Privacy Policy

Wolja Digital

Last update: January 10, 2025

Wolja Digital (“the Company”, “Wolja Digital” “we”, “us”, “our”) prioritises individual privacy and maintains rigorous transparency in personal data processing. This Privacy Notice outlines our approach to handling your personal information, emphasising our commitment to processing data in accordance with applicable data protection regulations.

This Privacy Notice encompasses the processing of personal data during your interactions with us, specifically: (1) accessing our digital platform at https://wolja.digital/ (the “Website”), (2) engaging in communications with our organisation, and (3) providing personal data in the context of our professional consultancy services.

We recommend carefully reviewing this Privacy Notice alongside our Terms of Service (the “Terms”) prior to sharing any personal information with our organisation.

Our Organisation

Wolja Digital comprises a network of companies and independent entrepreneurs established in the Republic of Poland and Republic of Georgia.
Data Protection Oversight:

• For EU-based interactions or services provided by Polish entities: Urząd Ochrony Danych Osobowych (Personal Data Protection Office) serves as the supervisory authority.
• For services from Georgian entities or non-EU regions: Personal data Protection Service provides regulatory oversight.
• Data Subject Rights: Individuals retain the right to lodge a data protection complaint with:
• Their designated supervisory authority
• The relevant data protection office overseeing our operations

A comprehensive list of local data protection authorities is available for reference.

How Do We Collect Personal Data?

1. Direct Data Provision You voluntarily share personal data to fulfil specific processing purposes. Examples include:

• Contacting us via email or messaging platforms
• Entering into contractual agreements

2. Automated Data Collection We utilise technical tools to automatically gather personal data during Website usage. Automated collection occurs with appropriate legal justification, serving purposes such as:

• Ensuring technical Website functionality
• Tracking and resolving technical issues

How Do We Process Personal Data?

We process your personal data only when it is necessary to achieve the purpose of the personal data processing and only to the extent necessary to achieve the purpose of the processing. Furthermore, we keep your personal data for a limited period of time and once the processing period has expired, we delete all existing copies of your personal data.

Below we have provided you with a full description of the data processing purposes of the users of the Website and clients of our services, what personal data we process, legal basis of data processing and information about the retention period.

– Communication with us

Any information you provide to us, date and time of call with our managers and consultants, information about your company, legal issues or other details you might share with us.

Legal Basis: legitimate interest

Data retention period: 1 year upon after the last communication

– Receiving consultancy services

Requests for services, description, and date of the request, answers from your questionnaires, strictly necessary for executing your request.

If necessary, we can request additional information to qualify the request, such as information about the size of the client company, business model, target industry/market.

We may also request the client’s representative name, surname, identification number, position in the company, name of the company, link to its website, description of the request, and, if necessary, other information depending on the substance of the request and requirements under the applicable AML regulations.

Legal Basis: contractual relations

Data retention period: 5 years upon cease of providing consultancy services. The retention period is based on tax and AML regulatory requirements

– Email and Social Networks Requests, Blog subscriptions, and other forms on Website

E-mail address, subject, and content of the request. Subscriptions, likes, comments, retweets, reposts, and any other activity on the Company’s pages on Social Networks.

Legal Basis: legitimate interests, in certain cases – your consent

Data retention period: 1 year upon the end of communication and/or subscription

– Log Data and Analytics

Information about your experience on the Website – your device and browser information, login data, user ID, IP-address, geolocation data, date, time, and duration of use of the Website, links you visited, links, by which you were addressed to the Website.

Legal Basis: legitimate interests, in certain cases – your consent Data retention period: 1 year upon the end of the use of the Website

– Cookies

The Company uses cookies to appropriately run the Website and for the analysis of the Website traffic. More information about cookies is provided below in Section 6.

Legal Basis: legitimate interests, in certain cases – your consent

Data retention period: depends on the type of cookie file, but does not exceed 1 year

Data Retention Period

We retain personal data only for necessary processing purposes, with specific timeframes detailed in Section 3.

Under certain circumstances, we may be required to retain your personal data for a longer period of time in accordance with applicable law or regulatory requirements, including:

• Legal proceedings
• Investigations
• Government inquiries

Retention periods strictly comply with legal obligations. We ensure data security and confidentiality throughout the retention period.

Privacy and Data Sharing Policy

We prioritise data protection, sharing personal information only when legally necessary or operationally essential. Our approach balances rigorous privacy safeguarding with practical service delivery requirements.

