Privacy Policy

I.Definitions

1. Data Protection Officer - a natural person with expert knowledge of the law and practices in the field of personal data protection, appointed by the Personal Data Controller to support him in fulfilling his obligations regarding the protection of personal data.

2. GDPR - Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.

3. Personal Data Controller - Globe Trade Centre S.A. with registered office at Komitetu Obrony Robotników 45A Street, 02-146 Warsaw, NIP: 5270025113, KRS: 0000061500.

4. Personal Date - information about an identified or identifiable natural person; an identifiable natural person is a person who can be directly or indirectly identified by one or more specific factors determining physical, physiological, genetic, mental, economic, cultural or social identity, including device IP, location data, online identifier and information collected via cookies and other similar technology.

5. Policy - this Privacy Policy.

6. Service - website run by the Personal Data Controller at www.gtcgroup.com.

7. User - any natural person visiting the Service or using one or more services or functionalities described in the Policy, as well as a natural person to whom personal data processed by the Personal Data Controller relates, e.g. a person visiting the Personal Data Controller's premises or sending an e-mail inquiry to him.

II. Introduction

1. The purpose of this Policy is to define the rules, method of processing and using Users' Personal Data. The Policy also contains information on the rights of natural persons in relation to the Personal Data provided by them. The legal basis of the Policy is Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of individuals with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, and see also the Personal Data Protection Act of May 10, 2018 (Journal of Laws of 2018, item 1000). This Policy is the implementation by the Personal Data Controller of the obligations arising from art. 12, 13 and 14 of GDPR.

2. Please note that by leaving the Personal Data Controller's website, the User enters an area where the Policy does not apply. The Personal Data Controller is not responsible for the privacy policy rules applicable on websites operated by other third-party entities.

3. In connection with the Personal Data Controller's business activity and the User's use of the Service, the Personal Data Controller collects data to the extent necessary to provide individual services offered, as well as information about the User's activity on the Service. The detailed rules and purposes of processing Personal Data are described below.

III. Contact with the Personal Data Controller and the Data Protection Officer

In all matters related to the processing of Personal Data, you can contact the Personal Data Controller at the above-mentioned address of the registered office or by email: dataprotection@gtcgroup.com

The Personal Data Controller has appointed a Data Protection Officer who can also be contacted at the following e-mail address: dataprotection@gtcgroup.com or by correspondence to the Personal Data Controller's address indicated above with the note "Data Protection Officer".

IV. Purposes and legal basis for the processing of Personal Data

The Personal Data Controller processes Personal Data in accordance with the business profile, for the purposes indicated below. If due to legal regulations, the nature of the service or the need to settle it, there is a need to process other personal data of the Users, the Personal Data Controller may process them to the extent necessary.

IV.1. Using the Service

Personal Data of all persons using the Service (including IP address or other identifiers and information collected via cookies or other similar technologies) are processed by the Personal Data Controller:
i. in order to provide electronic services in the scope of making content collected on the Service available to Users - then the legal basis for processing is the necessity of processing to perform the contract (Article 6(1)(b) of the GDPR);
ii. for analytical and statistical purposes - then the legal basis for processing is the legitimate interest of the Personal Data Controller (Article 6(1)(f) of the GDPR), consisting in conducting analyzes of Users' activity, as well as their preferences in order to improve the functionalities and services provided;
iii. in order to possibly establish and pursue claims or defend against claims - the legal basis for processing is the legitimate interest of the Personal Data Controller (Article 6(1)(f) of the GDPR), consisting in the protection of its rights.

The User's activity on the Service, including his Personal Data, are recorded in system logs (a special computer program used to store a chronological record containing information about events and activities that relate to the IT system used to provide services by the Personal Data Controller). The information collected in the logs are processed primarily for purposes related to the provision of services. The Personal Data Controller also processes them for technical and administrative purposes, to ensure the security of the IT system and to manage this system, as well as for analytical and statistical purposes - in this respect, the legal basis for processing is the Personal Data Controller's legitimate interest (Article 6(1)(f) of the GDPR).

IV.2. Recruitment

If you respond to our job offer, your Personal Data are processed in order to carry out the recruitment process for the position offered in our structures and to select the right person to be employed in the position specified in the job offer, including the assessment of the candidate's qualifications, abilities and skills. We obtained this data directly from you.

