Privacy Policy
Introduction
This document constitutes the Privacy Policy of “AGRIZAZ” sp. z o.o., with its registered office at ul. Bolesława Chrobrego 19, 74-400 Dębno (hereinafter: AGRIZAZ).
The AGRIZAZ Privacy Policy (hereinafter: the Policy) sets out the principles and methods of processing and using data and information obtained from employees, business partners, customers and users of all websites belonging to AGRIZAZ, i.e.:
and:
www.humusactive.pl
www.plonochron.pl
www.oszczedzam-miliony.pl
Please read the Policy carefully. By accessing or using a website belonging to AGRIZAZ and providing us with any personal data in connection with purchases made in the online store, participation in promotions, or contacting us, and having read this Policy, the User accepts the terms of this Policy and confirms that they have read its contents.
Terms used in the Policy
Personal Data – means Personal Data within the meaning of the GDPR, i.e. any information relating to an identified or identifiable natural person. Such data directly or indirectly identifies a natural person by reference to their surname, e-mail address, telephone number or other information which, when combined with the above, may identify the User.
GDPR – means Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), pursuant to which AGRIZAZ processes Users’ Personal Data.
User – a representative of an entity offering AGRIZAZ products, a customer of the online store, a newsletter subscriber, a competition participant, a person submitting an enquiry or a person visiting websites belonging to AGRIZAZ.
Services – means services provided electronically by AGRIZAZ via the website, i.e. newsletter subscription, submitting an enquiry via a contact form, sales through the online store and registering participation in competitions.
III. Provision of Personal Data
By providing their Personal Data on the website
and other websites belonging to AGRIZAZ, the User confirms that they have the necessary permissions to disclose personal data that will be used by AGRIZAZ in the manner described in this Policy.
VI. Personal Data Controller
The Personal Data Controller within the meaning of the GDPR is “AGRIZAZ” sp. z o.o. with its registered office at ul. Bolesława Chrobrego 19, 74-400 Dębno, tel. (95) 760 03 22.
V. Purposes of Personal Data Processing and Legal Bases for Processing
In accordance with the scope of its business activity, the Controller processes personal data for various purposes, but always in compliance with applicable law. Personal data is processed in connection with the following categories of activities:
Browsing the Website
The data of all entities using the Website (including IP addresses or other identifiers and information collected through cookies or other similar technologies) is processed by the Controller for one or more of the following purposes:
- providing electronic services consisting of making content available to Users in the Online Store and providing contact forms – legal basis for processing: processing necessary for the performance of a contract (Article 6(1)(b) of the GDPR);
- analytical and statistical purposes – legal basis for processing: the legitimate interests of the Controller (Article 6(1)(f) of the GDPR), consisting in analysing Users’ behaviour and activity, as well as their preferences, in order to improve the quality and relevance of the functionalities and services provided;
- ensuring IT security – legal basis for processing: the legitimate interests of the Controller (Article 6(1)(f) of the GDPR), consisting in protecting its rights and recording activity in system logs – the rules governing the processing of personal data for IT security purposes are described in the “IT Security” section;
- marketing purposes of the Controller and other entities, in particular in connection with displaying behavioural advertising – legal basis for processing: the legitimate interests of the Controller (Article 6(1)(f) of the GDPR), consisting in adapting the displayed advertising content – the rules governing the processing of personal data for marketing purposes are described in the “Marketing” section.
Contact Form
The Controller’s websites provide the possibility of contacting the Controller using an electronic contact form. Using the form requires the provision of personal data necessary to contact the User and respond to the enquiry. The User may also provide other data in order to facilitate contact or the handling of the enquiry. Providing data marked as mandatory is required in order for the enquiry to be accepted and handled, and failure to provide such data will make it impossible to use the form. Providing non-mandatory data is voluntary.
Personal data provided to the Controller through the contact form is processed for one or more of the following purposes:
- identifying the sender and handling the enquiry submitted through the available form – legal basis for processing: processing necessary for the performance of a contract for the provision of a service (Article 6(1)(b) of the GDPR);
- analytical and statistical purposes – legal basis for processing: the legitimate interests of the Controller (Article 6(1)(f) of the GDPR), consisting in maintaining statistics relating to enquiries submitted by Users in order to improve its functionality and the Controller’s activities;
- ensuring IT security – legal basis for processing: the legitimate interests of the Controller (Article 6(1)(f) of the GDPR), consisting in protecting its rights and recording activity in system logs – the rules governing the processing of personal data for IT security purposes are described in the “IT Security” section.
