general provisions
This privacy policy of the Website is informational in nature, which means that it is not a source of obligations for Service Recipients of the Website. The privacy policy sets out, above all, the rules concerning the processing of personal data by the Administrator on the Website, including the grounds, purposes and scope of personal data processing and the rights of data subjects, as well as information on the use of cookies and analytical tools on the Website.
The administrator of personal data collected via the Website is MARKOR SPÓŁKA JAWNA BIAŁEK, with its registered office in Drzewica (registered office address and address for service: ul. Braci Kobylańskich 5, 26-340 Drzewica, Poland); entered in the Register of Entrepreneurs of the National Court Register (KRS) under number 0000530783; registry court in which the company's documentation is kept: District Court for Łódź-Śródmieście in Łódź, 20th Commercial Division of the National Court Register; NIP (Tax ID): 7681836736; REGON (Statistical ID): 360117358, email address: bok@kmbc.pl and dk@kmbc.pl and contact phone number: 535334567 - hereinafter referred to as the "Administrator" and, at the same time, the Owner of the Website.
Personal data on the Website is processed by the Administrator in accordance with applicable law, in particular in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) - hereinafter referred to as "GDPR" or the "GDPR Regulation". Official text of the GDPR Regulation: http://eur-lex.europa.eu/legal-content/PL/TXT/?uri=CELEX%3A32016R0679
Use of the Website is voluntary. Similarly, the provision of personal data by a Service Recipient using the Website is voluntary, subject to two exceptions: (1) concluding agreements with the Administrator: failure to provide the data required — to the extent necessary to conclude and perform a Sales Agreement or an agreement for the provision of an Electronic Service with the Administrator — results in the inability to conclude that agreement. In such a case, providing personal data is a contractual requirement, and if the data subject wishes to conclude the agreement with the Administrator, they are obliged to provide the required data. The scope of data required to conclude the agreement is indicated by the Administrator on each occasion; (2) the Administrator's statutory obligations: providing personal data is a statutory requirement arising from generally applicable law that imposes on the Administrator an obligation to process personal data (e.g. processing data for the purposes of keeping tax or accounting records) and failure to provide it will prevent the Administrator from fulfilling those obligations. The Administrator exercises particular diligence to protect the interests of the persons whose personal data it processes, and in particular is responsible for, and ensures, that the data it collects is: (1) processed lawfully; (2) collected for specified, lawful purposes and not further processed in a manner incompatible with those purposes; (3) substantively correct and adequate in relation to the purposes for which it is processed; (4) stored in a form permitting identification of the data subjects for no longer than is necessary to achieve the purpose of the processing; and (5) processed in a manner ensuring appropriate security of personal data, including protection against unauthorised or unlawful processing and against accidental loss, destruction or damage, by means of appropriate technical or organisational measures.
Taking into account the nature, scope, context and purposes of processing, as well as the risk of a violation of the rights or freedoms of natural persons of varying likelihood and severity, the Administrator implements appropriate technical and organisational measures to ensure that processing is carried out in accordance with this Regulation and to be able to demonstrate this. These measures are reviewed and updated as necessary. The Administrator applies technical measures to prevent the acquisition and modification of personal data transmitted electronically by unauthorised persons.
All words, expressions and acronyms appearing in this privacy policy and beginning with a capital letter (e.g. Website, Electronic Service) should be understood in accordance with the meaning ascribed to them in this document.
grounds for data processing
The Administrator is entitled to process personal data in cases where – and to the extent that – at least one of the following conditions is met: (1) the data subject has given consent to the processing of their personal data for one or more specified purposes; (2) processing is necessary for the performance of a contract to which the data subject is a party, or in order to take steps at the request of the data subject prior to entering into a contract; (3) processing is necessary for compliance with a legal obligation to which the Administrator is subject; or (4) processing is necessary for the purposes of the legitimate interests pursued by the Administrator or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject requiring the protection of personal data, in particular where the data subject is a child.
Each instance of personal data processing by the Administrator requires at least one of the grounds indicated above to exist. The specific grounds for the Administrator's processing of the personal data of the Website's Service Recipients are indicated in the next section of the privacy policy, in relation to the given purpose of the Administrator's data processing.
