Privacy policy

I. Overview

In the privacy policy we inform about the legal basis for the processing of personal data, ways of collecting, processing and using them, as well as about the rights of the data subjects.

This policy applies to all cases in which OGUMIENIE CST acts as the Controller and Processor of personal data obtained from Data Subjects, as well as cases in which personal data have been obtained from other sources with the exception of personal data of employees and those processed under entrustment agreements.

II. Personal Data Controller:

The controller of your personal data is OGUMIENIE CST s.c. Anna Brela, Iwona Chrapek, seated in Zabrze 41-800 at ul. M.C. Skłodowskiej 34, NIP: 648-26-86-535, REGON number: 241062477, hereinafter referred to as “OGUMIENIE CST”.

III. Contact details for personal data protection issues

OGUMIENIE CST s.c. A. Brela, I. Chrapek
Ul. M.C. Skłodowskiej 34
41-800 Zabrze

Or to the following email address:
rodo@cstpoland.pl 

 

IV. Purpose, legal grounds and storage period of personal data

Purpose of data processing Legal grounds Storage period
Registering an account on our portals Article 6(1)(a) of the GDPR consent of the data subject until the moment of its withdrawal
Performance of a contract, order to which the data subject is a party Article 6(1)(b) of the GDPR performance of a contract or order to which the data subject is party until the contract or order have been performed or until the prescription of regulatory claims
Performance of a contract or order – personal data of people indicated in the contracts or of contact persons Article 6(1)(f) of the GDPR legitimate interests of the controller until the claims arising from the regulations have been concluded and prescribed
Recruitment Article 6(1)(a) of the GDPR giving consent by the data subject to the processing of their data 4 months after the end of the recruitment process
Newsletter Article 6(1)(a) of the GDPR giving consent by the data subject until the moment of its withdrawal
Response to an inquiry Article 6(1)(a) of the GDPR giving consent by the data subject until a reply is given, as well as for a period of 3 years from the termination of a contact (prescription of possible claims) or until the withdrawal of consent by the inquiring person
Complaint Article 6(1)(f) of the GDPR legitimate interests of the controller until the claims arising from the regulations have been prescribed
Accounting, tax Article 6(1)(c) of the GDPR For a period of 6 years from the date of completion of the service, contract, order
Seeing compensation or protection against claims Article 6(1)(f) of the GDPR legitimate interest Necessity to fulfill the obligation and prescription of claims
Product and service marketing, including profiling Article 6(1)(a) of the GDPR giving consent by the data subject until the moment of its withdrawal
Product and service marketing, including profiling Article 6(1)(f) of the GDPR legitimate interests of the controller until such time as an objection is raised
Organization and promotion of an event Article 6(1)(f) of the GDPR legitimate interests of the controller until the end of the event and the prescription of claims
Competitions, tests Article 6(1)(a) of the GDPR consent of the data subject until its withdrawal or r until the end of the competition and tests and the prescription of claims

 

V. Source of data collected and type of data made available by other entities

OGUMIENIE CST receives personal data directly from the data subjects or through other persons (from the data subject’s employer, from another employee or other entity with which the data subject cooperates on a regular basis).

If we collect personal data directly from you, you have direct control over the scope of the data collected by OGUMIENIE CST.

If the data are made available by another person, OGUMIENIE CST usually collects contact data related to the professional activity such as: name, surname, telephone number, e-mail address, company name, position or position and possibly other data resulting from the order or contract which serve as the basis for sharing personal data.

 

VI. Cookies

On our websites we may collect personal data automatically using cookies. Cookies are small text files that a website can send to your browser for storing on your computer, tablet or other mobile device. Cookies can make it easier to use a website by preserving and managing information about the status, applications, preferences and other information about the user. The settings of most browsers allow you to accept cookies, but users can change them to refuse cookies or receive warnings when they are sent./p>

 

If you want to learn more about our use of cookies, please refer to the cookies policy available on our websites.

 

VII. Automated decision making

The data you provide may be processed for the purpose of profiling and adapting the marketing content, offers or information we send to your interests and business or professional activities.

