The administrator of your personal data is GRATRANS Gracjan Kurzawski (ul. Świnków 9, 63-714 Kobierno). As a responsible organization that is aware that information has a specific value and constitutes a resource that requires proper protection, we want to properly inform you about matters related to the processing of personal data, especially in relation to the content of the new provisions on the protection of personal data, including regulations of the European Parliament and Of the Council (EU) 2016/679 of April 27, 2016. on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46 / EC (“GDPR”). For this reason, in this document, we present key information on the legal grounds for the processing of personal data, methods of their collection and use, as well as the rights of data subjects. GRATRANS Gracjan Kurzawski has appointed the Personal Data Protection Inspector who can be contacted at the following e-mail address: kontakt@eurolinespa.pl. When processing personal data, we apply the provisions of data protection law. Personal data is obtained and processed in the manner and on the terms set out in this Policy.

General provisions

At GRATRANS Gracjan Kurzawski, we pay special attention to protecting the privacy of our customers, contractors, employees and associates. One of its key aspects is the protection of the rights and freedoms of natural persons in relation to the processing of their personal data. We make sure that the processing of your data takes place in accordance with the provisions of the General Data Protection Regulation 2016/679 / EC (hereinafter: “GDPR”), the Act on the protection of personal data, as well as specific provisions (including the Accounting Act). GRATRANS Gracjan Kurzawski is the administrator of personal data within the meaning of art. 4 point 7 of the GDPR, we also use the services of processing entities referred to in art. 4 points 8 GDPR – they process personal data on behalf of the administrator (these are, for example, IT companies, law firms, security). GRATRANS Gracjan Kurzawski implements appropriate technical and organizational measures to ensure a level of security corresponding to the possible risk of violating the rights or freedoms of natural persons with a different probability and severity of the threat. Our activities in the field of personal data protection are based on adopted policies and procedures as well as regular training courses to increase the knowledge and competences of our employees and associates.

What do we use your personal data for

• Conclusion and performance of the contract of carriage on the basis of art. 38 sections 1 and 2 and art. 50 of the Act of November 15, 1984 Transport Law or the provision of art. 6 and 7 of the Convention on the Contract for the International Carriage of Goods by Road and Art. 6 sec. 1 lit. b and lit. f GDPR,
• Fulfilling the legal obligation incumbent on the administrator – art. 6 paragraph 1 lit. c GDPR Conducting marketing activities using electronic means of communication, art. 6 sec. 1 lit. a GDPR,
• Securing claims – art. 6 sec. 1 lit. f GDPR and taking actions in connection with the debt collection process,
• Establishing contact pursuant to art. 6 sec. 1 lit. f GDPR as a legitimate interest pursued by the administrator (e-mail, contact forms),
• Handling the complaint submission process – art. 6 section 1 lit. to beat,
• The legitimate interest of the administrator – art. 6 sec. 1 lit. f GDPR.

We provide third parties with your data with your consent or when we are required to do so under the law. We do not make automated decisions with regard to your personal data.

On what terms and on what basis do we process your data

We make every effort to protect the interests of data subjects, and in particular we ensure that the data is:

• processed in accordance with the law, fairly and in a transparent manner for the data subject;
• collected for specific, explicit and legitimate purposes and not further processed in a manner inconsistent with these purposes;
• adequate, relevant and limited to what is necessary to achieve the purposes for which they are processed;
• correct and updated as necessary. We take steps to ensure that personal data that is incorrect in the light of the purposes of their processing are immediately removed or corrected;
• stored in a form that permits identification of the data subject for no longer than is necessary to achieve the purposes of processing;
• processed in a manner that ensures appropriate security of personal data, including protection against unauthorized or unlawful processing as well as accidental loss or destruction.

We usually process your data on the basis of consent, which may be withdrawn at any time. Another case is when the processing of your data is necessary to perform the contract to which you are a party or to take action at your request, even before concluding the contract. In some situations, processing is necessary to fulfill the legal obligation incumbent on us as the controller. Such obligations result, for example, from the provisions of the labor law or the Accounting Act. Processing may also be necessary for the purposes of our legitimate interests, an example of which is pursuing claims from our business activities.

What rights do you have

We take appropriate measures to provide you with all relevant information in a concise, transparent, understandable and easily accessible form and conduct all communication with you regarding the processing of personal data in connection with the exercise of your right to:

• information provided when collecting personal data;
• information provided upon request – whether the data is processed and other issues specified in Art. 15 GDPR, including the right to copy data;
• data rectification;
• being forgotten;
• processing restrictions;
• data portability;
• objection;
• not being subject to decisions based solely on automated processing (including profiling);
• information about a breach of data protection.

In addition, if your personal data is processed on the basis of consent, you have the right to withdraw it. The consent may be withdrawn at any time, which does not affect the legality of the processing carried out before its withdrawal. In order to contact us regarding the implementation of a given right, please contact us via: Email address: kontakt@eurolinespa.pl. Correspondence address: ul. Świnków 9, 63-714 Kobierno. The security of your data is our priority, however, if you decide that by processing your personal data we violate the provisions of the GDPR, you have the right to lodge a complaint with the President of the Office for Personal Data Protection.

How we will contact you

We provide information in writing or otherwise, including, where appropriate, electronically. If you so request, we may provide the information orally, as long as we confirm your identity by other means. If you submit your request electronically, the information will also be provided electronically, if possible, unless you provide us with another preferred form of communication.

