Privacy

Personal Data Processing Policy of Grupa Hossa S.A.

In accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ EU L 119, 2016, p. 1, as amended) (“GDPR”), we hereby inform you that:
  1. The controller of your personal data provided by electronic means of communication, in particular via contact forms on websites and online portals, as well as provided in person at offices and branches or sent by post, including in particular:
a) first name and surname,
b) postal address,
c) email address,
d) telephone number,
e) date of birth (where required),
f) credit card number (where required)
is Grupa Hossa S.A., with its registered office in Gdańsk, ul. Cypriana Kamila Norwida 1, 80-280 Gdańsk, registered in the National Court Register under number 0000006925 (hereinafter the “Controller”).
  1. Contact details of the Controller’s Data Protection Officer: IOD@hossa.pl.
The Controller processes your personal data for the following purposes:
a) to contact you and handle enquiries submitted via the electronic contact form, as well as to process such enquiries (pursuant to Article 6(1)(b) and Article 6(1)(f) GDPR),
b) to provide services to you on the basis of contracts, orders, bookings or reservations concluded with you (pursuant to Article 6(1)(b) GDPR),
c) to comply with a legal obligation to which the Controller is subject under applicable law (pursuant to Article 6(1)(c) GDPR),
d) to carry out analyses, summaries, statistics and internal reports, as well as to pursue claims or defend against claims brought against the Controller (pursuant to Article 6(1)(f) GDPR),
e) for marketing and commercial purposes, i.e. for presenting and sending to you - on the basis of separately expressed voluntary consents - advertising offers, commercial information, newsletters and other informational, promotional and marketing materials relating to the activities of the Controller and entities cooperating with the Controller (hereinafter: “Commercial Partners”), via email to the email address you have provided, and using means of direct remote communication such as telephone calls, text messages and other telecommunications terminal equipment to the telephone number you have provided (pursuant to Article 6(1)(a) GDPR).
  1. The provision of your personal data is voluntary; however, without it we will not be able to provide services to you.
  2. In particular, we would like to point out that the personal data you provide may be used - on the basis of separately expressed consents and only within the scope covered by those consents - for marketing purposes, i.e. for the Controller to present and send to you advertising offers, commercial information, newsletters and other informational, promotional and marketing materials relating to the activities of the Controller and the Controller’s Business Partners, via email to the email address you have provided, and using means of direct remote communication such as telephone calls, text messages and other telecommunications terminal equipment to the telephone number you have provided.
  3. Consent given for the processing of personal data may be withdrawn at any time; however, this will not affect the lawfulness of the processing carried out on the basis of such consent prior to its withdrawal.
  4. Where personal data is processed on the basis of voluntarily given consent, the Controller will process such data for a maximum period of 5 years from the last contact for the purposes indicated in point 2(e) above, or until the consent is withdrawn, or for any other period required by law. In all other cases, your personal data will be retained for the period permitted by law in order to enable you to exercise your rights and, where applicable, to ensure that the history of financial settlements between you and the Controller can be demonstrated.
  5. The personal data you provide may be recorded by the Controller in an automated manner within IT systems and/or in a non‑automated manner, and may be sorted, organised, stored, retrieved, viewed, used, disclosed by transmission or made available. Personal data may also be subject to restriction, erasure or destruction. The personal data you provide may be subject to profiling, i.e. automated analysis and the generation of predictions regarding your preferences or future behaviour, in order for the Controller to determine which offer you may be most interested in.
  6. The recipients of your personal data may include the Controller’s service providers, including companies providing IT services or supplying IT solutions to the Controller, as well as companies carrying out marketing activities, including those participating in and/or performing activities related to the presentation and transmission of advertising offers, commercial information, newsletters and other informational, promotional and marketing materials relating to the activities of the Controller and the Controller’s Business Partners.
  7. As a general rule, personal data is processed within the European Economic Area (EEA). However, due to the Controller’s use of IT, cloud and communication solution providers, personal data may, in exceptional cases, be transferred outside the EEA. Such transfers are carried out in each instance in accordance with the requirements of the GDPR and with the use of appropriate legal mechanisms ensuring an adequate level of protection for personal data.
With regard to the use of Microsoft 365 services and the processing of data in the territory of the United States, such transfer is based on the European Commission’s decision of 10 July 2023, recognising the adequate level of protection ensured by the EU–US Data Privacy Framework (DPF).
  1. You have the right to request from the Controller, under the rules set out in the GDPR:
  • access to your personal data,
  • information regarding the purpose, scope, manner and forms of processing,
  • rectification of your personal data,
  • erasure of your personal data or restriction of its processing,
  • objection to the processing of your personal data,
  • transfer of your personal data to another data controller.
  1. You may exercise the rights referred to above at any time by submitting an appropriate request to the Controller at the contact address provided below: address info@hossa.gda.pl
  2. If you believe that the Controller’s processing of your personal data infringes the law, you have the right to lodge a complaint with the competent supervisory authority (the President of the Office for Personal Data Protection).