I

General provisions

The company IDEAS NCBR Sp. z o.o. (hereinafter IDEAS) pays special attention to the protection of users’ privacy, including their personal data collected in connection with visiting the website www.ideas-ncbr.pl (hereinafter: the website) and using the electronic services available on the website. In this document, we have specified all the necessary information about the processing of personal data that we want to provide to you in order for you as a user to make informed choices about using, including providing personal data by the website.

This privacy policy applies only to the website www.ideas-ncbr.pl

In the event that the user uses links on our website to external websites, IDEAS is not responsible for the privacy principles adopted on these websites. Therefore, we encourage you to read the privacy policy established therein before using a given website. See point XII Social media.

II

Entity responsible

The entity responsible (otherwise: the Administrator) for the processing of your personal data collected by the website is IDEAS NCBR Sp. z o.o. with the exceptions set out in this policy.

Contact details:

IDEAS NCBR Sp. z o.o.

1. ul. Chmielna 69, 00-801 Warsaw
2. Telephone:: 539 698 327
3. E-mail: biuro@ideas-ncbr.pl

III

Data processing

In connection with our business, we collect and process data about website users. This data may constitute information directly identifying a natural person (i.e. the User), which is collected in connection with the use of the services provided on the website, as well as information in an anonymous form on the basis of which we are not able to identify the user. Anonymous information mainly concerns data collected for internal purposes resulting from website management, including ensuring IT security of the website. We collect them through the use of cookies and server log files. In justified cases, we may combine the collected information, which means that anonymous data in connection with their assignment to an identified user will constitute the user’s personal data.

In order to ensure the transparency of data processing, in particular, we always inform about data processing at the time of its collection, including the purpose and legal basis of the processing – e.g. when using the contact form or setting cookie preferences. We strive to collect data only to the extent necessary for the indicated purpose and processed only for the period in which it is necessary.

When processing data, we ensure their security and confidentiality as well as access to information on processing to data subjects. If, despite the security measures in place, there is a breach of personal data protection (e.g. “a leak” or loss of data), we will inform the data subjects of such an event in a manner consistent with the law.

IV

How we collect personal data

We may collect personal data through:

• direct interactions, such as those made by the user when browsing our website or the social profile we run, or using the forms of contact provided,
• data from third parties, such as information from third party websites or other information that has been made publicly available or information provided by third parties, including, but not limited to, government and data resellers.
• the use of automated tracking technology, from which we obtain such data about the user’s interaction with our website, using various technologies, such as cookies, logs, web beacons and internet tags

V

For what purposes and legal bases we process personal data

We process users’ personal data in connection with:

1. management of the website ideas-ncbr.pl

by using the website, we collect user data in the form of anonymous information to the extent necessary for the proper functioning of the website, managing its content, creating statistical summaries of its visits, interest in content, publications, etc. The collected information about users relates to: IP address, type of software (e.g. Windows or Mac), screen resolution, name and version of the operating system as well as the type and version of the web browser, a unique device identifier. In the event that the user browses the website from a mobile device, we will collect similar information. We collect this information through cookies or server log files. The legal basis for the processing of the collected information is our legitimate interest pursuant to Article 6 (1) (f) of the GDPR or the consent (Article 6 (1) (a)) of the user to install cookies in accordance with the choice made.

2. correspondence that does not result from the concluded contract

by using the contact form provided on the website, or by sending  e-mail correspondence to the e-mail addresses provided, in a topic not related to the services provided by us to the sender of this correspondence, we will ask you to provide certain data that will allow us to respond.

The collected information resulting from the correspondence is processed solely for the purpose of communication and handling correspondence. We try to collect only the information that is necessary for a given case. The legal basis for the processing of the collected information is our legitimate interest pursuant to Article 6 (1) (f) of the GDPR, consisting in the need to resolve a reported matter related to  business activity. In a situation where you provide us with other data than necessary to settle a given case, the legal basis for the processing of this data will be Article 6 (1) (a) your consent to the processing of this personal data.

