This post is also available in:
PL 
DE
The Privacy Policy is a document which contains information about the processing of your personal data by VersaBox SA and the use of cookies on the versabox.eu website.
The policy has been created so that you can easily check how we process your personal data, what kind of data it is and why we do it, i.e. what our purpose is. In this document you can also check who we are, how to contact us in relation to your personal data and what rights you have.
Table of contents
1. Who are we? – Data Controller.
2. Legal basis.
4. What personal data do we collect and why?.
B. Website management and ensuring its security.
C. Compliance with legal obligations under the GDPR.
D. Functioning of the contact form.
F. Processing of job applicants’ data.
5. Rules on the use of cookies.
6. Information for users of Versabox social media profiles, groups and fan pages.
7. Who has access to your personal data?.
1. Who are we? – Data Controller
Personal data that we collect through our website www.versabox.eu is controlled by VersaBox SA with its registered office in Warsaw, Al. Jerozolimskie 211 apt. D4-D5 Warsaw, entered in the Register of Entrepreneurs of the National Court Register kept by the District Court for the capital city of Warsaw in Warsaw, 14th Commercial Division, KRS No 0000956635, Statistical ID No (REGON): 146858110, Tax ID No (NIP): 7010393861, waste database No (BDO): 000475718.
If you wish to contact us regarding your personal data, please write to the following e-mail address: gdpr@versabox.eu
2. Legal basis
Our obligation to prepare the Privacy Policy results from Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (hereinafter referred to as the “GDPR”) (O.J. EU L of 4 May 2016), and more specifically Article 13 of the GDPR, which refers to the Controller’s obligation to inform you about everything you can read here.
The GDPR is supplemented by the Act of 10 May 2018 on the protection of personal data (Journal of Laws of 2018, item 1000, as amended).
3. Definitions
Controller – an entity that manages your personal data, provides services to you by electronic means and stores and accesses information about your devices.
Cookies – computer data, in particular small text files, that are saved and stored on the devices through which you use my website.
Controller (first-party) Cookies – Cookies placed by the Controller, related to the Controller’s provision of services by electronic means via the versabox.eu website.
Third-party Cookies – Cookies placed by the Controller’s partners via the versabox.eu website.
Website – the website which you are currently visiting, operating in the www.versabox.eu domain
Device – an electronic device through which you access the versabox.eu website
User – this includes but is not limited to you, i.e. a person using the www.versabox.eu website
4. What personal data do we collect and why?.
A. Newsletter
On our website, you have the opportunity to subscribe to the Newsletter. You can do this in the designated section on the website. In order to successfully subscribe to the newsletter, you must enter your e-mail address and click the “SUBSCRIBE” button, which means that you consent to the processing of your personal data.
The purpose of data processing is:
• sending you a regular newsletter;
• informing you about novelties;
• informing you about Versabox products;
• showing you what we are currently doing;
• improving the quality of the newsletter content and enhancing the selection of content
Basis for the processing of personal data:
The basis for the processing of your personal data is the legitimate interest of the Controller, pursuant to Article 6(1)(f) of the GDPR.
Your personal data is processed only in connection with your consent to receive the newsletter.
Personal data storage period:
Your personal data that you have provided in order to receive my newsletter will be stored until you object or deactivate the newsletter – a link to unsubscribe from the newsletter can be found in every e-mail you receive.
B. Website management and ensuring its security
Your personal data is also stored for the purpose of:
• proper website management. This data includes: IP address, session data and browser data. This data is collected automatically.
• ensuring security of the Website and of other users. The data collected includes IP address, browser name, browser type, operating system type. The data is collected automatically.
Basis for the processing of personal data:
The basis for the processing of your personal data is the legitimate interest of the Controller, pursuant to Article 6(1)(f) of the GDPR. The legitimate interest of the Controller is to ensure the proper functioning of the website and to ensure the security of the website and its users.
Personal data storage period:
The above personal data will be stored until it is no longer useful for the proper functioning of the website and its security.
