«StarTruck» Website Privacy Policy

This Personal Data Processing and Personal Information Privacy Policy (next — the Policy) applies to all information posted on the website at: https://startruck.pl/ (next — the Website).

FRIEDMANN SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ (hereinafter referred to as the Service Provider) highly respects the confidential (personal) information of all individuals without exception who have visited the Website https://startruck.pl/, as well as those who use the services provided by the Website; therefore, the Service Provider strives to protect the confidentiality of personal data, thereby creating and ensuring the most comfortable conditions for using the Website’s services for every user.

I. Personal Data Administrator

The administrator of personal data contained on the website https://startruck.pl/ is FRIEDMANN SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, Warsaw, entered in the National Court Register under numbers TIN 5213956191 and NCR 0000953966.

II. Purpose of Personal Data Processing

We process users’ personal data in systematized databases, which we categorize by their processing purposes. We process this data to the extent necessary to achieve the stated purpose. The following list provides the databases, scope, and purposes of data processing.

We always inform about the purposes of personal data processing before or during the collection of such data.

III. Grounds and Duration of Personal Data Processing

When collecting personal data, we always inform about the legal grounds for its processing. When we inform about the application of:

• Article 6, paragraph 1, point (a) of the GDPR – this means that we process personal data based on obtained consent,
• Article 6, paragraph 1, point (b) of the GDPR – this means that we process personal data because it is necessary for the performance of a contract or for taking steps prior to entering into a contract, at the request of the User
• Article 6, paragraph 1, point (c) of the GDPR – this means that we process personal data to comply with legal obligations to which the Administrator is subject
• Article 6, paragraph 1, point (f) of the GDPR – this means that we process personal data for the purposes of the legitimate interests pursued by the Administrator, about which we always inform.

We may also process personal data based on other specific provisions, such as the Act on Providing Electronic Services

The duration of personal data processing depends on the grounds and purpose of its processing. We always inform about this before or during the collection of personal data. Examples of personal data retention periods:

• Personal data processed in connection with marketing activities will be processed until we receive an objection to the processing of this data.
• Personal data processed based on consent to its processing will be processed until such consent is withdrawn.
• Personal data processed using cookies and similar technologies will be processed until such files are deleted via browser or device settings, or until an objection to their processing is received.
• Personal data processed in connection with the fulfillment of legal obligations (e.g., for invoicing) will be processed for the period required by generally accepted accounting and tax legislation.
• Personal data related to the provision of services, including sales, will be stored until potential legal claims against us or by us.

IV. User Rights

The data subject has the right to access their personal data. The possibility of exercising the following rights depends on the legal grounds for personal data processing.

Right to data access. The data subject has the right to obtain confirmation from us as to whether their personal data is being processed. In this case, they have the right to access it and receive additional information (e.g., purposes, categories, recipients, permissions, source).

Upon receiving such a request, we are obliged to provide a copy of the processed personal data. If such a request is received electronically and, unless another response option is requested, we will also provide the information electronically.

Right to rectification. The data subject has the right to ask us to rectify any personal data concerning them that is inaccurate. Taking into account the purposes of processing, they have the right to request the completion of incomplete personal data, including by providing a supplementary statement.

Right to be forgotten. The data subject has the right to ask us to erase personal data concerning them without undue delay. We are then obliged to erase personal data without undue delay if one of the following grounds applies:

• the consent for personal data processing has been withdrawn, and there are no other legal grounds for processing,
• the data subject has objected to the processing,
• the personal data has been unlawfully processed,
• the personal data must be erased for compliance with a legal obligation,
• the personal data has been collected in relation to the offer of information society services.

Right to restriction of processing. The data subject has the right to ask us to restrict processing in the following cases:

• the data subject contests the accuracy of the personal data – for a period enabling us to verify the accuracy of such data;
• the processing is unlawful, and the data subject opposes the erasure of the personal data and requests the restriction of their use instead;
• we no longer need the personal data for the purposes of the processing, but they are required by the data subject for the establishment, exercise or defense of legal claims;
• the data subject has objected to processing pursuant to Article 21, paragraph 1 of the GDPR – pending the verification whether the legitimate grounds on our part as the administrator override those of the data subject.

