Privacy policy (protection of personal data)

1. Introduction

Protection of personal data has always been considered one of the most important aspects of Habza Group Companies (hereinafter known as: “HABZA”). We feel particularly responsible for the security of personal data processed in relation to our business activity. We believe that to maintain the highest ethical standards while running our business activity, we are obliged to properly inform you about matters connected to the processing of your personal data, especially in the light of new regulations on the protection of personal data, including Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation). Therefore, this document informs about the legal basis for the processing of personal data, means of collecting and using them, as well as your rights as data subjects.

1. What is personal data? 

Personal data are pieces of information about the identified natural person or a natural person possible to identify. In fact, processing of personal data is every action related to personal data whether it’s automatic or not, e.g., collecting, storing, recording, ordering, modifying, browsing, using, sharing, restricting, deleting or destroying. Habza processes personal data to properly execute agreements entered into between clients and Habza, including also debt recovering or complaint procedures. 

3. When does this Privacy policy apply?

This privacy policy applies to all cases in which Habza acts as the administrator of personal data and processes such data. It includes cases in which Habza processes personal data obtained directly from the involved person, as well as cases in which personal data are obtained from other sources. In both cases, Habza fulfils its informative obligation in compliance with regulations set forth respectively in art. 13 and art. 14 of GDPR. The following are the complete data of Habza as the administrator of personal data and the entity responsible for their protection: 

Habza Group Sp. z o.o. with its registered office in Warsaw,  1/3 Grójecka street, 02-019 Warsaw, entered into the register of entrepreneurs kept by the District Court for the capital city of Warsaw in Warsaw, 12th Commercial Division of the National Court Register under NCR (KRS) number 0000421956, holding TIN number 525-253-22-65 and REGON 146137326.

1. What is the way of processing personal data and what type of data does Habza process?

We’d like to remain transparent when it comes to the ways and legal basis for the processing of personal data, as well as purposes for which Habza processes such data. In order to make our explanation as clear as possible, the following is a summary of operations related to the processing of personal data.

Natural persons visiting Habza websites or using services provided by Habza by electronic means, which are hereinafter jointly referred to as “Portals”, are in control of the personal data provided by them. Portals restrict collection and use of information about their users to the necessary minimum, required to provide services to them at the desired level, according to art. 18 of the act of July 18, 2002 on providing services by electronic means.

We may collect personal data automatically to a limited extent with the use of cookie files on our websites. Cookies are small text files saved on the user’s computer or a mobile device while browsing websites. These files serve to use different functions of a specific website or to confirm that a specific user has viewed content on a specific website. From among various types of cookie files, it’s possible to distinguish cookies, which are required by the Portals of Habza in order for them to be functional.

We collect information about Portal use by users and their IP addresses based on the analysis of access logs. Such information is used to diagnose issues related to server operation, potential security breaches and to manage the website. IP addresses are used for statistical purposes, i.e. to collect and analyse demographic data of individuals who visit our website (e.g. information on the region from which the connection was established). Based on the data obtained in the aforementioned way, in particular cases we prepare general collective statistical reports disclosed to third parties with whom we cooperate. Most of the time, such reports include information about website traffic. However, we’d like to emphasise that such reports do not include any data, which enable identification (identity revelation) of a specific Portal user.

At the same time, we’d like to inform you that we might be obliged to reveal information about an IP address of a specific Portal user following a request of an authorized state authority, based on applicable regulations, due to the conducted proceedings.

1. Automatic processing of personal data and profiling

Information collected as a result of using our Portal might be processed automatically (including profiling), however, it shall not result in any legal consequences for any natural person nor shall it significantly affect its situation in any other similar way. Moreover, we shall restrict processing of personal data in such cases to a minimum level by trying to profile anonymous and aggregated data and by excluding profiling of sensitive data.

