We are committed to protecting your privacy. We respect privacy and seek to employ best practices when it comes to the processing of your personal data – especially in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC, also known as General Data Protection Regulation (GDPR).
I. Glossary – basic concepts.
Personal Data – all information that we process related to you. For example: first name, last name, e-mail address, telephone number etc.;
processing – all activities performed relating to your Personal Data. For example: gathering, retaining, updating, sending messages to you, deleting data;
Services – services offered by APMAR Trade sp. z o.o. over the Website, including, for example the setting–up of accounts by the User on the Website and using said accounts, placing orders for products and services, making purchases, providing technical support for Users, filling in questionnaires concerning the Website, participation in contests, and making other functionalities of the Website available;
APMAR Trade – the data controller of the Personal Data, i.e. APMAR Trade sp. z o.o. with its registered office in Wroclaw, Jana Szczyrki 11, 54-426 Wroclaw, Poland;
User – a person using our Website;
In the scope of all of the above definition references to the plural also include references to the singular and vice versa.
II. When you contact us or visit our Website: what Personal Data do we gather, for what purpose and what is the legal basis for its processing?
We may process your Personal Data obtained during our conversations or correspondence, for example to get answers or file a complaint.
When you communicate with us, for example via an external tool/chat, e-mail, forms published on the Website, social media, etc., we may process your Personal Data that identify you (e.g. e-mail address, IP number, your nickname), metadata concerning the contact (e.g. contact date, duration of our conversation) and also the content of our communication (e.g. chat conversation history, e-mail content).
Your Personal Data are processed in order to answer your inquiry, improving our communication, improving the quality of customer service, as well as for marketing purposes and concluding an agreement. In such cases, the legal basis for processing depends on the communication context.
If you contact us to receive information regarding APMAR Trade Services, products or the Website, as a rule, we process your Personal Data based on our legitimate interest (resulting from the abovementioned purposes; Article 6(1) letter f of the GDPR). The legitimate interest of APMAR Trade exists in the necessity to respond the Users or, depending on the context of your question, to promote our products or Services. However, if your inquiry leads to the conclusion of an agreement, the legal basis for processing shall be Article 6(1) letter b of the GDPR – taking steps at the request of the data subject prior to entering into a contract.
We can also send you commercial information about APMAR Trade’s products or the Services via electronic mail after your prior consent (e.g. newsletters). The consent is entirely voluntary and is not a prerequisite for the use of the Website – the User can opt out of commercial information via electronic means at any time, for example through the settings of their individual account in the account panel or by clicking on the link included in the received e-mail containing marketing content (it does not affect the lawfulness of sending commercial information based on consent before its withdrawal). Consent related to the commercial information may be given, for example, by selecting the appropriate option in the registration form or on pages within the Website. The legal basis for processing of your Personal Data for this purpose is our legitimate interest (Article 6(1) letter f of the GDPR) – our marketing.
2. Website and Services
We may process your Personal Data (e.g. your name, surname, address, e-mail address, billing address) as a result of your access and use of the Website and in connection with the provision of the Services.
While we provide the Services, we may process the information about the manner of using our Website and performance of the agreement binding us. The purpose, as well as the legal basis for the processing, is, as a rule, proper performance of the agreement that we have concluded (Article 6(1) letter b of the GDPR) – for example adjusting infrastructure parameters, facilitation of settlements, providing the Services (e.g. related to running a user account or creating a one-time account to fulfill a specific order), including selling goods, providing support or advice.
The scope of Personal Data that we can process, apart from the GDPR, results also in particular from the Act on the provision of electronic services of 18 July 2002. In order to use our Services, you will be required to provide some Personal Data, for example your first name, last name, e-mail address, billing details, etc.
Please understand that providing Personal Data in this scope is voluntary, however, failure to provide data which are necessary to use a given Service or the Website may prevent the User from using this Service, for example prevent the creation of an individual account within the Website or sales of the products.
