Privacy policy of the website www.nextmusic.pl

effective from 1 December 2025

GENERAL PROVISIONS

1. This Privacy Policy sets out the rules for the processing of personal data of Users using the services available through the website called "www.nextmusic.pl".
2. The administrator of the personal data of Users of the nextmusic.pl website is Next Film sp. z o.o. with its registered office in Warsaw.
3. The controller has appointed a Data Protection Officer (Edyta Palak), who can be contacted in any matter relating to the processing of personal data by e-mail: iod@next-film.pl or in writing at the following address: ul. Czerska 8/10, 00-732 Warsaw.
4. The Privacy Policy is available free of charge on the Website in a form that allows it to be downloaded, saved and printed. At the User's request sent to the e-mail address: kontakt@nextmusic.pl, the Privacy Policy may also be sent free of charge by e-mail in electronic form to the e-mail address provided by the User.

DEFINITIONS

1. Administrator – Next Film limited liability company with its registered office in Warsaw at ul. Czerska 8/10 (00-732) Warsaw, registered in the Register of Entrepreneurs of the National Court Register kept by the District Court for the Capital City of Warsaw in Warsaw, 13th Commercial Division of the National Court Register, under KRS number: 0000432663, NIP (Tax Identification Number): 7252061849.
2. Personal data – information about a natural person identified or identifiable by one or more specific factors determining physical, physiological, genetic, mental, economic, cultural or social identity, including device IP, location data, internet identifier and information collected through cookies and other similar technologies.
3. Newsletter – to persons who have consented to receive the newsletter by providing their e-mail address, the Administrator will send commercial information by e-mail about promotions, news, pre-sales and events related to Next Film, as well as marketing content related to other services of the Administrator and the following companies from the capital group: Agora S.A., Wyborcza sp. z o.o., Gazeta.pl sp. z o.o., Helios S.A., Grupa Radiowa Agory sp. z o.o., Eurozet sp. z o.o., Eurozet Radio sp. z o.o, Agora Książka i Muzyka Sp. z o.o., AMS S.A., in particular related to cultural events.
4. Privacy Policy – this privacy policy.
5. Website – the website operated by the Administrator at www.nextmusic.pl.
6. GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.
7. User – any natural person visiting the Website.
8. Trusted Partners – entities providing marketing, analytical and statistical services to the Administrator; a list of these entities can be found in section 31 of the Privacy Policy.

PURPOSES AND LEGAL BASIS FOR THE PROCESSING OF PERSONAL DATA ON THE WEBSITE

1. In connection with the User's use of the Website, the Administrator collects Personal Data to the extent necessary to provide specific electronic services offered on the Website, as well as information about the User's activity on the Website.
2. The User's activity on the Website, including their Personal Data, is recorded in system logs (a special computer program used to store chronological records containing information about events and activities related to the IT system used by the Administrator to provide services).
3. The personal data of all persons using the Website (including IP addresses or other identifiers and information collected through cookies or other similar technologies) are processed by the Administrator:  
   1. for the purpose of providing services by electronic means (services of access to the Website, services of internet communication with the service provider via the contact form) – in this case, the legal basis for the processing of Personal Data is the necessity of processing for the performance of a contract (Article 6(1)(b) of the GDPR);
   2. for technical and administrative purposes, for the purposes of ensuring the security of the IT system and managing that system – in this case, the legal basis for the processing of Personal Data is the legitimate interest of the Controller (Article 6(1)(f) of the GDPR), consisting in ensuring the adequate security and functionality of the IT system through which the services are provided;
   3. for analytical and statistical purposes – in this case, the legal basis for the processing of Personal Data is the User's consent (Article 6(1)(a) of the GDPR); such activities are undertaken by the Controller only if the User has given their consent; the User may withdraw their consent at any time; the methods of withdrawing consent are specified in point 33 of the Privacy Policy;
   4. for the purpose of possible establishment and pursuit of claims or defence against claims – in this case, the legal basis for the processing of Personal Data is the legitimate interest of the Controller (Article 6(1)(f) of the GDPR), consisting in the protection of its rights;
   5. for the marketing purposes of the Controller and other entities:
      – in the case of sending marketing content to the User as part of the Newsletter – the legal basis for the processing of Personal Data is the legitimate interest of the Controller (Article 6(1)(f) of the GDPR); such activities are undertaken by the Controller only if the User has consented to receiving commercial information in the form of the Newsletter; the User may withdraw their consent at any time; the methods of withdrawing consent are specified in point 33 of the Privacy Policy;
      – in the case of sending marketing content to the User via e-mail, MMS/SMS or telephone, in some cases via traditional mail (so-called direct marketing) – the legal basis for the processing of Personal Data is the User's consent (Article 6(1)(a) of the GDPR); such activities are undertaken by the Controller only if the User has given their consent; the User may withdraw their consent at any time; the methods of withdrawing consent are specified in section 33 of the Privacy Policy.
4. The Controller processes the Personal Data of Users visiting the Next Film profile on the Facebook social networking site. This data is processed solely in connection with the operation of the profile, including for the purpose of informing Users about the Controller's activities, promoting the Website, and responding to short queries sent via Facebook Messenger. The legal basis for the processing of Personal Data by the Administrator for this purpose is its legitimate interest (Article 6(1)(f) of the GDPR), consisting in promoting its own brand.

