general provisions
This Privacy Policy of the Website is informational in nature, which means it is not a source of obligations for Users of the Website. The Privacy Policy primarily sets out the rules for the processing of personal data by the Administrator on the Website, including the grounds, purposes, and scope of personal data processing, the rights of data subjects, and information on the use of cookies and analytical tools on the Website.
The administrator of personal data collected via the Website is MARKOR SPÓŁKA JAWNA BIAŁEK, with its registered office in Drzewica (registered office address and address for service: ul. Braci Kobylańskich 5, 26-340 Drzewica); entered in the Register of Entrepreneurs of the National Court Register under KRS number 0000530783; the registry court where the company's documentation is kept: District Court for Łódź-Śródmieście in Łódź, XX Commercial Division of the National Court Register; NIP (Tax ID): 7681836736; REGON (Statistical ID): 360117358, email addresses: bok@kmbc.pl and dk@kmbc.pl, and contact phone number: 535334567 — hereinafter referred to as the "Administrator," and simultaneously the Owner of the Website.
Personal data on the Website is processed by the Administrator in accordance with applicable law, in particular in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) — hereinafter referred to as "GDPR" or the "GDPR Regulation." Official text of the GDPR Regulation: http://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32016R0679
Use of the Website is voluntary. Similarly, the provision of personal data by a User of the Website is voluntary, subject to two exceptions: (1) entering into agreements with the Administrator: failure to provide the data required — to the extent necessary to conclude and perform a Sales Agreement or an agreement for the provision of an Electronic Service with the Administrator — results in the inability to conclude such an agreement. In such a case, providing personal data is a contractual requirement, and if the data subject wishes to enter into an agreement with the Administrator, they are obliged to provide the required data. The scope of data required to conclude an agreement is indicated by the Administrator on each occasion; (2) the Administrator's statutory obligations: providing personal data is a statutory requirement arising from generally applicable laws that impose on the Administrator an obligation to process personal data (e.g., processing data for the purpose of maintaining tax or accounting records), and failure to provide it will prevent the Administrator from fulfilling those obligations. The Administrator exercises particular care to protect the interests of the data subjects whose personal data it processes, and in particular is responsible for and ensures that the data it collects is: (1) processed lawfully; (2) collected for specified, lawful purposes and not further processed in a manner incompatible with those purposes; (3) substantively correct and adequate in relation to the purposes for which it is processed; (4) kept in a form which permits identification of data subjects for no longer than is necessary for the purposes for which the data is processed; and (5) processed in a manner that ensures appropriate security of personal data, including protection against unauthorized or unlawful processing and against accidental loss, destruction, or damage, through appropriate technical or organizational measures.
Taking into account the nature, scope, context, and purposes of processing, as well as the risk of varying likelihood and severity to the rights and freedoms of natural persons, the Administrator implements appropriate technical and organizational measures to ensure that processing is carried out in accordance with this Regulation and to be able to demonstrate this. These measures are reviewed and updated as necessary. The Administrator applies technical measures to prevent the acquisition and modification of personal data sent electronically by unauthorized persons.
All words, expressions, and acronyms appearing in this Privacy Policy and starting with a capital letter (e.g., Website, Electronic Service) should be understood in accordance with the meaning assigned to them in this document.
grounds for data processing
The Administrator is entitled to process personal data in cases where — and to the extent that — at least one of the following conditions is met: (1) the data subject has given consent to the processing of their personal data for one or more specified purposes; (2) processing is necessary for the performance of a contract to which the data subject is a party, or in order to take steps at the request of the data subject prior to entering into a contract; (3) processing is necessary for compliance with a legal obligation to which the Administrator is subject; or (4) processing is necessary for the purposes of the legitimate interests pursued by the Administrator or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
The Administrator's processing of personal data requires, in each case, at least one of the grounds indicated above. The specific grounds for the Administrator's processing of the personal data of Website Users are indicated in the next section of the Privacy Policy, with reference to the given purpose of the Administrator's processing of personal data.
The administrator of personal data collected and processed in connection with the use of the Website is the Owner. Personal data is processed for the purposes, for the period, and on the grounds and principles set out in the Privacy Policy published on the Website. The Privacy Policy primarily sets out the rules for the processing of personal data by the Administrator on the Website, including the grounds, purposes, and period of personal data processing, the rights of data subjects, and information on the use of Cookies and analytical tools on the Website. Use of the Website is voluntary. Similarly, the provision of personal data by a User of the Website is voluntary, subject to the exceptions set out in the Privacy Policy (e.g., the Owner's statutory obligations).
