The SYPAC Platform Privacy and Personal Data Policy

This SYPAC Platform Privacy and Personal Data Policy refers to the collection, storage and processingof personal data of the users, as well as the usage of the Cookies files by the SYPAC Platfor (the SYPAC mobile application or the website www.sypac.app). By the Privacy Policy, there has been determined the scope and purpose of processing the personal data of the individuals who visit the website or use the mobile application of the Personal Data Controller. SYPAC hereby informs that the personal data collected through the SYPAC Platform will be used only by SYPAC for commercial purposes, to execute on-line transactions and improve the quality of the SYPAC Platform, and such personal data will not be subject of sale or disclosure to any other business entities. This is hereby to kindly request you to read this privacy, personal data and Cookies policy before you commence to use the services of the SYPAC Platform and disclose any data through the Platform (personal data specifically).

Personal Data Controller

SYPAC Sp. z o.o. (hereinafter referred to as: “Personal Data Controller”), with its registered seat at: Bonifraterska 17, 00-203 Warsaw, will act as the Personal Data Controller, i.e. an authority responsible for processing personal data in compliance with applicable laws and regulations. The Personal Data Controller can be contacted in writing, by mail at SYPAC Sp. z o.o., Bonifraterska 17, 00-203 Warsaw or via electronic mail at: [email protected]

Data Protection Supervisor

The Personal Data Controller has appointed the Data Protection Supervisor that can be contacted at: [email protected]

Legal Grounds

The personal data will be processed in compliance with the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter referred to as the “GDPR”, the Act of 18 July 2002 on Providing Services by Electronic Means and the Act of 16 July 2004, the Telecommunication Law.

Important Information concerning Data Processing Purposes

You should be aware that when implementing all of the above specified purposes (apart from business contacts) we do not acquire your personal data from any third parties whatsoever. This is hereby to declare that we do not intend to implement the automated decision-making process with regard to personal data that have been disclosed to us. In addition, we do not disclose your personal data to any third countries (i.e. outside the territory of the European Union, Norway, Liechtenstein and Iceland).

Registration of Account on the SYPAC Platform

Your personal data and company data are processed for the purpose of registration of an account on the SYPAC Platform and the platform usage. To this extent, we act upon and comply with the two legal grounds. The first of them imply the provisions of Article 6.1.b GDPR, as the processing of the data proves necessary in order to provide the service and perform the contract. And, therefore, we will process your personal data until your account is removed. The other legal grounds implies the provisions of Article 6.1.f GDPR. What we rely upon, to this extent, is our reasonable interest to process your data in order to determine, establish and file claims or defend against claims, if filed. Your data will be stored for a 3-year timeframe from the date of the account removal.

Transactions Executed Through the SYPAC Platform

We process your personal data for you to be authorized to freely execute online transactions through our SYPAC Platform. The activities we undertake are grounded upon the provisions of Article 6.1.b GDPR, as the processing of the data proves necessary to provide the purchase/sale service. You should be also aware that the payment is settled for this type of transactions. And, thus, the personal data will be processed in compliance with Article 6.1.c GDPR. In the former two circumstances, your data will be processed for 5 (five) years starting from the beginning of the year following the year during which the accounting documents are issued. And, your data will be processed for 3 (three) years from the purchase/ sale date, with the aim being to establish, determine and file claims, complaints and to defend against claims, if filed, as provided for in Article 6.1.f GDPR.

Contacting the SYPAC Platform

Should you contact us through the contact form that is available on our website or should you contact us in any other manner, we will process your personal data that have been entered (specifically, first name, surname, e-mail address and other data that have been entered into the wording of the message forwarded to the Personal Data Controller). Your personal data will be processed for a simple reason. We process your data to be able to respond to your queries, irrespective of the selected form of contact.Your personal data will be processed in compliance with the provisions of Article 6.1.f GDPR, which means that such processing proves necessary to accomplish the purpose which results from our legally reasonable interest which, to this extent, involves the ensuring and maintaining contact with the Personal Data Controller. Your personal data will be processed for a 5-year timeframe. After the expiry of this timeframe, a need to process your personal data will be subject to verification and removal, if required.

