Privacy and cookies policy of Marketplace.pro

Purposes and Legal Bases for Processing Personal Data Related to the Operation of the Website and the Provision of Services/Functionalities on the Website.

The Data Controller processes personal data for the following purposes and to the following extent, and on the basis of the following legal provisions:

1.Legal Basis: Personal data processed under Article 6(1)(b) GDPR – i.e., for the purpose of performing a contract, as well as taking steps at the request of the data subject prior to entering into a contract. Also, where data processing is necessary for the purposes of the legitimate interests pursued by the Controller or by a third party – the Controller processes personal data under Article 6(1)(f) GDPR.

Purpose and Scope: On this basis, the Controller processes data for the following purposes and to the following extent:

• To contact the data subject at their request in order to present a service or offer, arrange a meeting/consultation/brief, or provide other content or information, and to conduct further discussions. For this purpose, data provided in particular via relevant forms on the Website (e.g., contact forms, strategic consultation/brief request forms), as well as data provided during telephone or email contact, such as name, surname, email address, telephone number, and IP address are processed.
• To provide services and functionalities of the Website that involve adding and displaying user-generated content in the form of comments/opinions on the Website’s pages. For this purpose, the Controller processes personal data provided by the user
  in the Website’s forms, as well as session data, operating system, browser, location and unique ID, IP address.

Legitimate Interest of the Controller: In the case of data processing for the above purposes, the legitimate interest pursued by the Controller consists of building and maintaining positive relationships with the data subjects, particularly by responding to their inquiries, as well as building and maintaining the Controller’s good image, and improving and raising the standard of offered and provided services (including those outside the Website).

2. Legal Basis: Where data processing is necessary for the purposes of the legitimate interests pursued by the Controller or by a third party – the Controller processes personal data under Article 6(1)(f) GDPR.

Purpose and Scope: On this basis, the Controller processes data for the following purposes and to the following extent:

• To determine the scope of and compile statistics on the use of the Website, to facilitate or otherwise optimize the use of the Website, its services and functionalities, or to ensure the IT security of the Website and its functionalities. For this purpose, the Controller processes in particular personal data about the user’s activity in the Website, including, among others, the amount of time spent on each subpage, search history, clicks, location, IP address, device ID, and data related to the user’s web browser and operating system.
• To establish, exercise, and enforce claims or to defend against claims in court proceedings or other enforcement proceedings. For this purpose, the Controller may process primarily the personal data provided by the user on the Website, data obtained during contact with the Controller (especially data provided in forms available on the Website), data related to the use of the Website’s services or functionalities (including data provided or collected in particular sections and resources of the Website), and other data necessary to prove the existence of a claim or that result from a legal requirement, court order, or other legal procedure.

Legitimate Interest of the Controller: In the case of personal data processing for the above purposes, the legitimate interest pursued by the Controller consists of enabling the establishment, pursuit, and enforcement of claims and defense against claims in court and before other state authorities, as well as improving the level, effectiveness, and security of the Online Service, and building and maintaining positive relationships with users.

3. Legal Basis: Where data processing is necessary for the purposes of the legitimate interests pursued by the Controller or by a third party, and where consent of the data subject was also required for processing – based on that consent – i.e., under Article 6(1)(f) GDPR and Article 6(1)(a) GDPR. If personal data are processed for the purposes of performing a contract or taking steps at the data subject’s request prior to entering into a contract, the basis is Article 6(1)(b) GDPR.

Additionally, in the case of certain marketing activities, especially when sending a Newsletter or other similar types of communication, particularly those subject to the legal regulations mentioned here, the legal basis for processing personal data also includes Article 10 of the Act of 18 July 2002 on the Provision of Services by Electronic Means (Journal of Laws No. 144, item 1204, as amended) and Article 172 of the Act of 16 July 2004 Telecommunications Law (consolidated text: Journal of Laws of 2022, item 1648, as amended).

