Privacy policy

Definitions

Controller — ALTEN Polska spółka z ograniczoną odpowiedzialnością with its registered office in Warsaw, address: ul. Grzybowska 87, 00-844 Warsaw, registered in the National Court Register (KRS) under the KRS No. 0000340221, Taxpayer Identification Number (NIP): 5213545223, National Business Register (REGON) No.: 142074853, share capital: PLN 500,000; mailing address: ul. Lubicz 23A, 31-503 Kraków

Personal Data — information about a natural person identified or identifiable by one or more factors specific to physical, physiological, genetic, mental, economic, cultural or social identity, including device’s IP address, location data, Internet identifier, and information collected through the use of cookies and other similar technologies.

Policy — this Privacy Policy.

GDPR — Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.

Website — a website run by the Controller on www.altenpolska.pl.

User — any natural person visiting the Website or using one or more of the services or functionalities described in the Policy.

Subject of the Policy

This Privacy Policy contains information about the Controller’s processing of the personal data of:

Users in connection with the use of the Website
Employees or associates of its customers and suppliers (contact persons)
Other persons who contact the Controller (by phone, via e-mail, through the contact form, through social media) and persons who are contacted by the Controller (by phone, via e-mail, through social media)
Participants in events organized by ALTEN Polska sp. z o.o.
People who sign up for the selected newsletter
Job candidate

The Policy also covers issues of processing Users’ personal data related to the Controller’s social media accounts.

The Policy also provides information on the cookies and analytical and marketing tools used.

Inspector

The Controller has appointed a Data Protection Officer who can be contacted on all matters relating to data processing and the exercise of rights related to the processing of personal data as follows:

a) by mail: address: ALTEN Polska sp. z o.o./Magdalena Tomaszewska mailing address: ul. Lubicz 23A, 31-503 Kraków

b) via e-mail: ALTEN_PL_RODO@alten.com

Purposes and legal basis of data processing

Re 1) Personal data of all persons using the Website (including IP address or other identifiers and information collected through cookies (Policy on cookies or other similar technologies), are processed by the Controller:

for the purpose of providing services electronically in terms of providing Users with access to content collected on the Website, in which case the legal basis is the necessity of data processing for the performance of the agreement (Article 6(1)(b) of the GDPR);
for analytical and statistical purposes, in which case the legal basis for the processing is the Controller’s legitimate interest (Article 6(1)(f) of the GDPR), consisting in conducting analyses of Users’ activities and preferences in order to improve the functionalities used and services provided;
for the purpose of possible establishment and investigation of claims or defense against claims, in which case the legal basis for the data processing is the Controller’s legitimate interest in protecting their rights (Article 6(1)(f) of the GDPR).

Re 2) Your personal data as an employee or associate of the Controller’s customers and suppliers (contact persons) will be processed for the purpose of:

the conclusion and performance of an agreement you have signed (Article 6(1)(b) of the GDPR) or an agreement entered into before the entity you represent or on behalf of which you act (Article 6(1)(f) of the GDPR);
making financial settlements, archiving documentation related to the conclusion and execution of the contract in accordance with the provisions of the Accounting Act and the Tax Ordinance (Article 6(1)(c) and (f) of the GDPR);
asserting and defending against possible claims, identifying persons authorized to represent parties to an agreement, contacting you in ongoing matters, including the execution of agreements between the Company and your employer/entity you represent, presenting offers, receiving orders, answering questions, and conducting direct marketing of the Company’s own products and services — on the basis of legitimate interest (Article 6(1)(f) of the GDPR), where the legitimate interest is to protect the rights of the Controller, maintaining contact with the customer/supplier; self-marketing.

Re 3) Your personal data as a person (who is neither an employee/associate of the customer/supplier nor a customer/supplier) contacting the Controller in any way (by phone, via e-mail, through the contact form, through social media) and those contacted by the Controller (by phone, via e-mail) will be processed for the purpose of:

communicating answers to your questions. The legal basis for data processing is the legitimate interest consisting in the ability to provide an answer to a question regarding the Controller’s business activities (Article 6(1)(f) of the GDPR);
establishing cooperation with you or your employer/entity you represent. The legal basis for the processing is the legitimate interest consisting in establishing and maintaining relationships in the course of the Controller’s business activities (Article 6(1)(f) of the GDPR).
processing your complaint. The legal basis for processing is the legitimate interest in processing the complaint (Article 6, paragraph 1, letter f) of the GDPR).

Re 4) Your data as a participant of events organized by the Controller will be processed for the purpose of:

registering you for an event (e.g., conference, trade show, workshop), including sending the event’s schedule. The legal basis for data processing is the legitimate interest consisting in organizing the event, including ensuring the participation of participants (Article 6(1)(f) of the GDPR).

Re 5) Your data as a person interested in receiving newsletters from the Controller will be processed for the purpose of:

sending you a newsletter to which you have subscribed on altenpolska.pl. The legal basis for processing your data is the legitimate interest consisting in the ability to provide marketing content to persons expressing such interest (Article 6(1)(f) of the GDPR). You have expressed interest in this content by signing up for the newsletter.