Business Contacts

Should you desire to share the personal data for the purpose of business relations, we will process your personal data, whilst acting upon our legally reasonable interest, as provided for in Article 6.1.f GDPR. The personal data may have been disclosed by third parties, e.g. employees, associates, vendors, clients, customers. To this extent, your personal data will be processed for an indefinite term.

Invoices

The issuing of a document, whereby it is to be confirmed and evidenced that the transaction has been executed, in the form of an invoice, and the acceptance of a payment prove necessary for a contract executed with the Personal Data Controller to be duly performed. In these circumstances, your data will be processed in compliance with the provisions of Article 6.1.b GDPR. In addition, where an invoice is issued, we are legally obliged to settle such invoice. The data processing thereunder is grounded upon Article 6.1.c GDPR. And, to this extent, we do not rely only upon the provisions of the GDPR, but also upon the provisions of the Accounting Act of 29 September 1994. For the above specified two purposes, your personal data will be processed by the Personal Data Controller for a 5-year timeframe starting from the beginning of the year following the year during which the accounting documents are issued.

We process your personal data that include a first name, surname, e-mail address, telephone number, voivodeship, town, with the aim being to provide you with the information about the activities we pursue and the prospected campaigns. The activities we undertake are grounded upon your authorization, as provided for in Article 6.1.a GDPR. You can resign from the newsletter at any time whatsoever, through contacting the Personal Data Controller. Your personal data are processed until your authorization is withdrawn or until the Personal Data Controller terminates to forward messages.

Server Administration and Website Resources Usage Statistics

We use your personal data concerning your activity on our websites, which include the wording of HTTP queries forwarded to our server by your device (URL address, IP address, browser type, operating system, browser language, request date and hour, cookie file identification reference, website resources browsed). The data that have been collected in this manner are recorded in server logs.

Access Logs

We collect the information concerning the usage of the SYPAC Platform by its users and their IP addresses based on the analysis of the access logs. This information is used to diagnose issues related to the server functioning, to analyse security breaches, if any, and to administer the website. We also use the IP address for statistical purposes, namely to gather and analyse the demographic data of the persons who visit our website (e.g. the information about the region where the connection has been made). We do guarantee that this information is not associated (connected) in any manner whatsoever by SYPAC with the personal data of the users of the SYPAC Platform, and specifically the data of subscribers of mailing lists and other services provided by our website.
In specific circumstances, the collective general statistical specifications, that are disclosed to third parties with which we cooperate, are prepared based on the information obtained in the above specified manner. The foregoing information usually includes the website viewing data. Nevertheless, these specifications do not include the data whereby it would be possible to identify (determine the identity) of a specific user of the SYPAC Platform.
We also inform that we may be obliged to disclose the information concerning the IP number of a specific user of the SYPAC Platform, at a relevant request of competent and duly authorised public authorities, for the sake of proceedings conducted thereby.
In order to ensure security of your personal data, SYPAC complies, as it has already been declared at the beginning of this Policy, with commonly applicable laws and regulations, specifically GDPR.

Cookies

A few words about Cookies:

Cookies are IT data, specifically text files, that are stored in the devices of end users, intended for using the website. A cookie identifies the user whereby it is possible to adjust the website the user uses to his or her needs. Whilst saving the preferences, it is possible to adjust the contents addressed thereto in an appropriate manner, including the ads. The Personal Data Controller uses the Cookies, with the aim being to guarantee a relevant standard of the Service comfort, whereas the collected data are used only within the firm, with the aim being to optimize the activities.

What type of Cookies are used on our website?

The Cookies that prove necessary for the functioning of the SYPAC Platform. These Cookies are used to guarantee, among other things, the duration of the user’s session, save the status of the user’s session, allow the authorisation with the usage of the logging service, save the information to allow for anonymous logging of the user, save the information necessary for the online “cart” to function, when doing online shopping.
The Cookies that are necessary to use the SYPAC Platform, but that make its usage simple. These files are used to allow to: restore the last view when logging to the product, save the choice made by the user in respect of showing a selected text or its display for a specific number of times, restore the user’s session, save the last selected product category, check whether Cookies record functions in an appropriate manner, allow automatic logging to the product (“remember me” option), adjust the content of the products to the preferences of the users, restore the last product search result, display the products that have been recently viewed when doing online shopping, display the last selected sorting parameter.