3. correspondence conducted resulting from the concluded contract or before its conclusion

by using the contact form provided on the website, or by sending e-mail correspondence to the e-mail address provided, in the subject related to the services provided by us to the sender of this correspondence, we collect information necessary to conclude or perform the concluded contract.

The collected information resulting from the correspondence is processed solely for the purpose of communication and handling correspondence. We try to collect only the information that is necessary for the conclusion or performance of the contract. The legal basis for the processing of the collected information is a contract or conclusion of a contract at the request of the data subject, pursuant to Article 6 (1) (b) of the GDPR, i.e. collecting the necessary information to conclude the contract and its implementation. In a situation where you provide us with other data than necessary to settle a given case, the legal basis for the processing of this data will be Article 6 (1) (a), i.e. your consent to the processing of this personal data.

4. telephone contact

in the case of contacting us by phone, in matters not related to the concluded contract or services provided, we may ask for personal data only if it is necessary to handle the case to which the contact relates. The legal basis for the processing of the collected information is our legitimate interest pursuant to Article 6 (1) (f) of the GDPR, consisting in the need to resolve a reported matter related to business activity.

5. recruitment

by sending the application documents to the e-mail address provided, we expect to provide us with personal data specified in the law (name and surname, date of birth, address, contact details provided as well as education and professional experience, if necessary for a given job position). Please do not provide us with any information other than that indicated above. In a situation where the scope of the transferred data is wider, this data will be processed by us on the basis of your consent resulting from the provision of this data for the purposes of the recruitment process.

The legal basis for the processing of the collected information is a legal provision obliging the controller to process a specific scope of personal data is Article 6 (1) (c) of the GDPR and the legitimate interest in assessing the candidate’s qualifications for a given job position, Article 6 (1) (f) of the GDPR, in the remaining scope (applies to data other than those resulting from the law), and consent of the data subject, pursuant to Article 6 (1) (a) of the GDPR.

6. company profile management

in connection with running a company profile, we process users’ personal data for the purposes of maintaining a company profile on selected social networks in order to inform about our activities, to promote the various events we organize and our brand, products and services, to build and maintain a community and for communication via the available functionalities of the given website (comments, chat, messages) and for analytical purposes regarding the analysis of the functioning, popularity, and manner of using a given company profile. The legal basis for the processing of the collected information is our legitimate interest pursuant to Article 6 (1) (f) of the GDPR.

More in section IX: Social media.

We may also collect personal data:

• in connection with the conducted activity, the Administrator collects personal data also in other cases – e.g. during business meetings, at industry events or by exchanging business cards – for purposes related to initiating and maintaining business contacts. The legal basis for processing in this case is the legitimate interest of the Administrator (Article 6 (1) (f) of the GDPR) consisting in creating a network of contacts in connection with the conducted activity. The legal basis for the processing of the collected information is our legitimate interest pursuant to Article 6 (1) (f) of the GDPR
• in connection with the provision of electronic services and ensuring their security, handling complaints, we can process Users’ data and operational data. The legal basis for the processing of the collected information is our legitimate interest pursuant to Article 6 (1) (f) of the GDPR
• in connection with the implementation of Users ‘rights, in particular the right to correct data, the right to withdraw consent and store Users’ requests and evidence of their service. The legal basis for the processing of the collected information is our legitimate interest pursuant to Article 6 (1) (f) of the GDPR
• in connection with the implementation of evidence and archival purposes and to secure information in the event of a legal need to prove facts, possible determination, investigation or defence against claims. The legal basis for the processing of the collected information is our legitimate interest pursuant to Article 6 (1) (f) of the GDPR.

VI

Types of personal data collected

In connection with the provision of electronic services, we collect personal data to the extent necessary for the specific purpose of their processing. These are, among others: name and surname, e-mail address, telephone number, content of the message or conversation. In addition, when sending application documents to us, we will process data such as: year of birth, address, education, experience, and in some cases (if they are provided) additionally: images, interests, skills.

