Privacy Policy

Privacy policy for a website Brose Sitech sp. z o.o.

Content

I. Introduction

II.  What information do we process in connection with your visit to our website?

III.  How do we process the personal data of people contacting or cooperating with us? 

IV.   How do we process job applicants’ personal data?

V. Information relating to all categories of Personal Data described above 

I.Introduction

1. What information will you find in this policy?

              In the document you are reading:

• Part I - contains introductory information,
• Part II - describes the information we process in connection with your visit to our website, including so-called cookies,
• Part III - explains how we process your personal data if you contact or cooperate with us,
• Part IV - outlines how we process the personal data of job applicants,
• Part V - contains information related to the processing of all the personal data described earlier.

2. Who is the data Administrator?

The Administrator of your personal data is Brose Sitech sp. z o.o., located in Polkowice at Strefowa 2, 59-100 Polkowice, registered in the Register of Entrepreneurs maintained by the District Court for Wrocław Fabryczna, 9th Commercial Division of the National Court Register, under KRS number 0000062266, NIP 6922088905, hereinafter referred to as the "Company" or the "Administrator."

3. How can you contact us to exercise your rights?

You can contact the Administrator via email at: iod@brose-sitech.com.

We will make every effort to provide you with information about the actions we have taken in response to your request as quickly as possible, no later than one month from the date of receiving your request. In exceptional cases, when the nature of your request is complex, we reserve the right to extend the above-mentioned deadline by an additional two months. You will be informed of this within one month of receiving your request.
Communication is free of charge. If your requests are manifestly unfounded or excessive, particularly due to their repetitive nature, the Administrator may:

• charge a reasonable fee for handling communication or taking the requested actions, considering the administrative costs of providing information, or
• refuse to act on the request.

II. What information do we process in connection with your visit to our website?

1. What categories of information do we collect on the website?

As a rule, we do not process personal data of individuals visiting our website at https://www.brose-sitech.com.

However, we automatically process certain non-personal information, including:

• the name of your internet service provider,
• information about the operating system and web browser you are using,
• information about the screen resolution you have set,
• the date and time of your visit,
• the address of the website you visited us from, and
• the individual pages of our website you visited.

2. What types of cookies do we use?

We also use cookie technology on our website through the Google Analytics tool.

Cookies are small packets of information sent by the visited website and stored on the end device (e.g., a laptop). They typically contain the address of the visited website, the date the cookie was placed, its expiration date, a unique number, and additional information according to the purpose of the file.

Google Analytics uses cookies to analyze how users interact with our website and to create anonymous, aggregated statistics and reports. You can find detailed information about this in Google's privacy policy.
Cookies will be stored on your device only based on your consent, which can be provided via the cookie plug-in (pop-up) available on our website.

The table below presents the cookies we use:

You can disable cookie storage via the cookie settings plug-in available on our website or directly on the device used to connect to our website, according to the browser manufacturer's instructions:

• Google Chrome;
• Safari;
• Mozilla Firefox.

Information on configuring and deleting cookies in other web browsers can be found on the manufacturers' websites.

III. How do we process the personal data of people contacting or cooperating with us?

1. Who is covered by the information in section III of the policy?

The information provided in this section applies to you if you are:

• a person contacting us via email or other available communication channels,
• directly our contractor,
• a person acting on behalf of our contractor, including their employee or collaborator.

2. Where do we obtain your personal data from?

We obtain your personal data directly from you, particularly when:

• you contact us via email or other available communication channels;
• you provide it to us at the start or during cooperation with you or the company you represent.

Additionally, we may obtain your personal data:

• from other companies within the Brose Sitech capital group to which the Administrator belongs, or from other business partners as part of our cooperation with them;
• from public sources (e.g., press, the Internet) if necessary to achieve our processing purposes.

3. What categories of your personal data do we process?

The categories of personal data we process include:

• basic personal data (name, surname, home address, or other contact details, including email or phone number);
• the name of the company you work for or on whose behalf you act;
• job position;
• image recorded on monitoring systems at the Administrator's facility, if you visit us at our facility or provide services on the premises;
• vehicle registration number – especially if you are the driver of a vehicle transporting goods for us;
• tax identification number (NIP), particularly included in contracts, invoices, or other accounting documents;
• exceptionally, personal identification number (PESEL) or date of birth;
• bank account number;
• data within IT systems used in the company.

4. What are the purposes and bases for processing your personal data?

As the Administartor of your personal data, the company determines the purposes and means of processing these data.
In every case, we strive to ensure that the scope of your personal data processing is as minimal and appropriate to the processing purposes as possible. These purposes, along with the corresponding legal bases, are presented below

The table below presents the cookies we use:

5. How long do we retain your personal data?

We process your personal data for as long as necessary to fulfill the company's purposes as indicated in this or other documents presented to you.

We retain personal data that we are legally obliged to store for the duration of the obligation, as specified by law. Other business-related data will be stored for the entire duration of the contract and until the expiration of any potential claims.
Data processed based on your consent will be retained until you withdraw it or for the period specified in the consent.