APMAR Trade may process User data to perform statistical and marketing analyses, developing marketing strategies and improving the quality of the Services and its products, as well as the performance of the Website. For this purpose, APMAR Trade may also use anonymous and non-anonymous questionnaires filled in by Users directly with the use of forms available on the Website or sent by Users via e-mail or in any other way. The data processing for the above purposes is lawful because it is necessary for the purposes resulting from the legitimate interests pursued by APMAR Trade (legal basis – Article 6(1) letter f of the GDPR) – statistical and marketing purposes.
3. Claim defense and security threats
We can also process a part of your Personal Data to pursue claims and defense against claims or to fulfill legal obligations resulting from applicable law, for example tax and accounting regulations - the legal basis for the processing is, accordingly, our legitimate interest (Article 6(1) letter f of the GDPR) or necessity for compliance with a legal obligation (Article 6(1) letter c of the GDPR).
Regardless, we can also process your Personal Data in order to prevent and detect any security threats, fraud, or other malicious actions. In such a case, the legal basis for the processing is our legitimate interest (Article 6(1) letter f of the GDPR).
III. Cookie files
We may use the cookie files for our Services, both within the APMAR Trade Website, as well as within the websites of our business partners.
IV. How long do we process your Personal Data?
Where APMAR Trade processes data for the direct marketing of its products and the Services, the data will cease to be processed for this purpose as soon as the User objects to the processing of their data. The User may also withdraw their consent to the sending of marketing information by electronic means at any time, and the information will no longer be sent after the withdrawal of consent.
Personal Data of the User will be stored for as long as it is necessary to use an individual account for the purpose of a specific Website to provide Services (the duration of the agreement) and usually for approximately next seven years after its termination, which results in particular from tax regulations.
If your Personal Data is being processed because you use our Services, including buying our products, participate in a competition, or we provide you with technical support and/or prepare an answer to an inquiry or complaint, your Personal Data will be stored and processed for as long as it is necessary to use it to perform any of the above functionalities and no longer than for the period specified in the law or for the period of the statute of limitations of claims.
Personal Data processed on the basis of your consent may be stored until its withdrawal, until the achievement of the objectives for which such consent was expressed or, if the processing is related to cookie files or other similar technology – until the deletion of such files via the browser/device settings (where it is technically possible).
Personal Data processed on the basis of our legitimate interest may be stored until you object to such processing, except when despite of your objection we conclude that there are important legitimate grounds for processing that override your interests, rights, and freedoms, or the basis for establishing, pursuing, or defending claims.
The retention periods described above may be extended as appropriate in the event of potential claims (during the prescription period defined by law, in particular the Civil Code), any claims and court proceedings – for the duration of such proceedings and their settlement – and if the law obligates us in certain cases to process such data for a longer period of time. In any case, a longer period of storage of Personal Data is decisive.
V. Who has access to your Personal Data?
The access to your Personal Data is only granted to:
- authorized employees and collaborators of APMAR Trade, or related entities, who have committed themselves to confidentiality or are under an appropriate statutory obligation of confidentiality;
- entities that support us in providing the Services, based on appropriate contracts, for example entities providing IT services or tools allowing for our communication, legal and consulting services providers, auditors/reviewers, entities handling internet payments, our marketing and advertising agencies (including marketing and advertising services provided by Google, Facebook, etc.).
All of these entities have access only to information necessary for their performance.
We may also be required – if there is a legal basis to do so – to provide certain information to public authorities, for purposes related to proceedings they are conducting.
Since some of the entities we cooperate with are registered outside the European Economic Area (EEA) (and so could be some of the entities providing us with solutions connected with APMAR Trade), and your Personal Data may be transferred there, we provide the appropriate safeguards, including legal mechanisms for the security of your Personal Data, , in particular we conclude data processing agreements that meet the requirements of the GDPR, which include standard data protection clauses adopted under the decision of the European Commission.
You have the right to obtain a copy of the appropriate safeguards for the transfer of your Personal Data, to countries outside the EEA, by contacting us.
In the event that Users are redirected to websites of entities other than APMAR Trade (e.g. in order to pay for a selected product), APMAR Trade does not provide such entities with any Personal Data of the Users. To the extent that the functions or related websites visited by the User are not APMAR Trade Website, APMAR Trade is not responsible for the processing of Personal Data related to the use of these websites. In order to understand the principles of data processing on these websites, the User should refer to the privacy policies made available on these websites.