1. Purposes of processing personal data by Habza 

When processing personal data resulting from your use of services offered by Habza, we deal with different legal bases for the processing, which depend on the category and purposes of the processed personal data:

– we process personal data of individuals who use our services because it’s necessary to execute agreements,

– sometimes it is the commonly applicable provisions of the law, which require us to process certain personal data for purposes related to taxes, accounting or prevention of unlawful acts.

Apart from the above-mentioned types of data, we collect the following personal data from natural persons who contact Habza to obtain information about offers (including declaration of intent to enter into an agreement) or to submit a complaint, leave comments on Habza services as well as those who contact us to enter into an agreement with Habza: name and surname, residential address, personal ID number, ID card number, e-mail address and telephone number. The above data are collected based on the consent granted by the client or a potential client of Habza or to execute an agreement (for this purpose we also use electronic registration systems to register telephone conversations when entering into agreements and contacting clients over the phone, while in such cases we inform the callers about recording the conversation and allow them to hang up if they don’t grant their consent to record it). The collected data can also be processed on the basis of a purpose, which substantiates our role as the administrator of data.

We would like to ask you not to share sensitive data with us (such as information about race or ethnic origin, political views, religion or philosophy, union affiliation, physical and mental health details, genetic data, biometric data, criminal records, information on private life). If we receive such information, excluding the obligation resulting from the commonly applicable provisions of the law, we shall immediately seek their permanent deletion from our databases.

Habza processes personal data of its clients and potential clients. Among such data, there are also personal data of persons related to Habza’s clients who are not natural persons (e.g. contact persons). This type of personal data is processed by IT systems used by Habza (including electronic systems for conversation registration when entering into agreements and contacting clients over the phone, while in such cases we inform the callers about recording the conversation and allow them to hang up if they don’t grant their consent to record it). Data processed for those purposes include: full name, company address and title of representation – in the case of representing a legal person or another organizational unit, e-mail address and telephone or fax number as well as bank account numbers or other data needed to execute payment operations. Moreover, in the case of clients who have already entered into paid agreements with Habza we also process data on payments, including credit card numbers and bank account numbers.

1. Retention, that is, how long do we process your personal data?

The duration of processing personal data depends on the legal basis, which is a legal condition for the processing of personal data by HABZA. According to Habza’s applicable policies, including data retention policies, we specify that under no circumstances are we allowed to process personal data for the period longer than the one set forth by the above-mentioned legal bases. According to the aforementioned information, we’d like to specify that:

1) if Habza processes personal data solely on the basis of a consent, their storage term lasts until the consent is withdrawn by the user, that is, when we receive a consent withdrawal request;

2) if Habza processes personal data on the basis of a justified interest of the administrator of data, the storage term lasts until the aforementioned interest expires (e.g. claim expiration of up to 6 years from the termination of legal relations) or until the data provider objects to the processing – to the extent and in situations, in which the data provider is entitled to the objection under the provisions of the law;

3) if Habza processes personal data because it’s mandatory under the applicable provisions of the law, the storage term is defined by such provisions (it is, for instance, the term in which authorities are authorized to request specific action to be taken by Habza in relation to your processed personal data);

4) if there are no legal or contractual requirements, the regular data storage term for agreements and other evidence documentation drawn up during the term of the agreement is up to 6 years. 

1. When and in what way do we share personal data with third parties? 

We transfer personal data to others solely when it is allowed under the provisions of the law or when we are to do so due to a legal obligation resulting from such provisions. In the first case, when entering into an agreement with a third party, such an agreement includes provisions and security mechanisms to protect personal data and maintain our standards of data protection, confidentiality and security. Such agreements are known as personal data processing agreements, and Habza is in constant and full control over ways and extent to which an entity entrusted with processing of certain categories of personal data actually processes them. In the other case, the rules of transferring data and ways of dealing with them are specified by the provisions of the law and such data can only be transferred to state authorities who exercise their statutory competencies. Therefore, we would like to distinguish the following recipients of the data processed by Habza as the administrator of data:

– personal data processing entities under data processing agreements (the so-called processors);

– entities providing hosting services for Habza;

– entities carrying out marketing or sales campaigns for Habza;

– other contractors of Habza, who provide software services and software or hardware servicing;

– debt collectors;

(whereas personal data are only transferred to an extent necessary to complete a purpose);

– auditors, legal advisers, tax advisers;

–authorities to control compliance with the law, regulatory bodies and other state and law enforcement authorities;

(whereas in the last two cases, we transfer data only in situations and to an extent actually necessary and required under the applicable provisions of the law and according to such provisions).