The company is subject to various document or data retention obligations, such as those arising from the Accounting Act or tax regulations — generally, this period lasts 6 years.
The retention period of personal data processed based on a legitimate interest may vary, depending on technologies used and the company’s business decisions.

After the processing period expires, the personal data will be deleted or anonymized, meaning they will be processed in such a way that they cannot be linked to any person. The company reserves 6 months from the expiration of the processing period to delete or anonymize the data. During this additional period, the data will only be stored. This time is necessary for the company to confirm the need for deletion and to technically prepare and carry out the deletion or anonymization.

Unforeseen circumstances may arise that justify the need for longer data retention. In particular, there may be circumstances that will be investigated by a public authority or court in the course of criminal, civil, or administrative proceedings. Such proceedings may not be concluded before the planned data processing period expires. In such cases, the Administrator will make efforts to ensure that personal data is processed only to the minimal extent necessary for the purposes of the proceedings.

6. Who are the recipients of your personal data?

In carrying out our tasks and objectives, your personal data may be shared with various recipients.

The list of the recipients’ categories:

1. Companies within the Brose Sitech group;
2. Public administration and justice authorities;
3. Administrator’s customers or suppliers;
4. Companies providing accounting services to the Administrator;
5. Companies providing health and safety (BHP) services to the Administrator;
6. Transport companies;
7. Providers of IT services in hardware and software;
8. Companies organizing training;
9. Companies renting office space to the Administrator;
10. Security companies;
11. Banks;
12. Advisory firms, particularly for legal or financial services;
13. Auditors;
14. Trade unions operating at the Administrator.

7. Processing of your personal data within the company and the Brose Sitech group

As a rule, your data is processed only within our company. Within its internal structure, we only transfer your data to such individuals or departments (e.g., purchasing or sales departments, IT, accounting, employee representatives) that:
a) require the data to fulfill contractual or other legal obligations, or
b) act in our legitimate interest.
The Administrator is part of the Brose Sitech capital group. We may transfer your data to other companies within the group if it falls within the purposes and legal bases outlined above, particularly based on an overriding legitimate interest (Art. 6(1)(f) GDPR) as part of an efficient organizational system within the group.

8. Processing of your personal data outside the European Economic Area (EEA)?

Your data may also be transferred outside the EEA in connection with the potential use of cloud-based IT solutions or services provided by a service center located outside the EEA, as well as in connection with business trips.

We will only transfer personal data to recipients outside the EEA if the European Commission confirms that the third country provides an adequate level of data protection, or based on other appropriate and sufficient safeguards, such as EU standard contractual clauses.

9. Are you obliged to provide us with your personal data, and what are the consequences of not providing it?

As part of the contract between us, you are required to provide us with the personal data necessary for its conclusion, execution, and termination. This includes personal data that we are required to collect under applicable labor, social security, and tax laws. We need your personal data to fulfill our obligations under applicable law. If you do not provide us with such personal data, we will not be able to meet our obligations related to the execution of your contract.
However, the personal data you provided to us based on voluntary consent does not affect your contract and its execution. You may withdraw such consent at any time.

IV.   How do we process job applicants’ personal data?

1. Who is this section of the privacy policy for?

The information provided in this section applies to you if you are participating in the recruitment process for a job position offered by the Administrator – Brose Sitech sp. z o.o., located in Polkowice at Strefowa 2, 59-100 Polkowice

2. Where do we obtain your personal data from?

• We primarily obtain your personal data directly from you, particularly when you provide it in your CV during the recruitment process. In addition, we may acquire your personal data: from our own resources or from other companies within the Brose Sitech capital group, to which the Administrator belongs, especially if you were previously employed by us or another group company, or if you left your CV for future recruitment purposes;
• from public sources (e.g., press, Internet) if necessary to achieve our processing purpose.

3. What categories of your personal data do we process?

The categories of personal data we process include, but are not limited to:

• First and last name;
• Date of birth;
• Contact information;
• Education;
• Professional qualifications;
• Previous employment history;
• Other information you provide to us during the recruitment process

4. What are the purposes and legal bases for processing your personal data

As the administrator of your personal data, the company determines the purposes and means of processing your data.
In each case, we strive to ensure that the scope of personal data processing is as limited and adequate as possible for the processing purposes. These purposes, along with the appropriate legal bases, are outlined below:

5. How long do we retain your personal data?

We process your personal data for as long as necessary to achieve the company’s purposes as indicated in this or other documents provided to you.

Personal data that we are legally obliged to store is processed for the duration of that legal obligation.
Data processed based on your consent will be processed until the consent is withdrawn or for the period specified in the consent.
The retention period for personal data processed based on a legitimate interest depends on the technologies used and the company’s business decisions.

As a rule, personal data for recruitment purposes is stored for no longer than one year.