Marketing
The Controller processes Users’ personal data for the purpose of conducting marketing activities, the legal basis for which is the legitimate interests of the Controller (Article 6(1)(f) of the GDPR) or consent to data processing (Article 6(1)(a) of the GDPR). These activities may include in particular:
- analysing Users’ behaviour and activity, as well as their preferences, in order to improve the quality and relevance of the functionalities and services provided – legal basis for processing: the legitimate interests of the Controller (Article 6(1)(f) of the GDPR), consisting in analysing visits to websites;
- conducting activities related to the direct marketing of goods and services – legal basis for processing: consent (Article 6(1)(a) of the GDPR), through the sending of commercial information electronically in the form of a newsletter;
- offering products and services by sending commercial information electronically and through telemarketing activities – legal basis for processing: consent (Article 6(1)(a) of the GDPR), based on a submitted request;
- making available the distribution network of products and services – legal basis for processing: consent (Article 6(1)(a) of the GDPR), based on a submitted request;
- conducting activities related to the implementation of a promotional and loyalty programme – legal basis for processing: consent (Article 6(1)(a) of the GDPR), consisting in assessing points within the product distribution network;
- engaging the customer community – legal basis for processing: consent (Article 6(1)(a) of the GDPR), in connection with competitions and promotional campaigns.
This means that if the User has consented to receiving marketing information by e-mail or other contact methods, the User’s personal data will be processed for the purpose of sending such information. The basis for processing data is the Controller’s legitimate interest in sending marketing information within the scope of the consent granted by the User (direct marketing). The data will be stored for this purpose for as long as the Controller’s legitimate interest exists, unless the User objects to receiving marketing information.
For the purpose of conducting marketing activities, the Controller may in certain cases use profiling. This means that through automated data processing, the Controller assesses selected factors concerning natural persons in order to analyse their behaviour or create forecasts for the future. When carrying out such profiling, the Controller does not use profiling that produces legal effects concerning the User or similarly significantly affects the User.
IT Security
The User’s activity, including their personal data, is recorded in system logs. Such data may be collected and processed for the purpose of:
- establishing, pursuing or defending against potential claims – legal basis for processing: the legitimate interests of the Controller (Article 6(1)(f) of the GDPR), in order to ensure accountability for actions taken by Users within the systems used by the Controller.
Information collected in logs is processed in connection with the services provided by the Controller. The Controller also processes such information for technical purposes, which means in particular that the data may be temporarily stored and processed in order to ensure the security and proper functioning of IT systems, for example in connection with backups, testing changes to IT systems, detecting irregularities or protecting against abuse and attacks.
VI. Cookies and Similar Technologies
The Controller declares that cookies are used on the website
and other websites belonging to AGRIZAZ.
Cookies are small text files installed on the device of a User visiting websites. Cookies collect information that facilitates the use of the website – including by remembering the User’s visits to the Online Store and the actions performed by the User.
Cookies used on the website
and other websites belonging to AGRIZAZ may be set by our website or by a third-party website.
The Controller primarily uses cookies in order to provide the User with electronic services and to improve the quality of those services. Accordingly, the Controller and other entities providing analytical and statistical services on its behalf use cookies by storing information or accessing information already stored on the User’s telecommunications terminal device (computer, telephone, tablet, etc.). Cookies used for this purpose include:
- adapting the content of websites to the User’s preferences and optimising the use of websites; in particular, these files make it possible to recognise the device of the website User and display the website appropriately, adapted to their individual needs;
- creating statistics that help understand how Users use websites, thereby enabling improvements to their structure and content;
- providing Users with advertising content better tailored to their interests.
Types of cookies used by AGRIZAZ:
- “Necessary” cookies, enabling the use of services available within the website, e.g. enabling the use of sessions;
- “Functional” cookies, enabling the website to “remember” settings selected by the User and personalise the User interface, e.g. the selected mobile or desktop version, recently entered search terms, website appearance, etc.;
- “Analytical” cookies, enabling the monitoring of Users’ activity on the website;
- cookies used to monitor website traffic, i.e. data analytics, including Google Analytics cookies. These files are used by Google to analyse how the User uses websites and to create statistics and reports concerning the functioning of websites. Google does not use the collected data to identify the User or combine this information in order to enable identification. Detailed information regarding the scope and rules of data collection in connection with this service can be found at: Google Privacy Policy.
The User may block the storage of cookies by changing the relevant settings in their web browser. Disabling cookies may affect the functioning of the website. Failure to change browser settings constitutes acceptance of the cookies used.
VII. How Long Do We Store Your Data?
In accordance with applicable law, we process your personal data for the period necessary to achieve the intended purpose. After this period, your personal data will be irreversibly deleted or destroyed.
Where we do not need to perform any operations on your personal data other than storing it (for example, where we retain the contents of an order for the purpose of defending against claims), we additionally secure the data by pseudonymisation until it is permanently deleted or destroyed. Pseudonymisation consists in encrypting personal data or a set of personal data in such a way that it cannot be read without an additional key, making such information completely unusable to an unauthorised person.
