookies and similar technologies. Some are strictly necessary; others are activated only after the required consent. Users can choose “Accept all”, “Reject optional” or “Customise” and later change their choice.

Session cookies expire at session end or logout unless a function requires otherwise. Pseudonymous analytics cookies may remain according to the tool configuration, generally no longer than 24 months, while session-replay recordings are generally retained for around 30 days. The consent panel contains the current list of technologies, vendors and retention settings.

24. Security, moderation and abuse prevention

Legal reference: Articles 25 and 32–35 GDPR; where applicable, the relevant Digital Services Act obligations for online platforms.

We use technical and organisational measures proportionate to risk, including access control, appropriate encryption, network protection, anti-bot mechanisms, file validation, backups, security monitoring and penetration testing. We do not publish details that could weaken those controls.

The system may analyse unusual sign-in attempts, devices, user reports, chargebacks, suspicious listings, spam and related signals. An internal risk level may be created and can trigger temporary re-authentication, payment blocking, listing hiding, messaging restrictions or account suspension.

Permanent account deletion or another action with significant effects is not intended to be made solely by an algorithm without the possibility of human review. Users can appeal significant moderation/security decisions.

Uploaded files may be malware-scanned, converted and stripped of metadata such as EXIF. Social content and listings may be moderated automatically and manually. Private messages are not routinely content-scanned; moderators may access content supplied as part of a user report.

25. Recipients of data

Legal reference: Article 13(1)(e), Article 14(1)(e) and Article 28 GDPR.

We do not publish a fixed list of every vendor because the infrastructure can change. Data may be provided, only as necessary, to the following categories:

• hosting, cloud, CDN, WAF, file-storage and backup providers;
• software, email, communications, Social, AI, analytics and monitoring providers;
• payment providers and payment-related financial service providers;
• wholesalers, manufacturers, suppliers and couriers fulfilling orders;
• accountants, auditors, lawyers, tax advisers and insurers;
• affiliate and advertising partners for technical attribution identifiers/conversion data or data the user provides directly to the partner;
• public authorities, courts, police, prosecutors, tax and supervisory authorities where required by law;
• parties involved in financing, due diligence, reorganisation, merger or sale of the business, subject to confidentiality and data minimisation.

Where a recipient acts as a processor, Eight Gate requires an appropriate Article 28 GDPR data-processing arrangement or another binding instrument. Where a recipient independently determines purposes and means, it may be a separate controller with its own transparency duties.

26. External partners and redirects

Travel, Banking & Finance, Insurance, Trading & Investments and certain Automotive services may redirect a user to a third-party partner. Eight Gate generally does not send profile data before the click or submit applications on the user’s behalf. The user provides application or booking data directly to the partner, which then acts as controller for its service.

Eight Gate may receive S2S/postback data needed for affiliate settlement, such as anonymous ID, product type, date, conversion status and value/commission, limited to attribution and abuse-prevention purposes.

FEEMAI is not part of Eight Gate services. It may be advertised as an external affiliate offer. Eight Gate does not send FEEMAI user-profile or Social data; processing after a user visits FEEMAI is governed by that provider.

27. International data transfers

Legal reference: Articles 44–49 GDPR (transfers to third countries and international organisations).

Eight Gate’s primary data infrastructure is located in the European Union. Some technology, advertising, communications or AI providers may operate outside the EEA, and suppliers fulfilling a particular order may be established in third countries.

If an order is fulfilled by a wholesaler or supplier outside the EEA — including in China — delivery data necessary for fulfilment may be transferred, such as recipient name, address, email and phone number.

Transfers outside the EEA take place only under a mechanism provided by Chapter V GDPR, depending on the circumstances: an adequacy decision, Standard Contractual Clauses or other appropriate safeguards, or — exceptionally where GDPR conditions are met — a specific derogation. Where SCCs or similar safeguards are used, supplementary technical/organisational safeguards and transfer-risk assessment may also be applied.

Users may ask Eight Gate for information about the safeguards applicable to a transfer of their personal data outside the EEA.

28. Retention

Legal reference: Article 5(1)(e) GDPR; Article 74 of the Polish Accounting Act; Article 70 of the Polish Tax Ordinance; and applicable limitation-period rules.

After the relevant period, data are deleted or effectively anonymised unless longer retention is legally required. Anonymous statistics may be retained without a fixed time limit if individuals cannot be identified.

29. Account deletion

Users can initiate account deletion in settings. Depending on configuration, a short technical period may apply to allow reversal or completion of active processes. Active sessions are then invalidated and favourites, alerts, preferences and AI-interest profiles are deleted or anonymised.

Account deletion does not automatically remove all data from accounting, transaction, complaint, security or legal records. Company/store details and order history can remain where necessary for legal duties, settlements and claims. Public content or messages may remain detached from the profile as described above.

30. Your rights

Legal reference: Article 12, Articles 15–22 and Article 77 GDPR.

Depending on the legal basis and circumstances, users have the rights to access and obtain a copy, rectify, erase, restrict, port data, object to legitimate-interest processing, object absolutely to direct marketing and related profiling, withdraw consent, and not be subject to a solely automated decision producing legal or similarly significant effects except where the law allows it. Users also have the right to complain to the Polish supervisory authority.

Requests can be sent to privacy@eightgate.pl. If we have reasonable doubts about identity, we may request limited additional verification. We normally respond within one month; GDPR permits an extension in complex cases, with notice to the requester.

Polish supervisory authority: President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw. uodo.gov.pl

31. Automated decisions

Legal reference: Article 22 GDPR; profiling is also governed by Article 4(4) and Article 21 GDPR.

Eight Gate uses automated recommendation, moderation and security mechanisms but does not intend to make solely automated decisions that by themselves produce legal or similarly significant effects. Automated controls may temporarily hide content, stop a payment or restrict a session for safety reasons; significant restrictions can be reviewed by a human.

32. Changes to this Policy

This Policy is drafted for the target launch scope. It cannot legally be guaranteed never to change: changes in law, material features, purposes, categories of data or transfer models may require an update.

Minor editorial/technical changes or a vendor change within the same category and processing model may be made without individual notice. Material changes will be communicated by email or another appropriate channel. If new consent is required, it will be requested before the new processing begins. Eight Gate keeps internal records of previous policy versions and the information shown to users.

32.1 This Policy and other GDPR compliance duties

This Policy is the public-facing transparency notice for users. It is not the only GDPR compliance documentation required from Eight Gate as controller. Eight Gate separately maintains or implements, as applicable, a record of processing activities (Article 30 GDPR), processor agreements (Article 28 GDPR), data-protection impact assessments where required (Article 35 GDPR), consent and objection records, security and personal-data-breach procedures (Articles 32–34 GDPR), documentation for transfers outside the EEA (Articles 44–49 GDPR), and an assessment of whether a Data Protection Officer must be designated (Article 37 GDPR).

33. Contact

Privacy: privacy@eightgate.pl
Controller: Eight Gate Spółka z ograniczoną odpowiedzialnością, ul. Złota 7/28, 00-019 Warszawa, Polska
KRS 0001247142 | NIP 5253093537 | REGON 544984908

The Policy is available in the website footer, at registration and in app settings. At registration we record the version of the Policy and Terms presented to the user.