After the processing period expires, personal data will be deleted or anonymized, meaning it will be processed in such a way that it cannot be linked to any individual. The company reserves 6 months after the processing period ends to carry out the deletion or anonymization. During this additional period, the data will only be stored. This time is necessary for the company to confirm the need for deletion and to technically prepare and execute the deletion or anonymization.

Unforeseen circumstances may arise that justify the need for longer retention of personal data. Circumstances may be investigated by a public authority or court during criminal, civil, or administrative proceedings. Such proceedings may not conclude before the planned processing period expires. In such cases, the Administrator will make efforts to ensure that personal data is processed only to the minimum extent necessary for the purposes of the proceedings.

6. Who are the recipients of your personal data?

While fulfilling our tasks and purposes, your personal data may be transferred to various recipients of personal data. In the table below, we provide a list of the categories of these recipients.

Categories of Personal Data recipients:

1. Companies within the Brose Sitech group;
2. Public administration and justice authorities;
3. Companies providing health and safety (BHP) services to the Administrator;
4. Providers of IT services in hardware and software;
5. Security companies;
6. Advisory firms, particularly for legal or financial services;
7. Auditors;
8. Companies providing recruiting services to the Administrator.

7. Processing of your personal data within the Company and the Brose Sitech Group

As a rule, your data is processed solely within our Company. Within its internal structure, we only share your data with individuals or departments (e.g., the purchasing or sales department, IT department, accounting, employee representatives) who:

a) require the data to fulfill contractual or other legal obligations, or
b) act in our legitimate interest.
The Administrator is part of the Brose Sitech capital group. We may transfer your data to other companies within the group, provided this falls within the scope of the purposes and legal bases outlined above, particularly based on the overriding legitimate interest (Art. 6(1)(f) GDPR) in maintaining an efficient organizational system within the group.

8. Is Your Personal Data processed outside the European Economic Area ("EEA")?

Your data may also be transferred outside the EEA in connection with the Company's use of cloud-based IT solutions or services maintained by a service center located outside the EEA, as well as in connection with business trips.
We will only transfer personal data to recipients outside the European Economic Area (EEA) if the European Commission confirms that the third country to which the data is transferred provides an adequate level of data protection or based on other appropriate and sufficient safeguards, such as EU standard contractual clauses.

9. Are you obliged to provide us with your Personal Data, and what are the consequences of not providing it?

You should provide us with your personal data necessary for the recruitment process. If you do not provide such personal data, we will not be able to hire you. In other cases, providing your data is voluntary.

V. Information relating to all categories of Personal Data described above

1. When do you have the right to object to the processing of your Personal Data?

You have the right to object to the processing of your personal data at any time if such processing is based on our legitimate interests. This applies to processing where the legal basis indicated in the tables above is Article 6(1)(f) GDPR.
Upon receiving your objection, we will cease processing your data unless we can demonstrate compelling legitimate grounds for the processing that override your interests, rights, and freedoms, or if your data is necessary for the establishment, exercise, or defense of legal claims. Therefore, we kindly ask you to justify your objection in such a way that we can understand your particular situation and respond accordingly. However, if your objection concerns the processing of data for direct marketing purposes, we will stop such processing regardless of the reasons for your objection.

2. What other rights do you have??

In accordance with the GDPR, you have the following rights concerning the processing of your personal data by the Administrator:

• Right of access to your personal data – the right to obtain information about the processing of personal data and a copy of the data;
• Right to rectification – the right to correct inaccurate or incomplete data;
• Right to erasure – the right to request the deletion of data that is no longer necessary for the purposes for which it was collected;
• Right to restrict processing – the right to limit the processing of data to storage only. The Administrator is obliged to restrict data processing in cases where: (a) you challenge the accuracy of your personal data or lodge an objection - for a period of time to allow the Administrator to check the accuracy of the data or to consider the objection; (b) the processing is unlawful and you object to the erasure of your personal data, requesting instead the restriction of its use; (c) the Administrator no longer needs your personal data for the purposes of the processing established by them, but you consider it necessary for the establishment, investigation or defense of claims; (d) you object to the processing - until it is determined whether the legitimate grounds on the part of the Administrator override the grounds for your objection;
• Right to data portability – the right to request the transfer of data provided by the data subject in a machine-readable format (by computer), to the extent that the data is processed based on a contract or consent;
• Right to lodge a complaint with a supervisory authority – the right to file a complaint if you believe that the processing of your personal data violates data protection regulations, addressed to the President of the Personal Data Protection Office at ul. Stawki 2, 00-193 Warsaw.

3. When Do You Have the Right to Withdraw Consent for the Processing of Your Personal Data?

In any case where your personal data is processed by the Administrator based on your consent, you have the right to withdraw consent at any time.
Withdrawal of consent does not affect the lawfulness of the processing carried out before the withdrawal

4. Are your Personal Data processed by us based on automated decision-making?

Decisions we make about you are not based on automated processing, including profiling, of your personal data.