COOKIES AND SIMILAR TECHNOLOGY

1. The Administrator uses cookies mainly to provide the User with electronic services and to improve the quality of those services. Therefore, the Administrator and its Trusted Partners use cookies to store information or access information already stored on the User's telecommunications terminal equipment (computer, telephone, tablet, etc.). The use of cookies on the Website is not intended to identify Users.
2. The Administrator uses necessary cookies, functional and analytical cookies, and advertising cookies.
3. Necessary cookies are used primarily to provide Users with the services and functionality of the Website that the User wishes to use. Necessary cookies may only be installed by the Administrator via the Website.
4. The legal basis for the processing of personal data in connection with the use of necessary cookies is the necessity of processing for the performance of a contract (Article 6(1)(b) of the GDPR).
5. Functional cookies are used to remember and adapt the Website to the User's choices, including language preferences. Functional cookies may be installed by the Administrator and its Trusted Partners via the Website.
6. Analytical cookies are used to obtain information such as the number of visits and sources of traffic to the Website; they enable the Administrator to determine which pages are more or less popular and how Users navigate the Website by keeping statistics on traffic on the Website. The information collected by these cookies is aggregated, so it is not intended to identify the User. Analytical cookies may be installed by the Administrator and its Trusted Partners via the Website.
7. Advertising cookies are used to tailor the advertising content displayed to the interests of Users within and outside the Website. Based on the information from these cookies and the User's activity on other websites, a profile of the User's interests is built. Advertising cookies may be installed by the Administrator and its Trusted Partners via the Website.
8. The legal basis for the processing of Personal Data in connection with the use of functional, analytical and advertising cookies is the User's consent (Article 6(1)(a) of the GDPR); such actions are taken by the Administrator only if the User has given their consent; The User may withdraw their consent at any time; the methods of withdrawing consent are specified in section 33 of the Privacy Policy.

PERIOD OF PERSONAL DATA PROCESSING

1. The period of processing of Personal Data by the Controller depends on the type of service provided and the purpose of processing.
2. As a rule, personal data is processed:
   1. for the period of providing the service through the Website;
   2. until the consent is withdrawn in cases where the legal basis for the processing of Personal Data is the User's consent (Article 6(a) of the GDPR);
   3. until an effective objection to the processing of personal data is lodged in cases where the legal basis for the processing of personal data is the legitimate interest of the Controller (Article 6(f) of the GDPR).
3. The period of processing of Personal Data may be extended if the processing is necessary to establish and pursue possible claims or defend against claims, and after that time only if and to the extent required by law. After the processing period has expired, personal data is irrevocably deleted or anonymised.

RECIPIENTS OF PERSONAL DATA

1. In connection with the provision of electronic services via the Website, Personal data will be disclosed to external entities, including in particular: suppliers responsible for operating IT systems used to provide services and entities such as banks and payment operators, research companies, couriers, as well as entities affiliated with the Administrator, including companies from its capital group.
2. If the User gives their consent, their personal data may be made available to the Administrator's Trusted Partners for their own purposes, including marketing purposes. This consent may be withdrawn by the User at any time.
3. The Administrator reserves the right to disclose information about the User to competent authorities or third parties who request such information on a legal basis and in accordance with applicable law.
4. The Administrator's Trusted Partner is: Google Inc. 

USER RIGHTS

1. The User has the following rights:
   1. the right to access the content of Personal Data,
   2. the right to request its rectification, erasure, restriction of processing, the right to transfer Personal Data;
   3. the right to object – for reasons related to their particular situation – to the processing of their Personal Data based on the Administrator's legitimate interest (Article 6(1)(f) of the GDPR);
   4. the right to object if their Personal Data is processed for direct marketing purposes;
   5. the right to withdraw consent at any time without affecting the lawfulness of the processing carried out on the basis of consent prior to its withdrawal – if the processing of Personal Data is based on the User's consent (Article 6(1)(a) of the GDPR);
   6. the right to lodge a complaint with the supervisory authority responsible for personal data protection, i.e. the President of the Personal Data Protection Office.
2. To the extent that the User's personal data is processed on the basis of consent, the User may withdraw this consent at any time:
   1. by contacting the Controller by e-mail at: iod@next-film.pl;
   2. by contacting the Controller by post at the following address: Next Film Sp. z o.o. ul. Czerska 8/10, 00-732 Warsaw;
   3. by clicking on the "Consents" link available in the footer of the Website and changing the relevant settings in this regard – regarding functional, analytical and advertising cookies.
3. Subscribing to the Newsletter requires the provision of Personal Data in the form of the User's email address. The User is required to provide such Personal Data, and failure to do so will result in the Newsletter not being sent.
4. The User may unsubscribe from the Newsletter at any time by clicking on the link provided in each Newsletter.
5. Sending a contact form (i.e. using the online communication service with the service provider) requires the provision of Personal Data in the form of the User's first and last name, email address and telephone number. The User is required to provide such Personal Data, and failure to do so will result in the service not being provided.

PERSONAL DATA SECURITY

1. The Controller conducts ongoing risk analysis to ensure that the Personal Data it processes is processed securely. The Controller ensures that all operations on Personal Data are recorded and performed only by authorised persons and only to the extent necessary for the performance of their tasks.
2. The Controller takes all necessary measures to ensure that its subcontractors and other entities cooperating with it also guarantee the application of appropriate security measures in each case when they process personal data on behalf of the Controller.

CHANGES TO THE PRIVACY POLICY

1. The Privacy Policy is reviewed on an ongoing basis and updated as necessary.
2. The current version of the Privacy Policy was adopted and has been in force since 1 December 2025.