C. Compliance with legal obligations under the GDPR.
Your personal data is also processed for the purpose of compliance with legal obligations under the GDPR to exercise your rights and, therefore, to archive your requests sent to me or to inform you of threats to your privacy. This follows from Article 6(1)(c) of the GDPR.
For this purpose, we will store your data in the form of your name, surname, e-mail address, type of request, data concerning the execution of the request, a description of the event constituting a breach, the determination of its impact on the rights and freedoms of a natural person and a description of the actions taken in this regard.
Basis for the processing of personal data:
The legal basis is Article 6(1)(c) of the GDPR.
Personal data storage period:
In order to comply with legal obligations under the GDPR to exercise your rights and, therefore, to archive your requests sent to me or to inform you of threats to your privacy, data will be stored until the expiry of the limitation periods.
D. Functioning of the contact form
In order to respond to your questions sent using the contact form, we will process the data you have provided.
Basis for the processing of personal data:
The basis for the processing of your personal data is consent granted by you, pursuant to Article 6(1)(a) of the GDPR.
Your personal data is only processed in connection with your consent and the data will be processed until the consent is withdrawn.
E. Sending of marketing content, such as offers, advertisements, information about promotions or events.
On our website, you may also consent to the processing of your data for broadly understood marketing purposes, which is understood as the possibility of sending you information about our current offer, promotions or events via various channels.
The purpose of data processing is:
• informing you about novelties and current offers;
• informing you about Versabox products;
• display of personalised advertisements or offers;
• invitations to events.
Basis for the processing of personal data:
The basis for the processing of your personal data is your consent, pursuant to Article 6(1)(a) of the GDPR.
Personal data storage period:
Your personal data that you have provided in order to receive marketing content will be stored until you object or withdraw the consent.
F. Processing of job applicants’ data
The protection of personal data of job applicants is particularly important. In order to ensure lawful, fair and transparent processing of your personal data, we have prepared the following notice. It sets out how we take care of your personal data and your rights during participation in our recruitment processes.
We process personal data provided by you in your job application (e.g. CV, cover letter), in particular, we may process the following information about you: name, surname, date of birth, contact details (e.g. e-mail, telephone number, address of residence), information about your education, professional qualifications, professional experience, as well as your image (if you include your photograph in the application documents).
If we carry out competence tests and you agree to take part in such tests, we also process information about your knowledge, skills and personal characteristics (e.g. information about your language skills or suitability for a particular position).
Please do not include in your job application any sensitive data, such as: data about your health, disabilities, political views, religious beliefs and other data specified in Article 9 of the GDPR. If the provision of such data is necessary due to your particular situation, we will ask you for separate consent to the processing of such data.
We process your personal data for the following purposes:
(a) recruitment for the position indicated in the job advertisement for which you are sending us your job application, including the selection of candidates for the conclusion of a civil law agreement (if this form of employment is indicated in the job advertisement);
(b) future recruitment for different job positions, if you have given your separate consent;
(c) in the event of a successful recruitment, in order to draw up an employment contract or a civil law agreement (e.g. a cooperation agreement), and to provide you with the necessary information concerning the commencement of work;
(e) the exercise or defence of legal claims relating to the recruitment process.
We process your personal data on different legal bases depending on the purpose of processing
(a) we process your personal data indicated in the Labour Code (Article 22 1) or in other legal regulations (e.g. your name, surname, date of birth, contact details, education, professional experience) or data necessary to take steps prior to the conclusion of an employment contract or a civil law agreement (e.g. your financial expectations, date of commencement of work/provision of services) in order to comply with our legal obligation (Article 6(1)(c) of the GDPR) or because such processing is necessary in order to take steps at your request before the conclusion of an employment contract or a civil law agreement (Article 6(1)(b) of the GDPR) and provision of such data is necessary in order to participate in the recruitment;
(b) We process your e-mail address and telephone number on the basis of our legitimate interest (Article 6(1)(f) of the GDPR), which involves, among other things, the possibility of conducting recruitment by electronic means, efficient communication with candidates. Provision of this data will be necessary to participate in the recruitment;
(c) we process other personal data (e.g. your image, interests) on the basis of your consent, and its provision does not affect the possibility to participate in the recruitment (Article 6(1)(a) of the GDPR). The provision of this data is voluntary.