The legal basis for the processing of your Personal Data in the scope resulting from art. 22(1) of the Labor Code is a legal obligation imposed on the Personal Data Controller (Article 6(1)(c) of the GDPR); in the case of providing Personal Data in a wider scope than specified in the provisions of labor law and in a situation where we offer you employment on a basis other than an employment contract, therefore the Labor Code will not apply, the legal basis for processing is your consent (Article 6(1)(a) of the GDPR).

If you provide us with your application, but we are not currently recruiting, your Personal Data is processed in order to carry out future recruitment processes and select the right person for employment in a vacant position, including the assessment of qualifications, abilities and skills of the candidate for work.

The legal basis for the processing of your Personal Data for the purposes of future recruitments is your consent (Article 6(1)(a) of the GDPR). We treat the sending of application documents to us as tantamount to consent for the processing of data contained therein.

IV.3. Sending commercial/marketing information

In the event of consent to receive marketing/commercial information from the Personal Data Controller by e-mail and/or telephone (via text messaage), Personal Data are processed in order to provide the above-mentioned information.

The legal basis for the processing of Personal Data is the legitimate interest of the Personal Data Controller (Article 6(1)(f) of the GDPR), in connection with the consent given, pursuant to Article 10 of the Act of 18 July 2002 on the provision of services by electronic means, consisting in sending marketing/commercial information by email or via text message (sms) to promote the Personal Data Administrator and the services provided, organized events.


IV.4. Contact form

The Personal Data Controller provides the possibility of contacting him using electronic contact forms. Using the form requires providing Personal Data necessary to contact the User and answer the inquiry. The User may also provide other data to facilitate contact or handling the inquiry. Providing data marked as mandatory is required in order to accept and handle the inquiry, and failure to provide them results in the inability to service. Providing other data is voluntary.

The legal basis for the processing of personal data is the legitimate interest of the Personal Data Controller - (Article 6(1)(f) of the GDPR).

IV.5. E-mail and traditional correspondence

In the case of directing to the Personal Data Controller via e-mail or traditional correspondence not related to the services provided to the sender or any other contract concluded with him, Personal Data contained in this correspondence is processed only for the purpose of communication and solving the matter to which the correspondence relates.

The legal basis for processing is the legitimate interest of the Personal Data Controller (Article 6(1)(f) of the GDPR) consisting in conducting correspondence addressed to him in connection with his business activity.

IV.6. Telephone contact

In the event of contacting the Personal Data Controller by phone, in matters not related to the concluded contract or the services provided, the Personal Data Controller may request Personal Data only if it is necessary to handle the matter to which the contact relates.

The legal basis in this case is the legitimate interest of the Personal Data Controller (Article 6(1)(f) of the GDPR) consisting in the need to resolve a reported case related to the business activity conducted by him.

IV.7. Collecting data as part of business contacts

In connection with the conducted business activity, the Personal Data Controller collects Personal Data, e.g. during business meetings or by exchanging business cards - for purposes related to initiating and maintaining business contacts.

Such Personal Data are processed in order to implement the legitimate interest of the Personal Data Controller and his contractor (Article 6(1)(f) of the GDPR) consisting in creating a network of contacts in connection with the conducted business activity.

IV.8. Processing of Personal Data of the Personal Data Controller's clients or members of the contractors' staff

In connection with concluding contracts as part of its business activity, the Personal Data Controller obtains from contractors / clients data of persons involved in the implementation of such contracts (e.g. data of contact persons performing the contract, data of persons representing the client / contractor, etc.). The scope of the data provided is in each case limited to the extent necessary to perform the contract and usually does not include information other than name, position and business contact details.

Such Personal Data are processed by the Personal Data Controller in order to:

i. conclusion and performance of the contract, on the basis of the need to perform the contract, i.e. when processing is necessary to perform the contract to which the User is a party, or to take action at the request of the User before concluding the contract (Article 6(1)(b) of the GDPR);
ii. resulting from legitimate interests pursued by the Personal Data Controller, i.e. related to the identification of parties, ensuring contact with the contractor, verification whether the person who contacts the Personal Data Controller is authorized to take actions on behalf of the contractor as well as in connection with any claims, handling requests, archiving, ongoing contact (Article 6(1)(f) of the GDPR);
iii. related to the performance of obligations arising from legal provisions, in particular in the field of taxes, accounting, civil law (Article 6(1)(c) of the GDPR.

