TERMINOLOGY 

Personal Data Controller (PDC) / Joint Controllers:

1. INTERFREIGHT International Transport Logistics Robotycki Limited Joint-Stock Partnership, based at ul. Strzeszyńska 35–37, Poznań (60-479), registered in the National Court Register under KRS number: 0000955426, maintained by the District Court Poznań – Nowe Miasto and Wilda, 8th Commercial Division of the National Court Register, with Tax Identification Number (NIP): 7812032382 and Statistical Number (REGON): 521277847.
2. INTERFREIGHT Management Limited Liability Company, based at ul. Strzeszyńska 35–37, Poznań (60-479), registered in the National Court Register under KRS number: 000000642665, maintained by the District Court Poznań – Nowe Miasto and Wilda, 8th Commercial Division of the National Court Register, with Tax Identification Number (NIP): 7543129799.

Personal Data – information about an identified or identifiable natural person (“data subject”), where an identifiable person is one who can be identified directly or indirectly, in particular by reference to an identifier such as name, identification number, location data, online identifier, or one or more specific factors determining the physical, physiological, genetic, mental, economic, cultural, or social identity of that person.

Special categories of data / sensitive data – revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, and genetic data, biometric data, health data, data concerning sexuality or sexual orientation.

Group of undertakings – means a controlling enterprise and the enterprises it controls.

Recipient – means a natural or legal person, public authority, agency, or other body to whom personal data is disclosed, whether or not it is a third party. Public authorities that may receive personal data in the framework of a particular inquiry in accordance with Union or Member State law shall not be regarded as recipients; the processing of those data by those public authorities shall be in compliance with the applicable data protection rules according to the purposes of the processing.

Restriction of processing – means the marking of stored personal data with the aim of limiting their processing in the future.

Supervisory authority – Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw

International organization – means an organization and its subordinate bodies governed by public international law or any other body established by or on the basis of an agreement between two or more countries.

Third country – a country not belonging to the European Economic Area.

Processor – a natural or legal person, public authority, agency or other body which processes personal data on behalf of the Data Controller.

Profiling – any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person’s performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

Processing – any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction.

GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).

Cross-border processing – means:

1. processing of personal data which takes place in the Union in the context of the activities of establishments in more than one Member State of a controller or processor in the Union.

1. Processing of personal data which takes place in the Union in the context of the activities of a single establishment of a controller or processor in the Union but which substantially affects or is likely to substantially affect data subjects in more than one Member State.

Data subject’s consent – any freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her. Consent must be properly documented to prove its validity.

WHAT RIGHTS DO YOU HAVE?

Under the provisions of the GDPR, you have the following rights:

• Right of access to personal data, pursuant to Article 15 of the GDPR
• Right to rectification of personal data (updating, correcting, etc.), pursuant to Article 16 of the GDPR
• Right to erasure of personal data (“right to be forgotten”), pursuant to Article 17 of the GDPR
• Right to restriction of processing, pursuant to Article 18 of the GDPR
• Right to data portability (if your personal data has been entered into our IT system and we have the technical capability to fulfill this right), pursuant to Article 20 of the GDPR, applicable when processing is based on Article 6(1)(a) and/or (b) and/or Article 9(2)(a) of the GDPR – the legal bases are indicated below in the detailed information addressed to specific groups of individuals
• Right to object (regarding processing based on Article 6(1)(f) or Article 6(1)(e) of the GDPR, i.e. our legitimate interests – more details in the specific information), pursuant to Article 21 of the GDPR
• Right to withdraw consent, with the reservation that withdrawal does not affect the lawfulness of processing carried out based on consent before its withdrawal – Article 7(3) of the GDPR, meaning that withdrawal applies only to future processing

The scope of exercising these rights is regulated by the provisions of the GDPR. Additionally, you have the right to:

• Lodge a complaint with the President of the Personal Data Protection Office, ul. Stawki 2, 00-193 Warsaw, if you believe that the processing of your personal data violates the GDPR, pursuant to Article 77 of the GDPR.

