Privacy Policy

In connection with the application of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the General Data Protection Regulation, hereinafter referred to as the GDPR), effective from 25 May 2018, we would like to provide you with important information regarding how we process your personal data and the rights you have in relation to such processing.

Personal data means any information relating to an identified or identifiable natural person (the “data subject”). This includes, for example, your first name, last name, address, date of birth, telephone number, or email address (this list is not exhaustive).

The data controller is the entity that, alone or jointly with others, determines the purposes and means of processing personal data. In other words, the data controller decides how your personal data is processed and is responsible for ensuring that such processing complies with applicable legal requirements.

The controller of your personal data for the purposes described below is:

Tartak “Olczyk” Sp. z o.o.
Świdno 1
29-105 Krasocin
Poland

In what purposes and on what legal bases may we process your personal data?

We may process your personal data for the following purposes:

1. For the conclusion and performance of a contract (Article 6(1)(a) of the GDPR), including the verification of your creditworthiness and the settlement of the contract, based on the data provided by you or obtained from other sources (the National Court Register (KRS), the Central Registration and Information on Business (CEIDG), and Business Information Bureaus (BIG); in each case, the legal basis for obtaining such information is provided by the regulations governing the operation of the respective information databases).
2. Where processing is necessary for compliance with legal obligations to which we are subject (Article 6(1)(c) of the GDPR), in particular:
   • a) compliance with tax obligations (issuing and accounting for invoices and other accounting documents);
   • b) fulfilment of obligations related to the exercise of the rights provided for under the GDPR (including, where necessary, identifying and verifying the identity of the requesting individual and providing a response).
3. For the purposes of our legitimate interests (Article 6(1)(f) of the GDPR), including:
   • a) direct marketing of our products or services carried out during the performance of a contract;
   • b) the establishment, exercise, or defence of legal claims that may arise in connection with contracts entered into (including the performance and settlement of contracts and the handling of complaints), or in connection with the fulfilment of obligations arising under the GDPR (in order to demonstrate compliance with the applicable legal requirements);
   • c) responding to enquiries and requests submitted by email, through the contact form, or to an employee’s email address (conducting email correspondence);
   • d) enabling communication between employees of the contracting parties who are not themselves parties to the contract, both during the quotation stage and in the course of the performance of concluded contracts;
   • e) verification of the identity of employees of contractors cooperating with the Company, for example drivers collecting our products or collecting products ordered from our contractor.

Providing your personal data is voluntary; however, it is necessary for the purposes described above, for example to enable us to conclude a contract with you or respond to your enquiry. Giving your consent is always entirely voluntary. We may also process your personal data for other purposes, provided that all legal requirements applicable to such processing are fulfilled (in particular where we have an appropriate legal basis for the processing and have complied with our information obligations towards you).

How long do we process your personal data?

Your personal data is processed for the following periods (these are the maximum data retention periods):

1. Personal data processed for the purpose of concluding and performing a contract – for the duration of the contract, and thereafter until the expiry of the limitation period for mutual claims (solely for the purpose of establishing, pursuing, or defending legal claims), on the basis of our legitimate interest or until you effectively object to such processing.
2. Personal data processed for the purpose of complying with tax obligations – for the period specified by applicable tax laws, which, as a rule, is 5 years from the end of the calendar year in which the invoice was issued.
3. Personal data processed for the purpose of fulfilling obligations related to the exercise of the rights provided for under the GDPR – for the period necessary to defend against legal claims (i.e. for the limitation period applicable to claims arising from the infringement of personal rights).
4. Personal data processed for the purpose of direct marketing of our own products or services – until you object to such processing, and following your objection or withdrawal of consent, solely for the purpose of defending against legal claims (for the limitation period applicable to claims arising from the infringement of personal rights).
5. Personal data processed for the purpose of establishing, pursuing, or defending legal claims – for the limitation period applicable to claims both against the Company and those asserted by the Company.
6. Personal data processed for the purpose of responding to enquiries and requests submitted by email – until an effective objection is raised or until the expiry of the limitation period for mutual claims arising in connection with the correspondence, for example those related to the performance of a contract.
7. Personal data processed for the purpose of enabling communication between employees of the contracting parties – until an effective objection is raised or until the expiry of the limitation period for mutual claims arising in connection with the correspondence, for example those related to the performance of a contract.
8. Personal data processed for the purpose of verifying the identity of employees – until an objection is raised or until the expiry of the limitation period for mutual claims arising in connection with the correspondence, for example those related to the performance of a contract.

