Privacy Policy

I. Personal data administrator

We inform you that the administrator of your personal data is Harvium simple joint-stock company, registered office address: ul. Chmielna 2 lok. 31, 00-020 Warsaw, entered in the register of entrepreneurs of the National Court Register kept by the District Court for the capital city of Warsaw in Warsaw, XII Commercial Division of the National Court Register, under KRS number: 0001116990 [hereinafter: Harvium or the Company].

You can contact the Company:

• In writing to the address: ul. Chmielna 2 lok. 31, 00-020 Warsaw
• By email to: contact@harvium.com
• By phone at: +48 784 852 271

In this document, 'Service' means the website https://harvium.pl, and 'Profiles' means profiles on social media portals such as Facebook or LinkedIn.

II. Purposes and legal bases for personal data processing

The Company processes your personal data only when at least one of the legal bases for their processing listed in Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data (also known as 'GDPR') exists.

Detailed purposes and legal bases for personal data processing are listed in the full document.

a) Business contacts

• Legal basis: Art. 6(1)(b) GDPR. In case of consent to data processing - Art. 6(1)(a) GDPR. Alternatively, Art. 6(1)(f) GDPR - legitimate interest of the Company.
• Purpose: Your data in this category will be processed for the following purposes: (I) direct marketing of the Company's own products and services, (II) establishing and maintaining business contacts, and thus developing the scope of the Company's activities, (III) improving the quality of products and services offered by the Company, (IV) ensuring property protection, security, control and monitoring of access to the Company's office premises, and (V) possible pursuit of claims or defense against claims.
• Processing period: Your personal data in this category will be processed for the period of mutual business contacts, until it is determined that further processing of personal data is pointless due to the purpose for which it was to be processed by the Company (usually after the limitation period for possible mutual claims).

Providing personal data is voluntary.

b) Individual clients

• Legal basis: Art. 6(1)(b) GDPR, and in case the data subject has consented to the processing of their data, the basis for processing is Art. 6(1)(a) GDPR. Furthermore, the legal basis is Art. 6(1)(f) GDPR, i.e. legitimate interest of the Company.
• Purpose: Your data in this category will be processed for the following purposes: (I) performance of the contract between you and the Company, (II) fulfillment of the Company's tax and accounting obligations, (III) direct marketing of the Company's own products and services, (IV) establishing and maintaining business contacts, and thus developing the scope of the Company's activities, (V) improving the quality of products and services offered by the Company, (VI) ensuring property protection, security, control and monitoring of access to the Company's office premises, and (VII) possible pursuit of claims or defense against claims.
• Processing period: Your personal data in this category will be processed for the period of performance of the subject of the contract between you and the Company. To the extent that your personal data is contained in accounting documents that the Company is obliged to store, the Company processes this data for the period during which, according to generally applicable legal provisions, it is obliged to store the aforementioned documents. In any case, the Company processes your personal data until it is determined that further processing is pointless due to the purpose for which it was to be processed by the Company (usually after the limitation period for possible mutual claims).

Providing personal data is voluntary, but it is a condition for concluding and performing a contract with you.

c) Client representatives

• Legal basis: Art. 6(1)(a) GDPR in case the data subject has consented to the processing of their data. Furthermore, the legal basis is Art. 6(1)(f) GDPR, i.e. legitimate interest of the Company.
• Purpose: Your data in this category will be processed for the following purposes: (I) verification of the correctness of representation of the Company's client, (II) performance of the contract between the entity you represent and the Company, (III) fulfillment of the Company's tax and accounting obligations, (IV) direct marketing of the Company's own products and services, (V) establishing and maintaining business contacts, and thus developing the scope of the Company's activities, (VI) improving the quality of products and services offered by the Company, (VII) ensuring property protection, security, control and monitoring of access to the Company's office premises, and (VIII) possible pursuit of claims or defense against claims.
• Processing period: Your personal data in this category will be processed for the period of performance of the subject of the contract between the entity you represent and the Company. To the extent that your personal data is contained in accounting documents that the Company is obliged to store, the Company processes this data for the period during which, according to generally applicable legal provisions, it is obliged to store the aforementioned documents. In any case, the Company processes your personal data until it is determined that further processing is pointless due to the purpose for which it was to be processed by the Company (usually after the limitation period for possible mutual claims).

