Privacy Policy

 

1. General provisions

1.1. This document provides information on how we process personal data, including the information referred to in Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the “GDPR”).

1.2. Please note that when leaving our website (e.g., by following a link to a website located in a different domain), you enter an area where this Privacy Policy does not apply. The Company is not responsible for the privacy policies in effect on websites operated by other entities.

 

2. Personal data controller

2.1. The controller of personal data is 7R S.A., with its registered office in Kraków (address: ul. Ludwinowska 7, 30-331 Kraków), entered into the Register of Entrepreneurs of the National Court Register maintained by the District Court for Kraków-Śródmieście in Kraków, 11th Commercial Division of the National Court Register under KRS number 0000379632, NIP [Tax Identification Number]: 677232083, and REGON [National Business Registry Number]: 120812966 (hereinafter referred to as the “Company”).

2.2. The Company exercises particular diligence to ensure that all personal data is processed in accordance with the purposes for which it was collected and used in compliance with the legal grounds and categories of data processing permitted by law.

 

3. Contact

3.1. For any matters related to the processing and protection of personal data, you may contact us via email at [email protected] or in writing at the Company’s address indicated in section 2.1 above.

 

4. Security, data storage, and processing principles

4.1. The Company ensures the security of personal data through appropriate technical and organizational measures aimed at preventing unlawful data processing, as well as accidental loss, destruction, or damage. The Company’s website and the contact form available on the website are encrypted.

4.2. The Company exercises particular diligence to ensure that personal data is processed in accordance with the principles of data processing outlined in the GDPR, specifically:

• processed lawfully, fairly, and in a transparent manner in relation to the data subject (principle of lawfulness, fairness, and transparency);
• collected for specified, explicit, and legitimate purposes and not further processed in a manner incompatible with those purposes (principle of purpose limitation);
• adequate, relevant, and limited to what is necessary in relation to the purposes for which they are processed (principle of data minimization);
• accurate and, where necessary, kept up to date; personal data that is inaccurate with respect to the purposes for which it is processed shall be promptly erased or rectified (principle of accuracy);
• stored in a form that permits identification of the data subject for no longer than is necessary for the purposes for which the data is processed (principle of storage limitation);
• processed in a manner that ensures appropriate security of personal data, including protection against unauthorized or unlawful processing, and against accidental loss, destruction, or damage, using appropriate technical or organizational measures (principle of integrity and confidentiality).

 

5. Purpose of personal data processing and legal basis

5.1. The Company collects personal data in the following cases:

• when a user of the website administered by the Company contacts the Company via the contact form, email, or telephone;
• when a user of the website administered by the Company subscribes to the newsletter;
• when the data subject is our (potential) contractor, including a landowner or a member of the (potential) contractor’s staff;
• when the data subject follows the Company’s social media profile, comments on our posts, or communicates with us through these platforms;
• when the data subject gives consent for a specific data processing activity

5.2. The purposes and legal bases for collecting personal data in these cases are as follows:

• Contact Form, Email Messages, or Telephone Contact (including recorded conversations): Personal data will be processed to facilitate one-time contact in the indicated form with the data subject and to respond to the inquiry – legal basis: Article 6(1)(f) of the GDPR (responding to inquiries and requests submitted via the contact form or other means, including storing significant applications and responses to ensure accountability).
• Consent for marketing communication or Newsletter subscription: Personal data will be used to provide information about the Company’s products and services. If the “7R Group marketing” option is selected, personal data may also be used to promote entities within the 7R capital group, the current list of which can be found HERE. Providing data and consenting to such communication is voluntary; however, failure to do so will prevent the receipt of marketing communications or newsletters – legal basis: Article 6(1)(a) of the GDPR (marketing activities promoting business operations through email addresses and phone numbers).
• Negotiation or conclusion of a contract with the Company: Personal data will be used for the purposes of contract execution – legal basis: Article 6(1)(b) of the GDPR, and also for the fulfillment of legal obligations imposed on the Company in connection with the conclusion and settlement of the contract, particularly tax and accounting obligations – legal basis: Article 6(1)(c) of the GDPR.
• If you are a person designated by a contractor for contract execution: Your personal data, including your name, surname, position, workplace, email address and telephone number, will be processed based on the legitimate interests of the controller, which consist of communication for the purpose of contract execution – legal basis: Article 6(1)(f) of the GDPR. Additionally, we inform you that the source of your personal data is our contractor, who is your employer or principal.
• Social media users’ personal data: Personal data of social media users, to the extent processed by the Company, is processed to inform users about the Company’s activities, based on the legitimate interest of promoting its business. It is also processed to respond to messages and comments, where the legitimate interest is communication with social media users – legal basis: Article 6(1)(f) of the GDPR. Furthermore, the data controllers for Facebook and Instagram users are Meta Platforms Ireland Limited, 4 Grand Canal Square, Grand Canal Harbour, Dublin 2, Ireland, while the data controller for LinkedIn users is LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland. For information on how these providers process personal data, please refer to their privacy policies.