APMAR Trade declares that the data stored and processed by it are secured in a necessary manner in accordance with applicable legal regulations. APMAR Trade maintains appropriate technical and organisational safeguards. Access to the User's Personal Data is granted only to persons who need the data in order to provide the Services and operate the Website.
VI. Your rights related to processing of your Personal Data
For the effective exercise of your rights, we recommend sending any requests to the email@example.com e-mail address from the contact address you have provided, along with the title “GDPR Request.” In the e-mail, please specify which right(s) you wish to invoke. Remember that this is only a suggestion on how you can exercise your rights. Complying with the above mentioned rules is not mandatory and any failure in this matter will not lead to the loss of the rights described below.
You have the following rights:
- Access to your Personal Data – you may ask us to provide detailed information regarding, for example:
- whether we are processing your Personal Data;
- for what purpose;
- what categories of data we are processing;
- who is the recipient of your Personal Data;
- what is the planned duration of processing (if possible), and if we are not able to answer, the criteria for determining that duration;
- if the Personal Data has not been collected from you – all available information as to their source.
You can also receive access to all of your Personal Data that we are processing (data copy).
- Data rectification – if information about you is or has become inaccurate, you have the right to demand that data to be rectified.
- Consent withdrawal – you may withdraw your consent to the processing of your Personal Data at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
- Erasure of data – in certain situations, the GDPR gives you the “right to be forgotten.” You can invoke this right if we are still processing your Personal Data, particularly in the following cases:
- your Personal Data is no longer vital for the purposes for which it was collected or otherwise processed;
- you withdrew consent to the processing of Personal Data and there is no other legal basis for continuing to process it;
- you object to the processing of your Personal Data when there is no overriding justified legal basis for processing;
- you object to the processing of your Personal Data for marketing purposes;
- your Personal Data is processed in a manner that violates the law;
- the law requires that we erase your Personal Data.
- Restriction of processing - in principle, you can demand that we limit our activities only to storing information about you when:
- you question the correctness of the Personal Data we are processing – for a period of time that allows us to determine the correctness of that data;
- the processing of your Personal Data violates the law, but you prefer that processing be restricted rather than the data be erased;
- APMAR Trade no longer needs your Personal Data for the purposes of processing, but you need it for establishing, pursuing, or defending legal claims;
- you have objected to the processing of your Personal Data – only until such time as it is determined whether your interests take precedence over our legally justified interests.
- Data portability – you have the right to receive your Personal Data in a commonly-used format that can be read by a computer and also to have your Personal Data sent to another data controller, if:
- processing is done on the basis of your consent or a contract; and
- processing is done in an automated manner.
- Objection – you have the right to object to some operations we perform on your Personal Data for special reasons related to your specificsituation, particularly in the following cases:
- when our processing is based on a legitimate interest;
- when we process your Personal Data for purposes related to scientific or historical studies, or for statistical purposes.
Remember, however, that when in spite of your objection, we conclude that there are important legitimate grounds for processing that override your interests, rights, and freedoms, or the basis for establishing, pursuing, or defending claims, we will continue to process your Personal Data encompassed by the objection to the extent necessary. If you disagree with such an assessment of the situation, you can exercise your right to file a complaint with the relevant public authority (more information below).
Where Personal Data are processed for direct marketing purposes, you have the right to object to the processing of your Personal Data for such marketing at any time. Where you object to the processing for direct marketing purposes, the Personal Data shall no longer be processed for such purposes.
- Complaints to the relevant public authority – in connection with our actions as the data controller regarding your Personal Data, you have the right to file a complaint to the relevant public authority which, in Poland, is the President of the Personal Data Protection Office. A detailed description of the complaint procedure is available at: https://uodo.gov.pl/en/559/941. You can find the list of local authorities responsible for data protection across the EU and their contact details at: https://edpb.europa.eu/about-edpb/board/members_en.
Of course, if you have any comments about how we process your Personal Data, we encourage you to contact our Data Protection Officer at firstname.lastname@example.org.