PURPOSE OF THE PERSONAL DATA PROTECTION POLICY

The purpose of the personal data protection policy is to ensure that the processing of personal data complies with the requirements of applicable Polish and European legal acts, including guidelines, in particular:

• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation – GDPR)
• Act of 10 May 2018 on the protection of personal data (Journal of Laws 2018, item 1000, as amended) – hereinafter referred to as the Act
• Guidelines of the Article 29 Working Party (now the European Data Protection Board)
• Guidelines of the President of the Personal Data Protection Office

This personal data protection policy applies to all natural persons whose data is processed by the Controllers.

PRINCIPLES OF PERSONAL DATA PROCESSING

The processing of personal data is carried out in accordance with the general principles set out in Article 5(1) and (2) of the GDPR. This means that personal data is processed:

• lawfully, based on at least one legal basis indicated in Article 6 or Article 9(2) of the GDPR (principle of lawfulness)
• fairly, taking into account the interests and reasonable expectations of data subjects (principle of fairness)
• transparently for data subjects (principle of transparency)
• for specific, explicit, and legitimate purposes (purpose limitation)
• in a manner that is adequate, relevant, and limited to what is necessary (data minimization)
• accurately and, where necessary, kept up to date (accuracy)
• for no longer than necessary for the purposes for which it is processed (storage limitation)
• in a way that ensures appropriate security (integrity and confidentiality)

HOW DO WE PROCESS YOUR PERSONAL DATA?

• Your personal data will not be subject to automated decision-making, and joint controllers do not use profiling.
• Your personal data is not transferred outside the European Economic Area. If such transfer occurs, it will be based on the European Commission’s approved Standard Contractual Clauses, and you will be informed accordingly (updated information).
• Personal data is not transferred to international organizations.

DETAILED INFORMATION FOR:

Suppliers of goods and services

Your personal data is processed based on:

• Article 6(1)(b) of the GDPR – actions aimed at concluding and/or performing a contract/order related to the provision of goods/services to us
• Article 6(1)(c) of the GDPR – compliance with legal obligations (e.g. based on: Article 74 of the Accounting Act of 29.09.1994; Articles 32, 70, and 86 of the Tax Ordinance Act of 29.08.1997; archiving documentation; the Convention on the Contract for the International Carriage of Goods by Road (CMR) of 19 May 1956)
• Article 6(1)(f) of the GDPR – our legitimate interest, e.g. protection against claims, debt recovery

Access to your data will be granted to: entities authorized under applicable law, as well as those supporting us in IT (including hosting), legal, audit, data protection, debt collection, legal services, courier, postal, banking, accounting, and other services.

Your personal data will be processed for 5 years due to tax regulations. This period may be extended based on our legitimate claims.

Providing your personal data is necessary for the purchasing process. Without it, we cannot conclude a contract or place an order for your goods/services.

Your personal data will be processed in paper form and in the IT systems of the Joint Controllers and processors entrusted with data processing under a binding agreement.

Your personal data will be processed in the Supplier database. Data may also originate from public registers such as the National Court Register (KRS), CEIDG, CRBR, websites, white lists, and others.

Providing your data is necessary for the above purposes. Without it, cooperation or order placement will not be possible.

Job Candidates

Your personal data will be processed based on:

• Article 6(1)(c) of the GDPR – legal obligation under Article 221 §1 of the Labour Code regarding: name(s), date of birth, contact details. For specialist positions: education, employment history, skills, and qualifications (e.g. driving license), based on actions aimed at concluding an employment or cooperation agreement – Article 6(1)(b) of the GDPR
• Article 6(1)(a) of the GDPR – consent for providing a broader scope of personal data than required. Consent is understood as the voluntary submission of application documents
• If you do not consent to data processing for future recruitment projects, your data will be deleted after the current recruitment ends
• If sensitive data is included (e.g. health status, political views), we will request consent under Article 9(2)(a) of the GDPR
• Article 6(1)(f) of the GDPR – legitimate interest of the Joint Controllers to process data for protection against potential claims (even after recruitment ends, but no longer than 3 years)

Access to your data will be granted to: entities authorized under applicable law, and those supporting us in legal matters, IT services (including hosting), and others. If your data is received from external recruitment providers, they may be recipients of your data during the recruitment process.