The administrator of personal data collected and processed in connection with the use of the Website is the Owner. Personal data is processed for the purposes, for the period, and on the grounds and principles set out in the privacy policy published on the Website. The privacy policy sets out, above all, the rules concerning the processing of personal data by the Administrator on the Website, including the grounds, purposes and period of personal data processing and the rights of data subjects, as well as information on the use of Cookies and analytical tools on the Website. Use of the Website is voluntary. Similarly, the provision of personal data by a person using the Website is voluntary, subject to the exceptions indicated in the privacy policy (e.g. the Owner's statutory obligations).
PURPOSE, GROUNDS AND PERIOD OF DATA PROCESSING ON THE WEBSITE
In each case, the purpose, grounds and scope, as well as the recipients, of the personal data processed by the Administrator result from the actions taken by the given Service Recipient on the Website. The Administrator may process personal data on the Website for the following purposes, on the following grounds, for the following periods and to the following extent:
| Purpose of data processing | Legal basis for data processing | Data retention period |
|---|---|---|
| Performance of an agreement for the provision of an Electronic Service, or taking steps at the request of the data subject prior to entering into an agreement | Article 6(1)(b) of the GDPR (performance of a contract) - processing is necessary for the performance of a contract to which the data subject is a party, or in order to take steps at the request of the data subject prior to entering into a contract | Data is stored for the period necessary for the performance, termination or other expiry of the agreement concluded. |
| Direct marketing | Article 6(1)(f) of the GDPR (legitimate interest of the administrator) - processing is necessary for purposes arising from the Administrator's legitimate interests – consisting of safeguarding the Administrator's interests and good image and pursuing the sale of products or services | Data is stored for the duration of the legitimate interest pursued by the Administrator, but no longer than the limitation period for claims against the data subject arising from the Administrator's business activity. The limitation period is set out by law, in particular the Civil Code (the basic limitation period for claims related to business activity is three years, and for a sales contract, two years). The Administrator may not process data for direct marketing purposes if the data subject has effectively objected to such processing. |
| Marketing | Article 6(1)(a) of the GDPR (consent) - the data subject has given consent to the processing of their personal data for marketing purposes by the Administrator | Data is stored until the data subject withdraws consent to further processing of their data for this purpose. |
| Establishing, pursuing or defending claims that may be raised by the Administrator or that may be raised against the Administrator | Article 6(1)(f) of the GDPR - processing is necessary for purposes arising from the Administrator's legitimate interests – consisting of establishing, pursuing or defending claims that may be raised by the Administrator or that may be raised against the Administrator | Data is stored for the duration of the legitimate interest pursued by the Administrator, but no longer than the limitation period for claims against the data subject arising from the Administrator's business activity. The limitation period is set out by law, in particular the Civil Code (the basic limitation period for claims related to business activity is three years). |
| Use of the Website and ensuring its proper operation | Article 6(1)(f) of the GDPR (legitimate interest of the administrator) – processing is necessary for purposes arising from the Administrator's legitimate interests – consisting of operating and maintaining the Website | Data is stored for the duration of the legitimate interest pursued by the Administrator, but no longer than the limitation period for the Administrator's claims against the data subject arising from the Administrator's business activity. The limitation period is set out by law, in particular the Civil Code (the basic limitation period for claims related to business activity is three years). |
| Keeping statistics and analysing traffic on the Website | Article 6(1)(f) of the GDPR (legitimate interest of the administrator) – processing is necessary for purposes arising from the Administrator's legitimate interests – consisting of keeping statistics and analysing traffic on the Website in order to improve the operation of the Website | Data is stored for the duration of the legitimate interest pursued by the Administrator, but no longer than the limitation period for the Administrator's claims against the data subject arising from the Administrator's business activity. The limitation period is set out by law, in particular the Civil Code (the basic limitation period for claims related to business activity is three years). |
RECIPIENTS OF DATA ON THE WEBSITE
For the Website to function properly, the Administrator must use the services of external entities (such as, for example, a software provider). The Administrator only uses the services of such processors as provide sufficient guarantees of implementing appropriate technical and organisational measures, so that the processing meets the requirements of the GDPR and protects the rights of data subjects. The Administrator does not disclose data in every case, nor to all recipients or categories of recipients indicated in the privacy policy – the Administrator discloses data only when necessary to achieve a given purpose of personal data processing, and only to the extent necessary to achieve it. The personal data of the Website's Service Recipients may be disclosed to the following recipients or categories of recipients:
- providers of services supplying the Administrator with technical, IT and organisational solutions enabling the Administrator to conduct its business activity, including the Website and the Electronic Services provided through it (in particular providers of computer software for running the Website, providers of email and hosting services, and providers of software for company management and technical support for the Administrator) - the Administrator discloses the Customer's collected personal data to a selected provider acting on its behalf only where and to the extent necessary to achieve a given data processing purpose consistent with this privacy policy.