The data you provide will not be processed for the purpose of automated decision making.

 

VIII. Consequences of failure to provide data

1. . In the case of electronic forms (e.g. contact forms), providing data is voluntary, only failure to provide data indicated as mandatory will result in the lack of possibility to send a form, participate in an event or subscribe to a newsletter.

2. In the case of persons who are a party to a contract/order, the provision of data necessary for the performance of the contract and legal obligations predetermines the conclusion and performance of the contract.

3. Providing data collected by representatives in the field of marketing, purchasing and sales activities is fully voluntary. Failure to submit the data results in the lack of possibility to contact you in the future.

 

IX. Recipients of personal data

We only pass on personal data to other entities if the law allows it. In such cases, we enter into third party agreements that include provisions and security mechanisms to ensure adequate protection of personal data and upholding of our standards.

OGUMIENIE CST is part of a worldwide network and, together with other professional service providers, it operates through external entities seated in other countries. Therefore, your personal data may be transferred to a country outside the EU.

In case of transferring the data to a third country for which no adequacy decision of the European Commission has been issued, the transfer shall take place only on the basis of an agreement taking into account EU requirements for the transfer of personal data outside the EEA.

The data we store can be transferred:

  1. to processors of personal data under entrustment agreements
  2. to providers of website hosting and management services
  3. to entities providing services in the field of software delivery, software and hardware maintenance, backup, security, data analysis
  4. to entities running marketing campaigns
  5. to entities providing survey services, including customer satisfaction surveys
  6. to debt collection companies
  7. to auditors, experts, legal and tax advisors
  8. to law enforcement authorities, regulators, state and local government bodies under legal provisions

 

X. Rights of data subjects

As per GDPR, you are entitled to: 

  1. 1. access your data, including to obtain a copy of the data
  2. 2. rectify (amend, update) the data
  3. 3. have your data erased (in cases indicated in the GDPR) 
  4. 4. restrict the processing of your personal data
  5. 5. object to its processing
  6. 6. transfer of data where the processing is based on your consent or a contract to which you are a party
  7. 7. withdraw your consent if your data are processed based on your consent.

    If you wish to unsubscribe from the newsletter, you can use the unsubscribe link included in each email sent to you or you may use the data contained in section III “Contact details for data protection issues”

    If you wish to withdraw your consent to the processing of your data, please use the contact details in section III “Contact details for data protection issues”

  8. 8. lodge a complaint with the supervisory authority – the President of the Office for the Protection of Personal Data. The list of supervisory authorities in other EU Member States is available at: http://ec.europa.eu/newsroom/article29/item-detail.cfm?item_id=612080.

OGUMIENIE CST reserves the right to exercise the above rights after positive verification of the identity of the person applying for its execution.

Exercising the aforementioned rights depends on detailed conditions set out in the GDPR. In case of a refusal to comply with your request, you will receive a response containing the reasons for the refusal.

If you wish to exercise your rights, please use the data indicated in section III “Contact details for data protection issues”

Please do not send any specific categories of personal data (revealing racial or ethnic origin, political opinions, beliefs, trade union affiliation, information relating to physical or mental health, genetic data, biometric data, information on sexual life, sexual orientation, convictions and violations of the law) via contact forms or websites. If you provide such information, this will imply your express consent to the collection and use of such information by OGUMIENIE CST in the manner specified in the form or document in which the data were disclosed to us.

 

XI. Security

To ensure the security of personal data, OGUMIENIE CST selects and applies appropriate technical and organizational measures to ensure the protection of the processed data and applies safeguards to protect the data against unauthorized access as well as against processing in breach of the applicable law. We have implemented appropriate policies, procedures and training regarding personal data protection and we regularly check whether the measures taken are adequate to secure the data held.

 

XII. Note from the administrator

OGUMIENIE CST reserves the right to modify this privacy policy in particular when it proves necessary or advisable in view of the guidelines of authorities responsible for the supervision of personal data protection processes, personal data processing practices, changes in technology, manners and purposes of processing personal data.

Last updated on May 22, 2018