Source: https://orugagroup.com/en/privacy-policy-of-oruga-group-sp-z-oo
Timestamp: 2019-04-22 01:04:07+00:00

Document:
Supervisory Authority: an independent public authority established by a member state in line with Art. 51 of the GDPR.
With respect to issues not defined above, definitions from Art. 4 of the GDPR shall be applicable.
The Data Controller of your personal data is Oruga Group Sp. z o.o. with its’ registered office in Warsaw at ul. Smulikowskiego 1/3, 00-389 Warsaw, National Court Register No. (KRS): 0000409643, VAT Reg. No. (NIP): 5213626803, State Statistical No. (REGON): 145988281, hereinafter referred to as the Data Controller or the Company.
ul. Smulikowskiego 1/2 suite 1, 00-389 Warsaw, Poland.
ul. Smulikowskiego 1/3 suite 202.
II.II. The Data Controller has appointed a Data Protection Officer; at the present moment, the Data Protection Officer is Ms. Olga Swiridiuk. The DPO provides answers to any questions pertaining to the personal data processed by the Data Controller.
1. Personal data processed by the Data Controller are collected, stored, edited, archived in paper documents, as well as IT systems and on electronic information media.
2. This document introduces regulations with respect to the principles of processing organisation and refers to paper and electronic information.
3. The Data Controller shall observe confidentiality with respect to data processing.
4. The Data Controller declares that entities performing functions as part of its’ structure, which remain in the relation of sub-contracting, cooperation, persons performing commissioned work or bound by other civil law agreements and labour agreements became liable for observing relevant confidentiality of data provided to them. The Data Controller declares that it is liable for violation of the confidentiality principle with respect to the data processed by such entities.
5. The Data Controller makes the processed personal data available to supervision entities and authorities authorised to process such data exclusively on the basis of legal provisions or upon explicit request of a Data Subject.
6. The Data Controller shall make the personal data available for the purpose of performing Services which are the subject of the agreement exclusively in a scope that is necessary for the purposes of a service that was ordered. Definition of Services is contained in the next chapter.
- conducting future recruitment processes - the legal basis for processing is the consent for the processing of personal data for this purpose.
Provision of personal data is voluntary, yet necessary for implementing the purposes defined above. If consent was given for participation in the current recruitment process, personal data of the data subject shall be stored for a maximum for 14 days from the date of its’ completion. If consent was given for participation in future recruitment processes, such data shall be stored for 5 years from the moment of sending of application or the moment of withdrawing the consent.
- in reference to data in electronic format - data are stored on electronic information media equipped with proper securities; data are also stored in an electronic data set (the so-called cloud), properly secured by a relevant security system, which may be accessed exclusively by authorised persons.
9. Issues not regulated in this document shall be governed by the provisions of the Regulation of the European Parliament and of the Council (EU) 2016/679 of 27 April 2016 the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), directive 95/46/EC on the protection of individuals with regard to the processing of personal data and on the free movement of such data, act of 29 August 1997 on the protection of personal data and relevant provisions of the EU member states with respect to the personal data protection.
III.I. In order to provide Services in line with the profile of operation, the Company processes the collected personal data - for different purposes, yet always in compliance with the law.
Oruga Group Sp. z o.o. also provides legal and business consulting services.
date of filing the order.
The legal basis for such processing of data is Art. 6.1.b) of the GDPR, which allows for the processing of personal data if such processing is necessary for the performance a contract or in order to take steps prior to entering into a contract; Provision of surname shall be understood as approval for the processing of such data, which has its’ basis in Art. 6.1.a) of the GDRP, which allows for the processing of such data on the basis of a freely given consent.
• potentially bank account number - if funds are returned.
The legal basis for such processing of data is Art. 6.1.f) of the GDPR which allows for the processing of personal data if, in this manner, the Data Controller pursues its’ legitimate interest (in this case, the Company’s interest is informing the client about activities related to the processing of the ordered service).
• first name and surname (if it is provided).
The legal basis for such processing is Art. 6.1.a) of the GDPR, which allows for the processing of personal data on the basis of a freely given consent. Provision of telephone number is optional and depends exclusively on a freely given consent.