According to the information provided in the job advertisement, you give such consent by including such personal data in your job application and by submitting the job application to us. You may also give such consent in other manner indicated by us for specific recruitment processes (e.g. by submitting a specific statement in writing or by ticking a designated checkbox);
(d) We process your personal data for future recruitment purposes on the basis of your consent (Article 6(1)(a) of the GDPR), which you express in the manner indicated by us for the specific recruitment process (e.g. by including in your CV a consent clause indicated by us);
(e) in the event of a successful recruitment, we process your personal data to the extent necessary to draw up an employment contract or a civil law agreement (Article 6(1)(b) of the GDPR), as well as to provide you with the information necessary before starting work on the basis of our legitimate interest consisting in providing you with information that will help you and us best prepare for your commencement of work (Article 6(1)(f) of the GDPR);
(g) in the event of any misunderstandings between you and Versabox in connection with the recruitment process, we process your personal data on the basis of our legitimate interest consisting in the exercise of defence of legal claims against us before courts or state authorities (Article 6(1)(f) of the GDPR).
How long do we process your personal data?
(a) We will process your personal data for the purpose of recruitment:
- for the position to which your application relates: for the period necessary to carry out the recruitment process and to select a candidate, and then for a period of approximately 6 months in the event that, for any reason, there is a need to repeat the recruitment process,
- for a period of 3 years after submission of your job application, if you have given your consent to the processing of your personal data for the purpose of future recruitment;
(b) in the event of a successful recruitment, we will continue to process your personal data on the basis of the processing principles and periods stipulated for employees, which will be communicated to you once you start working;
(c) in the event of any misunderstandings between you and Versabox, we will process your personal data for the purpose of exercise of defence of legal claims for a period of 3 years after the end of the recruitment process. In certain cases, we may process your data for longer than 3 years, if this is required by law.
5. Rules on the use of cookies
As Versabox, we value your privacy, so we want to let you know how we use cookies and other similar technologies (collectively referred to as “cookies”).
Personal data collected via cookies is controlled by us – Versabox or by our partners. You can find more information on the list of Cookie Partners.
Cookies used by the Controller are safe for your device. In particular, it is not possible for viruses or other unwanted software or malware to enter users’ devices via this route. These cookies allow us to identify the software you are using and to customise the website settings for each individual user. Cookies usually include the name of the domain from which they originate, the duration of their storage on a device and a value assigned to them.
The Controller uses two types of cookies:
We use cookies that differ both in their life cycle and in the domain from which they originate.
With regard to the life cycle, cookies are divided into:
- session cookies – deleted when you close your web browser,
- persistent cookies – deleted at the end of a predetermined time, regardless of whether you close your web browser.
Based on the domain from which they originate, cookies are divided into:
- first-party cookies – set by the web servers of our websites,
- third-party (our partners’) cookies – set by the web servers of sites other than our own websites.
5. Rules on the use of cookies
As Versabox, we value your privacy, so we want to let you know how we use cookies and other similar technologies (collectively referred to as “cookies”).
Personal data collected via cookies is controlled by us – Versabox or by our partners. You can find more information on the list .
Cookies used by the Controller are safe for your device. In particular, it is not possible for viruses or other unwanted software or malware to enter users’ devices via this route. These cookies allow us to identify the software you are using and to customise the website settings for each individual user. Cookies usually include the name of the domain from which they originate, the duration of their storage on a device and a value assigned to them.
The Controller uses two types of cookies:
We use cookies that differ both in their life cycle and in the domain from which they originate.
With regard to the life cycle, cookies are divided into:
- session cookies – deleted when you close your web browser,
- persistent cookies – deleted at the end of a predetermined time, regardless of whether you close your web browser.
