I. General information.

1. The Controller of personal data collected through the website: www.apollina.pl is ATAL S.A. with its registered office in Cieszyn, address: 43-400 Cieszyn, ul. Stawowa 27, entered in the Register of Entrepreneurs of the National Court Register kept by the District Court in Bielsko-Biała, VIII Commercial Division of the National Court Register (KRS) number: 0000262397, NIP (Tax ID): 548-248-72-78, REGON (National Business Register): 240415672, share capital: PLN 216,073,050.00 paid in full.
2. Data protection is implemented in accordance with the requirements of generally applicable laws, in particular the Regulation of the European Parliament and of the Council (EU) 2016/679 of April 27, 2016 on the protection of individuals with regard to the processing of personal data and on the free flow of such data and the repeal of Directive 95/46/EC (“GDPR”), the Personal Data Protection Act of 10 May 2018 and the Electronic Service Provision Act of 18.07.2002.
3. For the sake of a better understanding of the Privacy Policy, the term “User” and “Customer” is replaced by “You”, and “Controller” or “ATAL” is replaced by “We”.
4. The Data Protection Officer overseeing the processing of personal data at ATAL can be contacted by e-mail at: [email protected] or in writing at the address: ATAL S.A., Cieszyn (43-400), ul. Stawowa 27, with the note “Personal data”.
5. We respect the right to privacy and care about data security. To that end, we use a secure communication encryption protocol (SSL) and personal data is stored on secure servers.
6. Personal data provided via the contact form is treated as confidential and is not visible to unauthorized persons.

II. Purposes and legal basis for the processing of personal data by the Controller.

1. ATAL is the controller of its customers’ data. This means that if you use the contact forms available on our website or send e-mails to the ATAL employees’ address provided on the website, we process your personal data such as: first name, surname, e-mail address, telephone number, address, IP address, company name and other personal data provided by the User.
2. Personal data is processed:
   1. in accordance with data protection regulations and the implemented Personal Data Security Policy;
   2. in the scope and for the purpose necessary to pursue legitimate interests (legitimate purposes), and the processing does not violate the rights and freedoms of the data subject (Art. 6(1)(f) GDPR);
   3. in the scope and for the purpose being in accordance with the consent given by you (Art. 6(1)(a) GDPR), e.g.:
      • in the business contact form;
      • for direct marketing and for sending commercial information by electronic means;
      • for direct marketing and for sending commercial information by telephone.
3. Data is collected only in the appropriate, necessary and required scope in relation to the purposes for which it is processed.

III. Period for which personal data is stored.

1. Personal data is processed for the period necessary to achieve the purposes of the processing, as indicated in point II above, i.e.:
   • until the User withdraws consent to such processing – in case of consent granted, e.g., for marketing;
   • until an effective objection has been lodged – with regard to the pursuit of the Controller’s legitimate interests;
2. We try to minimize the retention period of personal data that is no longer used.

IV. Information on the rights of the data subject.

1. Each data subject has the right to demand access to their personal data, to data rectification, erasure or restriction of processing, as well as the right to data portability, the right to object to processing and the right to lodge a complaint with the supervisory authority, which in Poland is the President of the Office for Personal Data Protection, at the following address: ul. Stawki 2, 00-193 Warsaw, if you believe that the processing of your personal data violates the GDPR.
2. We reserve the right to process your personal data after you have withdrawn your consent only to the extent necessary for the purpose of pursuing possible claims before a court of law or if national or EU regulations or international law oblige us to do so.
3. Provision of personal data connected to consent to answer a question contained in the contact form and for the purpose of direct marketing and for sending commercial information by e-mail and telephone is voluntary, however, without it it will not be possible to use the contact form. If you do not wish to give consent, you can contact us directly by e-mail, telephone or in person at the sales offices.
4. Deletion of personal data may take place as a result of withdrawing consent, filing a legally permissible objection to the processing of personal data or requesting the deletion of personal data. Withdrawal of consent can take place in the same form in which it was given, by contacting the Controller electronically, by telephone or at the office. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of the consent before its withdrawal.
5. The Controller makes every effort to protect personal data from unauthorized access by third parties and to that end uses high-level organizational and technical security measures.

