Privacy Policy

ISON Care Sp. z o. o., ul. Sienna 73, 00-833 Warsaw, attaches particular importance to respecting the privacy of users visiting our website. The data collected in log files is used solely for the purposes of administering the website. We do not seek to identify website users.

Identifying data is not linked to specific individuals browsing ISON Care Sp. z o. o., with the exception of data provided by users in contact forms. To ensure the highest possible quality of service, we occasionally analyse log files to determine which pages are visited most frequently, which web browsers are used, whether the website structure contains errors, etc.

Copyright

The content of the Website is the property of ISON Care Sp. z o. o. All personal and economic copyrights to any elements of the Website (text, graphics, page layout, etc.) are reserved.

The Website and all its elements are protected by law, in particular the Act of 4 February 1994 on Copyright and Related Rights (consolidated text: Journal of Laws 00.80.904, as amended), and the Act of 16 April 1993 on Combating Unfair Competition (consolidated text: Journal of Laws 03.153.1503, as amended).

Protection of personal data

Personal data means any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name and surname, identification number, location data, an online identifier or one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person. Users provide their personal data on the portal voluntarily.

Data Controller

The controller (hereinafter the "Data Controller") of the personal data processed is ISON Care Sp. z o. o., ul. Sienna 73, 00-833 Warsaw.

Data processing by the controller

In connection with its business activities, the Controller collects and processes personal data in accordance with the relevant regulations, including in particular the GDPR (Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC), and the data processing principles set out therein.

The Data Controller ensures transparency in data processing; in particular, it always provides information about data processing at the time of collection, including the purpose and legal basis for processing, for example, when concluding a contract for the sale of goods or services. The Data Controller ensures that data is collected only to the extent necessary for the specified purpose and processed only for as long as is necessary.

When processing data, the Data Controller ensures its security and confidentiality, as well as access to information about the processing for data subjects. Should a personal data breach occur despite the security measures in place (e.g. a data 'leak' or loss), the Data Controller will notify the data subjects of such an incident in accordance with the regulations.

Recipients of data

In connection with the conduct of business activities requiring the processing of personal data, such data is disclosed to external parties, including, in particular, suppliers responsible for the maintenance of IT systems and equipment, entities providing legal or accounting services, couriers, and marketing or recruitment agencies. Data is also disclosed to entities affiliated with the Data Controller, including companies within its group. The Data Controller reserves the right to disclose selected information concerning the data subject to competent authorities or third parties who request such information, based on an appropriate legal basis and in accordance with applicable law.

Period of personal data processing

The period for which the Data Controller processes personal data depends on the type of service provided and the purpose of the processing. The period of data processing may also be determined by statutory provisions where these form the basis for processing. Where data is processed on the basis of the Data Controller's legitimate interest (e.g. for security reasons), the data is processed for a period enabling the pursuit of that interest or until a valid objection to the processing is raised. If processing is based on consent, the data is processed until such consent is withdrawn. Where the basis for processing is the necessity to conclude and perform a contract, the data is processed until its resolution.

The data processing period may be extended where processing is necessary for the establishment, exercise or defence of legal claims; after this period, processing may continue only where and to the extent required by law. Once the processing period has expired, the data is permanently deleted or anonymised.

Rights of data subjects

ISON Care Sp. z o. o. ensures that data subjects can exercise their rights under the GDPR. Data subjects have the following rights:

• the right to information regarding the processing of personal data - on this basis, the Data Controller provides the person making the request with information about the processing of data, including, in particular, the purposes and legal grounds for processing, the scope of the data held, the entities to whom it is disclosed, and the planned date of data deletion;
• the right to obtain a copy of the data - on this basis, the Data Controller provides a copy of the processed data concerning the person making the request;
• the right to rectification - the Data Controller is obliged to remove any inconsistencies or errors in the processed personal data and to complete it if it is incomplete;
• the right to erasure - on this basis, you may request the erasure of data whose processing is no longer necessary for any of the purposes for which it was collected;
• the right to restrict processing - upon receipt of such a request, the Data Controller shall cease processing personal data, with the exception of processing for which the data subject has given consent, and shall store it in accordance with established retention rules or until the grounds for restricting data processing cease to exist (e.g. a decision is issued by the supervisory authority authorising further data processing);
• the right to data portability - to the extent that the data is processed in connection with a contract or consent, the Data Controller provides the data supplied by the data subject in a machine-readable format. It is also possible to request that this data be sent to another entity, provided that the technical capabilities exist on the part of both the Controller and that other entity;
• the right to object to data processing for marketing purposes - the data subject may object at any time to the processing of personal data for marketing purposes, without having to justify such an objection;
• the right to object to other purposes of data processing - the data subject may at any time object to the processing of personal data carried out on the basis of the Data Controller's legitimate interest; such an objection should state the reasons;
• the right to withdraw consent - if data is processed on the basis of consent, the data subject has the right to withdraw that consent at any time; however, this does not affect the lawfulness of the processing carried out prior to the withdrawal of consent;
• the right to lodge a complaint - if it is considered that the processing of personal data infringes the provisions of the GDPR or other data protection regulations, the data subject may lodge a complaint with the President of the Personal Data Protection Office.

To exercise the above rights, please contact the Data Controller or the Data Protection Officer using the contact details provided above.

Purposes and legal bases for processing

Email and postal correspondence

Where personal data is sent to the Data Controller via email or post in correspondence unrelated to services provided to the sender or any other contract concluded with them, the personal data contained in such correspondence is processed solely for the purpose of communication and resolving the matter to which the correspondence relates.

Legal basis: Article 6(1)(f) of the GDPR - the legitimate interest of the Data Controller in handling correspondence addressed to it in connection with its business activities.