Purpose and Scope: On this basis, the Controller processes data for the following purposes and to the following extent:

• For the marketing of the Controller’s products and services and those of the Controller’s partners, including remarketing. For this purpose, the Controller primarily processes personal data provided by the data subject, including in forms on the Website, data related to the use of services, data on the user’s activity on the Website, including data recorded and stored via cookies, and in particular the user’s activity and history related to communications with the Controller. In the case of subscribing to the Newsletter or a similar service, including ordering a digital service or content, the data provided during that subscription/ordering is also processed. In the case of remarketing, the Controller also uses information about the data subject’s activity to reach them with marketing messages, including dedicated content, outside the Website. For this purpose, the Controller may use services from external providers offering certain mechanisms. These services, in particular, involve displaying the Controller’s messages on websites other than the Website. More details can also be found in the cookie-related provisions in the further part of this document.
• For the use by the Controller of cookies on the Website. Depending on the type (category) of cookies, the legal basis for the processing of personal data may vary:
  ○ Necessary cookies – Article 6(1)(f) GDPR and Article 6(1)(b) GDPR.
  ○ Preference, Statistic, Marketing cookies – Article 6(1)(a) GDPR.
  ○ If the Controller did not categorize the cookie file, Article 6(1)(a) GDPR also applies.
  More information on this topic can be found in the provisions on the use of cookies set out later in this document.
• For market research, opinion surveys, measurements, and statistics by the Controller or its partners or suppliers. For this purpose, the Controller uses, in particular, data provided by the Website user within the Website, including in particular within various Website forms, as well as data regarding user behavior during visits to the Website. Specific guidelines are provided in the information about a given survey or form or the place where the data subject enters their data.

Legitimate Interest of the Controller: In the case of personal data processing for the above purposes, the legitimate interest pursued by the Controller, where it is the legal basis for processing, consists of the ability to inform about the Controller’s offer, in particular about the services provided, and to build a positive image, implement direct marketing of products and services, as well as ensure the most optimal use of the Services and the functionalities of the Online Service and its pages in general, and increase their standard, effectiveness, and security, as well as develop other services of the Controller.

4. Legal Basis: Performance of a contract, as well as where data processing is necessary for the purposes of the legitimate interests pursued by the Controller or by a third party, i.e., under Article 6(1)(f) GDPR and Article 6(1)(b) GDPR.

Purpose and Scope: On this basis, the Controller processes data for the following purposes and to the following extent:

• To examine complaints, grievances, and requests, and to respond to user queries. For this purpose, the Controller processes primarily personal data provided in the contact form and other forms on the Online Service, in emails, SMS messages, complaints, grievances, and requests, and in queries submitted in other forms. For this purpose, the Controller also processes some personal data concerning the services and functionalities made available in the Online Service that gave rise to the complaint, grievance, request, or query, and data contained in documents attached to complaints, grievances, requests, and queries.

Legitimate Interest of the Controller: In the case of personal data processing for the above purposes, the legitimate interest pursued by the Controller consists of the ability to lawfully consider complaints, respond to comments or queries from users, as well as improving the level of provided services and building positive relationships with them.

Purposes and Legal Bases for Other/Remaining Personal Data Processing 

1. Legal Basis: Performance of a contract, as well as, where the processing is necessary for the purposes of the legitimate interests pursued by the Controller or by a third party—legitimate interest of the Controller pursuant to Article 6(1)(f) GDPR and Article 6(1)(b) GDPR (for the purposes of contract performance, as well as taking steps at the request of the data subject prior to entering into a contract).

Purpose and Scope: For this purpose, the Controller processes personal data (in particular: identifiers, content of comments, opinions) concerning individuals (users) visiting the profiles run by the Controller on social media or other platforms (such as Facebook, Instagram, YouTube, LinkedIn). Personal data are processed in order to manage these profiles and provide information about the Controller’s activities, as well as to share expressed opinions about the Controller.

Legitimate Interest of the Controller: Building the Controller’s image, providing information about its activities, as well as fostering positive relationships with users, and the ability to pursue or defend against possible claims, with the reservation that this Privacy Policy does not constitute regulations concerning the processing of personal data by the administrators of the aforementioned social media services or platforms.

2. Legal Basis: Performance of the Contract (Article 6(1)(b) GDPR) and, where processing is necessary for the purposes of the legitimate interests pursued by the Controller or by a third party—legitimate interest of the Controller pursuant to Article 6(1)(f) GDPR.