- providers of accounting, legal and advisory services who provide the Administrator with accounting, legal or advisory support (in particular an accounting office, a law firm or a debt-collection company) - the Administrator discloses the Customer's collected personal data to a selected provider acting on its behalf only where and to the extent necessary to achieve a given data processing purpose consistent with this privacy policy.
RIGHTS OF THE DATA SUBJECT
Right of access, rectification, restriction, erasure or portability - the data subject has the right to request from the Administrator access to their personal data, its rectification, erasure ("the right to be forgotten") or restriction of processing, and has the right to object to processing, as well as the right to data portability. The detailed conditions for exercising the rights indicated above are set out in Articles 15–21 of the GDPR.
Right to withdraw consent at any time – if a person's data is processed by the Administrator on the basis of consent given (pursuant to Article 6(1)(a) or Article 9(2)(a) of the GDPR), that person has the right to withdraw consent at any time without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal.
Right to lodge a complaint with a supervisory authority – a person whose data is processed by the Administrator has the right to lodge a complaint with a supervisory authority in the manner and procedure set out in the provisions of the GDPR and Polish law, in particular the Personal Data Protection Act. The supervisory authority in Poland is the President of the Personal Data Protection Office.
Right to object - the data subject has the right, at any time, on grounds relating to their particular situation, to object to the processing of their personal data based on Article 6(1)(e) (public interest or the exercise of official authority) or (f) (legitimate interest of the administrator), including profiling based on those provisions. In such a case, the Administrator may no longer process that personal data unless it demonstrates compelling legitimate grounds for processing that override the interests, rights and freedoms of the data subject, or grounds for establishing, exercising or defending legal claims.
Right to object regarding direct marketing - if personal data is processed for direct marketing purposes, the data subject has the right to object at any time to the processing of their personal data for such marketing, including profiling, to the extent that the processing is related to such direct marketing.
To exercise the rights referred to in this section of the privacy policy, you may contact the Administrator by sending an appropriate message in writing or by email to the Administrator's address indicated at the beginning of the privacy policy, or by using the contact form available on the Website.
