Privacy policy

Introduction

Bioshi Joint Stock Company with its registered office at Jasnogórska 1, 31-358 Krakow, is the administrator of the website https://www.bioshi.pl/.

In operating the website, we are committed to protecting your personal data and respecting your privacy by acting on the principles and fulfilling the obligations set forth in the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (RODO).

The link to the Regulation can be found here:

https://eur-lex.europa.eu/legal-content/PL/TXT/HTML/?uri=CELEX:32016R0679

Informing about the processing of personal data

Below you will find information about the processing of personal data that we perform for each service. You will learn from them in particular:

for what purpose and on what legal basis your personal data is processed,
who the recipients or categories of recipients of your personal data are,
how long your personal data is stored,
what rights you have in connection with the processing of your personal data;
information on whether providing your personal data is a statutory or contractual requirement or a condition for entering into a contract, and what the consequences, if any, of not providing it are;
information on whether you are subject to automated decision-making, including profiling, in connection with the processing of your personal data.

Your rights

Under the current legislation, a person whose personal data is processed has a number of rights, the exercise of which he or she may, under certain conditions, demand from the controller who processes the data.

Your rights are indicated below.

Right of access to data

It takes into account the possibility for the data subject to obtain information on whether and to what extent that person’s data is being processed. In addition, a person requesting the exercise of this right may demand that the controller obtain access to the data and, if necessary, obtain a copy of the data. This copy should be issued free of charge. For subsequent such requests, a reasonable fee may be charged to the requester, based on administrative costs, among other things.

Right to rectify data

If the personal data processed by the controller is inaccurate or incomplete, the data subject may request the controller to rectify it.

Right to erasure

This right is also often referred to as the “right to be forgotten.” Under the terms and in the cases specified by law, when it is possible, the person whose data is processed has the right to demand their erasure. However, it should be borne in mind that this request may not always be realized, for example, there will be no possibility of realization when there is a legal obligation for the controller to process them for a certain period of time.

Right to restrict processing

The RODO also provides for the possibility of requesting, under certain circumstances, the restriction of data processing carried out by the controller, in particular in cases where the processing is unlawful, where a person questions the accuracy of the data, or where the purposes of the controller’s processing have been exhausted and the data subject still needs the data (e.g., to defend claims).

Right to object to processing

The data subject has the right to object to the processing of personal data in situations where the processing is carried out on the grounds of Article 6(1)(e) and (f) of the RODO, respectively, in connection with the performance of tasks in the exercise of public authority or in the public interest, and in pursuit of a legal interest of the controller. This is an important right of data subjects that allows them to object to processing in situations where there is an imbalance of the parties to the processing.

Right to portability of personal data

It covers only cases where the processing is based on the data subject’s consent (Article 6(1)(a) RODO) or where it is necessary for the performance of a contract to which the data subject is a party, or to take action at the request of the data subject prior to entering into a contract (Article 6(1)(b) RODO), and at the same time the processing is automated. A person asserting the right in question may request that the controller transfer to him/her the set of collected data about him/her in the form of a structured, commonly used machine-readable format, and additionally also that the personal data be sent by the controller directly to another controller, if technically possible.

The right to withdraw the consent you have given

When the processing is based on the consent given by the data subject, the data subject has the right to withdraw that consent at any and all times. Importantly, the withdrawal of consent will not affect the lawfulness of processing prior to the withdrawal of consent.

Complaint to the supervisory authority

For unlawful processing, the data subject always has the right to lodge a complaint with the supervisory authority – the President of the Office for Personal Data, in accordance with Article 79 (1) of the RODO. For more information on how to lodge a complaint, visit the website of the DPA.

The right to claim compensation

Any person who has suffered pecuniary or non-pecuniary damage as a result of a violation of data protection law has the right to obtain compensation from the controller who committed the violation for the damage suffered, in accordance with Article 79(2) in conjunction with Article 82 of the RODO.

Third parties

Our website may contain links to third-party portals, and we may use third-party applications. Use of third-party content may require acceptance of their specific terms and conditions, including their separate privacy policies. It also usually involves the processing of personal data by a third party, which will sometimes act as our processor, however, many times it will also be considered a separate controller. In such a situation, we have no control over the processing of your personal data by this entity. Information on the processing of personal data by these controllers can be found in their privacy policies.

At the same time, we would like to inform you that we only use service providers who give a guarantee of the security of the personal data processing entrusted to them and who have implemented appropriate technical, organizational and physical measures at their premises to secure your personal data.

We use the following providers, whose privacy policies are summarized below:

– LinkedIn – https://linkedin.com/legal/privacy-policy

Detailed information about the processing of personal data – contact form

Administrator

The administrator of the personal data is Bioshi Joint Stock Company with its seat in Cracow at Jasnogórska 1, 31-358 Cracow. The company is registered in the Register of Entrepreneurs of the National Court Register under the number 0001053787.