V. Recipients of personal data.

1. Users’ personal and operational data may be shared with third parties for the purpose of performing a contract, in connection with the Controller’s legal obligations or for purposes arising from the Controller’s legitimate interests. In particular, recipients of the data may be:
   • processing entities to which ATAL has outsourced the processing of personal data on the basis of a relevant agreement, e.g., IT service providers, entities acting at the instruction of ATAL, if it is necessary for the performance of the agreement,
2. User data is not transferred outside the European Economic Area or to international organizations by default. In case of transfer of data to recipients in third countries, ATAL will apply the standard contractual clauses adopted by the European Commission, which establish basic guarantees for User data security.

VI. Social media tools

1. Our websites use plug-ins and other social media tools provided by social media, such as Facebook, Vimeo, Instagram, Youtube, LinkedIN.
2. When displaying our website containing such a plug-in, your browser will establish a direct connection with the servers of the social media administrators (service providers). The content of the plug-in is transmitted by the given service provider directly to your browser and integrated into the website. Thanks to the integration, service providers receive information that your browser has displayed our website, even if you do not have an account with a particular service provider or are not currently logged into such an account. Such information (along with your IP address) is sent by your browser directly to the server of the given service provider (some servers are located in the US) and stored there.
3. If you have logged into one of the social media networks, the service provider will be able to directly attribute your visit to our website to your account held with the respective social media network.
4. If you use a particular plug-in, such as clicking on the “Like” or “Share” button, this information will also be sent directly to the server of the given service provider and stored there.
5. In addition, such information will be published on the social media network and will be displayed to people added as your contacts. The purpose and scope of data collection and its further processing and use by service providers, as well as the possibility of getting in contact and your rights in this regard and the possibility of adjusting settings to ensure the protection of your privacy are described in the privacy policies of individual service providers.
   Facebook – https://www.facebook.com/legal/FB_Work_Privacy,
   Vimeo – https://vimeo.com/privacy,
   Instagram – https://help.instagram.com/519522125107875?helpref=page_content,
   Youtube – https://policies.google.com/privacy?hl=pl,
   LinkedIN – https://www.linkedin.com/legal/privacy-policy
6. If you do not want social media networks to attribute data collected during your visit to our website directly to your account held with the particular social media network, you need to log out of that account before visiting our website. You can also completely prevent plug-ins from being loaded on the website by using an appropriate extension for your browser, such as script blocking.

VII. Cookies

1. The website uses cookies. They are small text files sent by the web server and stored by the browser software on the computer. When the browser reconnects to the website, the website recognizes the type of device the user is connected from. The parameters allow only the server that created them to read the information contained in them. Therefore, cookies simplify the use of previously visited websites.
2. The information collected includes the IP address, type of browser used, language, type of operating system, Internet service provider, time and date information, location and information sent to the website via the contact form.
3. The data collected is used to monitor and check how users are using our sites in order to improve the website by ensuring a more efficient and problem-free navigation. We monitor user information with the use of tools that record user behavior on the website.
4. Cookies identify the user, which makes it possible to adjust the content of the website they are using to their needs. By remembering user preferences, this makes it possible to tailor targeted ads to the user. We use cookies to guarantee the highest standard of convenience of our website, and the data collected is only used internally to optimize operations.
5. We use the following cookies on our website:
   • “necessary” cookies to enable the use of services available on the website, used for security purposes;
   • “analytical” cookies to help improve our website by collecting and reporting information about its use;
   • “marketing” cookies to help us improve the relevance of the advertising campaigns you receive.
6. The user may disable or restore the collection of cookies at any time by changing browser settings. Instructions for managing cookies can be found in the software settings (in the web browser – (Chrome, Firefox, Internet Explorer, Opera, Safari)..
7. Additional personal data, such as an e-mail address, is only collected where the user has granted explicit consent by filling out the relevant form. We store such data and use it only as necessary to perform the given function.
8. Deleting cookies or disabling them in the browser may result in incorrect operation of the Website and limited access to various functions of the Website.