en
Privacy Policy
Introduction
Respecting the privacy rights of persons who have provided Colian sp. z o.o.[1] (hereinafter referred to as “Colian”) with their personal data, we would like to declare that we process the data in accordance with national and European legal regulations and in conditions which ensure the security of the data, i.e. its confidentiality, availability, integrity and accountability. In order to ensure the transparency of the processing we carry out, we present the data protection principles applicable in Colian, established on the basis of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter “GDPR”).
Data controller
The controller, i.e. the entity that decides about the purposes and means of personal data processing shall be Colian sp. z o.o. with its registered office at the following address: Zdrojowa 1, 62-860 Opatówek, but also, as the case may be, the entities indicated in the footnote. In matters relating to the processing of your personal data you can also contact us by e-mail at the following address: rodo@colian.com.
Data acquisition and the purpose of their processing
Colian is a leading company with Polish capital in the sweets, beverages, spices, dried fruit and nuts market. It is also present in the logistics services market. In performing our business functions, we process personal data for the following purposes:
| Processing purpose | Legal basis and data retention period | Legitimate purpose, if any |
| Conclusion and performance of a contract with a client or contracting party. | Art. 6(1)(b and f) of GDPR
For the duration of the contract and after its termination until the expiry of the claims arising therefrom, in principle 3 years, maximum 6 years. |
In connection with activities undertaken for the purpose of concluding a contract or its performance, the controller contacts the employees/co-workers of clients and contracting parties for a legitimate purpose. Moreover, the controller may obtain from the contracting party the basic data of its employee/associate (name, place of employment or co-operation, telephone number and in some cases number of the document with photograph) in relation to the performance of the contract that the data refers to from the entity with which the person is employed or co-operates. |
| Handling of complaints and claims. | Art. 6(1)(b and f) of GDPR
For 1 year after the statutory warranty expires or the claim is settled. |
In connection with the processing of the complaint, the controller contacts the clients’ employees/associates for a legitimate purpose. |
| Pursuit or defence of legal claims | Art. 6(1)(f) of GDPR
For the duration of proceedings concerning the pursued claims, i.e. until they become final and legally binding, and in the case of enforcement proceedings, until the claims are finally settled. |
In connection with the pursuit or defence of legal claims, the controller may process the data of employees/associates of clients or contractors for legitimate purposes. |
| Archiving documents, i.e. contracts and settlement documents | Art. 6(1)(c) of GDPR
For the periods specified by law and, if no such periods are specified for certain documents, for the time that their retention falls within the legitimate purpose of the controller regulated by the time of possible pursuit of claims. |
– |
| Keeping statistics | Art. 6(1)(f) of GDPR
Until any other processing operation indicated in this table is carried out. We do not store personal data exclusively for statistical purposes. |
Having information on the statistics of the Controller’s activities allows it to improve its operations |
| Conducting marketing activities without the use of electronic communications | Art. 6(1)(f) of GDPR
Until you object, i.e. you inform us in any way that you do not wish to be contacted and informed about our activities. |
Conducting marketing activities to promote the business. |
| Conducting marketing activities with the use of electronic means of communication | Art. 6(1)(a) of GDPR
Due to other applicable laws, in particular the Telecommunications Act and the Act on Providing Services by Electronic Means, these activities are carried out on the basis of the consents held. Until you object or withdraw your consent, i.e. you inform us in any way that you do not wish to be contacted and informed about our activities, and, once you withdraw your consent, for the purpose of proving the fulfilment of Colian’s legal obligations and related claims (up to 6 years after you have withdrawn your consent). |
Conducting marketing activities to promote the business using e-mail addresses and telephone numbers. |
| Access control, including monitoring on the premises of the data controller for the purpose of increasing the security of employees and the protection of property and the confidentiality of information. | Art. 6(1)(c and f) of GDPR
Until an objection is lodged, no longer than one year. Video recordings shall only be processed for the purpose for which they were collected and shall be kept for a period not exceeding 3 months from the date of the recording, unless the recording constitutes evidence in a legal proceeding, in which case it shall be kept until the legal conclusion of the proceeding or until any objection is lodged. |
Access control for persons on the controller’s premises is a legitimate purpose of the controller, and in the case of employees, it stems from legal provisions (art. 222 of the Labour Code).