PURPOSE, BASIS, AND PERIOD OF DATA PROCESSING ON THE WEBSITE
In each case, the purpose, basis, and scope, as well as the recipients of the personal data processed by the Administrator, result from the actions taken by a given User on the Website. The Administrator may process personal data on the Website for the following purposes, on the following grounds, for the following periods, and to the following extent:
| Purpose of data processing | Legal basis for data processing | Data retention period |
|---|---|---|
| Performance of an agreement for the provision of an Electronic Service or taking steps at the request of the data subject prior to entering into an agreement | Article 6(1)(b) of the GDPR (performance of a contract) — processing is necessary for the performance of a contract to which the data subject is a party, or to take steps at the request of the data subject prior to entering into a contract | Data is stored for the period necessary for the performance, termination, or other expiry of the concluded agreement. |
| Direct marketing | Article 6(1)(f) of the GDPR (legitimate interest of the administrator) — processing is necessary for purposes arising from the Administrator's legitimate interests, consisting of caring for the Administrator's interests and good image and pursuing the sale of products or services | Data is stored for the period during which the legitimate interest pursued by the Administrator exists, but no longer than the limitation period for claims against the data subject arising from the Administrator's business activity. The limitation period is set out in the applicable law, in particular the Civil Code (the basic limitation period for claims related to business activity is three years, and for a sales agreement, two years). The Administrator may not process data for direct marketing purposes if the data subject has effectively objected in this regard. |
| Marketing | Article 6(1)(a) of the GDPR (consent) — the data subject has given consent to the processing of their personal data for marketing purposes by the Administrator | Data is stored until the data subject withdraws their consent to further processing of their data for this purpose. |
| Establishing, pursuing, or defending claims that may be raised by the Administrator or that may be raised against the Administrator | Article 6(1)(f) of the GDPR — processing is necessary for purposes arising from the Administrator's legitimate interests, consisting of establishing, pursuing, or defending claims that may be raised by the Administrator or that may be raised against the Administrator | Data is stored for the period during which the legitimate interest pursued by the Administrator exists, but no longer than the limitation period for claims against the data subject arising from the Administrator's business activity. The limitation period is set out in the applicable law, in particular the Civil Code (the basic limitation period for claims related to business activity is three years). |
| Use of the Website and ensuring its proper operation | Article 6(1)(f) of the GDPR (legitimate interest of the administrator) — processing is necessary for purposes arising from the Administrator's legitimate interests, consisting of running and maintaining the Website | Data is stored for the period during which the legitimate interest pursued by the Administrator exists, but no longer than the limitation period for the Administrator's claims against the data subject arising from the Administrator's business activity. The limitation period is set out in the applicable law, in particular the Civil Code (the basic limitation period for claims related to business activity is three years). |
| Maintaining statistics and analyzing traffic on the Website | Article 6(1)(f) of the GDPR (legitimate interest of the administrator) — processing is necessary for purposes arising from the Administrator's legitimate interests, consisting of maintaining statistics and analyzing traffic on the Website in order to improve the functioning of the Website | Data is stored for the period during which the legitimate interest pursued by the Administrator exists, but no longer than the limitation period for the Administrator's claims against the data subject arising from the Administrator's business activity. The limitation period is set out in the applicable law, in particular the Civil Code (the basic limitation period for claims related to business activity is three years). |
RECIPIENTS OF DATA ON THE WEBSITE
For the Website to function properly, the Administrator must use the services of external entities (such as, for example, a software provider). The Administrator uses only the services of such processing entities that provide sufficient guarantees of implementing appropriate technical and organizational measures so that processing meets the requirements of the GDPR Regulation and protects the rights of data subjects. The Administrator does not transfer data in every case and not to all recipients or categories of recipients listed in the Privacy Policy — the Administrator transfers data only when it is necessary to achieve a given purpose of personal data processing, and only to the extent necessary to achieve it. The personal data of Website Users may be transferred to the following recipients or categories of recipients:
RIGHTS OF THE DATA SUBJECT
Right of access, rectification, restriction, erasure, or portability — the data subject has the right to request from the Administrator access to their personal data, its rectification, erasure ("the right to be forgotten"), or restriction of processing, and has the right to object to processing, as well as the right to data portability. The detailed conditions for exercising the above rights are set out in Articles 15-21 of the GDPR Regulation.
Right to withdraw consent at any time — if a data subject's data is processed by the Administrator on the basis of consent given (pursuant to Article 6(1)(a) or Article 9(2)(a) of the GDPR Regulation), they have the right to withdraw their consent at any time without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal.
Right to lodge a complaint with a supervisory authority — a data subject whose data is processed by the Administrator has the right to lodge a complaint with a supervisory authority in the manner and procedure set out in the provisions of the GDPR Regulation and Polish law, in particular the Personal Data Protection Act. The supervisory authority in Poland is the President of the Personal Data Protection Office.
Right to object — the data subject has the right, at any time, to object — on grounds relating to their particular situation — to the processing of their personal data based on Article 6(1)(e) (public interest or the exercise of official authority) or (f) (legitimate interest of the administrator), including profiling based on these provisions. In such a case, the Administrator may no longer process this personal data unless it demonstrates the existence of compelling legitimate grounds for processing that override the interests, rights, and freedoms of the data subject, or grounds for the establishment, exercise, or defense of legal claims.
Right to object to direct marketing — if personal data is processed for direct marketing purposes, the data subject has the right, at any time, to object to the processing of their personal data for such marketing, including profiling, to the extent that the processing is related to such direct marketing.