Contact

You can contact us in the following ways:

by letter to the address on the administrator’s premises;
by e-mail: zarzad@bioshi.pl

Purposes and legal basis for processing

We process your data for the purpose of pursuing our legitimate interests (pursuant to Article 6(1)(f) of the DPA) for the following purposes: to answer the question in the contact form and to secure possible claims.

Recipients of data and transfer to third countries

If necessary, your personal data may be transferred to processors providing services on behalf of the administrator and other data recipients – in particular to entities providing services on the basis of a contract for entrustment of personal data processing, legal services, IT service providers, data and document archiving service providers, data and document removal service providers, or couriers and postal service providers.

In particular, your personal data will be transferred to the entities AfterMarket.co.uk and Google LLC, which provide the administrator with website hosting services and provide the necessary ICT tools for, among other things, handling e-mail correspondence.

In connection with the processing of personal data using the services of these entities, there will be a transfer of data outside the European Union and the EEA, and the data will be processed on servers located, in particular, in the United States of America (USA).

Both Google LLC and AfterMarket.co.uk have certified their participation in the EU-U.S. Data Privacy Framework and the Switzerland-U.S. Data Privacy Framework (collectively referred to as “DPF”) with the U.S. Department of Commerce, for which the European Commission’s Implementing Decision 2023/1795 of July 10, 2023, pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, finding an adequate level of personal data protection provided under the EU-U.S. Data Protection Framework (notified as Document No. C(2023) 4745), was issued.

The validity of the Google LLC certificate can be checked at this link:

https://www.dataprivacyframework.gov/s/participant-search/participant-detail?id=a2zt000000001L5AAI&status=Active

Such data transfer may also be based on the application of appropriate legal safeguards, which are in particular the standard contractual clauses for the protection of personal data approved by the European Commission.

You can find more information about Google LLC’s personal data processing policies here: https://policies.google.com/privacy?hl=pl

At the same time, the controller reserves the right to disclose selected information concerning the data subject to the data subject to the competent authorities or to third parties who make a request for such information, based on the relevant legal basis and in accordance with the provisions of the applicable law.

Data retention period

Your data will be processed for no longer than necessary to provide you with an answer, after which time it may be processed for the period necessary to assert or defend against possible claims and the statute of limitations for any related claims.

Rights of data subjects

In connection with the processing of your personal data, you have the right to request access to your personal data, as well as to request the rectification of such data and its deletion. You also have the right to restrict the processing of your personal data.

Above and beyond the above, due to processing undertaken in the legitimate interest pursued by the controller, you have the right to object to such processing of your data.

You also have the right to lodge a complaint to the supervisory authority – the President of the Office for Personal Data Protection.

Data requirement and consequences of refusal

Providing the data contained in the contact form is voluntary, however, it is necessary to use the service and enable us to respond, correspond or take other actions.

Automated decision-making and profiling

Your personal data will not be processed by automated means in order to make a specific decision towards you (including no profiling).

Detailed information about the processing of personal data – electronic correspondence

Administrator

The administrator of the personal data is Bioshi Joint Stock Company, based in Cracow at Jasnogórska 1, 31-358 Cracow. The company is registered in the Register of Entrepreneurs of the National Court Register under the number 0001053787.Contact

You can contact us in the following ways:

by mail to the address at the registered office of the administrator;
by e-mail: zarzad@bioshi.pl

Purposes and legal basis for processing

We process your data for the fulfillment of our legitimate interests (in accordance with Article 6(1)(f) of the DPA) for the following purposes: correspondence with potential clients, customers and other third parties, documentation of arrangements made with clients, customers, other persons, receipt of letters, electronic submissions and requests, such as complaints, and to secure possible claims.

Recipients of data and transfer to third countries

If necessary, your personal data may be transferred to processors providing services on behalf of the controller and other data recipients – in particular, to service providers under a contract for entrustment of personal data processing, legal services, IT service providers, data and document archiving service providers, data and document disposal service providers or couriers and postal service providers.

In particular, your personal data will be transferred to the entities Benhauer Sp. z o.o., with its registered office in Kraków, ul. Stanisława Klimeckiego 4, 30-705 Kraków, entered in the Register of Entrepreneurs of the National Court Register kept by the District Court for Kraków Śródmieście in Kraków, XI Economic Department, under the KRS number 0000523346, NIP: 676 244 77 54, REGON: 122334666, and Google LLC, which provide the administrator with website hosting services and the necessary ICT tools, among others, to handle e-mail correspondence.

