Source: https://www.dax.com.pl/new/en/privacy-policy/
Timestamp: 2020-07-12 09:11:26
Document Index: 11620899

Matched Legal Cases: ['§ 2', '§ 3', '§ 4', '§ 5', '§ 6', '§ 7', '§ 8', '§ 9', '§ 10', '§ 4', '§ 4', '§ 5', '§ 4', '§ 4', '§ 4', '§ 5', '§ 4', '§ 4', '§ 5', '§ 11', '§ 4', '§ 4', '§ 4', '§ 5', '§ 4', '§ 4', '§ 5', '§ 1', '§ 4', '§ 4', '§ 5', '§ 4', '§ 4', '§ 4', '§ 4', '§ 1', '§ 2', '§ 1', '§ 2']

DAX COSMETICS - Privacy policy
we make every effort to protect the personal data we collect in accordance with national legislation and Regulation 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ L 119, 04.05.2016, p. 1, as amended in OJ L 127, 23.05.2018, p. 2), (hereinafter: GDPR).
We make this privacy policy available to you so that everyone with whom we have a relationship can know:
who is the controller of their personal information,
to what extent, for what purposes and on what legal grounds we process the data and to whom we make it available,
what rights are there in connection with the processing of data
in accordance with Articles 13 and 14 of the GDPR.
Details of the privacy policy may be provided at the time of collection of personal data or within a reasonable period – within one month at the latest - in the case of collection from indirect sources, i.e. not from the persons concerned.
§ 2 Contact point.
§ 3 Data processing.
Representatives and appointed contact persons.
Visitors to or users of our website or individual pages of our brands.
Persons who report undesirable effects of cosmetic products and are affected by them..
Persons who take part in promotional activities and competitions.
Visitors to our premises.
§ 4 Other lawful grounds.
§ 5 Rights.
§ 6 Data sources.
§ 7 Technical and organisational measures.
§ 8 International data transfer.
§ 9 ‘Cookies’
§ 10 Final remarks.
The controller of personal data is DAX COSMETICS sp. z o.o. (limited liability company), Spacerowa 18 St., Duchnów, 05-462 Wiązowna, Poland, entered into the Register of Entrepreneurs kept by the District Court for the Capital City of Warsaw, 14th Commercial Department under KRS No.: 0000020589 (National Court Register No.) having NIP No.: 5321708188 (Tax ID No.) and Regon No.: 016134490 (Statistical ID No.).
In certain cases, we may also process data as recipient or processor.
To supervise matters related to personal data protection and provide you with detailed information, we have appointed a special contact point. You can contact us by e-mail or telephone: twojedane@dax.com.pl, 22 779 05 00.
If you are one of our customers, then:
We process your data for the purpose of concluding or executing a contract (Article 6, paragraph 1, letter b of the GDPR) and in certain cases for the purpose of pursuing legitimate interests (Article 6, paragraph 1, letter f of the GDPR). We describe our legitimate interests in § 4.
The categories of personal data processed may include name and surname, PESEL (national identification number), type, series and number of identity document, telephone number, e-mail address, company name, NIP, Regon.
The recipients of the data may be service providers, courier, postal, legal or IT services.
The data will be kept for a period of at least 5 years from the end of the calendar year in which the deadline for payment of tax in connection with the concluded contract expired, however, legal regulations may provide for a longer period of data storage, in particular with regard to asserting or defending claims. Cases of a longer data processing period are described in § 4.
In connection with the processing you have the right to access and rectify the data, the right to limit the processing, the right to object to the processing, the right to lodge a complaint with the President of the Personal Data Protection Office (Stawki 2 St., 00-193 Warsaw, Poland). Detailed information on individual rights can be found in § 5.
Your personal data may be processed in the form of analytical, sales and marketing profiling, for the purpose of making measurements that will improve our services. Binding decisions are not automated, i.e. they are never taken without human intervention.
The provision of data is a contractual requirement and a refusal to provide data may prevent the conclusion or performance of the contract.
If you provide us with goods or services, then:
We process your data for the purpose of concluding or executing a contract (Article 6, paragraph 1, letter b of the GDR) and in certain cases for the purpose of pursuing legitimate interests (Article 6, paragraph 1, letter f of the GDPR). We describe our legitimate interests in § 4.
The categories of personal data processed may include: first and last name, telephone number, e-mail address, company name, NIP, Regon, function/position.