Re 6) Your data as a candidate for employment/cooperation with the Controller under a civil law contract will be processed for the purpose of:

carrying out the recruitment process conducted by the Controller (Article 22¹ of the Labor Code);
and, if you have given your consent, also for future recruitment processes conducted by the Company (Article 6(1)(a) of the GDPR).

Legal bases for data processing is:

Article 221 of the Labor Code with respect to the following data: first name, last name, date of birth, contact information, education, previous employment history;
Article 6(1)(f) of the GDPR legitimate interest in the data collected during the job interview. The legitimate interest is the need to verify your skills and qualifications in order to assess whether you are a suitable person for the position we are recruiting;
Your consent to the processing of data for future recruitment purposes (Art. 6(1)(a) of the GDPR);
Your consent to the processing of data provided in your CV and cover letter, in a broader scope than your first name, last name, date of birth, contact information, education, previous employment history (Article 6(1)(a) of the GDPR).

Source of data

Provision of personal data is voluntary and we obtained it primarily from you.

Your personal data will not be subject to profiling or automated decision-making.

Your personal information in the following areas: first name, last name, job title, business phone number, business e-mail address, place of work, has been made available to the Controller in connection with the performance of an agreement in which you have been designated as a contact person or because you represent a customer/supplier/vendor/service provider with whom the Controller cooperates.

Recipients of your data

If necessary, your personal data may be made available or entrusted to entities cooperating with the Controller on the basis of written agreements, including agreements on entrustment of personal data processing, in order to perform certain tasks and services for the Controller, e.g., in the field of IT support, advisory, administrative, auditing or consulting services.

Your personal data may be made available to entities authorized to obtain them under applicable laws, such as law enforcement agencies.

Period of processing of your personal data

The period the Controller processes data depends on the purpose of the processing. As a general rule, data are processed for the duration of the service, until the withdrawal of the consent given or the filing of an effective objection to data processing in cases where the legal basis for data processing is the legitimate interest of the Controller.

The data processing period may be extended in cases where the processing is necessary for the establishment and assertion of possible claims or defense against claims, and thereafter only if and to the extent required by law. After the expiration of the processing period, the data shall be irreversibly removed or anonymized.

Re 2) Your personal data as employee or associate of the Controller’s customers and suppliers (contact persons) will be stored for the following period of time:

duration of the agreement/contract — until its termination or expiration;
period of establishment, assertion or defense against claims — until the statute of limitations for contractual claims or claims related to the processing of personal data;
until you file an objection when it comes to marketing of goods and services offered by the Controller;

As a rule, for a period of 5 years counting from the end of the calendar year in which the deadline for tax payment expired — if it is a matter of processing your data in order to comply with the obligation to keep records under the applicable accounting regulations and the Tax Ordinance.

Re 3) Your personal data as a person who contacts the Controller or is contacted by the Controller will be processed for a period of: maintaining ongoing relationships (e.g., answering questions, providing offers, exchanging correspondence), and after the relationship ends for a period of 1 year. After this period, we may contact you to inquire about the possibility of further processing of your personal data.

Re 4) We will process your personal data as a person participating in an event organized by the Administrator for a period of 1 year from the end of the event, counted from the end of the calendar year in which the event was organized.

Re 5) Your personal data will be processed until you file an objection, unless the purpose of the processing is no longer valid before then (i.e., we cease to issue the newsletter).

Re 6) Your data as a job candidate will be processed until the recruitment process is completed, but no longer than for a period of 6 months from the end of recruitment. In the event that you consent to the processing of your data for the purposes of future recruitment, your data will be processed for a period of 36 months from the date of your consent, counted from the end of the calendar year in which the consent was granted.

Your rights

You have the following rights in relation to the processing of your personal data: (i) the right to access your personal data, (ii) the right to request the rectification of your personal data, (iii) (iv) the right to request the erasure of your personal data, (v) the right to request the restriction of the processing of your personal data, as well as (vi) the right to object to the processing of your personal data due to your particular situation.

To the extent that your data is processed on the basis of consent or as part of the service provided (data is necessary for the provision of the service), you may additionally exercise the following rights:

the right to withdraw consent to the extent that it is processed on this basis. Withdrawal of consent does not affect the lawfulness of the processing carried out on the basis of consent before its withdrawal,
the right to transfer personal data, i.e. to receive from the Administrator, in a structured, commonly used machine-readable format. You may send this data to another data controller or request that the Administrator send your data to another controller. The Administrator will do this if it is technically possible.

In order to exercise these rights, contact the Controller. Contact information is indicated above in items 1 and 3.

Should you submit a request to exercise a specific right, we will respond to you within a period of one month, however, if necessary, we have the right to extend this period by another two months, of which you shall be informed.

You also have the right to lodge a complaint to the personal data protection supervisory authority, i.e. the President of the Personal Data Protection Office (address: ul. Stawki 2, 00-193 Warsaw).

Published: 26.08.2024