The legal basis for such processing of data is Art. 6.1.c) of the GDPR, which allows for the processing of personal data if such processing is necessary for the Data Controller's compliance with legal obligations.
The legal basis for such processing of data is Art. 6.1.f) of the GDPR which allows for the processing of personal data if, in this manner, the Data Controller pursues its’ legitimate interest.
The legal basis for such processing of data is Art. 6.1.c) of the GDPR, which allows for the processing of personal data if such processing is necessary for the Data Controller's compliance with legal obligations and Art. 6.1.f) of the GDPR, which allows for the processing of personal data if, in this manner, the Data Controller pursues its’ legitimate interest.
The legal basis for such processing of data is Art. 6.1.f) of the GDPR which allows for the processing of personal data if, in this manner, the Data Controller pursues its’ legitimate interest (in this case, the Company’s interest is holding the personal data that allow for determining, seeking or defending against claims, including from clients and third parties).
numbers from foreign commercial/ tax registers.
sub-pages where the contact form was completed.
Such data is saved automatically in the so-called server logs during every use of the website that belongs to the Company. The legal basis for such processing of data is Art. 6.1.f) of the GDPR which allows for the processing of personal data if, in this manner, the Data Controller pursues its’ legitimate interest.
1. If the processing of personal data takes place on the basis of a consent, such consent may be withdrawn any time.
declaration on consent withdrawal sent via post.
3. If the processing of personal data took place on the basis of a consent, its’ withdrawal does not render the processing of personal data until such withdrawal illegitimate. Until the consent was withdrawn, processing was legitimate, and its’ withdrawal does not influence the legitimacy of hitherto processing.
Provision of personal data is voluntary. However, on account of Services offered by the Company, in some cases provision of specific personal data is necessary for efficient provision of offered Services.
The Company does not perform automated decision making, also on the basis of profiling. The content of the inquiry which is sent via the contact form is not subject to evaluation via an IT system. The proposed price of a Service is, in no case, the result of evaluation performed by any IT system.
1. The Data Controller transfers personal data within the necessary and minimum scope that is needed for business servicing of its’ clients. In relation to the above, if necessary, the data are transferred in particular to lawyers who provide services, companies servicing payments, accounting company, insurance company, banks and translators whose services are used by the Data Controller. The consent may be withdrawn at any time, yet the Data Controller does not guarantee provision of the Service that was ordered.
2. The Data Controller transfers the personal data to the indicated entities based on relevant legal provisions or decision of a competent body.
1. The Company uses services offered by such entities as Facebook, Microsoft and Google, which have their seats outside of the European Union and thus, in the light of the GDPR provisions, they are treated as third countries.
2. Personal data are transferred by the Data Controller outside of the European Economic Area only within a scope that is minimum and necessary to perform the Service that was ordered or other legitimate purposes of personal data processing. Withdrawal of consent does not allow for keeping the guarantee of performance of a Service that was ordered.
3. The Data Controller shall, upon every request of a Data Subject, immediately provide additional explanations with respect to the personal data processing.
4. A Data Subject has a right to receive copies of personal data transferred to a third country.
1. In line with binding legal provisions, personal data are processed only for the time necessary to accomplish the stipulated purpose for which the data was processed.
2. After the lapse of the time referred to in the preceding section, the data shall be permanently deleted or destroyed.
4. Annual periods are calculated from the end of the year when processing of personal data commenced to streamline the process of removal or destruction of personal data. Separate calculation of the deadline for every concluded agreement would be related to significant organisational and technical difficulties, as well as significant financial expenses, thus establishing one date for removal or destruction of personal data allows for more efficient management of this process. The Data Controller, upon a justified request of a Data Subject, shall refrain from the periods stipulated above.
5. The additional year related to the processing of personal data collected for the purpose of agreement performance results from the possibility of filing potential claims.
2. The above-listed rights are not absolute; thus, in certain cases the Data Controller may refuse to comply with them in line with the law.
there are bases for determining, seeking or defending against claims.
5. A Data Subject may file an objection against processing of his/ her data for marketing purposes at any moment.
A Data Subject may file a complaint to the President of the Personal Data Protection Office if the Data Subject believes that his/ her data are processed in breach of binding legal provisions.

References: Art. 51
 Art. 4
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6
 Art. 6