Providing data under Article 221 §1 of the Labour Code is necessary to participate in recruitment. Providing other data is voluntary. Without it, participation and potential contract conclusion will not be possible. Consent for future recruitment processes is entirely voluntary.

Contracting parties whose data is indicated in transport documents

Your personal data is processed based on:

• Article 6(1)(b) of the GDPR – actions related to the execution of assortment delivery orders
• Article 6(1)(c) of the GDPR – legal obligations (e.g. based on: Article 74 of the Accounting Act of 29.09.1994; Articles 32, 70, and 86 of the Tax Ordinance Act of 29.08.1997; archiving documentation; Convention on the Contract for the International Carriage of Goods by Road (CMR) of 19 May 1956)
• Article 6(1)(f) of the GDPR – our legitimate interest, e.g. protection against claims, debt recovery, execution of transport orders

Access to your data will be granted to: entities authorized under applicable law, and those supporting us in IT (including hosting), legal, audit, data protection, debt collection, legal services, courier, postal, banking, accounting, and other services. Additionally, the Polish Atomic Energy Agency may access your data.

Your personal data will be processed for up to 5 years. This period may be extended based on our legitimate claims.

Providing your personal data is necessary due to logistics processes. Your data was provided by your employer as the person responsible for the release/receipt of assortment. The scope includes: full name, contact details, address of workplace/location of delivery/receipt of radiopharmaceuticals.

Your personal data will be processed in paper form and in the IT systems of the Joint Controllers and processors entrusted with data processing under a binding agreement.

Your personal data will be processed in the dataset “Persons indicated in transport documentation” within the scope described above.

Individuals subject to monitoring on the premises of the Joint Controllers

Your personal data is processed based on:

• Article 6(1)(f) of the GDPR – our legitimate interest, which is the protection of the premises and property.

Access to your data will be granted to: entities authorized under applicable law, as well as those supporting us in IT (including hosting), legal, audit, data protection, and legal services.

Your personal data will be processed for up to 3 months. This period may be extended based on our legitimate claims.

Providing your personal data (image and location) is voluntary, but it is a necessary condition for being present on the premises monitored by the Joint Controllers.

Individuals submitting inquiries via website/email

Your personal data is processed based on:

• Article 6(1)(f) of the GDPR – our legitimate interest, which is to offer our services, and Article 6(1)(b) of the GDPR – actions taken by you to receive a cooperation offer or transport service quotation.

Access to your data will be granted to: entities authorized under applicable law, as well as those supporting us in IT (including hosting), legal, audit, data protection, and legal services.

Your personal data will be processed for up to 12 months. This period may be extended based on our legitimate claims.

Providing your personal data is voluntary, but it is a necessary condition for receiving a cooperation offer or transport service quotation.

Visitors to the website www.interfreight.pl and information about cookies

When visiting the website www.interfreight.pl, the Joint Controllers may collect information provided by the user through the form.

What are cookies?

Cookies are small text files containing information stored on the user’s computer or mobile device while viewing the website www.interfreight.pl, hosted by the company home.pl. . The website automatically collects only the information contained in cookies. Each time a user clicks a link on www.interfreight.pl, the cookie file is sent to the server of home.pl. . During this click, the server mechanisms of www.interfreight.pl may read the information contained in the cookie.

Cookies are used to tailor the content of www.interfreight.pl to the user’s preferences. They contain statistical information (e.g. number of visits to the site) and do not allow for user identification – they are fully anonymous and do not collect personal or sensitive data from the user’s device.

Can I delete these files from my device?

Yes, while on www.interfreight.pl, you can change your cookie settings yourself (in the bottom left corner – follow the instructions via the gear icon).

What types of cookies are used?

• Session cookies – These are essential for maintaining proper communication between the server and the browser, allowing correct display of the website content and use of its functionalities. They identify the session (i.e. the dialogue between browser and server) and users communicating with the server at the same time.