Based on the domain from which they originate, cookies are divided into:
- first-party cookies – set by the web servers of our websites,
- third-party (our partners’) cookies – set by the web servers of sites other than our own websites.
For what purposes do we use cookies and do we need consent?
| No | Type of cookies | Is consent required? | Purpose | |
| 1. | Operation of the website | Always active | You cannot disable these cookies, because they are essential for the website to function properly. These cookies also store the cookie settings you have defined. They also enable us to prevent fraud and detect errors. | |
| [Necessary cookies] | Consent not required | These cookies are always active and cannot be disabled. | ||
| 2 | Consent required | Thanks to these cookies, we can provide you with an efficient and user-friendly website, that is tailored to your preferences; we can also continually improve it. They enable us, among other things, to check how you use our website and whether our communications are of interest to you, e.g. how often you visit our site, which website functions you use, which job vacancies you apply for or whether you open the e-mails we send you. | ||
| 3. | Convenience of the website use | Consent required | These cookies enable us to provide you with various useful features on our website and to remember your settings or interests, e.g. language, font size or other display settings of our site. Thanks to these cookies, our mechanisms can also recognise what video settings are the most suitable for your device. | |
| [Preference cookies] | ||||
| 4. | Advertising tailored to you | Consent required | These cookies allow us to check your activity on our website and tailor our advertisements to your needs and interests. They also allow us to limit the number of ad impressions and measure the effectiveness of advertising campaigns. We may collect information ourselves or with the help of our advertising partners who help us manage online advertising (which includes the conduct of retargeting activities). | |
| [Marketing cookies] | Additionally, we may monitor your activity not only on our website, but also on other sites, so that we can best tailor our advertisements and offers to your needs and interests. We may receive information from our partners and combine it with information we have about your activity on our website. This will include int. al. information about the websites you visit, the frequency of the visits and the type of devices you use. In this case, profiling of your data may take place – based on the information we obtain about your online activity, we will send you a personalised advertisement or offer. | |||
| Consent to marketing cookies also involves our possible use of social media plugins. They enable the sharing of information and our content on social media (e.g. Facebook, LinkedIn) or the use of the “Like” button on our website. They also allow us to see if you have a social media account and are logged into it when you are using our website. However, these plugins may also collect information about your use of the versabox.eu website. You can disable social media plugins, but if you do so, you will no longer be able to use social media features. The website code contains the Facebook Pixel implemented in it. This is a code that collects information about your use of the website so that – on the basis of the collected information – you can receive personalised advertising as part of Facebook’s advertising tools. This tool does not collect any data that allows your direct identification. If you deactivate the Facebook Pixel, we will not be able to target you with advertising tailored to your activity on the website. |
What information do we collect about you?
We or our partners may collect the following information about you by means of cookies:
- data concerning your device (e.g. device ID, MAC address, IP address, operating system, device settings, in particular the language set, screen resolution, browser type),
- data concerning your visits to our website (int. al. time and duration of a visit, date, subpages visited on our websites, search data),
- data concerning your location (if you have given your separate consent),
- e-mail address (hashed),
- information about the advertisements you have watched, including information about the links you clicked on,
- information about your activity on other websites (if you have given your separate consent), including information about the websites visited and the frequency of the visits.
Furthermore, the Controller uses third-party cookies to collect general and anonymous statistical data via Google Analytics analytical tools (administrator of third-party cookies: Google Inc. based in the USA).
Possibility of determining the conditions of storage of Cookies or allowing Cookie access:
You can allow cookies using the settings centre available in the footer of our website. By using the “I understand and accept” or “More settings” buttons, you can grant the relevant consents and manage your preferences. You can withdraw your consent at any time in the preference centre (“cookie settings”) available in the footer of each of our websites.
Our partners also determine their own cookie management policies separately. On the list, you can find information on how to use the “opt out” function for selected partners. By doing so, you can withdraw your consent or object to the processing of your data by these partners.
