Privacy - general

---

INTRODUCTORY INFORMATION

Respecting the right to privacy of the persons who entrusted ORBICO Sp. z o.o. (hereinafter referred to as "Orbico") with their personal data, we would like to state that we process the collected data in accordance with national and European legal regulations and in conditions ensuring their safety. In order to ensure transparency of data processing, we present the rules of personal data protection applicable in Orbico, as laid down in the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation)  (General Data Protection Regulation, hereinafter referred to as the "GDPR").

Data Controller

The controller, i.e. the entity deciding about the purposes and means of personal data processing is ORBICO Sp. z o.o. with its registered office in Warsaw 02-675 at ul. Wołoska 5, entered in the National Court Register by the District Court for the Capital City of  Warsaw in Warsaw, 13th Commercial Division under the number: KRS 0000046562, REGON: 277632751, NIP: 646-25-26-337, share capital PLN 40 841 450,00.

Orbico attaches considerable importance to the protection of personal data, which is why as a Controller it encourages you to contact in case of any doubts regarding the processing of your personal data at the e-mail address iod.no.pl@orbico.com

Obtaining personal data and the purpose of their processing

Orbico is a member of the Orbico Group, the largest distributor in Europe.  While running our business we process personal data for the following purposes:

Conclusion and performance of a contract  with a customer or a contractor
Art. 6, sec. 1b and f of the GDPR
For the term of the contract, and after its termination until the expiration of the claims resulting from it, as a rule - for 3 years (in the case of a sales contract within the scope of the business activity of the company - for 2 years), maximum: for 6 years.
In connection with actions taken in order to conclude a contract or in relation to its performance, the Data Controller shall contact the employees/co-operators of clients and contractors for a justified purpose. Moreover, the Controller may obtain from the contracting party the basic data of its employee/co-worker (name, surname, place of employment or cooperation, telephone number, e-mail adress and in specific situations the document number with a photo) in connection with the performance of the contract to which the data relate, from the entity with which the person is employed or cooperates.

Complaints handling
Art. 6, sec. 1b and f of the GDPR
For 1 year from the date of expiration of the warranty or complaint solution.
In connection with the processing of a complaint, the Controller shall contact the employees/workers of the clients for a justified purpose.

Assertion of claims or defense against claims
Art. 6, sec. 1f of the GDPR
For the duration of proceedings concerning the claims, i.e. until their final settlement, and in the case of enforcement proceedings until the final settlement of the claims being pursued.
In connection with assertion of claims or defending against claims, for a justified purpose the Controller may process the data of customers, contractors,  employees/co-operators of customers or contractors.

Filing the documents i.e. agreements and settlement documents
Art. 6, sec. 1c of the GDPR
For the periods specified by law and if, with regard to certain documents, they are not indicated, for the time when their storage is within the scope of the legally justified purpose of the Controller, depending on the time of claims assertion

Keeping statistics and analyses
Art. 6, sec. 1f of the GDPR
Until another processing purpose specified in this table is met.. We do not store personal data exclusively for statistical and analytical purposes.
Keeping statistics and analysis of activities allows the controller to improve the business.

Marketing activities without the use of electronic means of communication
Art. 6, sec. 1f of the GDPR
Until you object i.e. inform us in any form that you do not wish to be contacted by us and that you do not want to be informed of the actions we take.
Marketing activities promoting our business.

Marketing activities with the use of electronic means of communication
Art. 6, sec. 1a GDPR
Due to other applicable regulations, in particular, the Telecommunications Law and the Act on providing services by electronic means these activities are conducted on the basis of consents obtained.
Until you withdraw your consent, i.e. inform us in any form that you do not wish to be contacted by us and that you do not want to be informed of the actions we take. After withdrawal of your consent - in order to prove compliance of Orbico with its legal obligations and related claims (up to 6 years from the revocation of your consent).
Marketing activities promoting our business with the use of email addresses and telephone numbers.

Access control, including monitoring on the premises of the Data Controller for the purposes of improving the security of employees, protection of property and confidentiality of information 
Art. 6, sec. 1c and f of the GDPR
Until an objection is lodged (no longer than one year)
Image recordings shall only be processed for the purposes for which they were collected and shall be kept for a period not exceeding 3 months from the date of recording, unless the recording is an evidence in the proceedings, and then  - until the proceedings are finally terminated or until an objection is lodged.
Access control for persons staying on the territory of the Controller is its legitimate purpose, and in the case of employees it is specified in legal regulations (Article 222 of the Labour Code).
Moreover, the Controller may obtain the basic data of an employee/co-worker (name, surname, place of employment or cooperation, telephone number and in specific situations the document number with a photo) before the arrival of the data subject, from the entity with which the data subject is employed or with which it cooperates.

