This is a courtesy translation. In the event of any discrepancy, the Polish version of this policy prevails.
01
Who is the controller of my personal data?
The controller of your personal data is Utilis Sp. z o. o., with its registered office in Lubin, ul. Bronisława Malinowskiego 5A/5, 59-300 Lubin, Poland, entered in the register of entrepreneurs of the National Court Register under KRS number 0001151865, tax ID (NIP) 6922543344, statistical number (REGON) 540748520, hereinafter referred to as “Utilis”.
In all matters relating to the protection of personal data you may contact us at biuro@utilis.pl, by telephone at +48 698 412 902, or by post at the company's registered address.
Utilis has not appointed a data protection officer. Data protection duties are performed directly by the controller, and contact in such matters is made using the contact details indicated above.
We process personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (GDPR) and with the Polish Personal Data Protection Act of 10 May 2018.
02
What personal data do we process?
As a controller of personal data within the meaning of the GDPR, we process in particular the following categories of data:
- Data of people contacting us through the contact form, by e-mail or by telephone — first name, e-mail address, telephone number, message topic and the content of the enquiry.
- Data of candidates for employment and cooperation — the data provided to us in connection with a recruitment process, in particular the data contained in a CV and a cover letter.
- Data of contractors and their employees and representatives — the data necessary to conclude and perform a contract and to issue and settle invoices (name, tax ID, business address), and the contact data of the people designated for contact (first name, surname, job title, business e-mail address, business telephone number).
- Data of people visiting our LinkedIn profile — the data made available within that service in connection with interaction with our profile.
- Technical data related to the use of the website — IP address, information about the browser and device, and the data stored in cookies, described in the section on cookies.
We do not collect through the website the special categories of personal data referred to in Article 9 GDPR, and we ask that you do not include them in the content of the messages you send us.
03
For what purposes and on what basis do we process data?
Handling enquiries
The data provided in the contact form, in an e-mail or during a telephone call is processed in order to answer your enquiry and conduct further correspondence — on the basis of Article 6(1)(b) GDPR (steps taken at the request of the data subject prior to entering into a contract) and Article 6(1)(f) GDPR (the controller's legitimate interest in communicating with people interested in our services).
Recruitment
Candidates' data is processed in order to carry out the recruitment process — on the basis of Article 6(1)(c) GDPR in connection with the provisions of the Polish Labour Code (as regards the data required by law), Article 6(1)(b) GDPR (steps taken prior to entering into a contract) and Article 6(1)(a) GDPR (consent — as regards data provided voluntarily beyond the scope required by law, and where consent is given to take part in future recruitment processes).
Concluding and performing contracts
Contractors' data is processed in order to conclude and perform a contract — on the basis of Article 6(1)(b) GDPR, and in the case of the contact people indicated by the contractor — on the basis of Article 6(1)(f) GDPR (the legitimate interest in the day-to-day performance of the contract).
Accounting and tax obligations
The data contained in accounting documents is processed in order to comply with legal obligations, in particular under the Polish Accounting Act and tax regulations — on the basis of Article 6(1)(c) GDPR.
Website security
Technical data and the data processed by the Google reCAPTCHA mechanism protecting the contact form is processed in order to ensure the security and correct operation of the website and to prevent abuse — on the basis of Article 6(1)(f) GDPR.
Establishing and pursuing claims
We may also process data in order to establish, pursue or defend against claims — on the basis of Article 6(1)(f) GDPR.
04
How long do we keep the data?
- Data from correspondence and enquiries — for the period necessary to answer and close the matter, and thereafter for the limitation period of any possible claims.
- Candidates' data — until the end of the recruitment process, and where consent to take part in future recruitment processes has been given — for 12 months from the date it was given or until it is withdrawn earlier.
- Contractors' data — for the term of the contract and, after it ends, for the period resulting from the law (in particular 5 years for accounting and tax documentation) and for the limitation period of claims.
- Data processed on the basis of consent — until that consent is withdrawn.
- Data stored in cookies — for the period indicated in the section on cookies or until the user deletes them in their browser settings.
05
Who do we share the data with?
We do not sell your personal data. Data may be shared only with the entities whose services we use in running our business and with the authorities entitled to receive it under the law. These are in particular:
- Providers of hosting services and of website maintenance and development.
- Providers of e-mail and communication tools.
- Google Ireland Limited — in connection with the operation of the reCAPTCHA mechanism protecting the contact form.
- LinkedIn Ireland Unlimited Company — as regards the data processed in connection with our profile in that service.
- Our accounting office and our legal and tax advisers.
- Public authorities and courts — to the extent and in the cases provided for by law.
With the entities that process data on our behalf we conclude data processing agreements obliging them to protect the data appropriately.
06
Is data transferred outside the European Economic Area?
As a rule, we process data within the European Economic Area. In connection with the use of providers whose infrastructure may be located partly outside the EEA (in particular Google and LinkedIn), your data may be transferred to third countries. In such a case, the transfer takes place on the basis of a European Commission adequacy decision or on the basis of standard contractual clauses approved by the European Commission, with additional safeguards applied.
07
What rights do you have?
In connection with the processing of personal data you have the following rights:
- The right to access your data and to obtain a copy of it.
- The right to rectification of data that is inaccurate or incomplete.
- The right to erasure of data if it is no longer necessary for the purposes for which it was collected, or if the processing has no legal basis.
- The right to restriction of processing.
- The right to data portability for data processed on the basis of consent or a contract.
- The right to object to processing based on the controller's legitimate interest.
- The right to withdraw consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.
- The right to lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland) if you consider that the processing of your data infringes the GDPR.
To exercise the rights above, please contact us at biuro@utilis.pl. We respond to requests without undue delay and no later than one month from receipt.
08
Is providing data mandatory?
Providing data is voluntary, but in some cases it is necessary for us to take action at your request. Providing a first name and an e-mail address in the contact form is required in order to answer an enquiry, and providing the data required by law is required in order to conclude a contract or to take part in a recruitment process. Failure to provide such data will make it impossible, respectively, to answer the enquiry, conclude the contract or consider the application.
09
Do we make automated decisions?
Your personal data is not used for automated decision-making, including profiling, that would produce legal effects concerning you or similarly significantly affect you.
10
Cookies
Cookies are small text files saved on your device when you use the website. We use them so that the website works correctly and to remember your decision regarding cookie consent.
Strictly necessary cookies
The “CookieBy” and “UtilisCookieConsent” files record that the cookie banner has been displayed and which choice you made (allow or deny). They are stored for 60 days. Their use is necessary for the website to work and does not require consent.
Third-party cookies
On the subpage with the contact form we use the Google reCAPTCHA service provided by Google Ireland Limited, which saves its own cookies and collects data about how the website is used in order to distinguish users from bots. The rules on the processing of data by Google are described in Google's privacy policy.
Analytics and marketing cookies
We currently do not use cookies for analytics or advertising purposes on the website. Should such tools be introduced, we will update this policy and will collect consent before they are activated.
You can change your cookie settings in your browser at any time — block cookies from being saved or delete those already stored. Detailed information can be found in the “Help” section of your browser's menu. Restricting the use of cookies may affect some functions of the website.
11
Changes to the privacy policy
This privacy policy may be updated in connection with changes in the law, the development of our website or the scope of the services we provide. The current version is always available at this address, and the date of the last change is indicated at the beginning of the document.