From what sources do we obtain your personal data?

In typical situations, we obtain your personal data directly from you, for example in connection with the conclusion and performance of contracts or when responding to your enquiries (e.g. through the contact details provided on our website). We may also obtain your data from publicly available sources, such as your company’s website or the website of the company where you are employed. Such data may include your first name, surname, job title, business telephone number, and business email address (for contact purposes). We may also obtain your data from the National Court Register (KRS) or the Central Registration and Information on Business (CEIDG) (for the purpose of verifying the information you have provided, solely within the scope of the information contained therein), as well as from publicly available industry portals. Your personal data may also be provided to us by your employer in order to enable us to contact you in connection with a contract concluded with your employer or to verify your identity (for example, where you are a driver collecting our products).

To whom do we disclose your personal data?

Your personal data will not be disclosed to any third party unless such disclosure is necessary for the performance of a contract to which the Company is a party (for example, a contract with an insurer or with a customer to whom the Company’s products are delivered using external transport services), or where disclosure is required by law, for example at the request of the Police or another competent public authority. We may also disclose your personal data where we have another legal basis for doing so. In each case, the existence of such a legal basis is verified by us, and you will be informed accordingly. Your personal data may also be disclosed to data processors acting on our behalf, such as security service providers (where you visit our premises) or providers of IT services. We conclude data processing agreements with such entities, and they may process your personal data only for the purposes and within the scope specified in those agreements. Your personal data may also be shared with employees of other departments within the Company. For example, if you conclude a contract with the Sales Department, your personal data will also be provided to the Accounting Department for the purpose of settling that contract. Access to personal data is granted only to duly authorised employees and only to the extent necessary for the performance of their duties. If your personal data is to be transferred outside the European Economic Area (EEA), the Company will implement appropriate safeguards to ensure that such transfers are carried out in accordance with the applicable data protection laws.

What rights do you have regarding the processing of your personal data?

You have the right to access your personal data, including the right to obtain a copy of your data, the right to data portability, the right to rectify and erase your data, the right to restrict processing, and the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you (see more at: www.giodo.gov.pl). We also encourage you to read the information leaflet concerning your rights, available at: https://www.gov.pl/cyfryzacja/rodo-informator. You also have the right to lodge a complaint with the supervisory authority (the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych). Where your personal data is processed on the basis of your consent, you may withdraw that consent at any time. You may withdraw your consent by sending an email or a letter to the contact details provided below (see the section “How to contact us”). The withdrawal of consent does not affect the lawfulness of any processing carried out before the withdrawal of consent. Following the withdrawal of your consent, the Company will assess whether it continues to have another legal basis for processing your personal data.

Please note that whenever your personal data is processed on the basis of Article 6(1)(f) of the GDPR (see above), namely on the basis of the Company’s legitimate interests, you have the right to object at any time, on grounds relating to your particular situation, to the processing of your personal data.

Following such an objection, the Company will no longer be entitled to process your personal data unless it demonstrates compelling legitimate grounds for the processing which override your interests, rights, and freedoms, or unless the processing is necessary for the establishment, exercise, or defence of legal claims. Whenever the Company relies on its legitimate interests as the legal basis for processing personal data pursuant to Article 6(1)(f) of the GDPR, it always carries out a careful assessment to determine whether such legitimate interests genuinely exist. In the context of processing based on legitimate interests, it should be noted that this legal basis (i.e. without the need to obtain additional consent) allows the Company to process personal data for the purpose of marketing its own products or services during the term of the contractual relationship (for example, through traditional direct mail marketing).

You should also note that where personal data is processed pursuant to Article 6(1)(f) of the GDPR for direct marketing purposes relating to the Company’s own products or services, you are not required to justify your objection by reference to your particular situation. Once you object, the Company will no longer process your personal data for direct marketing purposes on the basis of Article 6(1)(f) of the GDPR to the extent that such data was processed for those purposes. You may submit your objection using the contact details provided below (see the section “How to contact us”). For all matters relating to the protection of your personal data (including submitting an objection, withdrawing your consent, reporting a suspected breach of personal data protection legislation, or exercising any of your other rights), you may contact us by email at: biuro@tartakolczyk.com.pl. In response to your request, you may be asked to provide the information necessary to verify your identity or any additional information required to enable us to process your request correctly.

Request a Quote