Privacy policy and personal data processing

Welcome to the website (“Website”) owned by "BOLL" Wojciech Dalewski Spółka jawna, located at Chemiczna 3 St., 65-713 Zielona Góra, registered in the District Court in Zielona Góra, VIII Commercial Division of the National Court Register under KRS number: 0000034509, NIP: 929-000-11-70, REGON: 970679600000, hereinafter referred to as "BOLL", "we", "our", "us", depending on the context.

BOLL places great importance on protecting the privacy of individuals and their personal data collected in connection with our business activities.

As a responsible organization that recognizes that information has a certain value and as a resource requires appropriate protection, we are committed to properly informing you about matters related to personal data processing, especially in light of the provisions of data protection laws, including Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons concerning the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the “GDPR”). Therefore, in this privacy policy (hereinafter: the “Policy”), we present key information related to the processing of personal data in the Company's activities.

This Policy provides information on personal data processing, including a description of how we collect, use, and protect the personal data provided to us, the purposes and legal bases for processing, and the rights of individuals whose data is processed.

The Privacy Policy consists of:

General information applicable to all personal data processing operations by BOLL, and
Specific sections that, for different data processing operations, indicate the specific purposes and legal bases for processing, categories of recipients, data storage time, and other information required by law.

Data Controller

The controller of your personal data is "BOLL" Wojciech Dalewski Spółka jawna, located at Chemiczna 3 St., 65-713 Zielona Góra, registered by the District Court in Zielona Góra, VIII Commercial Division of the National Court Register under KRS number: 0000034509, NIP: 929-000-11-70, REGON: 970679600000.

Contact regarding personal data

Do you want to notify us of a breach of your personal data protection, submit a request regarding your rights as a data subject? Do you have questions or concerns about the protection of your personal data?

Contact details of the Data Protection Officer for BOLL:
Kacper Kałagate vel Kałagow
Email: rodo@boll.pl
Address: "BOLL" Wojciech Dalewski Spółka Jawna, ul. Chemiczna 3, 65-713 Zielona Góra with the note "Data Protection Officer."

Joint Controller Relations

In processes related to the website and as the owner of social media profiles, BOLL, to achieve the set business objectives and ensure the highest standards of service, processes your personal data as part of joint controller relationships with other entities. Joint controllers independently decide on the purposes and means of data processing, but to varying extents, within a set of information usually collected in an application, service, or system. BOLL is responsible only for the personal data it processes within the cooperation with the aforementioned entities. Information regarding joint controller relationships can be found directly in the section Detailed information on Data Processing.

Transferring Personal Data

Personal data will be transferred by the controller only to trusted entities, such as companies that provide and maintain chosen IT systems and solutions, accounting, legal, postal, and courier service providers. Personal data will generally not be transferred outside the EEA or made available to international organizations. However, if the controller uses service providers outside the EEA that have not been recognized by the European Commission as providing an adequate level of personal data protection, the transfer of personal data to these entities is based on standard contractual clauses adopted by the European Commission, thus subject to appropriate safeguards regarding the protection of privacy, rights and freedoms of the data subjects. A copy of the standard contractual clauses can be obtained from the controller.

How to exercise your rights

In connection with our processing of your personal data, you have the right to:

withdraw your consent for processing (if we are acting based on such consent),
request access to your personal data,
request correction of your personal data,
request deletion or restriction of the processing of your personal data,
object to the processing of data based on legitimate interests (unless there is an overriding legal basis) or for direct marketing purposes;
not to be subject to automated decision-making that has a significant impact on the customer;
request a transfer of your data, in a machine-readable format, to you or another data controller;
file a complaint with a supervisory authority, which in Poland is the President of the Personal Data Protection Office.

If you have questions related to this policy, general processing of your personal data by us, or your data protection rights, please contact us at rodo@boll.pl.

Detailed information regarding the processing of your data

We may process your personal data in various ways and situations depending on whether you are a Client, Supplier, User of our online services and social media, or interested in working at BOLL. Regardless of the situation, we oblige to not sell, commercialise, or use your personal data in violation of applicable data protection regulations.

We have organized the information about personal data processing into sets dedicated to categories of individuals, allowing you to quickly find the relevant information for your case.

Current or Potential Clients

We have obtained your personal data directly from you in connection with the negotiation and execution of the contract or from publicly available sources. We process personal data in the scope of contact details (e.g., phone number, email address), employment data (position, place of employment), and identification data (name, surname).

Purposes and Legal Basis of Data Processing:

Establishing and maintaining business relationships – processing is necessary for the legitimate interests of the controller in purchasing goods and services necessary for conducting business (Article 6(1)(f) of the GDPR).
Execution of contract provisions – processing is necessary to perform pre-contractual actions and to fulfil provisions of contracts (Article 6(1)(b) of the GDPR).
Keeping accounting and tax documentation – processing is necessary to fulfil legal obligations arising from Article 74 of the Accounting Act and other taxpayer-related regulations (Article 6(1)(c) of the GDPR).
Claims pursuit and defence – processing is necessary for the legitimate interests of the controller (Article 6(1)(f) of the GDPR).
Marketing of own services, when the processing is necessary for the legitimate interests of the controller (Article 6(1)(f) of the GDPR), and in the case of marketing through specified communication channels (phone, email), based on the consent provided for this purpose (Article 6(1)(f) of the GDPR in conjunction with Article 10(1-2) of the Act on Providing Services by Electronic Means or Article 172(1) of the Telecommunications Act).
Marketing of own services may be preceded by profiling, understood as automated matching of content provided according to the client's interests or needs, where processing is necessary for the legitimate interests of the controller (Article 6(1)(f) of the GDPR), and in the case of profiling that significantly influences your decisions, only if consent has been given.

Data Processing Period:

Data is processed appropriately for the following periods:

Until a valid objection/request for data deletion is submitted – applies to points 1 and 5 above, excluding email and telephone communication;
Until the contract is terminated or expires – applies to point 2 above;
5 years from the end of the calendar year in which the contract was terminated or expired – applies to point 3 above;
Until the expiration of claims – applies to point 4 above;
Until consent is withdrawn – applies to points 5 and 6 above.

Other Information:

Providing data is voluntary but necessary for the conclusion and execution of contract. Data processing in the marketing of own services may be preceded by profiling, understood as the automated matching of content according to the client's interests or needs. If profiling significantly influences your decisions, the mechanism is activated only after you give your consent.

Current or potential service, equipment, or software providers

Purposes and Legal Basis of Data Processing:

Establishing communication and maintaining business relationships – processing is necessary for the legitimate interests of the controller in purchasing goods and services necessary for conducting business (Article 6(1)(f) of the GDPR).
Evaluation and classification of service and goods providers, and the quality of their work – the legal basis is the necessity of processing for the legitimate interest of the controller (Article 6(1)(f) of the GDPR).
Execution of contract provisions – processing is necessary to perform pre-contractual actions and to fulfil provisions of contracts (Article 6(1)(b) of the GDPR).
Keeping accounting and tax documentation – processing is necessary to fulfil a legal obligation arising from Article 74 of the Accounting Act and other taxpayer-related regulations (Article 6(1)(c) of the GDPR).
Claims pursuit and defence – processing is necessary for the legitimate interests of the controller (Article 6(1)(f) of the GDPR).

Data Processing Period:

Data is processed appropriately for the following periods:

Until a valid objection/request for data deletion is submitted – applies to points 1-2 above;
Until the contract is terminated or expires – applies to point 3 above;
5 years from the end of the calendar year in which the contract was terminated or expired – applies to point 4 above;
Until the expiration of claims – applies to point 5 above.

Other Information:

Providing data is voluntary but necessary for the conclusion and execution of the contract. In the process of personal data processing, no automated decision-making, including profiling, takes place.

Representatives/employees of our customers or service, device, or software providers, collectively referred to as Business Partners:

We have obtained your personal data directly from you in connection with the process of negotiating and fulfilling a contract with the Business Partners you represent, or from publicly available sources. We process personal data within the scope of contact information (e.g., phone number, email address), employment-related data (position, place of employment), and identification data (first and last name).

Purposes of Data Processing and Legal Basis:

Ongoing communication related to business and economic relations with the Business Partner – processing is necessary for the legitimate interests of the administrator (Article 6(1)(f) of the GDPR).
Pursuing and defending claims – processing is necessary for the legitimate interests of the administrator in protecting the business’s interests (Article 6(1)(f) of the GDPR).
Marketing of own services, where processing is necessary for the purposes arising from the legitimate interests of the Administrator (Article 6(1)(f) of the GDPR), and in the case of communication through specific channels [phone, email], based on the consent provided (Article 6(1)(f) of the GDPR in conjunction with Article 10(1-2) of the Act on Providing Electronic Services or Article 172(1) of the Telecommunications Law).
Marketing of own services may be preceded by profiling, understood as automated customization of content according to customer interests or needs, where processing is necessary for purposes arising from the legitimate interests of the Administrator (Article 6(1)(f) of the GDPR), and in the case of profiling that significantly affects your decisions, only if such consent has been given.

