Privacy policy

Privacy policy and information about the processing of personal data

Pursuant to art. 13 of Regulation (EU) 2016/679 of the European Parliament and of the Council of April 27, 2016. on the protection of individuals with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter: “RODO”), we kindly inform you that:

1. Personal data Administrator

The administrators of the personal data of an individual participating in correspondence conducted by e-mail (hereinafter: “Recipient”) are:

• Złota 75A Sp. z o.o. located in Warsaw (registered office address: ul. Złota 75A/7, 00-819 Warsaw), entered in the Register of Entrepreneurs of the National Court Register kept by the District Court for the Capital City of Warsaw, XIII Economic Department of the National Court Register under KRS number: 0000732488, NIP: 9662120914, REGON: 380264173, with share capital of 11 000 PLN,

• Tuwima 48 Sp. z o.o. with its registered office in Łódź (registered office address: 48/11 Juliana Tuwima St., 90-021 Łódź), entered in the Register of Entrepreneurs of the National Court Register maintained by the District Court for Łódź-Śródmieście in Łódź, 20th Commercial Division of the National Court Register, under KRS number: 0001120644, Tax ID (NIP): 7252345943, National Business Registry Number (REGON): 529382035, with share capital of 60,000 PLN,

• Złota 2 Sp. z o.o. located in Białystok (registered office address: ul. Złota 2/19, 15-016 Białystok), entered in the Register of Entrepreneurs of the National Court Register kept by the District Court in Białystok, XII Economic Department of the National Court Register under the KRS number: 0001157573, NIP: 9662203267, REGON: 540996613, with the share capital of 50 000 PLN,

• Szopena 35C Sp. z o.o. located in Rzeszów (registered office address: ul. Fryderyka Szopena 35C, 35-055 Rzeszów), entered in the Register of Entrepreneurs of the National Court Register kept by the District Court in Rzeszów, XII Economic Department of the National Court Register under the KRS number: 0001191193, NIP: 8133939051, REGON: 542572194, with the share capital of 30 000 PLN,

• Warszawska 6 Sp. z o.o. with its registered office in Białystok (address: ul. Warszawska 6/32, 15-063 Białystok), entered in the Register of Entrepreneurs of the National Court Register maintained by the District Court in Białystok, 12th Commercial Division of the National Court Register under KRS number: 0000460414, Tax Identification Number (NIP): 5423231548, National Business Registry Number (REGON): 200780405, with a share capital of 5 850 PLN,

• Biznes Hub Offices Sp. z o.o. with its registered office in Warsaw (registered office address: Złota 75A/7, 00-819 Warsaw), entered in the Register of Entrepreneurs of the National Court Register maintained by the District Court for the Capital City of Warsaw in Warsaw, 13th Commercial Division of the National Court Register, under KRS number: 0001097465, NIP: 5273106846, REGON: 528282515, with a share capital of 100 000 PLN,

(hereinafter: “Administrator” or “Administrators”).

2. Contact for processing of personal data

In all matters related to the processing of personal data, the Recipient may contact the Administrator by e-mail, at the following addresses:

• for Złota 75A Sp. z o.o. – info@zlota75a.pl

• for Tuwima 48 Sp. z o.o. – czesc@tuwima48.com

• for Złota 2 Sp. z o.o. – info@zlota2.pl

• for Szopena 35C Sp. z o.o. – info@szopena35c.pl

• for Warszawska 6 Sp. z o.o. – info@warszawska6.pl

• for Biznes Hub Offices Sp. z o.o. – offices@bizneshub.pl

The primary, shared email address for contacting all of the Data Controllers listed above is info@bizneshub.pl. Regardless, you may also contact individual Data Controllers using their respective contact information listed above.

3. Purpose of personal data processing

The Administrator may process the personal data of the Recipient in order to:

a) to establish and maintain business relations with the Recipient or the entity on whose behalf the Recipient contacts the Administrator – on the basis of Art. 6 para. 1(f) RODO (processing is necessary for the purposes of the Administrator’s legitimate interest in establishing and maintaining business contacts),

b) to conclude a contract between the Recipient and the Administrator and its execution – on the basis of Art. 6 para. 1(b) RODO (processing is necessary for the performance of the contract concluded with the Administrator),

c) the conclusion of an agreement between the entity on whose behalf the Recipient contacts the Administrator and the Administrator and its performance – on the basis of Art. 6 para. 1(f) RODO (the processing is necessary for the purposes of the Administrator’s legitimate interest, which is to ensure proper communication conducted for the purpose of entering into or performing a contract),

d) to fulfill the Administrator’s obligations under the provisions of the RODO (including the creation of records and registers) – based on Art. 6 para. 1(c) RODO (processing is necessary for the Administrator to fulfill a legal obligation),

e) establishing, pursuing, or defending against claims – pursuant to Article 6(1)(f) of the GDPR (processing is necessary for the purposes of the Controller’s legitimate interests, which consist of protecting the Controller’s financial and non-financial interests),

f) conducting direct marketing of the Controller’s products and services, as well as the products and services of entities affiliated with or cooperating with the Controller, including sending commercial information and marketing materials via email – pursuant to Article 6(1)(f) of the GDPR, i.e., the Controller’s legitimate interest in conducting direct marketing and informing customers about products and services that may be of interest to them. Email is used to send commercial communications only in cases where the recipient has provided the required consent to this form of communication.