IV.9. Registration and participation in events.

The Personal Data Administrator processes personal data of participants registering and participating in events organized by him. The Personal Data Administrator receives personal data from event participants. In order to enable event registration, the Personal Data Administrator uses the services of its partner, i.e.

- EventLabs Sp. z o.o. (for more information on the processing of personal data by the partner, see here: https://app.evenea.pl/downloads/polityka-prywatnosci-evenea.pdf );
with whom the Personal Data Administrator has entered into relevant agreements for the processing of personal data.

Personal Data of the participants of the event, is processed in order to:

(i) conclude and execute an agreement with the Personal Data Administrator, on the subject of participation in an event organized by the Personal Data Administrator, on the basis of Article 6(1)(b) of the GDPR;

(ii) to implement the legitimate interest of the Personal Data Administrator, on the basis of Article 6(1)(f) GDPR, consisting of:

- proper organization and operation of the event, in accordance with the provisions of the event regulations available to participants on the event website;

- taking care of the image and popularization of the activities of the Personal Data Administrator by publishing captured recordings and photographs of the event on the Personal Data Administrator's website, social media and YouTube profile;

- taking care of the safety of participants and assets of the Personal Data Administrator;

- investigating and defending against claims.

Provision of data is voluntary, however, necessary for the possibility of participation in an event organized by the Personal Data Administrator.

IV.10 Implementation of legal obligations imposed on the Personal Data Controller

The Personal Data Controller processes Users' Personal Data in connection with the implementation of legal obligations imposed on him regarding accounting and accounting documentation, as well as the implementation of the rights of the Users.

Such Personal Data is processed on the basis of article 6(1)(c) of the GDPR - processing is necessary to fulfill the legal obligation imposed on the Personal data Controller

IV.11. Establishing, pursuing claims and defending against claims

In order to establish, pursue claims and defend against claims, including documenting objections to the processing of Personal Data, Users' Personal Data that they have provided to the Personal Data Controller will be processed.

The legal basis for the processing of Personal Data is article 6 (1)(f) of the GDPR, which allows for the processing of Personal Data for the purpose of possible determination, investigation or defense against claims, which are the implementation of the Personal Data Controller's legitimate interest.

IV.12. Social media

LinkedIn

Personal Data are processed in order to:

i. administration and management of the Personal Data Controller's company profile, including responding to posts and comments posted by Users, and supervision over content published by Users
- the legal basis for data processing is the Personal Data Controller's legitimate interest (Article 6(1)(f) of the GDPR) consisting in the possibility of running and managing a company profile;
ii. responding to inquiries addressed to the Personal Data Controller via the LinkedIn profile
- the legal basis for data processing is the Personal Data Controller's legitimate interest (Article 6(1)(f) of the GDPR) consisting in the possibility of providing answers to persons contacting the Personal Data Controller;
iii. fulfillment of legal obligations imposed on the Personal Data Controller - the legal basis for data processing is article 6 (1)(c) of the GDPR;
iv. implementation of other legally justified interests of the Personal Data Controller, for which the Personal Data Controller considers in particular the possibility of pursuing and defending claims, preventing fraud and economic crimes
- the legal basis for data processing is article 6 (1)(f) of the GDPR.

In addition, the Personal Data Controller informs that the administrator of the LinkedIn portal as a supplier of tools is an entity jointly responsible for the processing of data of persons using the Personal Data Controller’s company profile, which may process their data for its own purposes based on its own legal grounds.

More information on data processing by the LinkedIn administrator can be found at the following link: https://www.linkedin.com/legal/privacy-policy?_l=pl_PL

Youtube

Personal Data are processed in order to:

i. administration and management of the Personal Data Controller's company profile, including responding to posts and comments posted by Users, and supervision over content published by Users
- the legal basis for data processing is the Personal Data Controller's legitimate interest (Article 6(1)(f) of the GDPR) consisting in the possibility of running and managing a company Youtube profile;
ii. fulfillment of legal obligations imposed on the Personal Data Controller
- the legal basis for data processing is article 6 (1)(c) of the GDPR;
iii. implementation of other legally justified interests of the Personal Data Controller, for which the Personal Data Controller considers in particular the possibility of pursuing and defending claims, preventing fraud and economic crimes
- the legal basis for data processing is article 6 (1)(f) of the GDPR.