To exercise the rights referred to in this section of the Privacy Policy, you may contact the Administrator by sending an appropriate message in writing or by email to the Administrator's address indicated at the beginning of the Privacy Policy, or by using the contact form available on the Website.
COOKIES ON THE WEBSITE AND ANALYTICS
Cookies are small pieces of text information in the form of text files, sent by a server and stored on the device of a person visiting the Website (e.g., on the hard drive of a computer, laptop, or on the memory card of a smartphone — depending on the device used by the visitor to our Website). Detailed information about cookies, including their history, can be found, among other places, here: https://en.wikipedia.org/wiki/HTTP_cookie Cookies that may be sent by the Website can be divided into different types, according to the following criteria:
| By provider:
1) first-party (created by the Administrator's Website) and 2) belonging to third parties (other than the Administrator) |
By their storage period on the device of the person visiting the Website:
1) session cookies (stored until logging out of the Website or closing the web browser) and 2) persistent cookies (stored for a specified time, defined by the parameters of each file, or until manually deleted) |
By purpose of use:
1) necessary (enabling the proper functioning of the Website), 2) functional/preference (enabling the Website to be tailored to the preferences of the person visiting the site), 3) analytical and performance (collecting information on how the Website is used), 4) marketing, advertising, and social (collecting information about the person visiting the Website in order to display personalized advertisements to that person and to conduct other marketing activities, including on websites other than the Website, such |
|---|
The Administrator may process data contained in cookies while visitors use the Website for the following specific purposes:
| Purposes of using cookies on the Administrator's Website | Identifying Users as logged in on the Website and showing that they are logged in (necessary cookies) |
| Remembering data from completed forms, surveys, or Website login data (necessary and/or functional/preference cookies) | |
| Tailoring the content of the Website to the individual preferences of the User (e.g., regarding colors, font size, page layout) and optimizing use of the Website (functional/preference cookies) | |
| Maintaining anonymous statistics showing how the Website is used (statistical cookies) | |
| Remarketing, i.e., studying the behavioral characteristics of Website visitors through anonymous analysis of their actions (e.g., repeat visits to specific pages, keywords, etc.) in order to create their profile and deliver advertisements tailored to their anticipated interests, including when they visit other websites within the advertising network of Google Ireland Ltd. and Facebook Ireland Ltd. (marketing, advertising, and social cookies) |
You can check which cookies (including their duration and provider) are being sent by the Website at any given time in the most popular web browsers as follows:
| In Chrome: (1) click the padlock icon on the left of the address bar, (2) go to the "Cookies" tab. | In Firefox: (1) click the shield icon on the left of the address bar, (2) go to the "Allowed" or "Blocked" tab, (3) click "Cross-Site Tracking Cookies," "Social Media Trackers," or "Tracking Content" | In Internet Explorer: (1) click the "Tools" menu, (2) go to "Internet Options," (3) go to the "General" tab, (4) go to "Settings," (5) click "View files" |
| In Opera: (1) click the padlock icon on the left of the address bar, (2) go to the "Cookies" tab. | In Safari: (1) click the "Preferences" menu, (2) go to the "Privacy" tab, (3) click "Manage Website Data" | Regardless of your browser, using tools available e.g. at: https://www.cookiemetrix.com/ or: https://www.cookie-checker.com/ |
By default, most web browsers on the market accept the storage of cookies. Everyone can determine the conditions for using cookies through their own browser settings. This means you can, for example, partially restrict (e.g., temporarily) or completely disable the storage of cookies — however, in the latter case this may affect certain functionalities of the Website.
Web browser settings regarding cookies are relevant from the standpoint of consent to the use of cookies by our Website — under applicable law, such consent may also be expressed through browser settings. Detailed information on changing cookie settings and deleting them yourself in the most popular web browsers is available in the browser's help section and on the pages below (just click the relevant link):
The Administrator may use Google Analytics and Universal Analytics services on the Website, provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). These services help the Administrator maintain statistics and analyze traffic on the Website. The collected data is processed within these services to generate statistics useful for administering the Website and analyzing traffic on the Website. This data is aggregate in nature. By using the above services on the Website, the Administrator collects data such as the sources and medium through which visitors reach the Website and how they behave on the Website, information about the devices and browsers used to visit the site, IP address and domain, geographic data, and demographic data (age, gender) and interests.
A person can easily block the sharing of information about their activity on the Website with Google Analytics — for example, by installing a browser add-on provided by Google Ireland Ltd., available here: https://tools.google.com/dlpage/gaoptout?hl=en
The Administrator may use the Facebook Pixel service on the Website, provided by Facebook Ireland Limited (4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland). This service helps the Administrator measure the effectiveness of advertisements and find out what actions Website visitors take, as well as display personalized ads to those visitors. Detailed information on how the Facebook Pixel works can be found at the following web address:https://www.facebook.com/business/help/742478679120153?helpref=page_content
You can manage the operation of the Facebook Pixel through your ad settings in your Facebook.com account:https://www.facebook.com/ads/preferences/?entry_product=ad_settings_screen