Excluding the last categories, we do not transfer your personal data beyond the borders of the Republic of Poland.

1. What are the rights of subjects, which provide personal data, and how to exercise them? 

Natural persons have defined rights to their personal data, and Habza as the administrator of data is responsible for the execution of those rights according to the applicable provisions of the law. If you have any questions and requests about the extent and execution of rights, or if you want to contact us to exercise your rights related to the protection of personal data, contact us by e-mail: biuro@habza.com.pl. We reserve the right to execute the following rights after a positive identity verification of the person asking to execute such rights.

Natural persons have the right to access the data, which we store as the administrator of data. This right can be exercised by sending an email to: biuro@habza.com.pl.

Personal data change

Changes (the right to correct), including updating your personal data processed by Habza, can be done by sending an email to: biuro@habza.com.pl.

Consent withdrawal

If personal data is processed based on the user’s consent, natural persons have the right to withdraw it at any time. We inform about this right at all times when asking for consent, and we allow the granted consent to be withdrawn in the same simple way it was previously granted. If there is no other information, meaning, we have not provided another address or a different contact number for consent withdrawal, we would like you to email us at biuro@habza.com.pl.

Right to restrict the processing or object to the processing of personal data 

Natural persons have the right to restrict processing or object to the processing of personal data at any time, due to their unusual situation, unless processing is required under the provisions of the law.

Any natural person can object to the processing of their personal data, when:

• processing of personal data is conducted on the basis of a legally justified interest or for statistical purposes, and the objection is justified in special circumstances in which it found itself in,
• personal data are processed for the purposes of direct marketing, including profiling.

You have the right to object to the processing at any time.

However, when it comes to restriction of the processing of personal data, we would like to inform you that you are entitled to this right when, for instance, when the concerned person noticed they are incorrect. Then you can request us to restrict the processing of data for the period, which will be sufficient for us to check their correctness. 

Other rights: the right to delete and transfer data 

If you wish to execute such rights, email us at biuro@habza.com.pl.

The right to delete personal data can be exercised when, for instance, data of a natural person are no longer needed for purposes, for which they were previously collected by Habza, or when a natural person withdrew its consent to the processing of its personal data by Habza. Moreover, when a natural person objects to the processing of its data or when its data are processed unlawfully.

Data should also be deleted after the obligation under the provisions of the law is fulfilled.

However, the right to transfer personal data can be exercised when the processing of personal data is carried out on the basis of a natural person’s consent or an agreement entered into with it when processing is carried out automatically.

All other questions, doubts and complaints 

If you have any questions, complaints or doubts about the content of this Privacy Policy or about the way in which we process personal data, send us an email to biuro@habza.com.pl.

Persons whose personal data are processed by Habza have the right to lodge a complaint with the supervisory body, which is the President of the Personal Data Protection Office (address, 2 Stawki street, 00-193 Warsaw).

The Company’s correspondence address is:

HABZA GROUP SP. Z O.O.
1/3 GRÓJECKA ST.
02-019 WARSAW

1. Are changes to this Privacy policy possible and when to expect them?

We undertake to regularly review this Privacy policy and change it when it turns out to be necessary or required due to: new provisions of the law, new instructions of authorities responsible for supervision over personal data protection processes, best practices used in personal data protection. We also reserve the possibility to change this Privacy policy if technology used to process personal data changes (if the change affects the content of this document) and also if ways, purposes or legal bases for processing of personal data change.