Privacy Policy

Information concerning the processing of personal data and other matters for persons using the website managed by Urgo sp. z o.o. with its registered office in Warsaw.

(hereinafter referred to as the ‘Information’)

I. Purpose and scope of the Information.

1. This Information is intended for natural persons (hereinafter referred to as: ‘Users’) using the website at urgopolska.pl (hereinafter referred to as: ‘Website’).

2. This Notice sets out the information required by law, including the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter: ‘RODO’), concerning the rules for the use of the Website, including the processing of Users’ personal data.

3. This Notice also applies if, in connection with your use of the Service, you provide personal data to another natural person (e.g. via the Contact Form or the Application Form referred to below). In such a situation, references in this Notice to the User as the subject of the personal data shall also be deemed to refer, mutatis mutandis, to such natural person whose personal data is shared in connection with the use of the Service by another person. Any person making personal data available to another natural person in connection with the use of the Website should have the appropriate authorisation to do so arising from or granted under mandatory provisions of law, particularly the RODO.

II. Personal Data Administrator.

4. The administrator of Users’ personal data (and, at the same time, the operator of the Website) is the following company (hereinafter: “Administrator”):

Urgo sp. z o.o.

(formerly: Polfa Łódź sp. z o.o.)

with registered office in Warsaw

al. Jerozolimskie 142B

02-305 Warsaw

NIP: 1132330835, REGON: 013276500

KRS No.: 0000060390 (registration court District Court for the Capital City of Warsaw in Warsaw)

5. The Administrator can be contacted via the contact form located on the urgopolska.pl website in the ‘Contact’ tab (hereinafter: ‘Contact Form’) or by sending a message to the e-mail address:

kontakt@pl.urgo.com

III. Categories and sources of the Users’ personal data obtained.

6. The Administrator obtains Users’ personal data through the Contact Form (provided that the User fills in such data in the Contact Form and sends it to the Administrator by clicking the “Send message” button), as well as personal data sent by e-mail to any e-mail address indicated in the Service in any of the domains managed by the Administrator (as well as in the domain pl.urgo.com), in particular to the above contact address: kontakt@pl.urgo.com:

first name(s) and surname
e-mail (electronic mail) address of the User.
telephone number of the User.
place of work; name of business or professional activity; professional position; payment or invoice data and other data identifying the User – provided that the User includes them in a message sent to the Administrator via the Contact Form or to any e-mail address indicated on the Services in any of the domains managed by the Administrator (as well as in the domain pl.urgo.com), in particular sent to the above-mentioned contact e-mail address.

7. The Administrator obtains the personal data of candidates for employees or associates of the Administrator through the ‘Pracuj.pl’ and ‘LinkedIn’ portals (applications) (relevant information in this regard, including the purpose, scope, category, and principles of personal data processing, can be found on these portals. In the Service (under the ‘Career’ tab) there are links leading to the above-mentioned Internet services (applications), as well as the User is redirected to recruitment advertisements placed at those Internet services (applications) after clicking on the names of the recruitment advertisements in the above-mentioned ‘Career.’

8. Moreover, it may happen that a User decides to provide the Administrator with his/her personal data for the purposes referred to in section 7 above via the Contact Form or to any e-mail address indicated on the Website in any of the domains managed by the Administrator (as well as in the domain pl.urgo.com), in a message sent to the above contact e-mail address. In such a situation, the Administrator shall process, for the above purpose, the personal data of such User interested in working or cooperating with the Administrator, which shall include:

the first name(s) and surname of the User.
date of birth of the User
the User’s e-mail (electronic mail) address, telephone number and other contact details as indicated by the User.
educational background of the User
Professional qualifications of the User.
the User’s previous employment history.

9. In addition, personal data of the Administrator’s contractors who are natural persons (or natural persons representing the Administrator’s contractors) is obtained through the ‘New Customer Card’ form available on the Website (at: urgopolska.pl/karta-nowego-clienta/) (hereinafter: ‘Customer Card’). The following categories of Users’ personal data are obtained through the Customer Card:

name(s) and surname (of the counterparty or representative).
type of activity conducted, and authorisations and permissions held.
e-mail (electronic mail) address.
telephone number.
function (position) of the representing person.

10. In addition, as part of the operation of the Service, certain personal data of Users may be collected automatically through cookies, as referred to in the following sections of this Information (details of the purposes, grounds, and categories of recipients of data collected using cookies are included exclusively in the referred section of this Information).

IV. Special categories of personal data.

11. In addition, the Administrator collects data from Users via the Website on adverse reactions to cosmetic products and medicinal products via the reporting form available under the tab ‘Reporting of adverse reactions’ (hereinafter: ‘Reporting Form’). Some of the data collected through the Report Form may be data about your health, thus constituting sensitive data (included in the special categories referred to in Article 9(1) of the RODO). Data obtained through the Application Form includes:

the category and type of medicinal or cosmetic product used by the User.
information relating to the User’s pregnancy and events relating to pharmacotherapy.
the way in which the User used the Product and the nature and course of the adverse reaction and its consequences.
name and surname, profession and contact details of the reporting person (telephone, e-mail, fax);
other data indicated by the User in the Notification Form.