Purpose and Scope: Organization of events and training sessions.
In connection with organizing events, including online events or training sessions, the Controller obtains personal data from individuals who register for and participate in such events or training. The scope of the transferred data is in each case limited to the extent necessary for organizing the event and usually does not include more information than the participant’s name and email address.

Such personal data are processed to identify participants of the event/training, to contact them, and to handle their participation.

Personal data will also be processed for purposes related to evaluating satisfaction with participation in the event or training, for statistical purposes, or to provide participants with appropriate confirmations of participation, certificates, etc.

Events or training sessions may be recorded—in such a case, the participant will be informed of this fact, in particular by means of a notification displayed by the tool used by the Controller to organize the online event or training, or by being informed before the start of an in-person event or training session. Recordings may be made available, in particular, to event participants.

Legitimate Interest of the Controller: Organizing the event in connection with the submitted registration to participate, as well as gathering information and conducting analyses related to evaluating satisfaction with participation in the event or training, and for general statistical purposes.

3. Legal Basis: Processing is necessary to comply with a legal obligation to which the Controller is subject, pursuant to Article 6(1)(c) GDPR; the data subject has given consent to the processing of their personal data for one or more specified purposes, pursuant to Article 6(1)(a) GDPR; processing is necessary for the performance of a contract to which the data subject is a party, or to take steps at the request of the data subject prior to entering into a contract pursuant to Article 6(1)(b) GDPR; and where processing is necessary for the purposes of the legitimate interests pursued by the Controller or by a third party—legitimate interest of the Controller pursuant to Article 6(1)(f) GDPR.

Purpose and Scope: Conducting recruitment processes and employment. As part of recruitment processes, the Controller expects the submission of personal data (e.g., in application documents such as a CV or résumé) only to the extent defined by labor law regulations. Therefore, no broader scope of information should be submitted. If the submitted applications contain additional data that go beyond the scope specified by labor law regulations, their processing will be based on the candidate’s consent (Article 6(1)(a) GDPR), expressed through an unequivocal affirmative action, i.e., by sending the application documents or submitting the application via an external entity’s tools, in accordance with the information provided on the Website. If the submitted applications contain information not relevant to the recruitment purpose, they will not be used or taken into account in the recruitment process.

In the case of employment, personal data are processed depending on the chosen form of employment and include:

• If the preferred form of employment is an employment contract: In order to fulfill obligations arising from legal regulations related to employment, primarily the Labor Code—the legal basis for processing is the legal obligation of the Controller (Article 6(1)(c) GDPR in conjunction with labor law).
• If the preferred form of employment is a civil law contract: For the purpose of conducting the recruitment process—the legal basis for processing the data contained in the application documents is taking steps at the request of the data subject prior to entering into a contract (Article 6(1)(b) GDPR).
• To carry out the recruitment process regarding data not required by law or by the Controller, as well as for future recruitment processes—the legal basis for processing is consent (Article 6(1)(a) GDPR).
• To verify the qualifications and skills of candidates and to determine the terms of potential cooperation—the legal basis for processing is the Controller’s legitimate interest (Article 6(1)(f) GDPR).
• To establish or pursue claims by the Controller or defend against claims made against the Controller—the legal basis for processing is the Controller’s legitimate interest (Article 6(1)(f) GDPR).

Where personal data are processed based on consent, it can be withdrawn at any time without affecting the lawfulness of processing carried out prior to its withdrawal. Personal data will be processed for the duration of the current recruitment process, after which they will be archived for evidentiary purposes for a period of 1 year and then deleted. If additional consent was given for future recruitments, the data will be processed for 1 year from the moment consent was given or until consent is withdrawn—after this period, they will also be archived for evidentiary purposes for 1 year and then deleted.

Providing data as specified in Article 22(1) of the Labor Code is required—if the candidate prefers employment under an employment contract—by law, primarily the Labor Code, and if the candidate prefers employment under a civil law contract—by the Controller. Failure to provide this data will result in the inability to consider the candidate’s application in the recruitment process. Providing other data is voluntary.

Legitimate Interest of the Controller: Where in the above cases the legal basis for data processing is the Controller’s legitimate interest, that interest includes, in particular, the establishment or pursuit of claims by the Controller or defending against claims made against the Controller, verification of candidates, and determining the terms of potential cooperation.