Recruitment process
Art. 6, sec. 1a, b, c and f of the GDPR
Up to 3 months from the end of the recruitment process, and in case of consent for further recruitment processes not longer than for 2 years.
Without additional consent of the data subject, the Controller may store the data of candidates for employment who have not been employed  for 3 months after the end of the recruitment process as a legitimate objective of the Controller, as the employed employee/co-operator may not prove himself/herself good at the position or may resign.

HR management  (employees and cooperators)
Art. 6, sec. 1a, b, c and f of the GDPR
Art. 9, sec. 2b of the GDPR
Pursuant to the binding provisions on archiving labour law documents, i.e. personal files for years and in some cases - for 10 years. The 10-year period for keeping records  related to employment relationship and employees' personal files shall apply to all employees employed after 1 January 2019. In the case of employees employed after 31 December 1998 and before 1 January 2019, records related to employment relationship and the employees' personal files shall be kept for 50 years from the date of termination or expiry of the employment relationship, unless the employer makes a statement of intent to provide reports concerning all employees and contractors employed during that period, and the employer actually submits such reports.
If the retention period of  selected documents is shorter, the Controller will follow this shorter retention period. Civil law contracts shall be stored until the expiration of the statute of limitations of the resulting claims.
Facial image may be used by the Controller only with the consent of the employee / cooperator.

Contact form at a website
Art. 6, sec. 1f of the GDPR
Until an objection is lodged (no longer than one year)
Providing answers to requests and enquiries made with the use of a contact form or in any other form, including storing sensitive requests and answers provided, with a view to maintaining the principle of accountability.

Adapting the content of websites to user's needs, optimizing the use of websites
Art. 6, sec. 1f of the GDPR
Personal data will be processed for the periods indicated in the Information on the use of "cookies" or until you object to the data being processed.
Expressing an objection can only occur by changing the settings of the end user's browser, which will prevent the collection of information using cookies.
The legitimate interest of the Controller, which is service of websites, website user's visits and analysis of website activity, as well as optimization of the use of websites.

If the time limits for pursuing potential claims are shorter than the time limits for storing settlement documents for tax purposes, we will store them for the time necessary for tax and settlement purposes, i.e. for 5 years from the end of the year in which the tax obligation has been updated.
We have collected your personal data from the following sources: 
- publicly accessible registers,
- directly from you
- from superiors, co-operators, employees and co-workers
- from another member of Orbico Group, which is a separate controller, but only for internal administrative purposes. To use your personal data for any other purpose we will ask you for your consent.

Data recipients

In connection with its business, Orbico will disclose your personal information to the following entities:

- state bodies or other entities qualified under the provisions of law,
- entities supporting us in conducting our business by our order, in particular: providers of external IT systems supporting our business, transport companies and providers of postal and courier services, entities auditing our operations, entities cooperating with Orbico in marketing campaigns, as well as providing consulting, legal and insurance services. Such entities, however, will process data on the basis of an agreement with Orbico and only in accordance with its instructions,
- banks in case of a need to conduct settlements,
- producers of goods for which Orbico is a distributor,
- other companies of Orbico Group.

Powers with regard to the processing of data and the voluntary nature of the provision of data

Each person whose data is processed by Orbico is entitled to:

- access their personal data
- rectify their personal data
- erase their personal data
- limit the processing of their personal data
- object against processing their personal data
- portability of their personal data

For more information on the rights of data subjects, see Articles 12-23 of the GDPR, the text of which can be found at the following address: https://eur-lex.europa.eu/legal-content/PL/TXT/?uri=CELEX%3A32016R0679

Moreover, the person whose data is processed by Orbico has the right to lodge a complaint with the supervisory authority, i.e. the President of the Office for Personal Data Protection. More information at the following address: https://uodo.gov.pl/pl/p/skargi

Do you have to provide your personal data?

Providing data is necessary for concluding agreements, settlement of business transactions as well as for the fulfilment of legal requirements by Orbico. For the remaining purposes (in particular for the purpose of processing the data by Orbico for marketing purposes), the provision of the data is voluntary.

Transfer of data to third countries

In certain situations, data may be transferred to third countries. The transfer of personal data always takes place on the basis of legal regulations, including the basis of a decision of the European Commission stating the appropriate degree of protection of that third country or with the application of appropriate safeguards referred to in art. 46 of the GDPR or in special situations referred to in art. 49 of the GDPR. Further information on the transfer of data to third countries and the legal bases can be obtained by e-mail via the Data Protection Officer.

Processing of personal data by automated means 
Personal data will not be processed by automated means (including profiling) in such a way that such could result in making decisions or obtaining any legal effect or otherwise significantly affect our customers, business partners and their employees/co-workers.