The Controller processes only personal data relevant to the matter to which the correspondence relates. All correspondence is stored in a manner that ensures the security of the personal data (and other information) it contains and is disclosed only to authorised persons.

Telephone contact

Where the Data Controller is contacted by telephone regarding matters unrelated to a concluded contract or services provided, the Data Controller may request personal data only where this is necessary to handle the matter to which the contact relates.

Legal basis: Article 6(1)(f) of the GDPR - the legitimate interest of the Data Controller in resolving the matter raised in connection with its business activities.

Telephone calls may also be recorded; in such cases, appropriate information is provided at the start of the call. Calls are recorded for the purpose of monitoring the quality of the service provided and verifying the work of consultants, as well as for statistical purposes. Recordings are accessible only to employees of the Data Controller and persons operating the Data Controller's helpline.

Personal data in the form of call recordings are processed:

• for purposes relating to the provision of customer and client support via the helpline, where the Data Controller offers such a service - the legal basis for processing is that processing is necessary for the performance of a contract (Article 6(1)(b) of the GDPR);
• to monitor service quality and verify the work of helpline consultants, as well as for analytical and statistical purposes - the legal basis for processing is the legitimate interest of the Data Controller (Article 6(1)(f) of the GDPR), which consists of ensuring the highest possible quality of service for customers and clients, as well as the work of consultants, and conducting statistical analyses of telephone communications.

Recruitment

As part of recruitment processes, the Data Controller expects personal data (e.g. in a CV or resume) to be provided only to the extent specified in labour law. Therefore, information should not be provided beyond this scope. Should submitted applications contain additional data, such data will not be used or taken into account in the recruitment process.

Personal data is processed:

• for the purpose of fulfilling legal obligations arising from legislation relating to the employment process, including, in particular, the Labour Code - the legal basis for processing is the legal obligation incumbent on the Data Controller (Article 6(1)(c) of the GDPR in conjunction with the provisions of the Labour Code);
• for the purpose of conducting the recruitment process in relation to data not required by law, as well as for the purposes of future recruitment processes - the legal basis for processing is consent (Article 6(1)(a) of the GDPR);
• for the purpose of establishing or pursuing potential claims or defending against such claims - the legal basis for data processing is the legitimate interest of the Data Controller (Article 6(1)(f) of the GDPR).

Data collection in connection with the provision of services or the performance of other contracts

Where data is collected for purposes related to the performance of a specific contract, the Data Controller provides the data subject with detailed information regarding the processing of their personal data at the time the contract is concluded.

Data security

In order to ensure the integrity, confidentiality and availability of data, the Data Controller has implemented procedures (Personal Data Processing Policy) enabling access to personal data only to authorised persons and solely to the extent necessary for the performance of their tasks. The Data Controller also takes all necessary measures to ensure that its subcontractors and other cooperating entities guarantee the application of appropriate security measures whenever they process personal data on behalf of the Data Controller.

Profiling

Profiling means any form of automated processing of personal data consisting of the use of personal data to evaluate certain personal aspects relating to a natural person, in particular to analyse or predict aspects concerning that natural person's performance at work, economic situation, health, personal preferences, interests, reliability, behaviour, location or movements.

Profiling consists of three elements:

• the processing is automated (at least in part);
• the processing concerns personal data;
• the purpose of the processing is to evaluate personal factors, attribute certain characteristics or predict behaviour.

What is automated data processing?

We speak of automated data processing when data is processed exclusively by an algorithm (computer), i.e. without human intervention. The Data Controller is obliged to provide information about automated processing, including profiling, if such processing produces legal effects or significantly affects the individual concerned. The data subject has the right to object to automated processing, including profiling. The GDPR also guarantees the right not to be subject to a decision based solely on automated processing.

Cookies

What are cookies?

They are small pieces of data, known as cookies, sent by the website we visit and stored on the device (computer, laptop, smartphone) we use when browsing the internet.

Almost every website uses cookie technology. When you visit our website, fragments of code containing your settings are stored on your computer.

These 'cookies', consisting of a string of letters and numbers, contain various pieces of information necessary for the proper functioning of websites, e.g. those requiring authorisation, such as when logging into an email account or an online shop.

Cookies also enable, amongst other things, the storage of our preferences and the personalisation of websites in terms of the content displayed and the tailoring of advertisements. Thanks to cookies, it is also possible to register products and services or vote in online surveys.

Personal data collected using cookies may only be gathered for the purpose of performing specific functions for the user, such as remembering login details for a website or remembering items added to a shopping basket in an online shop. Such data is encrypted in a way that prevents unauthorised access.

Due to the lifespan of cookies and other similar technologies, we use two main types of these files:

• session cookies - temporary files stored on the User's device until they log out, leave the website or application, or close the software (web browser);
• persistent cookies - stored on the User's device for the period specified in the cookie settings or until the User deletes them.

Depending on the purpose for which cookies and other similar technologies are used, we employ the following types:

• essential for the operation of the service and application - enabling the use of our services, e.g. authentication cookies used for services requiring authentication;
• cookies used to ensure security, e.g. used to detect authentication fraud;
• performance cookies - enabling the collection of information on how websites and applications are used;
• functional cookies - enabling the remembering of settings selected by the User and the personalisation of the User interface, e.g. regarding the selected language or region from which the User originates, font size, the appearance of the website and applications, etc.;
• advertising cookies - enabling the delivery of advertising content to Users that is better tailored to their interests;
• statistical cookies - used to compile statistics regarding websites and applications.

You can delete cookies at any time or block them from being set using the options available in your web browser. Deleting cookies or blocking them from being set may make it difficult to use the website, or even prevent you from using some of its features. The management and deletion of cookies varies depending on the browser used. Detailed information on this subject can be obtained by using the Help function in your browser.