COOKIES ON THE WEBSITE AND ANALYTICS
Cookies are small pieces of text information in the form of text files, sent by the server and saved on the device of the person visiting the Website (e.g. on the hard drive of a computer or laptop, or on the memory card of a smartphone – depending on the device the visitor to our Website is using). Detailed information on Cookies, as well as the history of their origin, can be found, among other places, here: https://pl.wikipedia.org/wiki/HTTP_cookie Cookies that may be sent by the Website can be divided into different types, according to the following criteria:
| By provider:
1) own (created by the Administrator's Website) and 2) belonging to third parties (other than the Administrator) |
By the period for which they are stored on the device of the person visiting the Website:
1) session cookies (stored until logging out of the Website or closing the web browser) and 2) persistent cookies (stored for a specified period, defined by the parameters of each file, or until manually deleted) |
By the purpose of their use:
1) necessary (enabling the proper functioning of the Website), 2) functional/preference (enabling the Website to be adapted to the preferences of the person visiting the site), 3) analytical and performance (gathering information about how the Website is used), 4) marketing, advertising and social-media (collecting information about the person visiting the Website in order to display personalised advertisements to that person and to carry out other marketing activities, including also on websites separate from the Website, such |
|---|
The Administrator may process data contained in Cookies while visitors are using the Website for the following specific purposes:
| Purposes of using Cookies on the Administrator's Website | Identifying Service Recipients as logged in to the Website and showing that they are logged in (necessary Cookies) |
| Remembering data entered in forms, surveys or login details for the Website (necessary and/or functional/preference Cookies) | |
| Adapting the content of the Website to the individual preferences of the Service Recipient (e.g. concerning colours, font size, page layout) and optimising the use of the Website (functional/preference Cookies) | |
| Keeping anonymous statistics showing how the Website is used (statistical Cookies) | |
| Remarketing, that is, examining the behavioural characteristics of Website visitors through anonymous analysis of their actions (e.g. repeat visits to specific pages, keywords, etc.) in order to build a profile of them and serve them advertisements matched to their likely interests, including when they visit other websites within the advertising network of Google Ireland Ltd. and Facebook Ireland Ltd. (marketing, advertising and social-media Cookies) |
You can check which Cookies (including their lifespan and provider) are being sent by the Website at any given time in the most popular web browsers as follows:
| In the Chrome browser: (1) in the address bar, click the padlock icon on the left, (2) go to the "Cookies" tab. | In the Firefox browser: (1) in the address bar, click the shield icon on the left, (2) go to the "Allowed" or "Blocked" tab, (3) click "Cross-site tracking cookies", "Social media trackers" or "Tracking content" | In the Internet Explorer browser: (1) click the "Tools" menu, (2) go to the "Internet Options" tab, (3) go to the "General" tab, (4) go to the "Settings" tab, (5) click "View files" |
| In the Opera browser: (1) in the address bar, click the padlock icon on the left, (2) go to the "Cookies" tab. | In the Safari browser: (1) click the "Preferences" menu, (2) go to the "Privacy" tab, (3) click "Manage Website Data" | Regardless of the browser, using tools available e.g. at: https://www.cookiemetrix.com/ or: https://www.cookie-checker.com/ |
Most web browsers available on the market accept the saving of Cookies by default. Everyone can determine the conditions for using Cookies through the settings of their own web browser. This means that it is possible, for example, to partially restrict (e.g. temporarily) or completely disable the ability to save Cookies – however, in the latter case this may affect certain functionalities of the Website.
Web browser settings regarding Cookies are relevant from the point of view of consent to the use of Cookies by our Website – under applicable regulations, such consent may also be expressed through browser settings. Detailed information on changing Cookie settings and deleting them yourself in the most popular web browsers is available in the help section of the web browser and on the pages below (simply click the relevant link):
- in the Chrome browser
- in the Firefox browser
- in the Internet Explorer browser
- in the Opera browser
- in the Safari browser
- in the Microsoft Edge browser
The Administrator may use Google Analytics and Universal Analytics services on the Website, provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). These services help the Administrator keep statistics and analyse traffic on the Website. The data collected is processed within the above services to generate statistics helpful in administering the Website and analysing traffic on the Website. This data is aggregate in nature. By using the above services on the Website, the Administrator collects data such as the source and medium by which visitors reach the Website and how they behave on the Website, information about the devices and browsers from which they visit the site, IP address and domain, geographic data, and demographic data (age, gender) and interests.
It is possible to easily block Google Analytics from receiving information about your activity on the Website – for this purpose you can, for example, install the browser add-on provided by Google Ireland Ltd., available here: https://tools.google.com/dlpage/gaoptout?hl=pl
The Administrator may use the Facebook Pixel service on the Website, provided by Facebook Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland). This service helps the Administrator measure the effectiveness of advertisements and find out what actions Website visitors take, as well as display matched advertisements to those persons. Detailed information on how the Facebook Pixel works can be found at the following web address:https://www.facebook.com/business/help/742478679120153?helpref=page_content
You can manage the operation of the Facebook Pixel through the ad settings in your account on Facebook.com:https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen