Information obligation

INFORMATION OBLIGATION CLAUSE

Respecting the fundamental right of every person to keep privacy, we attach great importance to ensuring the confidentiality and protection of personal data being processed, and we make every effort so that the processing of this data shall be carried out in a lawful manner, respecting the fundamental rights and freedoms of data
subjects. Accordingly, and to ensure a proper processing of personal data pursuant to the provisions of Article 13(1) and (2) of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (OJ EU L.2016.119.1), hereinafter referred to as “GDPR”, we present this information obligation clause containing relevant information on the processing of personal data.

1. Controller of Your Personal Data

The Controller of your personal data shall be Pharmapoint S.A. with its registered office in Łódź (91-342) at ul. Zbąszyńska 3, entered into the Register of Entrepreneurs of the National Court Register kept by the District Court for Łódź-Śródmieście in Łódź, 20th Commercial Division of the National Court Register, under KRS number: 0000368567, NIP [Tax ID No.]: 779-238-40-07, REGON [National Business Registry No.]: 301582667. You can contact the Controller using the correspondence details or by e-mail, writing at: info@pharmapoint.pl

2. Data Protection Officer

In order to adequately protect personal data, the Controller has appointed a Data Protection Officer whom you can contact via e-mail writing at: iod@pharmapoint.com.pl

3. Personal Data Recipients

The recipients of your personal data may be entities cooperating to the extent of agreements being performed and of the Controller’s activities – under relevant agreements concluded on entrusting the processing of personal data and provided that proper security measures are applied to protect your personal data, as well as entities to whom the Controller is obliged to provide data pursuant to applicable law. The recipients of your personal data may also be entities providing online payment services and carrier companies.

4. Right to Lodge a Complaint with a Supervisory Authority

You have the right to lodge a complaint with the supervisory authority – the President of the Personal Data Protection Office – at any time, should you deem that the processing of your personal data violates the provisions of the GDPR. Detailed information is available on the web page https://uodo.gov.pl/pl/83/155

5. Data Subjects’ Rights

You have the right to request access to your data, their rectification, erasure, restriction of the processing, the right to data portability and the right to object to processing, and also the right to withdraw your consent to the processing of your data at any time, provided that the processing is performed based on your consent to the processing of your personal data.

6. Information on the Transfer of Data to a Third Country

Your personal data shall not be transferred to any third country or international organisation.

7. Information on Profiling

Your data shall not be subject to any automated decision making, including profiling.

8. Extent, Purpose and Lawful Basis for the Processing of Personal Data

The extent connected with recruitment

If you are a job candidate, we shall process your personal data based on Article 6(1)(a), (b) and (c) of the GDPR - the Act of 26 June 1974 - The Labour Code and Article 6(1)(f) of the GDPR - the establishment, exercise or defence of potential claims between you and the Controller.
The purpose of data processing shall be the selection of a person, from among job candidates, who fulfils the Controller’s expectations towards a future employee as accurately as possible.
We shall process your personal data for 3 months, starting from the end of the recruitment process. If you have given consent to future recruitment processes, your application documents shall be stored for a period no longer than 12 months or until you withdraw your consent to personal data processing or effectively object to the processing.

The extent connected with cooperation with Trading Partners

We shall process your personal data based on Article 6(1)(b) and (f) of the GDPR - contacting you in connection with conclusion and performance of an agreement, as well as the establishment, exercise and defence of mutual claims, if any. To the extent connected with handling complaints, data processing shall happen based on Article 6(1)(b) and (c) of the GDPR - the Act of 23 April 1964 - The Civil Code. To the extent connected with debt collection, we shall process your personal data based on Article 6(1)(f) of the GDPR - actions aimed at recovery of receivables.
The purpose of personal data processing shall be activities aimed at the conclusion of agreements with suppliers or customers and their subsequent performance.
We shall process your personal data for 5 years – starting from the year following the year of agreement expiry pursuant to Article74(2)(4) of the Accounting Act of 29 September 1994. As regards complaints, we shall process your personal data for 1 year – after the date of warranty expiry or complaint settlement, pursuant to Article74(2)(6) of the Accounting Act of 29 September 1994 (JoL RP of 2019 Item 351, uniform text).

The extent connected with potential trading partners

We shall process your personal data based on Article 6(1)(f) of the GDPR.
The purpose of personal data processing shall be contacting you in order to establish business cooperation, including networking in connection with business activity conducted.
The Controller has obtained your personal data from public sources (such as websites) or from people employed/cooperating with you.
Your personal data shall be processed for the period necessary to achieve the said objective and we shall control their further usefulness systematically.

The extent connected with handling questions submitted to the Controller

If you submit a question to the Controller via e-mail, we shall process your personal data based on Article 6(1)(f) of the GDPR.
The purpose of data processing shall be answering the question sent by you.
Your personal data shall be processed for the period necessary to answer the question and for the period and to the extent required by law or to secure claims, if any.

The extent connected with reporting adverse effects

We shall process your personal data based on Article 6(1)(c) of the GDPR - the Act of 5 September 2001 - The Pharmaceutical Law, and Article 9(2)(b) of the GDPR.
The purpose of personal data processing shall be meeting legal obligations imposed on the Controller.
Your personal data shall be processed for the period resulting from applicable law, and erased afterwards.

The extent connected with marketing

To the extent connected with conducting marketing activities of our products and services, we shall process your personal data based on Article 6(1)(a) and (f) of the GDPR.
The purpose of data processing shall be brand building and sending commercial information via electronic means of communication.
We shall process your personal data until you withdraw your consent or object to the processing of your data, which you can do via e-mail, writing at info@pharmapoint.com.pl