The data will be stored for a period of at least 5 years from the end of the calendar year in which the deadline for payment of tax in connection with the concluded contract has expired, however, legal regulations may provide for a longer period of data storage, in particular with regard to asserting or defending claims. Cases of a longer period of data processing are described in § 4.
3. Representatives and appointed contact persons
If you are a representative or contact person, then:
We process your data for the purpose of achieving our legitimate interest, which is the communication between us and you (Article 6, paragraph 1, letter f of the GDPR). Other cases of our legitimate interest are described in § 4.
The categories of personal data that we process may include: first name and surname, the company with which you are affiliated, your position/function, company telephone number, company e-mail address, contact history between us and you.
The recipients of the data may be courier, postal, legal or IT service providers.
The data will be kept for the period necessary to meet your contact needs between us and you.
In connection with the processing you have the right to access and rectify the data, the right to limit the processing, the right to object to the processing, the right to lodge a complaint with the President of the Office for Personal Data Protection (Stawki 2 St., 00-193 Warsaw, Poland). Detailed information on individual rights can be found in § 5.
4. Visitors to or users of our website or individual pages of our brands
If you contact us via our website or websites of our brands (Hada Labo Tokyo, Yoskine, Perfecta, Cashmere, Dax Sun, Celia, Dax Men) and use their services (e.g. newsletter services), then:
We process your data for the purpose of achieving our legitimate interest, which is communication between us and you (Article 6, paragraph 1, letter f of the GDPR) such as compiling compilations, analyses and statistics based on our legitimate interest in improving our offer and services and adapting them to your preferences. Other cases of our legitimate interests are described in § 4. If you have provided us with your e-mail address in order to receive the newsletters, the data will be processed on the basis of your consent (Article 6 paragraph 1 letter a of the GDPR) and Article 10 paragraph 2 of the Act of 18 July, 2002 on Providing Services by Electronic Means.
The categories of personal data processed may include e-mail address.
The recipients of the data may be entities providing IT and marketing services.
The data will be stored for the period necessary to answer the sent inquiries or until your consent is withdrawn. cases of a longer period of data processing are described in § 4.
In connection with the processing you have the right to access and rectify the data, the right to restrict the processing, the right to object to the processing, the right to withdraw your consent at any time (without affecting the lawfulness of the processing which was carried out before its withdrawal), the right to delete the data, the right to lodge a complaint with the President of the Personal Data Protection Office (Stawki 2 St., 00-193 Warsaw, Poland). Detailed information on individual rights can be found in § 5.
We may also process information that enables us to remember your preferences in using the website - we use ‘cookies’ to collect this type of data (more information on this subject can be found in § 11).
Your personal data may be processed in the form of analytical, sales and marketing profiling, in order to adapt our materials to your needs and interests and to make measurements to improve our services. Binding decisions are not automated, i.e. they are never made without human intervention.
Data relating to the use of our website or the websites of our brands may be used for internal statistical purposes and to develop and improve our products, services, communication methods and functionality of our websites, as well as to ensure information security. In this case, we use only aggregate data and do not use names, e-mail addresses or other information that can directly identify you.
If you are the claimant, person making the complaint, then:
We process your data on the basis of a legitimate interest, which is the service or action taken in the course of complaint proceedings (Article 6, paragraph 1, letter f of the GDPR), acting in principle as the recipient of your data; other cases of our legitimate interests are described in § 4.
The categories of personal data processed may include data within the scope made available to us by you or our Partners (vendors). Most often for this purpose we will need your name and contact details (e-mail address, telephone number, mailing address).
The recipients of the data may be entities providing courier, postal, legal or IT services.
The data will be stored for the period necessary to handle and process your complaint. Cases of longer processing times are described in § 4.
Providing the data is voluntary, and the refusal to provide it may make communication and handling and processing of complaints impossible.
6. Persons who report undesirable effects of cosmetic products and are affected by them
If you are the person who reports the undesirable effects of cosmetic products or the person affected by the undesirable effect, then:
The processing of your data is necessary for reasons of public interest in the field of public health, such as protection against serious cross-border threats under Article 23 of Regulation (EC) No 1223/2009 of the European Parliament and of the Council of 30 November 2009 on cosmetic products and Article 9 of the Act of 4 October 2018 on cosmetic products in connection with Article 9, paragraph 2, letter i of the GDPR.
The categories of data to be processed include: name, surname, age, occupation if related to the use of the cosmetic product, residence or correspondence address, e-mail address, telephone number (if given), other data provided in connection with the notification, description of serious undesirable effects and, if justified, other information concerning the state of health of the person affected.