12. The provisions of this Information concerning the personal data referred to in section 11 above shall apply mutatis mutandis in the event that such data are obtained for an identical purpose in connection with the use of the Service, i.e. if they are sent by the User to any e-mail address indicated on the Service in any of the domains managed by the Administrator (as well as in the domain pl.urgo.com), in particular in a message sent to the e-mail address for contact indicated in the Information.

V. Purposes and grounds for the processing of Users’ personal data.

13. The Users’ personal data referred to in section 6 above (collected via the Contact Form) are processed by the Administrator to:

to respond, manage and deal with enquiries, suggestions and complaints from Users concerning the Administrator’s activities and products (with regard to contractors who are under contract with the Administrator on the basis of Article 6(1)(b) of the DPA, with regard to other Users on the basis of Article 6(1)(a) of the DPA).
to respond to, manage and fulfil requests from Users concerning their personal data (based on Article 6(1)(c) RODO).

14. The Users’ personal data referred to in clause 9 above (collected by means of the Customer Card) are processed by the Administrator for the purpose of:

the performance of contracts relating to products and services offered by the Administrator to contractors, including the delivery of order documentation, accounting documents, information on the characteristics and distribution of products (Article 6(1)(b) and (c) RODO);
managing relationships with contractors, including researching contractor satisfaction with the products and services offered by the Administrator (Article 6(1)(f) RODO);
the investigation, establishment or safeguarding of the Administrator’s claims against those who have been involved in the production process or from whom it has purchased the product or its components (Article 6(1)(f) and Article 9(2)(f) RODO
to send marketing content (commercial information) concerning the activities and products offered by the Administrator (direct marketing) to Users who have given their express consent to do so by ticking the appropriate box in the Customer Card, via the communication channel covered by the consent given (respectively: an e-mail message, a telephone call or an SMS message), including the use of telecommunications terminal equipment and automatic calling systems for this purpose (on the basis of Article 6(1)(a) RODO and Article 10(2) of the 18 July 2002 on the provision of electronic services).

15. Personal data of Users interested in taking up employment or cooperation with the Administrator, referred to in point 8 above (collected via the Contact Form), are processed by the Administrator to:

recruiting natural persons for positions (functions) of employees or associates of the Administrator (based on Article 6(1)(c) of the RODO and Article 22(1) § 1 and 2 of the Act of 26 June 1974. – Labour Code).

16. The Users’ personal data referred to in clause 11 above (those collected via the Application Form) are processed by the Administrator to:

to ensure that the undesirable effects of medicinal and cosmetic products can be reported, registered and processed by the Administrator in accordance with the relevant provisions of Polish and European Union law (pursuant to Article 6(1)(c) and Article 9(2)(i) of the DPA);
to assert, establish or secure claims by the Administrator against entities that have taken part in the production process or from which it has purchased the product or its ingredients (based on art. 6(1)(f) and art. 9(2)(f) RODO).

VI. Further transfers of Users’ personal data.

17. Any access to Users’ personal data obtained by the Administrator is limited to those who need to have such access to fulfil their professional duties and to the data processors whose categories are set out below.

18. The Administrator may use third-party service providers, acting as entities to which the processing of Users’ personal data is entrusted, to provide, among other things, IT support, marketing support and other administrative support. These service providers act as entities to which the Administrator entrusts the processing of personal data in accordance with the Administrator’s instructions and within the framework of the purposes and grounds for the processing of personal data indicated in this Notice; these entities gain access to the Users’ personal data to the extent necessary for the provision of such services and in accordance with the applicable data protection legislation.

19. The Administrator may also transfer the Users’ personal data in the performance of obligations or powers under the law to public authorities, courts, external advisers and other third parties acting on the basis of such laws.

20. An updated list of the entities to which the Administrator entrusts the processing of personal data and third parties to whom the Administrator makes personal data available is made available upon request to the Administrator (contact details are indicated in paragraphs 4-5 of the Information).

21. Users’ personal data are not transferred by the Administrator outside the European Economic Area (EEA) under any circumstances.

VII. Storage periods for Users’ personal data.

22. The Users’ personal data is stored only for the period necessary for the purpose for which it was obtained by the Administrator, but no longer than the period provided for by the law in the given case.

23. Regarding the personal data of Users who have had legal relationships (including contracts) with the Administrator, the maximum period for the retention of personal data is further determined by the legal provisions on the limitation of claims.