When will we fulfill your request

We try to provide information immediately – as a rule, within one month of receiving the request. If necessary, this period may be extended by another two months due to the complexity of the request. However, in any case, within one month of receiving the request, we will inform you of the action taken and (if applicable) of the extension of the deadline, stating the reason for such delay.

Subcontractors / processors

We may transfer your personal data to companies or other trustworthy business partners who provide services on our behalf, for example to provide technical support, to evaluate the suitability of the website for marketing or other types of service provision. If we cooperate with entities that process personal data on our behalf, we only use the services of such processors that provide sufficient guarantees to implement appropriate technical and organizational measures so that data processing meets the requirements of the GDPR and protects the rights of data subjects. We check in detail the entities to which we entrust the processing of your data. We conclude detailed agreements with them, and we periodically inspect the compliance of processing operations with the content of such agreements and the law. Your personal data may also be received by: a. Entities and bodies authorized to process personal data on the basis of legal provisions, banks if it is necessary to conduct settlements, b. Institutions granting co-financing for the purpose of performing the contract concluded with the Administrator, entities providing transport and loading services, e. customs agency, f. platforms for the exchange of information between carriers, g. entities and bodies authorized to process personal data, h. entities providing software delivery, i. entities providing IT services, j. law firms legal, k. The owner of the Facebook social network on the non-changeable data rules specified by Facebook available at https://www.facebook.com/about/privacy. The personal data provided by you may be made available to entities based outside the European Economic Area (EEA), i.e. in third countries. With regard to these countries, no decision has been issued by the European Commission recognizing that these countries provide an adequate level of protection within the meaning of European data protection regulations.

How we care for the processing of your data

To meet legal requirements, we have developed detailed procedures covering such issues as:

• data protection by design and data protection by default;
• data protection impact assessment;
• notification of violations;
• keeping a register of data processing activities;
• data retention;
• exercising the rights of data subjects.

We regularly check and update our documentation in order to be able to demonstrate compliance with the legal requirements in accordance with the principle of accountability set out in the GDPR, but also in the interests of the data subjects, we try to incorporate the best market practices into it.

Data Retention

We store personal data in a form that permits identification of the data subject for no longer than it is necessary for the purposes for which the data are processed. After this period, the data is anonymized (we deprive any features that make it possible to identify a given person) or we delete it. In the retention procedure, we ensure that the period of personal data storage is limited to the strict minimum. The data processing period is determined in the first place on the basis of legal provisions (e.g. the storage time of employee documentation, accounting documents), as well as the justified interest of the administrator (e.g. marketing activity). The retention policy covers both data processed in paper and electronic form.

Authorizations

We ensure that every person acting under our authorization and having access to your personal data processes it only at our request, unless other requirements result from EU law or the law of a Member State.

Cookies

The policy of using cookies by the website.

a) Cookie files (so-called “cookies”) are IT data, in particular text files, which are stored on the Website User’s end device and are intended for using the Website’s pages. Cookies usually contain the name of the website they come from, the storage time on the end device and a unique number.

b) The entity that places cookies on the Website User’s end device and obtains access to them is the website owner. c) The cookie mechanism is not used to obtain any information about website users or to track their navigation. Cookies used on the website do not store any personal data or other information collected from users and are used for statistical purposes.

d) By default, the software used for browsing websites (browser) allows the handling of cookies on the User’s device on which it is running. In most cases, the software in this area can be configured independently, including, among others, forcing automatic blocking of cookies. Issues related to the configuration of how to handle cookies can be found in the software settings (web browsers). It should be borne in mind that the settings of restrictions in relation to the use of cookies may affect the operation of certain website functionalities.

e) Cookies are used to adapt the content of the Website pages to the User’s preferences and to optimize the use of websites; in particular, these files allow to recognize the device of the Website User and properly display the website, tailored to his individual needs; creating statistics that help to understand how Website Users use websites, which allows improving their structure and content; maintaining the Website User’s session (after logging in), thanks to which the User does not have to re-enter the login and password on each subpage of the Website;

f) The Website uses two basic types of cookies: session cookies and persistent cookies. Session cookies are temporary files that are stored on the User’s end device until logging out, leaving the website or turning off the software (web browser). Persistent cookies are stored on the User’s end device for the time specified in the cookie file parameters or until they are deleted by the User.

g) The Website uses the following types of cookies:

• necessary “cookies, enabling the use of services available on the Website, eg authentication cookies used for services that require authentication on the Website;
• cookies used to ensure security, e.g. used to detect fraud in the field of authentication on the Website; ◦ “performance” cookies, enabling the collection of information on the use of the website pages
• “Functional” cookies, enabling “remembering” the settings selected by the User and personalizing the User’s interface, e.g. in terms of the selected language or region from which the User comes, font size, website appearance, etc.

Links to other pages on the website

The website owner informs that the website contains links to other websites. The website owner recommends that you read the privacy policies in force there, as he is not responsible for them.

Securing user data on the Website

The description of technical and organizational security measures is included in the Security Policy (personal data protection) of the website owner. In particular, the following safeguards are used:

a) data downloaded automatically by the server are secured by the website access authentication mechanism;

b) data collected from users during the registration process are secured with the SSL protocol and through the website access authentication mechanism;

c) access to website administration takes place using an authentication mechanism.