Please be advised that changing your preferences for certain types of cookies may hinder the use of some of our services.
You can also delete Cookies at any time using the functions available in the web browser you are using.
Restricting the use of cookies may affect some of the functionalities available on the website.
Additional information on social media tools and plugins
Our website uses plugins and other social media tools provided by social networks such as Facebook, Google, LinkedIN.
When displaying our website containing such a plugin, your browser will establish a direct connection to the servers of the social network administrators (service providers). The plugin content is transmitted by the respective service provider directly to your browser and integrated into the website. Thanks to this integration, service providers receive information that your browser has displayed our website, even if you do not have a profile with a given service provider or are not currently logged into their services. This information (together with your IP address) is sent by your browser directly to the server of the relevant service provider (some servers are located in the USA) and stored there.
If you have logged into one of the social networks, the service provider will be able to directly associate your visit to our website with your profile on the relevant social network.
If you use the plugin, e.g. by clicking the “Like” or “Share” button, the relevant information will also be sent directly to the server of the respective service provider and stored there.
Moreover, this information will be published on the relevant social network and will be visible to people added as your contacts. The purpose and scope of data collection, its further processing and use by service providers, as well as the possibility to contact you and to adjust settings to ensure protection of your privacy and your rights in this respect are described in the privacy policy of the respective service provider.
- Facebook – https://www.facebook.com/legal/FB_Work_Privacy,
- Google – https://policies.google.com/privacy?hl=pl,
- LinkedIN – https://www.linkedin.com/legal/privacy-policy.
If you do not want social networks to assign data collected during your visit to our website directly to your profile in a given social network, you must log out of that social network before visiting our website. You can also completely prevent the plugins from being loaded on the website by using the appropriate extensions for your browser (e.g. script blocking), or by using the appropriate settings in the preference centre (cookie settings in the website footer).
6. Information for users of Versabox social media profiles, groups and fan pages
Depending on which profiles you use, we may process the following information about you:
Service Provider – Facebook Ireland Limited (Facebook)
Scope of data:
Your name, surname, e-mail address, profile picture (avatar), information about your education and professional experience, location information, the content of correspondence you send us (e.g. via Facebook Messenger), comments and other content you post on our Facebook profile.
Joint controllership.
We may process statistical data about your activity on our profile. In this respect, your data is jointly controlled by Versabox and Facebook for statistical purposes. The arrangements defining the scope of joint controllership, including the principles of responsibility for the processing of your personal data, are available at: https://www.facebook.com/legal/terms/page_controller_addendum. In accordance with these principles, Facebook undertakes to assume primary responsibility for the processing of your data for statistical purposes and for complying with all relevant obligations set out in the GDPR in respect of the processing of your personal data for statistical purposes.For more information regarding the processing of your data by Facebook, please visit: https://www.facebook.com/privacy/explanati.
Service Provider: LinkedIn Ireland Unlimited Company (LinkedIn)
Scope of data: Your name, surname, e-mail address, profile picture (avatar), information about your education and professional experience, job search information, comments and other content you post on our LinkedIn profile.
For more information regarding the processing of your data by LinkedIn, please visit: https://www.linkedin.com/legal/privacy-policy.
Youtube
Service Provider: Google Ireland Limited (Youtube)
Scope of data: Your name, surname, username, content of your posts and comments.
For more information regarding the processing of your data by Youtube, please visit: https://policies.google.com/privacy
We process your personal data on our profiles for the purpose of:
- management of our social media profiles, including for the purpose of ensuring the order and safety of participants in discussions on our profiles, including removal of comments that violate the law, decency or the rules of the social network on which we run our profile;
- correspondence with you in relation to the topic of a specific profile and any topics you contact us about;
- marketing and promotion of our products and services;
- analysis of the activity of users of our profiles, including for the purpose of collecting data on the number of likes, comments and shares on our profile or content posted there;
- running competitions on our profiles
We process your personal data on our profiles on the basis of our legitimate interest (Article 6(1)(f) of the GDPR), consisting, inter alia, in:
- ensuring order and safety on our profiles by moderating posts and comments made by users of our profiles;
- building positive relations with users of our profiles, in particular by corresponding with them and organising competitions;
- marketing of our products and services;
- analysing the activity of users of our profiles in order to best tailor the content posted there to their needs.