4. Voluntariness of providing personal data

The provision of personal data by the Data Subject is voluntary. Depending on the purpose of the contact, the provision of certain data may be necessary to enter into or perform a contract, respond to an inquiry, or carry out other actions specified in section 3 above.

5. Automated decision-making

The Recipient’s personal data will not be used for automated decision-making, including profiling.

6. Google and Microsoft services

In connection with the Administrator’s use of services provided by Google and Microsoft (which are recipients of the Recipient’s data), the Recipient’s personal data may be transferred to the following third countries: United Kingdom, Canada, USA, Chile, Brazil, Israel, Saudi Arabia, Qatar, India, China, South Korea, Japan, Singapore, Taiwan (Republic of China), Indonesia and Australia. The basis for the transfer of data to the aforementioned. third countries are:

a) in the case of the United Kingdom, Canada, Israel and Japan, decisions of the European Commission finding an adequate level of protection for personal data in each of the aforementioned. third countries,

b) for the U.S., Chile, Brazil, Saudi Arabia, Qatar, India, China, South Korea, Singapore, Taiwan (Republic of China), Indonesia, and Australia – contractual clauses providing an adequate level of protection, in accordance with the standard contractual clauses set forth in Commission Implementing Decision (EU) 2021/914 of June 4, 2021. on standard contractual clauses for the transfer of personal data to third countries under Regulation (EU) 2016/679 of the European Parliament and of the Council.

Recipients of the Recipient’s personal data will be:

7. Recipients of personal data

The recipients of the Addressee’s personal data may include:

a) the other Data Controllers listed in point 1, to the extent necessary for the joint servicing of customers, communication, and activities conducted under the Biznes Hub brand,

b) entities that provide the Controller with IT, hosting, and email services, as well as CRM systems and other tools used for customer service and communication,

c) entities providing services related to the sending of electronic messages and the handling of marketing communications,

d) entities affiliated with or cooperating with the Controller, in whose products or services the Recipient has expressed an interest—to the extent necessary to facilitate contact, present an offer, or enter into a contract,

e) entities that provide accounting services to the Controller,

f) law firms and other professional advisors assisting the Controller,

g) entities to which the Controller is required to disclose data pursuant to applicable law.

8. Storage of personal data

Personal data of the Recipient will be stored:

a) for the duration of the contract and for the period necessary to fulfill the obligations related to its conclusion and performance—in the case of data processed in connection with the conclusion and performance of the contract,

b) until the statute of limitations for the relevant claims expires—in the case of data processed for the purpose of establishing, asserting, or defending against claims,

c) until an objection is effectively filed or the purpose of the processing ceases to exist—in the case of data processed on the basis of the Controller’s legitimate interest,

d) until consent is withdrawn—in the case of data processed on the basis of consent, in particular in connection with the sending of commercial information via email.

After an objection to direct marketing has been filed or consent to receive commercial communications has been withdrawn, the Controller may retain, to the extent necessary, data that allows for the recording of the opt-out from further communications, in order to respect the Recipient’s request, prevent the re-sending of marketing communications to them, and demonstrate the correctness of the actions taken.

9. Entitlements of the Recipient

In connection with the Administrator’s processing of the Recipient’s personal data, the Recipient shall have the following rights:

a) the right to know what personal data concerning the Addressee is being processed by the Administrator and to receive a copy of such data (the so-called right of access). The release of the first copy of the data is free,

b) if the data being processed becomes outdated or incomplete (or otherwise inaccurate), the data subject has the right to request that it be corrected,

c) In certain situations, the Recipient may ask the Administrator to delete personal data, such as when:

• the data will cease to be needed by the Administrator for the purposes it informed,

• effectively revoked consent to data processing – as long as the Administrator does not have the right to process data on any other legal basis,

• processing is unlawful,

• the need to delete the data arises from the Administrator’s legal obligation,

d) the right to transfer data to another controller – this applies only to those data of the Recipient that are processed under contract and by automated means,

e) The right to object to the processing of the Recipient’s personal data for purposes arising from the legitimate interests of the Administrator,

f) if the Recipient considers that the processed personal data is incorrect, the processing is unlawful, or the Administrator no longer needs the specified data, the Recipient may request that for a certain necessary period of time (e.g., to verify the correctness of the data or to assert claims) the Administrator not perform any operations on the data, but only store it,

g) The data subject has the right to file a complaint with the President of the Personal Data Protection Office if he or she believes that the Controller’s processing of his or her personal data violates the provisions of the GDPR or other personal data protection laws,

h) The recipient has the right at any time to object to the processing of their personal data for direct marketing purposes and to withdraw their consent to receive commercial information electronically. The recipient may opt out, in particular, by using the unsubscribe link included in the message received or by contacting the Data Controller. Upon receiving such a request, the Data Controller will cease sending marketing communications to the recipient.