The data controller may obtain the basic data of the employee/associate (name, place of employment or co-operation, telephone number and in some cases photo ID) prior to the arrival of the data subject from the entity with which the data subject is employed or co-operates. |
| Recruitment | Art. 6(1)(a, c and f) of GDPR
Up to 6 months from the end of the recruitment process and, in the case of consent for further recruitment processes, no longer than one year. |
Without the additional consent of the data subject, the controller may store the data of job applicants who have not yet been hired up to 6 months after the end of the recruitment process as a legitimate purpose of the controller in view of the fact that the hired employee/associate may not successfully perform the job or may resign. |
| Management of human resources – employees and associates | Art. 6(1)(a, b, c and f) of GDPR
Art. 9(2)(b) of GDPR According to the applicable regulations, the obligation to archive labour law documents, i.e. personal files for 50 years, in some cases for 10 years. The 10-year retention period for documentation on matters related to the employment relationship and the employee’s personal file will apply to all employees hired after 1 January 2019. For employees hired in the period after 31 December 1998 and before 1 January 2019, the documentation related to the employment relationship and the employee’s personal file will be kept for 50 years from the date of termination or expiry of the employment relationship, unless the employer declares and actually submits information reports for all employees and contractors hired in the period. If the retention period for the selected documents is shorter, the controller shall respect this shorter period. In the case of civil law contracts, these contracts will be stored until the expiry of the limitation periods for claims arising therefrom. |
The controller shall only use the image on the basis of the employee’s/associate’s consent. |
| Keeping a contact form on the website | Art. 6(1)(b) of GDPR | Responding to requests and enquiries submitted via the contact form or in another form, including retention of sensitive requests and responses in order to maintain accountability |
If the periods for the pursuit of possible claims are shorter than the periods for the retention of tax assessment documents, we will retain these documents for the time necessary for tax assessment purposes, i.e. for 5 years from the end of the year in which the tax liability arose.
Recipients of data
In connection with the operated business, Colian will disclose your personal data to the following entities:
– state authorities or other entities authorised by law,
– entities supporting us in our activities on our behalf, in particular: suppliers of external ICT systems supporting our activities, entities auditing our activities, or entities cooperating with Colian as part of marketing campaigns, whereby such entities will process data on the basis of a contract with Colian and exclusively in accordance with its instructions, as well as, if necessary, to other entities of the Colian Group, as specified in the footnote,
– banks where clearing is necessary.
Rights in relation to the processed data and voluntary nature of providing the data
Every person whose data is processed by Colian has the right to:
– access their personal data,
– rectify their personal data,
– delete their personal data,
– restrict the processing of their personal data,
– object to the processing of his/her personal data,
– transfer their personal data.
More information on data subjects’ rights is available in Articles 12-23 of the GDPR, the text of which can be found at: https://eur-lex.europa.eu/legal-content/PL/TXT/?uri=CELEX%3A32016R0679.
Furthermore, the person whose data is processed by Colian has the right to lodge a complaint to the supervisory authority, i.e. the President of the Office for Personal Data Protection; more information at: https://uodo.gov.pl/pl/p/skargi.
Do you have to provide your personal details?
The provision of data is necessary for the conclusion of contracts and the settlement of business operations and for Colian to comply with the law. In other respects (especially for the purpose of data processing by Colian for marketing purposes), the provision of data is voluntary.
Transfer of data to third countries
Data will be processed in the European Economic Area.
In addition, there may be situations where basic Colian employee/associate business data (such as name, position, business telephone number and e-mail address) may be transferred to third countries. The necessity of transferring data to third countries is subject to the performance of the contract between Colian and the employee/associate whose personal data is transferred. The transfer to a third country of personal data of an employee/associate concerns those persons who will perform activities for a client or potential client from a third country.
Processing of personal data by automated means
Personal data will not be processed by automated means (including profiling) in such a way that any decision is likely to be made as a result of such automated processing, that other legal effects are likely to be produced or that our clients, contracting parties and their employees/associates are likely to be materially affected in any way.
[1] but also:
Colian Holding sp. z o.o. ul. Zdrojowa 1, 62-860 Opatówek
and entities economically and/or financially and/or personally linked to the operations of Colian Holding sp. z o.o. .:
Colian Logistic sp. z o.o., ul. Zdrojowa 1, 62-860 Opatówek