As far as competitions are concerned, if you are the winner of a competition, we will also process your personal data in order to fulfil our tax obligations related to the settlement of the prize (Article 6(1)(c) of the GDPR).
Depending on the purposes for which we process your personal data on our profiles, we process it for the following periods:
- if you send us a question or a complaint – for a period necessary to answer your questions and for evidence purposes – for 3 years from the moment we reply to you;
- in the case of marketing of our products and services – until you object to the use of your data for this purpose, but for no longer than the period in which you follow us;
- in the case of analysis of activity – until you object to the use of your data for this purpose and we decide that your objection is justified, but for no longer than the period in which you follow us;
- where it is necessary to ensure order on our profiles – until you object to the use of your data for this purpose and we decide that your objection is justified, but for no longer than the period in which you follow us;
- in the case of competitions – for the duration of the competition and for a maximum of 3 years after the end of the competition concerned, int. al. for the purpose of exercise or defence of legal claims related to the competition concerned. If you are the winner of a competition, we will process your data for a period of 5 years from the end of the calendar year in which the deadline for payment of tax related to the awarded prize expired, in accordance with tax law.
Your personal data may be received by:
providers of social networks on which we maintain our profiles (e.g. Facebook, LinkedIn, Google,), providers of marketing services (e.g. providers of services for handling user correspondence) and state authorities (e.g. the police, the public prosecutor’s office, the President of the Personal Data Protection Office). Your personal data may be transferred to third countries (outside the European Economic Area – EEA), as some of our suppliers are located outside the EEA. In connection with the transfer of your data outside the EEA, we have ensured that our suppliers guarantee a high level of protection of personal data.
7. Who has access to your personal data?
Data made available to the Controller by the User will be made available only to those entities with whom the Controller has previously signed a data processing agreement, and the transfer of this data is necessary due to the external provision of services to the Controller, e.g. as regards the provision of a mailing platform, accounting, IT service and IT system security.
I use the Facebook Pixel to display advertisements as part of remarketing, therefore, your personal data will be processed by Facebook Ireland Ltd, which will be the controller of your data.
8. What are your rights?
You have:
- The right to access your data and data copies,
- The right to rectification (correction) of your data,
- The right to erasure of data – if you believe that we are not entitled to process the data, you can request its erasure,
- The right to restriction of data processing – you may request that the processing of personal data be restricted to the storage of agreed actions, if your data is incorrect or if its processing is illegal,
- Right to object – you may object to the processing of your data for marketing purposes if such processing is based on the Controller’s legitimate interest, in which case we will cease such processing. You may also object to the processing of your data for other purposes, including profiling of your data, if the legal basis for the processing is the legitimate interest of the controller. Such a request should state the reasons for the objection, by specifying what constitutes the particular situation in respect of which you are objecting. The objection will not be accepted if we demonstrate that the controller’s legitimate interest overrides your claim or that your data is necessary for the establishment, exercise or defence of legal claims against you.
- Right to data portability – the right to data portability applies to data processed by automated means which you have provided to us on the basis of consent or an agreement. You can receive the data in a structured format, such as xml, or we can send it directly to the indicated data controller.
- Right to lodge a complaint – if you believe that I am processing your data unlawfully, you may lodge a complaint with the President of the Personal Data Protection Office (ul. Stawki 2, Warsaw) or another supervisory authority,
- If your data is processed by us on the basis of your consent, you may withdraw your consent at any time, which will result in us ceasing to process that data, unless there is another legal basis giving us the right to do so. Your withdrawal of consent does not affect the lawfulness of the processing before its withdrawal.
9. Contact
If you wish to exercise your rights, please contact us at the following e-mail address: gdpr@versabox.eu