The recipients of the data may be the relevant administrative centres, i.e. the entities entrusted by the Chief Sanitary Inspector with the processing of the data contained in the Serious Undesirable Effects Information System due to the use of Cosmetic Products, therapeutic entities involved in the process of evaluating an undesirable effect, entities providing services, courier, postal, legal or IT services.
The data will be stored not longer than one year after the end of the verification of the adverse reaction report; cases of a longer data processing period are described in § 4.
In connection with the processing you have the right to access and rectify the data, the right to restrict the processing, the right to object to the processing, the right to lodge a complaint with the President of the Office for Personal Data Protection (Stawki 2 St., 00-193 Warsaw, Poland). Detailed information on individual rights can be found in § 5.
Providing the data is a statutory requirement, the refusal to provide the data may make it impossible to report an undesirable effect.
7. Persons who take part in promotional activities and competitions
If you are a person taking part in our promotional, marketing and competition activities, then:
We process your data based on your voluntary consent (Article 6, paragraph 1, letter a of the GDPR). We also process your personal data for the purposes of legitimate interests (Article 6, paragraph 1, letter f of the GDPR) according to § 4.
The categories of data processed include data within the scope you have made available to us. Most often for this purpose we will need your name and surname and contact details (e-mail address, telephone number, correspondence address).
The recipients of the data may be entities providing courier, postal, legal, IT or promotional campaigns and competitions.
As a rule, the data will be stored for the duration of the promotional action or the contest. Cases of a longer data processing period are described in § 4.
In connection with the processing you have the right to access and rectify the data, the right to restrict the processing, the right to withdraw your consent at any time (without affecting the lawfulness of the processing which was carried out before its withdrawal), the right to delete the data, the right to lodge a complaint with the President of the Office for Personal Data Protection (Stawki 2 St., 00-193 Warsaw, Poland). Detailed information on individual rights can be found in § 5.
Providing the data is voluntary, and the refusal to provide it may make it impossible to participate in a competition, promotional or marketing action.
Detailed rules of data processing will also be indicated in the regulations of the competition, promotional or marketing action.
If you are interested in our job or cooperation offers, then:
We process your data for the purpose of concluding an employment contract based on and within the scope of Article 22(1) § 1 of the Labour Code or concluding a civil law contract (Article 6, paragraph 1, letter b of the GDPR). We also process your personal data for the purposes of legitimate interests (Article 6, paragraph 1, letter f of the GDPR) pursuant to § 4.
If you wish to participate in subsequent recruitments or if you wish to include information in your application documents that may be considered as sensitive, we will process your data on the basis of your voluntary consent (Article 6, paragraph 1, letter f or Article 9, paragraph 2, letter a of the GDPR).
The categories of data to be processed include: first name(s) and surname(s), date of birth, contact details you have indicated, education, professional qualifications, employment history, company (in the case of sole proprietorship) and other data you have provided in your application documents.
The recipients of the data may be entities providing IT services.
The data will be stored for the duration of the given recruitment process, unless you agree to keep them for the purposes of future recruitment processes; cases of a longer period of data processing are described in § 4.
In connection with the processing you have the right to access and rectify the data, the right to restrict the processing, the right to withdraw your consent at any time (without affecting the lawfulness of the processing which was carried out before its withdrawal), the right to object to the processing, the right to delete the data, the right to lodge a complaint with the President of the Office for Personal Data Protection (Stawki 2 St., 00-193 Warsaw, Poland). Detailed information on individual rights can be found in § 5.
The provision of the data results from the scope defined by the Labour Code or is a contractual requirement (in case of employment based on a civil law contract) and the refusal to provide the data may make it impossible to establish an employment relationship or conclude a contract.
If you are a participant in our training courses, then:
We process your data for the purpose of providing you with detailed information about our products and services (Article 6, paragraph 1, letter f of the GDPR). We also process your personal data for other purposes based on legitimate interests (Article 6, paragraph 1, letter f of the GDPR) according to § 4.
The categories of personal data processed may include your name.
The recipients of the data may be providers of courier, postal, legal or IT services.
The data will be stored for the period necessary to carry out a given training course; cases of a longer period of data processing are described in § 4.
Providing the data is voluntary, and the refusal to provide it may make the training impossible.
10.Visitors to our premises
If you are on our premises, then:
We process your data based on the legitimate interest of ensuring the security and protection of property (Article 6, paragraph 1, letter f of the GDPR).
The categories of personal data processed may include image.
The recipients of the data may be security providers.