• Legal Compliance Framework

We disclose personal data when mandated by legal proceedings, such as responding to court orders, government requests, or protecting organisational rights. This ensures transparency while maintaining individual safety and regulatory adherence.

• Service Delivery Approach

When service requirements necessitate third-party involvement, we engage trusted partners selectively. Prior to any data transfer, we obtain explicit consent and ensure comprehensive understanding of the collaborative context.

• Partner Evaluation Process

Our partner selection emphasises stringent data protection standards. We meticulously screen potential collaborators, verifying their commitment to GDPR compliance and robust data handling practices. Data Processing Agreements form a critical component of our partnership framework.

• Transparency Commitment

We acknowledge potential limitations in absolute data protection and encourage individuals to review our partners’ privacy policies. Our goal remains consistently transparent communication about data handling practices.

• Regulatory Alignment

All data transfers comply with GDPR requirements, with particular attention to consent mechanisms, processing agreements, and individual rights preservation.

Cookies and Website Functionality

Our Website utilises cookies to enhance user experience and functionality. Cookies are small data files stored on your device that enable website memory and personalisation.

• Cookie Categories

Necessary cookies ensure core website functionality and security. Performance cookies enable analytics and statistical improvements. Functional cookies support navigation and feature access. Targeting cookies facilitate personalised advertising based on browsing behaviour.

We use Google Analytics

• Consent and Control

Users can customize or withdraw consent for non-essential trackers through browser settings, with necessary cookies remaining essential for website operation.

Data Subject Rights

We are committed to protecting your personal data and ensuring your rights are respected. You have several key rights regarding your personal information:

Right of Access – request access to your personal data by contacting our specified email. We will provide a copy of processed data, potentially with a reasonable administrative fee.

Right to Rectification – Update inaccurate or incomplete personal data through contacting us via email.

Right to Erasure – request deletion of your personal data when no longer necessary, invoking the “right to be forgotten”.

Right to Restrict Processing – limit data processing under specific circumstances, such as challenging data accuracy or objecting to processing.

Right to Data Portability – receive your personal data in a structured, machine-readable format for transmission to another controller.

Right to Object – challenge data processing based on legitimate interests or marketing purposes.

Right to Withdraw Consent – revoke previously given consent for data processing.

Right to Lodge a Complaint – file a complaint with the supervisory authority if you believe data processing violates legislation.

Each right can be exercised by contacting us through the designated communication channel.

Child Data Protection Policy

We do not collect personal data from individuals under 16. If we discover such data has been collected, we will immediately delete it. Parents or guardians who believe we may have inadvertently collected a child’s personal information should contact us using the provided email address.

CROSS-BORDER TRANSFER

Wolja Digital recognizes the complexities of cross-border data movement, particularly when transferring personal data between our EU and Georgian entities. We are committed to ensuring robust protection of personal data

throughout such transfers, adhering strictly to the General Data Protection Regulation (GDPR) requirements.

When transferring personal data between our EU and Georgian entities, we exclusively rely on European Commission-approved Standard Contractual Clauses (SCCs), which provide comprehensive legal safeguards for data subjects. These clauses establish stringent obligations for data protection, ensuring that personal information receives equivalent levels of protection during and after international transfer.

Our transfer mechanism includes multiple layers of security. We implement end-to-end encryption during data transmission, restrict access to transferred data through multi-factor authentication, and maintain detailed logs of all cross-border data movements. Prior to any transfer, we conduct thorough transfer impact assessments to evaluate potential risks and implement necessary mitigation strategies.

Data subjects retain full rights under GDPR, including the ability to request information about their data’s location, seek rectification, and lodge complaints about potential mishandling. We provide transparent communication channels for individuals to exercise these rights, regardless of their data’s geographical location.

Our internal processes mandate regular audits of international data transfer practices, ensuring continuous compliance with evolving regulatory standards. We document each transfer’s legal basis, whether it stems from explicit consent, contractual necessity, or other lawful grounds recognized under European data protection frameworks.

Automated Decision-Making

We do not engage in any automated decision-making or profiling using your personal data. All decisions that may significantly affect you are made with human involvement. We believe in preserving human judgement in matters that concern our customers.

Changes To The Privacy Policy

We may modify this Privacy Policy due to technological changes, legal requirements, or other reasons. Continued website usage indicates acceptance of updated terms. Significant changes requiring personal data processing consent will prompt explicit user approval.