➢ Personal data is processed in accordance with applicable law, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter referred to as GDPR.

➢ The Controller of personal data is Fabryka Kosmetyków „POLLENA–EWA” S.A., ul. Zachodnia 25, 97-425 Zelów. In the scope of personal data of the Controller's contractors, personal data of persons employed or applying for employment by the Controller (under an employment contract or another contract), the controllers (joint controllers) of personal data may also be entities that are subsidiaries of Fabryka Kosmetyków „POLLENA–EWA” S.A. belonging to the TZMO Group. The current list of these entities is available at www.tzmo-global.com/RODO.

➢ In matters concerning the processing of personal data and the exercise of rights related to the processing of personal data, you can contact the Data Protection Officer: Mr. Jan Stemposz, Toruńskie Zakłady Materiałów Opatrunkowych S.A. ul. Żółkiewskiego 20/26, 87-100 Toruń, e-mail address: iod@tzmo.com.pl.

➢ The Controller processes personal data in particular:

• on the basis of Art. 6(1)(a) GDPR – the data subject has given consent to the processing of his or her personal data for one or more specific purposes – in particular for the purpose of maintaining contact with the data subject; making available or delivering (including via e-mail) commercial information, other information, or product samples; organizing, conducting, and documenting events, including contests, promotions, and other marketing actions;
• on the basis of Art. 6(1)(b) GDPR – processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract – in particular for the purpose of performing all rights and obligations resulting from contracts concluded by the Controller;
• on the basis of Art. 6(1)(c) GDPR – processing is necessary for compliance with a legal obligation to which the controller is subject – in particular for the purpose of exercising the rights and obligations of the Controller resulting from applicable laws, particularly in the field of tax law, labor law, and social security;
• on the basis of Art. 6(1)(f) GDPR – processing is necessary for the purposes of the legitimate interests pursued by the Controller – in particular for the purpose of asserting claims.

➢ The recipients of personal data are persons employed by the Controller (under an employment contract or under another contract) and trusted entities cooperating with the Controller – to the extent necessary to achieve the purposes of processing; personal data may also be made available to public authorities and other entities entitled to receive them under provisions of law, at their request.

➢ The Controller does not intend to transfer personal data to a third country or to international organizations.

➢ Personal data is stored:

• in the case of data processed on the basis of Art. 6(1)(a) GDPR – until the processing purposes indicated in the granted consent are achieved;
• in the case of data processed on the basis of Art. 6(1)(b) GDPR – until the parties to the contract have fulfilled all obligations related to the performance of the contract, and subsequently until the expiration or limitation of any claims related to the contract;
• in the case of data processed on the basis of Art. 6(1)(c) GDPR – until the legal obligation incumbent on the Controller is fulfilled, in particular the obligation to store documentation;
• in the case of data processed on the basis of Art. 6(1)(f) GDPR – until the processing purposes are achieved, in particular until the satisfaction, expiration, or limitation of the claim.

➢ The data subject has the right to request from the Controller access to their personal data, and in cases specified in the GDPR also their rectification, erasure, or restriction of processing; they also have the right to data portability.

➢ The data subject has the right to lodge a complaint with the supervisory authority for personal data protection provided for by law if they believe that the processing of their personal data violates the provisions of the GDPR.

➢ In the case of personal data processed on the basis of Art. 6(1)(a) GDPR, the data subject has the right to withdraw consent to the processing of this data at any time without affecting the lawfulness of processing based on consent before its withdrawal. Withdrawal of consent may take place, e.g., by sending a statement of withdrawal of consent via e-mail to the address: iod@tzmo.com.pl

➢ In the case of personal data processed on the basis of Art. 6(1)(a) GDPR, the provision of personal data is not a statutory or contractual requirement and is voluntary; however, the consequence of not providing data may be the impossibility or difficulty in achieving the processing purposes, in particular lack of contact with the Controller; failure to make available or deliver commercial information, other information, or product samples; inability to participate in events, including contests, promotions, and other marketing actions. In other cases, the provision of personal data may be a statutory or contractual requirement if so provided by a provision of law or a clause of the contract.

➢ In connection with the processing of personal data by the Controller, automated decision-making, including profiling, does not take place.