The data will be stored for a period not exceeding 30 days from the date of recording. In the case where the recordings constitute evidence in proceedings conducted under the law or we have received information that they may constitute evidence in the proceedings, the period of storage may be extended until the legal conclusion of the proceedings. Cases of a longer data processing period are described in § 4.
In addition to the situations mentioned in § 4, we may also process your data for other purposes in certain cases. This may involve extending the storage period of your data.
We will process your data for the purposes necessary to fulfil our legal obligations (Article 6, paragraph 1, letter c of the GDPR):
for the duration of the legal obligations imposed on us by applicable law, including but not limited to tax, social security etc.,
for the time that certain laws require us to store data (these laws may provide for different retention periods).
In addition, we may also process your data for other purposes, which are based on our legitimate interests (Article 6, paragraph 1, letter f of the GDPR):
to maintain correspondence,
to establish, defend and pursue claims, which includes, inter alia, selling our claims to another party,
to promote the company and our services,
to compile, analyse and for statistical purposes,
to establish business or partnership relations,
Your personal data will not be processed based on our legitimate interests if, in certain cases, your rights and freedoms are overridden by them.
The right of access and obtain a copy of your personal data – at your request we will inform you whether we are processing your personal data. We are also obliged, upon separate request, to provide more detailed information on: the purposes of the processing, the categories of personal data, the recipients of the data or their categories, the storage period of the personal data or the criteria for determining it, the source of the data, the automated processing of personal data and the consequences of such processing for you. In the case of the transfer of personal data to a third country, we will also inform you of the safeguards applicable to the transfer at your request. We will also make a copy of your personal data upon your request. This will be made available to you in a popular IT file format. The first copy will be made available free of charge. However, we may charge a fee for each subsequent copy at an amount to be determined by the GDPR.
The right to rectification – if your personal data is found to be incorrect, we will rectify the inaccuracies. We will do so on our own initiative – or, if you draw our attention to this, at your request.
The right to erasure, including the ‘right to be forgotten’ – if you do not wish your personal data to be processed and we find that there is no other legal basis for us to process your data - we will delete it from our databases. However, please note that the deletion of certain data may prevent us from providing services to you – this applies to those services in connection with which it is necessary to process the personal data you have provided. For example, we will not be able to answer your questions and present you with our offer if you request the deletion of your e-mail address. However, despite such a request, we will be able to process certain personal data in accordance with the rules set out in the GDPR.
The right to limitation the processing – in the cases provided for by the GDPR, we will limit the processing of your personal data at your request. In simple terms, a restriction on the processing of your personal data prevents it from being used beyond storage. In this case, any other activities on the data subject to a processing restriction will only be permitted with your consent.
The right to data portability – in accordance with the rules of the GDPR, you may request the transfer of personal data saved in a standard machine-readable file format. If your purpose is to transfer your personal data to another controller, we will send the file containing your personal data directly to the controller.
The right to object – in some cases, even if we are processing personal data lawfully without your consent, you can demand that we stop processing your personal data by objecting. This will be justified if you can show that our lawful activities nevertheless infringe your interests, rights or freedoms.
The right not to be subject to automated decision-making including profiling – you have the right not to be subject to decisions which would be based solely on automated processing, including profiling, if they were to produce legal effects against you or to affect you in a similar manner.
The right to withdraw your consent at any time – if we have asked for your consent, you may withdraw your consent at any time. Unless we have a separate basis for processing, we will cease using your personal data for the purpose for which you have given your consent. However, please note that withdrawing your consent may sometimes prevent you from providing interesting content or information.
The right to lodge a complaint with a supervisory authority – if you believe that your rights have been infringed by our personal data processing activities, you may lodge a complaint with the President of the Office for Personal Data Protection (Stawki 2 St., 00-193 Warsaw, Poland).
The rights mentioned above may be limited in certain situations, e.g. when we can show that we are legally obliged to process your data.
If you wish to exercise your rights, all you must do is send your request using the contact details indicated in § 1 or § 2.
As a rule, most of the data that we process is information that you have provided us with of your own free will.
In some, sporadic cases, especially if you use our specific services, we may process personal data that we are able to deduce from other information that you provide to us and that we collect in the course of our relationship. This data will be processed no longer than is necessary for the purpose for which it was collected or will be deleted immediately.