24. Regarding the personal data of Users obtained based on the User’s consent, they are stored in each case no longer than until such consent is withdrawn by the User.

VIII. Other principles for the processing of Users’ personal data.

25. Users providing personal data and other information to the Administrator should ensure that such data is up-to-date and accurate. In particular, by submitting data via the Contact Form, Client Card or Application Form, the User confirms that they have read this Information and that the data provided to the Administrator is up-to-date and accurate. The Administrator, for its part, shall endeavour, in the processing of Users’ personal data, to ensure that such data are accurate and up to date.

26. The Administrator applies the security measures required by law to protect the confidentiality and integrity of the personal data processed by the Administrator. However, the Administrator cannot guarantee that these measures will completely prevent the disclosure of personal data, in particular because of the criminal actions of third parties or the malfunction of electronic devices. In such a case, the legal provisions on liability for breaches of personal data security will apply.

27. The Administrator does not apply automated decision-making based on Users’ personal data obtained through the Website.

IX. Users’ rights (as personal data subjects).

28. The User has the right to request from the Administrator access to the personal data concerning him/her, to rectify, erase or restrict the processing of such personal data and to object to the Administrator’s processing of the User’s personal data – regarding all or some of such data. The User also has the right to request the transfer of personal data processed by the Administrator to another entity.

29. If the User has consented to any personal data processing activities (including the sending of commercial information), the User may withdraw that consent at any time, with effect for the future. Such withdrawal will not affect the lawfulness of the Administrator’s processing of personal data prior to the withdrawal of consent.

30. The User may exercise his/her rights related to the processing of personal data by the Administrator (including those indicated in points 28 and 29 above) by contacting the Administrator using the contact details indicated in points 4-5 of this Information.

31. In the event of any unlawful processing of personal data concerning him/her, the User may lodge a complaint with the competent supervisory authority (i.e. the President of the Office for Personal Data Protection, ul. Stawki 2, 00-193 Warsaw).

X. Cookies.

32. The Website uses cookies. Cookies are small files that allow the Administrator, among other things, to compare visits to the Website by new and existing Users, to understand how Users use the Website, and to provide data to improve future use of the Website. Cookies do not transmit personal information about the User (such as name and surname) but may allow identification of the device used to use the Website (hence they may contain personal data within the meaning of the RODO). If the User wishes to avoid cookies being stored, they should change their browser settings and delete all cookies from their browsing history. The Website also displays (at the bottom of the page) an overlay regarding the Website’s use of cookies, which appears when you first access the Website’s website, with three buttons: ‘Cookie Settings’, “I Accept”, “I Opt Out”, whereby:

in the event of clicking on the ‘I give up’ button, only the cookies necessary for the proper use of the Website (so-called ‘necessary cookies’) will be stored on the User’s electronic device; necessary cookies are required to be able to use the basic functions of the Website, such as providing a secure login or adjusting consent preferences. Such cookies do not contain any data relating directly to an identifiable natural person (although we stipulate that, in light of certain possible lines of interpretation of the RODO, they may still be considered to contain personal data within the meaning of the RODO);

If the ‘I accept’ button is clicked, the following cookies will also be stored on the User’s electronic device, which are not necessary for the operation of the Service, but are cookies: (i) analytical (they are used for the Administrator to understand how the Users interact with the Service; these cookies help to provide information on indicators such as the number of visitors, rejection rate, source of traffic, etc.); (ii) performance (they are used for the Administrator to understand and analyse key performance indicators of the Service, which helps to provide a better user experience to the Users. ); (ii) performance cookies (these are used for the Administrator to understand and analyse key performance indicators of the Service, which helps to provide visitors with a better user experience); (iii) advertising cookies (these are used to provide Users with personalised advertising based on the services previously visited by the User and to analyse the effectiveness of advertising campaigns).

33. The basis for the processing of the personal data contained in the cookies referred to in paragraph 32(a) above is the Administrator’s legitimate interest in ensuring the operation of the Website, while those referred to in paragraph 32(b) above are based on the User’s consent.

34. There are many sources of information in the public domain that describe in detail how cookies work (we recommend in this respect: www.wszystkoociasteczkach.pl). Regarding information on the settings of web browsers regarding cookies, please consult the information made available by selecting the ‘Help’ option (or similar option) in your browser or on the website of the entity that owns the rights to your browser.

XI. Other provisions concerning the use of the Service.

35. All graphic elements, structure and generally the content of the Website are the subject of intellectual property rights vested in the Administrator (Urgo sp. z o.o.). All trademarks and other company or product designations presented in the Website are the property of the Administrator or entities that have authorised the Administrator to use them. The content and objects of intellectual property rights cannot be used (especially commercially) by any other entities without the Administrator’s explicit consent.

36. The Administrator reserves the right to change the content of this Information. Any changes will be made in accordance with the provisions of law, and the amended content of the Information will be available on the Website.