Providing personal data is voluntary, but failure to provide it may prevent the Company from establishing cooperation with the entity you represent.

d) Employees, collaborators, recruitment candidates

• Legal basis: Art. 6(1)(b) GDPR, Art. 6(1)(c) GDPR and Art. 6(1)(f) GDPR. In case the data subject has consented to the processing of their data, the basis for processing is Art. 6(1)(a) GDPR. Regarding sensitive data, the basis for processing personal data is Art. 9(2)(b) GDPR, and in case the data subject has consented to the processing of this data, the basis for processing is Art. 9(2)(a) GDPR.
• Purpose: Your data in this category will be processed for the following purposes: (I) assessment of candidacy in the recruitment process for employment in the Company, (II) depending on the results of this assessment - for employment in the Company, (III) necessary for the performance of work obligations, (IV) fulfillment of the employer's obligation in accordance with applicable Polish law, (V) determination of the source and scope of rights and obligations of the parties to the cooperation agreement, (VI) fulfillment of obligations related to proper mutual settlement, including settlement of income tax and social or sickness insurance contributions in accordance with applicable Polish law, (VII) ensuring property protection, security, control and monitoring of access to the Company's office premises, and (VIII) possible pursuit of claims or defense against claims.
• Processing period: Your personal data in this category will be processed for the period of the recruitment process, and in case of concluding a contract with the Company after its completion - for the duration of that contract. Furthermore, your personal data will be stored for the period legally required for payroll and personnel data and no shorter than the period legally required for storing documentation on the basis of which settlements were made for income tax and social and sickness insurance contributions. To the extent that your personal data is contained in accounting documents that the Company is obliged to store, the Company processes this data for the period during which, according to generally applicable legal provisions, it is obliged to store the aforementioned documents. In any case, the Company processes your personal data until it is determined that further processing is pointless due to the purpose for which it was to be processed by the Company (usually after the limitation period for possible mutual claims).

Providing personal data, within the scope specified in Art. 22(1) of the Labor Code, is necessary to participate in the recruitment process. In other respects, providing data is voluntary.

e) Service and Profile users

• Legal basis: Art. 6(1)(a) GDPR in case the data subject has consented to the processing of their data. Furthermore, the legal basis is Art. 6(1)(f) GDPR, i.e. legitimate interest of the Company.
• Purpose: Your data in this category will be processed for the following purposes: (I) operation of the Service and Profiles, (II) information about the Company's offers, products and services, (III) marketing of the Company's products and services, (IV) responding to inquiries, enabling expression of opinions, comments, (V) business correspondence, (VI) newsletter distribution, (VII) complaint handling, and (VIII) possible pursuit or defense against claims.
• Processing period: Your personal data in this category will be processed for the period of using the Service or Profiles, and in case of subscribing to the newsletter service, until resignation from this service. In any case, the Company processes your personal data until it is determined that further processing is pointless due to the purpose for which it was to be processed by the Company (usually after the limitation period for possible mutual claims).

Providing personal data is voluntary.

f) Persons with recorded images

• Legal basis: Art. 6(1)(f) GDPR
• Purpose: Your data in this category will be processed for the following purposes: (i) ensuring security and protection of persons and property, (ii) monitoring premises against unauthorized access, (iii) maintaining confidentiality of information.
• Processing period: Your personal data in this category will be processed for a period of three months, and then automatically deleted. In case of an incident and the need to use the recording, they will be stored until the matter is clarified or the relevant proceedings conducted under applicable legal provisions are completed. Providing your personal data is voluntary but necessary to be present in the Company's premises and facilities covered by video monitoring. Your data in this category will be processed automatically - monitoring cameras record images continuously - and will not be profiled.

III. Categories of personal data recipients

Your personal data may be transferred to:

• entities providing services for the Company, such as: legal, tax, accounting advice, IT support, maintenance and operation of the Service and Profiles, audit, forwarding, transport, delivery;
• entities authorized by law, e.g. supervisory authorities, law enforcement, courts, tax, pension authorities;
• banks financing the Company's activities and those in which the Company holds bank accounts;
• medical companies providing healthcare services for employees or Company personnel (applies to persons using this care);
• companies providing employee benefit programs/services for the Company (applies only to persons using such benefits/programs);
• training and educational companies and institutions to which data is disclosed in connection with referral by the Company to training, courses, studies, etc., organized by these companies or institutions;
• other entities not listed above, according to the principles specified in legal provisions.

IV. Transfer of data outside the EEA

The Company does not transfer your personal data to entities outside the European Economic Area (EEA).

V. Rights related to personal data processing

• Right to access data (Art. 15 GDPR)
• Right to data correction (Art. 16 GDPR)
• Right to data deletion (Art. 17 GDPR)
• Right to restrict processing (Art. 18 GDPR)
• Right to object to data processing (Art. 21 GDPR)
• Right to data portability (Art. 20 GDPR)
• Right to file a complaint with the President of the Personal Data Protection Office

This privacy policy may change. If you have any questions, please contact the administrator.