Privacy policy

The protection of personal data has always been one of the most important aspects of our business of providing access to the “filmdist” film distribution software. We also aim to inform you properly about matters related to the processing of personal data, in particular in light of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the “GDPR”).

For this reason, this document sets out the legal bases for processing personal data, the ways in which it is collected and used, and the related rights of data subjects.

Personal data means any information relating to a natural person who can be identified, directly or indirectly, on the basis of that information. It may include information such as names, contact details, online identification data, online identifiers or other characteristics of a given person. Impulse processes personal data for various purposes, and depending on the purpose, different collection methods, legal bases for processing, uses, disclosures and retention periods may apply.

This Policy may be supplemented by additional privacy statements or terms made available to the user where necessary.

The Policy applies to all cases in which Impulse is the controller of personal data and processes personal data. This covers both cases where Impulse processes personal data obtained directly from the data subject and cases where we obtained personal data from other sources. Impulse fulfils its information obligations in both of the above cases, as set out respectively in Article 13 and Article 14 of the GDPR.

Impulse.pl sp. z o.o. with its registered office in Lębork, ul. Bolesława Krzywoustego 15A, 84-300 Lębork, Poland, entered in the register of entrepreneurs kept by the District Court Gdańsk-Północ in Gdańsk, 8th Commercial Division, under KRS no. 0000324829, NIP 6342710713, REGON 241143684, share capital (fully paid up) PLN 50,000.

The Data Protection Officer is Bartłomiej Chyży, e-mail: iod@impulse.pl.

We are committed to protecting the personal data of our clients, users, employees and other stakeholders. If you would like to contact us with questions about your personal data, go to the “How to contact us” section below.

The type of personal data we collect depends on your relationship with us and on the Services we provide. To that end, we may collect the following personal data:

• Name and contact details — first name and surname, e-mail address, postal address, telephone number, as well as work-related information such as job title and other employment or education details.
• Account credentials — passwords and other security information used for authentication and to obtain access.
• Financial information — bank account, credit card and debit card numbers for payment processing purposes.
• Computer, device and connection information — IP address, browser type, version and location, advertising identifiers, cookie identifiers and related information.

We collect personal data from the following sources:

• Direct interactions — for example when you register for our Services, make a purchase or communicate with us.
• Automated tracking technologies — information collected automatically about your interaction with our Services, websites or application using various technologies such as cookies.

Personal data is used for the purposes for which it was collected and may be further used only for statutory or other legitimate purposes. For example, if you use the contact form on our website or in the application, we will first use the information you provide to respond to your service request. We may use that information further to improve the quality of our customer service process.

Legal bases for processing

Lawfulness of processing is one of the core principles of personal data processing. We rely on the following legal bases:

• processing is necessary for the performance of a contract or to take steps prior to entering into a contract,
• processing is necessary for the purposes of our legitimate interests — for example in order to improve the quality of our products and Services,
• processing is necessary for compliance with a legal obligation to which we are subject, or is otherwise lawful under applicable data protection law,
• with your consent.

Purposes of processing

Depending on how you interact with us and with the Service, we may use your personal data for the following purposes:

• Managing the relationship between you and our business, including providing and administering access to our Services and managing how the Services are used. This processing is necessary for the performance of a contract.
• Developing and improving new and existing products and Services. This processing is necessary for the purposes of our legitimate interests.
• Marketing and advertising, such as customer segmentation and delivering marketing or advertising messages that we believe may be of interest to you. This processing takes place with your consent or in connection with our legitimate interests.
• Other general business support purposes, including but not limited to procurement, financial and tax management, risk and compliance management and external reporting. This processing is necessary for compliance with a legal obligation to which we are subject, is otherwise lawful under applicable data protection law, or serves the purposes of our legitimate interests.

Impulse processes the personal data of its clients and prospective clients. That data may also include the personal data of individuals connected with Impulse clients that are not natural persons (e.g. contact persons). Personal data of this kind is processed in the IT systems used by Impulse.

In order to deliver the best possible Services and support our business, we may share certain information internally or with selected third parties. There may also be statutory or legal obligations that, in good faith, require us to disclose your personal data externally. The parties with whom we may share data are:

• our service providers, e.g. for service management or hosting and/or technology supporting the Services we deliver,
• other parties, e.g. where necessary in connection with external audits, regulatory compliance, the pursuit of receivables or other rights, risk management, corporate development and/or corporate governance,
• government authorities, regulators and other third parties, in response to a legal request, court orders and/or as otherwise necessary to comply with applicable law.

Whenever we share personal data, we apply appropriate safeguards in accordance with applicable data protection law. As required by applicable law, third parties are obliged to apply appropriate safeguards to protect personal data and may only access the personal data they need in order to perform specific tasks.

Your personal data will be processed to the extent necessary to perform our obligations and to fulfil legal obligations, and for as long as necessary to achieve the purposes for which the information is collected, in accordance with our data retention rules and applicable data protection law.

When we no longer need your personal data, we will take all reasonable steps to delete it from our systems and records, or take steps to anonymise it appropriately so that you can no longer be identified from it.

To keep your data secure, we have implemented an internal framework of policies and minimum standards. We also limit access to personal data for our employees, business partners, service providers and external providers to the necessary minimum.

In particular, as required by law, we take appropriate technical and organisational measures (policies and procedures, IT security and others) to ensure the confidentiality and integrity of your personal data and of the way it is processed.

We fully respect your rights under applicable law. Your rights may include the following:

Right of access

The right to see the personal data we process about you.