In addition to the data provided above, when using our website, we will additionally collect and save in the file log data about the IP address (internet protocol address) of the end device you use, the name of the service provider through which the website is accessed, the name of downloaded files or information, date and time and the times of viewing the published content, date and time of information sent, name of the operating system and information on the web browser used to browse the website, name or number of the device from which you browse. Log files are saved by us for a short time to determine disruptions and for security reasons (e.g. to investigate attack attempts) and then deleted. Log files, the further storage of which is required for evidence purposes, are not deleted until the incident in question has been finally resolved and may be forwarded to investigating authorities on a case-by-case basis.

VII

Rights of the data subjects

The user whose personal data we process has the following rights:

1. The right to be informed about the processing of personal data

on this basis, we provide the person submitting the request with information on data processing, including in particular the purposes and legal grounds for processing, the scope of the data held, entities to which they are disclosed, and the planned date of data deletion.

2. The right to obtain a copy of the data

on this basis, we provide a copy of the processed data relating to the person submitting the request.

3. Right to rectification

on this basis, we are obliged to remove any inconsistencies or errors in the processing of personal data and to supplement them if they are incomplete.

4. The right to object to processing for the purpose of direct marketing

on this basis, we are obliged to immediately stop processing data for the purpose of direct marketing.

5. The right to object to the processing of data on the basis of our legitimate interest

on this basis, we are obliged to take steps to assess whether our legitimate interest does not violate the right to privacy of the requesting person, and in the event of a violation of the law, stop processing personal data for a specific purpose.

6. The right to erase your data

 on this basis, you can request the deletion of data, the processing of which is no longer necessary to achieve any of the purposes for which they were collected.

7. The right to data portability

on this basis – to the extent that the data is processed in connection with the concluded contract or consent – the Administrator issues the data provided by the data subject in a computer-readable format.

8. The right to limit processing

on this basis, we cease to perform operations on personal data – with the exception of operations for which the data subject has consented – and their storage, in accordance with the adopted retention rules or until the reasons for limiting data processing have ceased to exist.

9. Right of complaint

if it is found that the processing of personal data violates the provisions on the protection of personal data, the data subject may submit a complaint to the President of the Personal Data Protection Office.

In order to exercise the above-mentioned rights, contact us on one of the following communication channels:

E-mail: iod@ideas-ncbr.pl

Telephone: 539 698 327

Post: IDEAS NCBR Sp. z o.o. ul. Chmielna 69, 00-801 Warsaw

VIII

Recipients of personal data

We do not disclose the personal data of the Users of our website, except in the case of:

• in which it is necessary in connection with the conducted activity, telecommunications operators, law offices,
• required or permitted by law, in this case, we provide personal data to companies, organizations and individuals, if we believe in good faith that the sharing, use, preservation or disclosure of data is justified in connection with:
• striving to meet the requirements of applicable law, regulations, legal processes or valid demands of state institutions;
• enforcing the applicable terms of use of the website (website regulations), including the examination of potential violations;
• fraud detection and prevention, and the resolution of other fraud, security and technical issues;
• protection of the property rights or security of the Administrator, website users and other persons in a manner required or permitted by law.
• when you, as the data subject, consent to such sharing,
• when it is necessary for the performance of activities ordered by us by third parties on the basis of signed contracts, e.g. hosting provider, website service. In this situation, in certain cases, in the form of entrusting their processing, we may transfer the personal data obtained by us to cooperating suppliers so that they can process personal data on our behalf.

IX

Cross-border data transfers

We do not transfer data to third parties based in countries outside the European Economic Area (EEA) or international organizations.

X

Automated processing including profiling

We and our service providers may automatically collect certain information about you and how you use the service. Please see our Cookie Policy for details on cookies and other web monitoring technologies that we use as part of our service.

Except as permitted by applicable law, cookies will not be placed on your hard drive until you have given your consent via the cookie banner or via the preference centre.

The cookie policy contains information on how to block these technologies.

Your personal data is not used for profiling.