Data Retention Period:

Data is processed for the following periods:

Until a legitimate objection/request for data deletion is submitted, or until the processing purpose is fulfilled – applies to point 1 above.
Until the statute of limitations for claims – applies to point 2 above.
Until consent is withdrawn – applies to points 3-4 above.

Additional Information: Providing data is voluntary but necessary for concluding and fulfilling the contract. The processing of data in the process of marketing own services may be preceded by profiling, understood as automated customization of content according to customer interests or needs. If profiling significantly affects your decisions, the mechanism is activated only after you have given consent.

Individuals Communicating with Us on Any Matter:

We have obtained your personal data directly from you through a contact form, email, or phone call. We process personal data within the scope of contact information (e.g., phone number, email address), employment-related data (position, place of employment), and identification data (first and last name), as well as other data you provide in communication.

Purposes of Data Processing and Legal Basis:

Registration of correspondence and response – processing is necessary for the legitimate interests of the administrator in ensuring timely responses to letters, timely payments to suppliers, and maintaining the quality of cooperation with contractors and other interested parties (Article 6(1)(f) of the GDPR).
Pursuing and defending claims – processing is necessary for the legitimate interests of the administrator in protecting the business’s interests (Article 6(1)(f) of the GDPR).

Data Retention Period:

Data is processed for the following periods:

Until a legitimate objection/request for data deletion is submitted, or until the processing purpose is fulfilled – applies to point 1 above.
Until the statute of limitations for claims – applies to point 2 above.

Additional Information: Providing data is voluntary but necessary to receive a response to your inquiry. The processing of personal data does not involve automated decision-making, including profiling.

Individuals Interested in Cooperation or Employment with BOLL:

We have obtained your personal data directly from the application you submitted, through direct communication (e.g., during a recruitment interview), and, if you consent, from other sources agreed with you. During recruitment, we may generate additional information about you, such as opinions or competency assessments.

During recruitment processes, we may collect the following categories of your personal data to create your recruitment profile:

Contact details: first and last name, address, email address, phone number.
Information provided in the application: your professional career history, employment history, date of birth, image, education, skills, language proficiency, and any other information included in your application.
Other data: any information you choose to share with us during recruitment processes and that we generate in connection with the application.

It cannot be excluded that the process may involve special category data (within the meaning of Article 9 of the GDPR), such as health information, but we will process such data only if you voluntarily provide it with your application.

Additionally, during recruitment, we may obtain the following information:

Competency assessment: based on your application and observations made during the recruitment process, we may generate evaluative information and opinions about your candidacy; we may also ask you to undergo assessments of your competencies, skills, character traits, or cognitive abilities.
References: we may decide to obtain references from individuals/institutions from your professional career. We will only contact those individuals whose contact details you have provided to us and only after obtaining your consent.

Purpose and Legal Basis for Data Processing

Conducting and concluding the recruitment process for the position you applied for:
Inclusion of Your recruitment profile (application and other information generated in relation to the application) in future recruitment processes for the next 12 months from the date of consent.
Establishing, Pursuing, or Defending Against Claims, based on Article 6(1)(f) of the GDPR, to pursue the legitimate interests of the data controller, which involve assessing the risk of claims being made against us and taking measures to defend against them.

Based on Article 6(1)(b) of the GDPR, to take necessary actions at the request of the person before entering into a contract—concerning the data provided during the recruitment process as specified in Article 2211 of the Polish Labor Code, as well as based on the consent you provided under Article 6(1)(a) of the GDPR for data beyond what is outlined in Article 221 §1 of the Polish Labor Code.
Based on Article 6(1)(f) of the GDPR, to pursue the legitimate interests of the data controller—in relation to the data generated during the recruitment process.

Data Processing Period

Your personal data will be processed for the duration of the specific recruitment process, and after that, it will be stored for the period during which any potential claims from either party may be made, i.e., 6 months from the date of application submission. If you withdraw from the recruitment process during its course, your personal data will still be stored for 6 months from the application submission date to allow for any claims.

If you consent to the processing of your personal data for future recruitment purposes, we will process your data for this purpose until the consent is withdrawn, but not longer than 12 months from the date of application submission and consent.

Co-Administration – Job Board Portals

BOLL and recruitment services such as Pracuj.pl are joint controllers of your personal data when you respond to our job offer through these services.

Each of the joint controllers independently determines the purposes and means of data processing but to varying extents. BOLL is responsible only for the personal data it processes.

When using job board portals, independently and separately from BOLL, the portal operators also process your data. If you create an account with these job board services, the companies managing these platforms will continue to process your data for their purposes as detailed in their privacy policies. The privacy policy of Grupa Pracuj SA (Pracuj.pl) is available here.