Right to rectification

If your personal data is inaccurate or incomplete, you have the right to ask us to correct or supplement it.

Right to erasure (“right to be forgotten”)

The right to request erasure of your personal data to the extent permitted by applicable law. In certain circumstances we may not be able to accept your request — for example where processing is necessary for compliance with a legal obligation or for the performance of a contract. In some cases your personal data is necessary in order to provide the Services; if you do not provide us with such information, you may not be able to access the Services or some of their features.

Right to restriction of processing

The right to ask us to restrict or stop processing your personal data held by us, for a specified period or indefinitely. In certain circumstances we may not be able to accept your request — for example where processing is necessary for compliance with a legal obligation, or where we can demonstrate compelling legitimate grounds for refusal.

Right to data portability

The right to ask us to transfer your personal data directly to you. At your request, and where technically feasible, we will transfer your personal data to you or to another entity of your choice.

Right to object

The right to object to the processing of your personal data. The grounds for objection should relate to your particular situation and to processing based on legitimate interest. In such a case we will stop processing the personal data unless we can demonstrate compelling legitimate grounds for refusal. In certain circumstances you have an unconditional right to object, for example in the context of direct marketing.

Withdrawal of consent

The right to withdraw your consent to the processing of your personal data at any time — for example after you have consented to being informed about our Services. Withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal.

To exercise your rights (where applicable) and/or if you have any other questions about the processing of personal data, see the “How to contact us” section below.

If you are not satisfied with our response or disagree with our data privacy practices, you may also lodge a complaint with your local data protection authority.

Cookies are small text files stored by your browser on your device. Below we list every cookie we use on this website, together with its purpose and retention period. We do not use cookies for advertising, profiling or tracking you across other websites.

Besides cookies, we store your light or dark theme preference in the browser’s local storage. That information is never sent to our servers or shared with anyone.

Our contact forms use Cloudflare Turnstile, whose widget we load from Cloudflare servers — it may store technical data in your browser that is required to complete the check. We do not use pre-clearance mode, so Turnstile sets no cookies on this website that would recognise you beyond the form itself. See the “Protecting forms against abuse” section for details.

Categories

Necessary

Remembering your cookie choice and protecting forms against abuse. The website does not work correctly without them, so they are always active — we store them on the basis of our legitimate interest in keeping the website running and secure (Article 6(1)(f) GDPR).

Analytics

Google Analytics 4 loaded through Google Tag Manager — statistics on visits and how the website is used. We store them only after you give consent (Article 6(1)(a) GDPR and the provisions of the Polish Electronic Communications Act on storing information on terminal equipment).

Managing your consent

On your first visit we show a banner where you can accept analytics cookies or keep only the necessary ones. Until you give consent, Google Analytics runs in Consent Mode v2 with device storage denied, so no analytics cookies are written.

You can change or withdraw your decision at any time via the “Cookie settings” link in the website footer. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal. We remember your choice for 12 months and ask again afterwards.

Independently of our tool, most browsers let you block and delete cookies in their own settings. Blocking necessary cookies may disrupt the website.

The contact forms on our website are protected by Cloudflare Turnstile, which distinguishes real users from automated traffic. Without that protection the forms would be used for bulk spam.

As part of this check, your IP address, information about your browser and device, and the way you interact with the page are transmitted to Cloudflare. The legal basis is our legitimate interest in protecting the Services against abuse (Article 6(1)(f) GDPR). In this respect Cloudflare acts as a processor on our behalf.

Turnstile is not used to serve advertising or to profile users for marketing purposes, and the data collected this way is not used to build a profile of you across other websites. The provider describes its data processing in the Cloudflare Privacy Policy.

In addition, on our own servers only, we limit how many submissions can be sent from a single IP address and apply simple bot-detection techniques. Submissions considered suspicious are routed to a separate queue for human review rather than being deleted automatically.

Our websites may contain links to other third-party websites, which may have privacy and cookie statements that differ from ours. We are not responsible for the collection, processing or disclosure of personal data gathered through such other websites.

We are also not responsible for any information or content on such websites. Links to other websites are provided solely for the convenience of users. Using and browsing such websites is subject to the rules applicable to that website. Please read the privacy information published on other websites that can be accessed through our site.

If you have any questions about how we process your personal data, or if you would like to exercise one of your rights, contact us at iod@impulse.pl. If you are not satisfied with our response or disagree with our data privacy practices, depending on applicable law you may also lodge a complaint with your local data protection authority.

In response to a request, where necessary, we may ask you to confirm your identity and to provide information that helps us better understand your request. If your request is refused in whole or in part, we will explain why.

In certain circumstances you may appoint an Authorised Representative to submit requests to exercise specific privacy rights on your behalf. To do so, you must provide the Authorised Representative with written and signed consent to submit the request on your behalf and verify your identity directly with us. We may reject a request from an Authorised Representative who does not provide proof of authorisation to act on your behalf.

Should you have any questions, reservations or doubts about the content of this Privacy Policy or the way in which we process personal data, as well as any complaints on these matters, please send an e-mail with the details to iod@impulse.pl. All complaints received will be considered and answered.

Individuals whose personal data is processed by Impulse also have the right to lodge a complaint with the supervisory authority, which is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych).

We do not limit how you can reach us — you can also contact us in person at the Impulse office, by post or by telephone:

From time to time we may update this Policy or other specific privacy statements. When we make changes to this Policy, we will add a new date to its content.

This version has been in force since 24 August 2026.