If we have not obtained personal data directly from you, we inform you that:
the data may have been obtained from the person or entity that designated you as representing or appointed to contact,
in case of persons involved in the recruitment process or persons interested in establishing cooperation on the basis of a civil law contract - personal data may have been obtained from recruitment agencies or personnel consulting companies with which we cooperate or our employees (in case of instructions),
where the adverse reaction is reported by a person other than the person affected by the adverse reaction, personal data may have been obtained from the legal representative, legal guardian, relative or other person who reported the adverse reaction on your behalf.
We are committed to properly protecting your personal data in accordance with established internal policies, orders, procedures and standards so that your personal data is protected against unauthorised use or access, unlawful alteration, loss or destruction.
We apply physical and logical safeguards of a high standard.
Your personal data will not be kept longer than necessary for the purpose for which it was collected, including the need to comply with legal obligations and to process disputes, assert or defend claims.
As part of ensuring the security of the personal data processed, we undertake to consider:
confidentiality - we will protect your data against accidental disclosure to third parties,
integrity - we will protect your data against unauthorised modification,
accessibility - we will only provide access to your data to authorised persons if necessary.
Your personal data may be processed by third parties only if such third party undertakes to provide appropriate technical and organisational measures to ensure the security of the processing of personal data as well as to maintain the confidentiality of such data.
Each of our employees or associates who have access to personal data have the appropriate authorization and are obliged to maintain confidentiality.
The personal data you provide on our sites are encrypted and protected by SSL certificate. It secures the transmission of data within the domain and confirms its authenticity.
Your personal data will in principle not be transferred to countries outside the European Economic Area (EEA) where the law may not provide the same level of protection for your data.
If, however, your personal data are transferred to recipients in third countries (outside the EEA), e.g. the United States, such transfers will only take place on the basis of an adequacy decision taken by the European Commission, i.e., for organisations participating in the EU-U.S. Privacy Shield programme, or on the basis of standard contractual clauses as decided by the European Commission or on the basis of your explicit consent, which we will directly request from you, where appropriate.
International data transfers based on the Privacy Shield will relate specifically to IT services provided to us by Microsoft Corporation.
Our website or individual pages of our brands use ‘cookies’.
‘Cookies’ are information in the form of small text files that are stored on your computer by a server. They are important because they allow the server to read information each time you connect to a computer.
The information collected using ‘cookies’ do not constitute personal data but may be used to provide you with certain functions. Such data is encrypted in a way that prevents access to it by unauthorized persons.
The software used to browse the web pages by default allows you to place ‘cookies’ on your computer - with the help of the settings of your web browser you have given your consent (Article 6, paragraph 1, letter a of the GDPR).
You can configure your browser to block the automatic acceptance of cookies or to be informed each time a file is sent to your device. More information about the handling of cookies and the possible configurations can be found in the settings of your browser. The level of restrictions on the use of cookies may affect the availability and functionality offered by our websites, including the possibility of blocking their full operation.
Our website or individual pages of our brands use ‘cookies’ for the correct configuration and to:
adjusting the content of our websites to your preferences,
the correct configuration of selected functions of the web pages, to verify the authenticity of the browser session,
recognize the device and properly display the website, adjusted to your individual needs,
remembering your settings and personalising the interface, e.g. in the language or region of your choice,
remember the history of the pages you visit on the site in order to recommend the content, font size, website design, etc.
We may also use ‘cookies’ placed by DAX partners to display advertisements and account for their effects (for example: Google Analytics, Google AdWords).
The data we collect may be used to create so-called profiles, based on interests and their activity on our websites.
Based on created profiles, we send more tailored marketing messages informing about our goods or services. The legal basis for our processing of this type of data is the legitimate interest of the controller (Article 6, paragraph 1, letter f of the GDPR), consisting in conducting marketing activities.
We may collect data about your activities on our websites. The above data will be used for internal statistical purposes and to develop and improve our products, services, communication methods and functionality of our websites, as well as to ensure IT security. In this case, we use only aggregate data and do not use names, e-mail addresses or other personally identifiable information.
The legal basis for our processing of such data is the legitimate interest (Article 6, paragraph 1, letter f of the GDPR) to improve our websites in order to ensure a high quality of service and functionality of our websites.
The periods of storage of personal data indicated above in this section will occur most frequently. Due to the variety of possible situations, please contact the contact details indicated in § 1 or § 2.
We reserve the right to make changes to this privacy policy which may arise from the need to adapt to changes in legislation or applicable privacy standards or in connection with the expansion of our offering.
We will notify you of any changes in data processing on our websites or electronically.
This privacy policy is effective from 12.08.2019 and supersedes the privacy policy of 25.05.2018.