Additional Information

Providing personal data is voluntary, but for the data specified in Article 221 §1 of the Labor Code, it is necessary to participate in the recruitment process. No automated decision-making, including profiling, occurs during the personal data processing.

Website users on the boll.pl domain and other independently created websites (landing pages) as well as social media services

Personal data is collected directly from you when using the website or interacting with our social media profiles. The website uses cookies to employ analytical tools provided by social media services. More information can be found in our Cookie Policy.

Purpose and Legal Basis for Data Processing

Initiating communication and maintaining relationships with website users or through social media services:
Pursuing Claims and Defending Against Claims:
Marketing of Own Services, when processing is necessary for the legitimate interests of the controller (Article 6(1)(f) GDPR). If conducted through a specified communication channel [phone, email], it is based on the consent provided (Article 6(1)(f) GDPR in connection with Article 10(1-2) of the Act on the Provision of Electronic Services or Article 172(1) of the Telecommunications Law).
Marketing of Own Services may be preceded by profiling, understood as the automated tailoring of provided content according to the client's interests or needs, when processing is necessary for the legitimate interests of the controller (Article 6(1)(f) GDPR). Profiling that significantly impacts your decisions will only occur if you have provided consent.

Processing is necessary for the legitimate interests of the controller, which involve maintaining communication with potential customers and brand supporters (Article 6(1)(f) GDPR).

Processing is necessary for the legitimate interests of the controller (Article 6(1)(f) GDPR).

Data Processing Period

Your personal data will be processed for the period during which you remain an active user of the service, and afterward, for the necessary period to comply with legal regulations, pursue, or defend against potential claims, but no longer than 6 years.
Your personal data processed within social media services:
The controller does not archive personal data or your activity on social media services.
Data processed for marketing purposes will be processed until the consent is withdrawn, with the reservation that the withdrawal of consent does not affect the legality of data processing conducted before its withdrawal.

Data collected in private messages—will be retained for the time necessary to respond to your inquiries or until the end of the cooperation.
Data contained in comments under a selected publication—will be available until they are deleted by the author of the publication or post.
Personal data collected by social media portals, such as post history, activity history—are subject to retention according to the rules specified in the regulations of those portals.
Statistical data regarding visitors to the BOLL fan page will be processed for as long as this data is available on the social media portal.

Co-Administration

BOLL, as the creator of profiles on the social media services provided by the entities listed below, is a joint controller of the personal data published on these profiles along with:

Facebook, Instagram - Meta Platforms Ireland Limited, ATTN: Privacy Operations, Merrion Road, Dublin 4, D04 X2K5, Ireland; more about privacy here.
LinkedIn Corporation, 1000 West Maude Avenue, Sunnyvale, CA 94085, USA; more about privacy here.
YouTube, provided by Google LLC, headquartered at 901 Cherry Ave, San Bruno, CA 94066, USA; more about privacy here.

Each of the aforementioned Joint Controllers independently determines the purposes and means of data processing, but to varying extents. BOLL is responsible solely for the personal data it processes.

When using social media services independently and separately from BOLL as the owner of the business account on these platforms, when you communicate with us via these media, they are also responsible for processing your data. If you create an account with these social media services, the companies managing them continue to process your data for their own purposes, as detailed in their Privacy Policies. If you have any questions or requests for the social media platform owners, please contact them:

For Meta Platforms Ireland Limited (Facebook, Instagram), more about privacy can be found here.
For LinkedIn Corporation (LinkedIn), more about privacy can be found here.
For Google LLC (YouTube), more about privacy can be found here.

Additional Information Providing data is voluntary but necessary to use the functionality of the service and social media profiles. Data processing in the process of marketing our own services may be preceded by profiling, understood as automated content customization according to the client's interests or needs. If profiling significantly affects your decisions, the mechanism is triggered only after you give your consent.

Cookies and other tracking technologies on our services

Within the website under the domain boll.pl (hereinafter: the Service) and on independently created websites (landing pages), we use information stored through cookies, which are data stored on users' devices designed for browsing websites (e.g., computer, tablet, phone). These usually contain the name of the website they come from, the duration of their storage on the end device, and a unique number. When you visit our website, you can read more about this in our Cookie Policy.

Final information

We are continuously developing our competencies, modernizing processes, and auditing the adopted data processing model and security measures. As a result, changes to the messages directed to you and made available here may occur. We reserve the right to update them. The privacy policy may also change due to changes in legal regulations or updates regarding the purposes of personal data processing.

Information about changes to the documents will be published on the Service in the Privacy Policy section.