Google LLC has certified its participation in the EU-U.S. Data Privacy Framework and the Switzerland-U.S. Data Privacy Framework (collectively referred to as the ‘DPF’) with the U.S. Department of Commerce, for which European Commission Implementing Decision 2023/1795 of 10 July 2023, pursuant to Regulation (EU) 2016/679 of the European Parliament and of the Council, finding an adequate level of personal data protection ensured under the EU-U.S. Data Protection Framework (notified under document number C(2023) 4745) has been issued.

The validity of the Google LLC certificate can be checked at this link:

https://www.dataprivacyframework.gov/s/participant-search/participant-detail?id=a2zt000000001L5AAI&status=Active

Such data transfers may also be based on the application of appropriate legal safeguards, which are in particular the standard contractual clauses for the protection of personal data approved by the European Commission.

You can find more information on the principles of personal data processing by Google LLC here:

https://policies.google.com/privacy?hl=pl

At the same time, the controller reserves the right to disclose selected information concerning the data subject to the competent authorities or to third parties who request such information on the appropriate legal basis and in accordance with the provisions of the applicable law.

Data retention period

Your data will be processed for the duration of the correspondence and thereafter may be processed for the duration of the contract (if applicable) and for the period necessary to assert or defend against possible claims and the statute of limitations for any related claims.

Rights of data subjects

Above and beyond the above, due to processing undertaken in the legitimate interest pursued by the controller, you have the right to object to such processing of your data.

You also have the right to lodge a complaint to the supervisory authority – the President of the Office for Personal Data Protection.

Requirement to provide data and consequences of refusal

Provision of the data contained in the contact form is voluntary, but necessary to use the service and to enable us to reply, correspond or take other action.

Automated decision-making and profiling

Your personal data will not be processed in an automated manner in order to make a specific decision towards you (including no profiling).

Detailed information on processing of personal data – shareholder registration

Administrator

The administrator of the personal data is Bioshi Spółka Akcyjna with its registered office in Cracow at Jasnogórska 1, 31-358 Cracow. The company is entered in the Register of Entrepreneurs of the National Court Register under the number 0001053787.

Contact

You can contact us in the following ways:

by letter to the address on the administrator’s premises;
by e-mail: zarzad@bioshi.pl

Aims and legal bases of the processing

We process your data for the pursuit of our legitimate interests (pursuant to Article 6(1)(f) of the DPA) for the following purposes: shareholder registration and the safeguarding of potential claims.

Recipients of data and transfers to third countries

If necessary, your personal data may be forwarded to processors providing services on behalf of the controller and other data recipients – in particular to entities providing services on the basis of a contract for entrustment of personal data processing, legal services, IT service providers, data and document archiving service providers, data and document deletion service providers or couriers and postal service providers.

In particular, your personal data will be transferred to the entities … and Google LLC, which provide the controller with website hosting services and the necessary ICT tools, among others, for the handling of e-mail correspondence.

In connection with the processing of personal data using the services of these entities, there will be a transfer of data outside the European Union and the EEA, and the data will be processed on servers located in particular in the United States of America (USA).

The validity of the Google LLC certificate can be checked at this link:

https://www.dataprivacyframework.gov/s/participant-search/participant-detail?id=a2zt000000001L5AAI&status=Active

More information on the principles of personal data processing by Benhauer Sp. z o.o., with its registered office in Kraków at ul. Stanisława Klimeckiego 4, 30-705 Kraków, entered into the Register of Entrepreneurs of the National Court Register kept by the District Court for Kraków Śródmieście in Kraków, XI Economic Department, under KRS number 0000523346, NIP: 676 244 77 54, REGON: 122334666, can be found here:

https://www.salesmanago.pl/marketing-automation/terms.htm

You can find more information on the principles of personal data processing by Google LLC here:

https://policies.google.com/privacy?hl=pl

At the same time, the controller reserves the right to disclose selected information concerning the data subject to the data subject to the competent authorities or to third parties who request such information, based on the relevant legal basis and in accordance with the provisions of the applicable law.

Data retention period

Your data will be processed for no longer than is necessary to maintain your shareholder account and for the period necessary to assert or defend against possible claims and the statute of limitations for any related claims.

Rights of data subjects

Above and beyond the above, due to processing undertaken in the legitimate interest pursued by the controller, you have the right to object to such processing of your data.

You also have the right to lodge a complaint to the supervisory authority – the President of the Office for Personal Data Protection.

Requirement to provide data and consequences of refusal

The provision of data is voluntary, however, it is necessary in order to use the service and to enable us to set up a shareholder account or respond and/or take other action.

Automated decision-making and profiling

Your personal data will not be processed in an automated manner in order to make a specific decision towards you (including no profiling).

Contact

If you have any questions or suggestions regarding our Privacy Policy, please contact us by:

traditional correspondence to the address at the registered office of the administrator
contact form available at https://www.bioshi.pl/
e-mail to: zarzad@bioshi.pl