In addition, the Personal Data Controller informs that the administrator of the Youtube portal as a supplier of tools is an entity jointly responsible for the processing of data of persons using the Personal Data Controller’s company profile, which may process their data for its own purposes based on its own legal grounds.

More information on data processing by the Youtube administrator can be found at the following link: https://www.youtube.com/static?gl=PL&template=terms

V. Recipients of Personal Data

In connection with the conduct of activities requiring the processing of Personal Data, Personal Data may be disclosed to external entities.

The recipients of Personal Data entrusted to the Personal Data Controller by the Users are the following entities to whom Personal Data is transferred to the minimum extent necessary to achieve the purpose / purposes for which the data was obtained:

- authorized Personal Data Controller's personnel, subcontractors and entities providing services to the Personal Data Controller (including IT services and technical support), which must have access to data in order to properly perform their duties;
- entities processing Personal Data on behalf of the Personal Data Controller (e.g. accounting office, technical service providers, hosting service providers, law firms, other entities providing services to the Administrator, including, but not limited to, those related to handling registration and participation in Events);
- competent authorities authorized in accordance with applicable law regulations;
- in the case of data processed on the LinkedIn portal, the recipients of the data will be other LinkedIn users (due to the fact that information about people following accounts, likes, as well as the content of comments, posts and other information provided by Users are public) as well as the administrator of the LinkedIn portal;
- in the case of data processed on the Youtube portal, the recipients of the data will be other users of the Youtube channel (due to the fact that information about people following accounts, likes, as well as the content of comments, posts and other information provided by Users are public) as well as the administrator of the Youtube portal.

VI. Transfer of Personal Data outside the European Economic Area

The level of protection of Personal Data outside the European Economic Area (EEA) differs from that provided by European law. For this reason, the Personal Data Controller transfers personal data outside the EEA only when necessary, and ensuring an appropriate level of protection, primarily through:

i. cooperation with entities processing Personal Data in countries for which an appropriate decision of the European Commission has been issued regarding the determination of an adequate level of protection of Personal Data;
ii. the use of standard contractual clauses issued by the European Commission;
iii. application of binding corporate rules approved by the competent supervisory authority.


VII. Period of Personal Data processing

The Personal Data Controller processes the Personal Data obtained for the period necessary to achieve the purpose/purposes for which they were provided. The period of data processing is related to the purposes and grounds for their processing, therefore:

- data processed on the basis of statutory requirements (e.g. tax) will be processed for the time in which the law requires data storage;
- when the basis for processing is the performance of the contract, then the data is processed by the Personal Data Controller as long as it is necessary to perform the contract;
- data processed on the basis of the Personal Data Controller's legitimate interest will be processed until the data subject successfully submits an objection or the interest ceases. Data processed for the purpose of pursuing or defending against claims will be processed for a period equal to the period of limitation of these claims;
- data processed on the basis of consent will be processed until the consent expressed by the data subject is withdrawn;
- Personal Data processed as part of the recruitment process will be stored until the completion of this process, and in the event of consent to the processing of data for future recruitment, for a period not longer than 1 year;
- Personal Data processed on the LinkedIn portal will be stored for the period in which the User remains an active user of the Personal Data Controller's company profile or until an objection to data processing is raised; while the data contained in posts or comments will be processed until they are deleted;
- Personal Data processed on the Youtube portal will be stored for the period in which the User remains an active user of the Personal Data Controller's company profile or until the objection to data processing; while the data contained in posts or comments will be processed until they are deleted.

The period of data processing may be extended if the processing is necessary to establish or pursue claims or defend against claims, and after this period - only if and to the extent required by law. After the end of the processing period, the data is irreversibly deleted or anonymized.

VIII. Users rights

The Personal Data Controller exercises the rights of the Users related to the processing of their Personal Data. In particular, each User has the right to:

- access to his Personal Data, including obtaining a copy thereof;
- rectification (correction) or completion of incomplete Personal Data;
- request deletion of Personal Data in cases provided for by law ("right to be forgotten");
- submit a request to limit the processing of Personal Data;
- object to the processing of Personal Data;
- if the basis for the processing of Personal Data is the legitimate interest of the Personal Data Controller, the User has the right to object to the processing of Personal Data at any time, without the need to justify his decision, especially when the legitimate interest consists in conducting activities related to marketing direct;
- withdrawal of consent to the processing of Personal Data. The consent expressed by the Users may be withdrawn at any time, which will not affect the lawfulness of data processing carried out before its withdrawal.