 

6. Period of personal data processing

6.1. The Company regularly evaluates whether personal data processed by it is not processed for longer than necessary for the purposes for which the data is being processed.

6.2. Personal data processed based on granted consent will be processed until such consent is withdrawn or until the purpose for which the data was collected ceases. Consent may be withdrawn at any time without affecting the lawfulness of processing carried out based on the consent before its withdrawal.

6.3. Data provided via the contact form, during telephone contact, or via email will be processed for the duration of handling the inquiry.

6.4. Data processed in connection with the presentation of an offer, provision of a service, conclusion, or performance of a contract will be processed in accordance with applicable legal regulations, but no longer than until the expiration of the limitation period for claims related to the activity for which the data was processed.

6.5. Data processed for purposes related to direct marketing will be processed until consent is withdrawn or an objection is raised.

6.6. Data processed by the Company on social media platforms will be processed until the user ceases to follow our profile, and in the case of inquiries made via such platforms, for the duration of responding to the inquiry.

6.7. In any case, personal data may also be processed for the duration of the limitation period for claims related to the activity for which personal data was processed.

 

7. User rights

7.1. The Company ensures the exercise of the rights of individuals whose data it processes in accordance with applicable laws. For any questions, requests regarding the scope and exercise of rights, or to contact us to exercise specific rights concerning data protection, please email us at: [email protected]. The Company reserves the right to fulfill the following rights upon positively verifying the identity of the individual requesting the action.

7.2. Access to Personal Data. Individuals have the right to access the data held by the Company.

7.3. Modification of Personal Data. Individuals have the right to modify or update their personal data processed by the Company.

7.4. Withdrawal of Consent. Where personal data is processed based on consent, individuals have the right to withdraw this consent at any time.

7.5. Right to Restrict Processing or Object to Processing. Individuals have the right to restrict processing or object to the processing of their personal data at any time, based on their particular situation, unless processing is required by law.

7.6. Right to Request Data Deletion and Data Portability. Individuals have the right to request data deletion when it is no longer necessary for the purposes for which it was collected, upon withdrawing consent, raising an objection to processing, or when processing is unlawful. Additionally, the right to data portability applies when personal data is processed based on consent or a contract and when processing is automated. In such cases, the Company will provide or transfer the data in a structured, commonly used, and machine-readable format to the designated party.

7.7. The Company informs that it is not obligated to delete personal data if processing is necessary for compliance with a legal obligation under EU or Polish law, for the performance of a task carried out in the public interest, or for the establishment, exercise, or defense of legal claims.

7.8. If, at any time, an individual believes that their rights under applicable law or this Privacy Policy are being violated, they have the right to file a complaint with a supervisory authority (in Poland: President of the Personal Data Protection Office PUODO).

 

8. Disclosure of personal data

8.1. Your personal data may be disclosed to external entities providing services to the Company, such as accounting, legal, audit, or IT services. Furthermore, your personal data may be disclosed to authorized public authorities. It may also be shared with other companies within the 7R Group.

 

9. Transfer of personal data outside the EEA

9.1. The Company informs that personal data may be processed outside the EEA; however, in such cases, we take steps to ensure appropriate safeguards, particularly by selecting or requiring our service providers to select entities from countries deemed by the European Commission to provide an adequate level of personal data protection or entities that sign standard contractual clauses approved by the European Commission.

9.2. If necessary, to enhance personal data security, we implement additional supplementary measures, such as encryption.

 

10. Obligation to provide personal data

10.1. Providing personal data is voluntary; however, failure to provide such data will prevent the Company from carrying out the activities for which the data was collected. For instance, this includes responding to inquiries requiring identification, exercising rights, establishing cooperation, receiving commercial information, or subscribing to newsletters.

 

11. Changes to the Privacy Policy

11.1. This Privacy Policy is effective as of May 10, 2024.

11.2. The Company is committed to regularly reviewing this Privacy Policy and amending it as necessary due to new legal provisions, new guidelines from supervisory authorities on data protection processes, or best practices in data protection. The Company also reserves the right to amend this Privacy Policy if there are changes in the technologies used to process personal data (provided the change affects the content of this document) or changes in the purposes, methods, or legal bases for processing personal data.