Your personal data will be processed by the Controller for the period necessary to fulfil the purposes referred to in the section “Purposes and legal bases for the processing of personal data”, for example until the completion of the newsletter service provided to you, termination of your participation agreement in our loyalty programme, completion of complaint proceedings, and thereafter until the limitation period for any potential claims has expired or until any statutory data retention obligations have expired.
VIII. Transfer of Personal Data to Other Entities
We do not sell, trade or otherwise transfer your personal data to third parties. We may disclose your data where we believe such disclosure is required or permitted by law, in order to enforce our website policies or to protect our or others’ rights, property or safety. However, non-personally identifiable visitor information may be provided to other parties for marketing, advertising or other purposes.
We may engage third parties and individuals to improve our services, provide services on our behalf or provide services related to the development of our services.
Such persons may have access to your personal data solely for the purpose of performing tasks on our behalf and are obliged not to disclose or use such data for any other purpose.
Transfer of Personal Data to Third Countries and International Organisations
Your personal data is not transferred to Third Countries, i.e. outside the European Economic Area (EEA), or to international organisations.
User Rights
Pursuant to Chapter III, Articles 15–21 of the GDPR, the User has the following rights in connection with the processing of their Personal Data by AGRIZAZ:
- the right of access to their Personal Data;
- the right to rectify processed data;
- the right to erasure of data (“right to be forgotten”);
- the right to restriction of data processing;
- the right to data portability;
- the right to object to further processing of data;
- the right not to be subject to decisions based solely on automated processing, including profiling.
Each of the above rights may be exercised upon the User’s request. AGRIZAZ will review the submitted request and send a response within 1 month from the date of receipt of the request.
As part of their rights, the User may at any time withdraw consent to further processing of Personal Data for purposes requiring consent, provided that withdrawal of consent does not affect the lawfulness of the use of personal data in activities carried out on the basis of consent before its withdrawal.
A request concerning the exercise of the rights listed above may be submitted by traditional mail to:
ul. Bolesława Chrobrego 19,
74-400 Dębno
or by e-mail to:
Where possible, the request should precisely indicate what it concerns, in particular:
- who is submitting the request;
- which of the rights described above the applicant wishes to exercise;
- which processing purposes the request concerns (e.g. marketing purposes, analytical purposes, etc.).
If the Controller is unable to determine the content of the request or identify the person submitting it on the basis of the information provided, the Controller will ask the applicant for additional information.
AGRIZAZ reserves the right both not to respond to a request and to provide a response later than the period indicated above (up to two months) due to the number of enquiries or the complex nature of the submitted request. A complex request means the need to compile Data from multiple IT systems or the need to consult more than one person from one or more departments in order to obtain the information covered by the request.
In both of the above situations, AGRIZAZ undertakes to inform the User accordingly and provide reasons in each case.
The response will be sent to the e-mail address from which the request was submitted, and in the case of requests submitted by post – by registered mail to the address indicated by the applicant, unless the contents of the letter indicate that the applicant wishes to receive a response by e-mail. In such a case, an e-mail address must be provided.
Right to Withdraw Consent
If the Controller processes your personal data on the basis of consent granted by you, you may withdraw that consent at any time at your discretion.
If you wish to withdraw your consent to the processing of your personal data, you may do so in the following ways:
- send an e-mail directly to the Controller at [email protected];
- click the link included at the end of an e-mail message.
If the Controller processes your personal data on the basis of consent granted by you, withdrawing that consent does not mean that the processing of personal data carried out up to that point was unlawful. In other words, until consent is withdrawn, the Controller is entitled to process your personal data, and withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.
XII. Right to Lodge a Complaint
If you believe that your personal data is being processed contrary to applicable law, you may lodge a complaint with the President of the Personal Data Protection Office.
XIII. Security Rules
AGRIZAZ has implemented appropriate security measures (organisational and technical) aimed at protecting Personal Data against loss, misuse, unlawful processing or modification. The Controller undertakes to protect all information disclosed by Users in accordance with security and confidentiality standards. Access to Users’ Personal Data has been strictly restricted in order to prevent such information from being accessed by unauthorised persons. Access to Personal Data is limited to an authorised number of AGRIZAZ employees.
AGRIZAZ is entitled to disclose data to entities authorised under applicable provisions of law.
XIV. Amendments to the Policy
Due to technological development and progress, as well as changes in applicable law, the rules set out in this Privacy Policy may change. The User will be informed of any changes to these rules by publication of the new version of this document on the website:
www.agrizaz.pl/polityka-prywatnosci/
and will also be notified by e-mail.
This Privacy Policy is effective as of
8 January 2024.