The above rights, as well as the intention to withdraw consent, may be implemented by sending a relevant request by e-mail to the e-mail address indicated in point III of the Policy or by post to the address of the Personal Data Controller's registered office given in point I and III of the Policy.

In cases where it is recognized that the processing of Personal Data of natural persons by the Personal Data Controller violates the provisions of the GDPR or is inconsistent with the Policy, Users have the right to lodge a complaint with the supervisory body.

IX. Security of Personal Data

The Personal Data Controller ensures the security of Personal Data against unlawful disclosure to unauthorized persons, data acquisition by unauthorized persons, destruction, loss, damage or change, and personal data processing in a manner inconsistent with the provisions of the GDPR.

In order to secure the entrusted Personal Data, the Personal Data Controller takes technical and organizational measures that meet the requirements of the GDPR, in particular the measures listed in art. 24 and Art. 32 of the GDPR, ensuring confidentiality, integrity and availability of processing services for the Personal Data provided.

X. Automated decision making and profiling

Your data may be processed by the Personal Data Controller in an automated manner, including in the form of profiling. However, individual decisions related to this processing will not be automated.

XI. Cookies and similar technology

Cookies are small text files installed on your device as a User browsing our website (Service). Cookies collect information facilitating the use of the website - e.g. by remembering the User's visits to the Service and activities performed by him.

Essential cookies
We use necessary cookies to provide the User with services provided electronically. Cookies used for this purpose include cookies with data entered by the User (session ID) for the duration of the session (user input cookies).

Performance cookies
We use performance cookies to improve the quality of services. Therefore, we and other entities providing analytical and statistical services for us, use cookies to store information or gaining access for information which are already stored in the User's telecommunications end devices (computer, telephone, tablet, etc.). Cookies used for this purpose include Google Analytics cookies used to analyze how the User uses the Service, to create statistics and reports on the functioning of the Service.

Analytical tools
The Personal Data Controller and its partners use various solutions and tools used for analytical purposes. Below we present some basic information about these tools. Detailed information in this regard can be found in the partner's privacy policy.

- Google Analytics
Google Analytics cookies are files used by Google to create statistics and reports on the functioning of the Service, in order to analyze how the User uses the Service. Google does not use the collected data to identify the User and does not combine this information to enable identification. Detailed information on the scope and principles of data collection in connection with this service can be found at the link: https://www.google.com/intl/pl/policies/privacy/partners.

Cookie settings management
Essential cookies, which are necessary to use the Service, are automatically installed on the User's device. Their use is necessary to provide a telecommunications service (data transmission to display content) - the User has no option to opt out of these cookies if he wants to use the Website.

Performance cookies are not automatically installed by the Personal Data Controller. The User may grant permission for the installation of performance cookies by expressing consent when opening the Service. User may agree for the installation of performance cookies by moving the slider on the cookie banner that appears after entering the Service. Then the Personal Data Controller will be entitled to install performance cookies in accordance with the settings of the browser used by the User (in the case of default settings, all cookies are installed).

User may withdraw the consent at any time. For this purpose, the User should click on "Change settings" in the lower right corner of the Service and move the slider. Withdrawal of consent to the use of cookies is also possible through the browser settings. Detailed information on this can be found at the following links:

- Internet Explorer: https://support.microsoft.com/pl-pl/help/17442/windows-internet-explorerdelete-manage-cookies

- Mozilla Firefox: http://support.mozilla.org/pl/kb/ciasteczka

- Google Chrome: http://support.google.com/chrome/bin/answer.py?hl=pl&answer=95647

- Opera: http://help.opera.com/Windows/12.10/pl/cookies.html

- Safari: https://support.apple.com/kb/PH5042?locale=en-GB
 
User may verify the status of current privacy settings for the browser they use at any time, using the tools available at the links below:

http://www.youronlinechoices.com/pl/twojewybory

http://optout.aboutads.info/?c=2&lang=EN

XII. Final Provisions

To the extent not covered by this Policy, EU regulations on the protection of personal data shall apply..
The date of introduction of the Policy: 13 March 2023.

Cookies we use on this website

We have listed all the cookies currently used on this website. What cookies your device downloads depends on the pages or services you use on this website or how you were brought to this website.