Privacy Policy

§ 1 GENERAL INFORMATION

The Controller of your personal data is Corotop S.A. with its registered office in Chrząstowice, ul. Ozimska 2A, 46-053 Chrząstowice.
In order to ensure constant supervision over the correctness of the processing of personal data, the Controller has appointed a Data Protection Officer, hereinafter referred to as the DPO for short. This is the person you can contact electronically by email: iod@corotop.com for all matters concerning the processing of your personal data and the exercising of your rights in relation to the processing.
The Privacy Policy sets out the terms and conditions of the processing by the Controller of:
– personal data of website users,
– personal data of social media users, in particular the data of fans of our Facebook and Instagram fanpage,
– personal data contained in electronic correspondence sent by email.
The Controller shall take the utmost care to protect the privacy of data subjects. In order to protect the personal data of persons using the website, the Controller has applied technical and organisational measures to ensure the protection of the processed personal data, in accordance with the GDPR.
The Controller shall take the utmost care to protect the privacy of data subjects. In order to protect the personal data of persons using the website, the Controller has applied technical and organisational measures to ensure the protection of the processed personal data, in accordance with the GDPR.

§ 2 PURPOSE, LEGAL BASIS AND PERIOD OF THE DATA PROCESSING

PURPOSE OF THE PROCESSING	LEGAL BASIS	PERIOD OF THE DATA PROCESSING	ADDITIONAL INFORMATION
The data processing within social networks (Facebook, Instagram, LinkedIn, YouTube)	Art. 6(f) of the GDPR, the Controller’s legitimate interest is to respond to enquiries made in a private message and/or to comment on posts, to receive information on fanpage activities and to carry out other marketing activities User activity related to the use of our social network will not be archived outside the service.	the personal data will be processed until an objection to the processing is raised An objection can be expressed by deleting messages or comments In the case of offensive, vulgar and infringing content, the Controller may remove comments and posts at any time Personal data collected by social networks, i.e. post history, activity history in the application, is subject to retention under the terms and conditions of the individual social network.	By means of the photos on your profile, the Controller may get to know your image
Responding to an enquiry made by email.	Art. 6(f) of the GDPR, the Controller’s legitimate interest is to respond to enquiries made by email and business communications	the personal data will be processed until an objection to the processing is raised	In electronic correspondence, the Controller shall process all data included in correspondence by the person directing the correspondence
Direct marketing	6(1)(f) of the GDPR, the Controller’s legitimate interest is to provide information about the Controller’s products and services Marketing by the Controller by means of a phone number or email address takes place on the basis of consent to carry out marketing with the communication channel in accordance with the Act on Providing Services by Electronic Means or the Act – Telecommunications Law.	the personal data will be processed until an objection to the processing is raised
Creation of records and statistics	Art. 6(1)(c) of the GDPR – as regards data contained in the documents confirming the application of the compliance and accountability principle (including, for example, the register of persons who have objected in accordance with the GDPR) Art. 6(1)(f) of the GDPR, the Controller’s legitimate interest is to know about persons who are exercising their rights under the GDPR and to improve the business, to determine the correct functioning of the website, to improve the quality of the website.	the personal data will be stored until you successfully raise an objection or the purpose of the processing has been achieved, but for no longer than 5 years
Customer satisfaction survey	Art. 6(1)(f) of the GDPR – the Controller’s legitimate interest is to obtain, in the form of a survey, information on the level of customer satisfaction with the products and services provided by COROTOP	the personal data will be stored until you successfully raise an objection or the purpose of the processing has been achieved, but for no longer than 5 years

§ 3 AUTOMATED DECISION-MAKING AND PROFILING

The Controller does not carry out automated decision-making, including decision-making based on profiling.

§ 4 RECIPIENTS OF THE PERSONAL DATA

In order to properly provide services via the website, user data may be transmitted to the following entities:
– entities providing IT and marketing services to the Controller,
– the domain hosting operator,
– entities providing consultancy, audit and legal assistance services to the Controller,
– Kingspan Group entities, i.e. entities directly related to the Controller

Entities to whom the personal data is shared process the data on the basis of a contract with us and only in accordance with our instructions or on the basis of the law.
Data may only be shared to the extent necessary to fulfil the purposes for which your data is processed

§ 5 SERVICES OF THIRD-PARTY SUPPLIERS

The Controller does not transfer your personal data outside the European Economic Area.

§ 6 RIGHTS OF DATA SUBJECTS

We kindly inform you that every user of the website has the right to:
– access to their personal data,
– rectification of the personal data,
– erasure of personal data (the right to be forgotten),
– restriction of the processing of personal data,
– object to the processing of personal data,
– data portability.

2. We respect the rights under the personal data protection laws and strive to facilitate the exercise of these rights to the greatest extent possible.

3. We point out that the listed rights are not absolute and that we may therefore legitimately deny users exercising them in certain situations. However, if we refuse to grant a request, it is only after careful consideration and only if the refusal is necessary.

4. As regards the right to object, we explain that you have the right to object at any time to the processing of your personal data on the basis of the legitimate interest of the Controller in relation to your particular situation. However, you must bear in mind that, according to the laws, we can refuse to take into account an objection if we demonstrate that:

- there are legitimate grounds for the processing which override your interests, rights and freedoms, or
- there are grounds for the establishment, assertion or defence of claims.

5. Furthermore, you may object to the processing of your personal data for marketing purposes at any time. In such an event, we will cease processing for this purpose upon receipt of the objection.

6. Any user can exercise their rights by filling in the form on the website and sending the completed form via email to the Company’s appointed Data Protection Officer at the email address: iod@corotop.com or by letter to the postal address: Corotop S.A. ul. Ozimska 2A, 46-053 Chrząstowice, with annotation “Data Protection Officer” You can download the form here.

§ 7 RIGHT TO LODGE A COMPLAINT

If you believe that your personal data is being processed in violation of the applicable law, you may lodge a complaint with the President of the Personal Data Protection Office.

§ 8 FINAL REMARKS

1. The website may contain links to other websites not owned or administered by the Controller. In this case, the Controller is not responsible for their content and access to them. Any links to other sites are provided for the convenience of the website only. The Controller recommends that, when going to other sites, the user reads the privacy policy established there.
2. Questions or concerns about the privacy and data security policy of the website can be addressed via email directly to the Company’s appointed DPO – email address: iod@corotop.com
3. The personal data protection laws shall apply to matters not settled in this Privacy Policy.
4. Users will be informed of any changes made to this Privacy Policy through a notice posted on the website.
5. This Policy has been adopted by Corotop S.A. and is effective from 18/04/2024.