You need to know that:

The Personal Data Controller uses the outsourced services to improve the quality of the SYPAC Platform. The list of subcontractor is subject to regular changes, due to the fact that we continually strive to develop the best ever platform. The Cookies are used to:

monitor the traffic on our website;
collect anonymous and collective statistics which allow us to understand the manner the users use our website, and to continually improve the quality of our products;
determine the number of anonymous users of our website;
control the frequency the selected content is displayed to the users;
control the frequency the users select a specific service;
analyse newsletter subscriptions;
use communication tools;
handle online payments.

The following are the third parties which support us when accomplishing the above specified purposes:

Google Analytics (more detailed information and an addition to the browser that blocks Google Analytics: tools.google.com);
Google Tag Manager (more detailed information available at www.tagmanager.google.com)
HubSpot (more detailed information available at www.hubspot.com)
Social Media Performance Marketing on Google Ads (available at ads.google.com), LinkedIn (ads.linkedin.com) and Facebook (https://www.facebook.com/business/tools/ads-manager)

How are Cookies managed, rejected or removed?

You can manage the Cookies that are used by us or by any other outsourced vendors, through changing the settings of your browser. When visiting the websites or the SYPAC Platform applications, you authorize us to use the necessary Cookies, in compliance with the regulations set forth in this Policy. However you can freely adjust privacy settings, using your browser, in the “Cookies settings” tab or any other analogous tab. But still, it is important that you be aware that the existing Cookies can be deleted from the devices, and that the Cookies can be blocked in future. To this extent, it is necessary to change the browser settings. All the modification that limit the browser’s using the Cookies will have a visible effect on your feelings related to the usage of the SYPAC Platform, whereas some of the services we have developed are possible not to function in an appropriate manner or not to function at all.

Parties to which Your Personal Data are Disclosed

Our website contains links to other websites. We do not hold any liability whatsoever for privacy settings on these websites. We do recommend that the privacy policy be accurately reviewed after visiting these website. This Privacy Policy concerns only the website and mobile application administered by SYPAC.Your personal data are disclosed to: Google Analytics, producers, sellers, carriers, forwarders.In addition, the personal data can be disclosed to public authorities based upon applicable laws and regulations, as well as to other business entities with which we cooperate based upon the agreements on outsourcing the processing of personal data.

Your Rights

Due to our using your personal data, you may request:

access to your personal data, confirmation whether your personal data are actually used, copies of your personal data, as well as the information related to the usage of the data (Article 15 GDPR),
copies of the personal data that you have delivered to us, and that such copy be delivered to you or a business entity you indicate, in a commonly used and computer readable form (Article 20 GDPR),
rectify your personal data if incomplete or inaccurate (Article 16 GDPR),
delete all or some of your personal data (Article 17 GDPR), if the purpose of legal grounds for using the data proves no longer valid, e.g. an authorization is withdrawn or a legitimate objection is filed, or if the personal data have been used in the manner that does not comply with applicable laws and regulations,
that the usage of your personal data be restricted and limited (Article 18 GDPR) for the timeframe necessary for a relevant decision to be made on the legitimacy of a request to delete or rectify the data, or the legitimacy of your objection, or for the timeframe that will be necessary to establish, determine, file or defend your claim.

You are authorised to file an objection to the usage of your data based upon our legally reasonable interest (Article 21 GDPR). In these circumstances, we will consider whether, given such particular situation, your rights and freedoms enjoy priority before the protection of confidentiality of the personal data we process.

You may withdraw your authorization for using your personal data at any moment whatsoever (Article 7 GDPR). Your withdrawing this authorization will not affect the compliance of their usage on the basis of the authorization prior to such withdrawal

You may file a complaint in relation to the usage of your data with the President of the Personal Data Protection Office, at Stawki 2, 00-193 Warsaw. The complaint can be filed in an electronic form, in writing or verbally to relevant records, at the registered seat of the President of the Personal Data Protection Office.

Changes to the Privacy and Personal Data Protection Policy

If necessary, the Privacy Policy can be accordingly changed and supplemented. You will be duly informed of any and all changes and supplements, through relevant information to be published on our website; if changes prove significant, you will be contacted directly at an indicated e-mail address.