Right to object. The data subject has the right to object, on grounds relating to their particular situation, at any time to processing of personal data concerning them which is based on Article 6, paragraph 1, letter f) (legitimate interest of the administrator), including profiling. In such a case, we shall no longer process the personal data unless we demonstrate compelling legitimate grounds for the processing. These grounds override the interests, rights, and freedoms of the data subject or for the establishment, exercise, or defense of legal claims.

Furthermore, if personal data is processed for direct marketing purposes (including profiling for marketing purposes), it shall no longer be processed for such purposes. Automated decision-making, including profiling.

The data subject has the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning him or her or similarly significantly affects him or her.

The law does not apply if the decision is:

• necessary for entering into, or performance of, a contract between the data subject and us;
• authorised by Union or Member State law to which the administrator is subject and which lays down suitable measures to safeguard the data subject’s rights and freedoms and legitimate interests; or based on the data subject’s explicit consent.

Users have the right to control the processing of their data contained in the Service Provider’s datasets. This includes, in particular, the right to access and rectify your data, as well as to request the supplementation, updating, correction of personal data, temporary or permanent suspension of its processing, or deletion if it is incomplete, outdated, incorrect, or was collected in violation of the Law, or if it is no longer needed to achieve the purpose for which it was collected.

V. System Logs

These are internal event logs of the Service’s server, automatically recording page requests sent when Users visit its storefront. System logs contain the page request sent by the user, IP address, browser type, browser language, date and time of the request, and at least one “cookie” file that can uniquely identify the user’s browser.

Details of the website’s cookie usage are specified on the page “Cookie Policy“.

VI. Data Transfer Outside the EEA

The level of personal data protection outside the European Economic Area (EEA) differs from that provided by European legislation. For this reason, the Administrator transfers personal data outside the EEA only when necessary and with an adequate level of protection, mainly through:

• cooperation with organizations processing personal data in countries for which an adequacy decision has been adopted by the European Commission;
• the use of standard contractual clauses issued by the European Commission;
• the application of binding corporate rules approved by the competent supervisory authority;
• in the case of data transfer to the USA – cooperation with organizations participating in the Privacy Shield program approved by a decision of the European Commission.

The Administrator always informs about the intention to transfer personal data outside the EEA at the stage of its collection.

VII. Copyright

The content of the website pages is the property of FRIEDMANN SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ. All personal and proprietary copyrights to any elements of the Website (text, graphics, page layout, etc.) are protected.

The Website and all its elements are protected by law, in particular by the Act of February 4, 1994, on Copyright and Related Rights (consolidated text, Journal of Laws No. 00.80.904 as amended) and the Act of April 16, 1993, on Combating Unfair Competition (consolidated text OJ 03.153.1503 as amended).

VIII. Other

The Website may contain links to other websites. We are not responsible for the privacy policies applied on these pages. We recommend that you familiarize yourself with the privacy policies of these pages when you visit them. The Service Provider reserves the right to change the Privacy Policy and “cookies”.

IX. Terminology and Abbreviations

The terminology used in this Policy means the following:

1. Administrator – FRIEDMANN SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ
2. GDPR – General Data Protection Regulation, adopted by the European Union on April 27, 2016, and effective from May 25, 2018.
3. Personal data means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier, or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural, or social identity of that natural person.;
4. Database – means any structured set of personal data which is accessible according to specific criteria, whether centralised, decentralised or dispersed on a functional or geographical basis;
5. Processing of Personal Data – Any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.
6. Website – an internet service provided by the administrator, located on the internet at the address https://startruck.pl/;
7. User – a person who has access to the Website via the Internet and uses it.