XI

Time of data processing

In accordance with the established policy, we will process personal data:

• for 6 years from the end of correspondence not related to the contract,
• for 6 years from the end of the contract to which the data subject is a party, including all information collected during the term of the contract, arrangements, explanations conducted by e-mail or telephone,
• for 3 years from collecting data for the purposes of website management,
• for 10 years from the end of the claim handling procedure,
• until the objection is raised or the purpose of processing is completed in a situation where the data is processed for the purpose of direct marketing,
• until the consent is withdrawn or the purpose for which the consent was given is completed,
• for 6 months of receipt of application documents in a situation where a given candidature has not been selected.

XII

Social media plugins

We use social plugins from various websites on our website. When using plugins, your internet browser establishes a direct connection to the servers of the respective social network. The provider concerned receives the information that your internet browser has displayed the appropriate page on the given social network, even if you do not have a user account with this provider or you are not logged in at the moment. The log files (including the IP address) are sent by your Internet browser directly to the server of the respective provider and stored there, if necessary. The provider or its server may be located outside the EU or EEA (e.g. in the USA). However, although we are the owner of the page run in a given social media, due to the nature of social media activities, the administrator of this data will also be the owner (hereinafter referred to as the Operator) of the given social media. The operator operates the entire IT infrastructure of the service, has its own privacy policy and maintains its own relationship with the User (if you are a registered user of the service of a given social networking site). We therefore have no influence on the scope of the data collected by the providers of social networks using these plugins. The purpose and scope of data collection, their further processing and use by the social network, as well as the related rights of users and the possibility of setting the protection of their privacy, are presented in the information on the privacy policy of a given social network.

1. Facebook plugins

Facebook is operated by the company at www.facebook.com, Facebook Inc., 1601 S. California Ave, Palo Alto, CA 94304, USA, and at www.facebook.de by the company Facebook Ireland Limited, Hanover Reach, 5-7 Hanover Quay, Dublin 2, Ireland („Facebook”). You can find an overview of Facebook plugins and their appearance here: http://developers.facebook.com/plugins; information on Facebook’s privacy policy can be found here: http://www.facebook.com/policy.php

2. LinkedIn plugin

LinkedIn is provided by LinkedIn Corporation, 2029 Stierlin Court, Mountain View, CA 94043, USA („LinkedIn”). You can find an overview of the LinkedIn plugins and their appearance here: https://developer.linkedin.com/plugins; information on data protection can be found on LinkedIn here: https://www.linkedin.com/legal/privacy-policy

3. Twitter plugins

Twitter is operated by Twitter Inc., 1355 Market St, Suite 900, San Francisco, CA 94103, USA (“Twitter”). You can find an overview of the Twitter plugins and their appearance here: https://twitter.com/about/resources/buttons; information on Twitter’s privacy policy can be found here: https://twitter.com/privacy

4. YouTube

This online offer uses the YouTube video platform, which is operated by YouTube, LLC, 901 Cherry Ave, San Bruno, CA 94066, USA (“YouTube”). YouTube is a platform that allows you to play audio and video files.

Our purpose of processing data on our social profiles is to inform Users about our offers, products, services, promotions, competitions, industry events, company news, as well as to interact with people visiting our company profile.

XIII

Data Protection Officer

We have appointed a Data Protection Officer who can be contacted on any topic regarding the processing of personal data through:

• E-mail: iod@ideas-ncbr.pl
• Post: IDEAS NCBR Sp. z o.o. ul. Chmielna 69, 00-801 Warsaw with the annotation: Data Protection Officer.

XIV

Final Provisions

1. This Privacy Policy may change from time to time. The user’s rights under this Privacy Policy will not be limited without the user’s express consent. Any changes to the Privacy Policy will be published on this page, and we will inform you about any significant changes in a more visible way. We also keep previous versions of this Privacy Policy in the archive to enable users to review them. The current version of the Privacy Policy was published on 01/08/2021.
2. Any questions, concerns or claims regarding the content of this Privacy Policy or the manner in which we process personal data, as well as complaints regarding these matters (although we hope that there will be no need to file such complaints), can be submitted by sending an e-mail with details of the complaint to the address: biuro@ideas-ncbr.pl All complaints received will be considered and we will provide answers to them.