ONSEN® operates transparently!
1. Definitions
1.1. The transparency policy sets out the rules for collecting, processing, and using personal data by Onsen Sp. z o.o. based in Toruń at ul. Marii Skłodowskiej-Curie 71G, registered in the National Court Register under number 0000588698, with REGON number 363084435 and NIP number 9562314576, hereinafter referred to as the Administrator.
1.2 Personal data means information about an identified or identifiable natural person by one or more specific factors determining physical, physiological, genetic, mental, economic, cultural, or social identity, including device IP, location data, internet identifier, and information collected through cookies or similar technologies.
1.3 Data subject means any natural person who visits the Service, uses one or more services or functionalities described in the Transparency Policy, as well as any person whose personal data is processed by the Administrator.
2. Data Processing
2.1 Data processing by the Administrator is carried out in accordance with applicable law and data processing principles. The Administrator ensures transparency in the personal data processing process by informing about the purpose and legal basis for processing at the time of collection, for example, when entering into a contract for the sale of goods or services. Data is collected only to the extent necessary and processed for a specified period.
2.2 To ensure the security and confidentiality of personal data, the Administrator employs appropriate security measures. In the event of a breach of personal data protection, the Administrator informs the relevant entities in accordance with applicable regulations. Contact with the Administrator is possible via electronic communication means, by post, or in person.
2.3 To ensure the integrity and confidentiality of data, the Administrator implements procedures allowing access to data only to authorized persons. It also applies technical and organizational solutions and supervises the activities of subcontractors to ensure an adequate level of data security. It regularly conducts a risk analysis related to data processing and takes action to increase data security when necessary.
3. Contact with the Administrator
3.1 Contact with the Administrator is possible at the email address biuro@onsen.eu, using the contact form on the Website, or by post or correspondence to the Administrator's registered office, i.e., in Toruń at ul. Marii Skłodowskiej-Curie 71G.
4. Personal Data Security 4. Personal Data Security
4.1 The Administrator takes a number of actions to ensure the security of personal data. Procedures have been implemented to allow access to data only to authorized persons, and organizational and technical solutions are used to record and perform operations on personal data only by authorized persons. Additionally, it ensures that all subcontractors and other cooperating entities processing personal data on its behalf apply appropriate security measures.
4.2 The Administrator systematically analyzes the risks associated with the processing of personal data and monitors the adequacy of the security measures to the identified threats. If necessary, additional measures are taken to increase data security.
4.3 The purposes and legal bases for the processing of personal data comply with applicable law. The Administrator processes data in accordance with established purposes and legal bases for processing, ensuring transparency of the process and informing about data processing at the time of collection.
5. Correspondence
5.1 If you contact the Administrator via email, social media, or traditional correspondence regarding matters not directly related to services provided to you, as well as unrelated to any contract or relationship, your personal data contained in that correspondence will be processed solely for the purpose of communication and resolving the matter discussed in the correspondence. The legal basis for processing personal data in such cases is the legitimate interest of the Administrator, which consists of the necessity to resolve the reported issue.
5.2 The Administrator processes only the relevant personal data contained in the correspondence for the respective matter. All correspondence is stored in a manner ensuring the security of personal data and other information contained therein, and it is disclosed only to authorized persons for this purpose.
6. Telephone Contact
6.1 When contacting the Administrator by telephone regarding matters unrelated to a concluded contract or services provided, the Administrator may request personal data only when necessary to handle the reported matter related to its business activity. The legal basis for processing personal data in such cases is the legitimate interest of the Administrator, which consists of the necessity to resolve the reported issue.
6.2 Telephone conversations may be recorded, with information about the recording being provided to the individual at the beginning of the call. Recordings are used to monitor service quality, verify the work of consultants, and for statistical purposes. Access to recordings is limited to Administrator's employees and individuals managing the helpline.
6.3 Personal data contained in call recordings are processed for customer and visitor service purposes through the helpline if such service is provided. The legal basis for processing in this case is the necessity of processing to provide the service. Additionally, data are processed for monitoring service quality, verifying the work of consultants, and for analytical and statistical purposes. The legal basis for processing in these cases is the legitimate interest of the Administrator in ensuring high-quality customer and visitor service, maintaining high-quality work of consultants, and conducting statistical analyses related to telephone communication.
7. Video Monitoring
7.1 To ensure the safety of individuals and property and maintain order on premises managed by the Administrator, video monitoring and access control to the Company's premises are used. Personal data collected in this way are processed solely for security purposes and defense against claims or assertion of claims by the Administrator. Processing of personal data in the form of monitoring recordings and entry and exit register data is based on the legitimate interest of the Administrator, which consists of ensuring the safety of individuals and property on premises managed by the Administrator and protecting its rights. The monitored area is appropriately marked with graphic signs informing about the presence of monitoring, ensuring that individuals using the area are aware of the surveillance.
8. Social Media Platforms
8.1 The Administrator processes personal data left by individuals visiting its public profiles on social media platforms such as LinkedIn, TikTok, Facebook, Instagram, LinkedIn, Pinterest, or YouTube. These data may include comments, likes, and internet identifiers. The legal basis for processing personal data is the legitimate interest of the Administrator, which includes promoting the Administrator's brand and improving the quality of services provided, as well as conducting analyses and user preferences. It should be noted that the above information does not concern the processing of personal data by administrators of social media platforms, who are responsible for processing data on their own social media platforms. The processing of personal data of individuals visiting the Administrator's profiles on social media platforms for the purposes listed below:
8.1.1 Determining their activity on the profiles.
8.1.2 Efficiently managing profiles by providing information about the Administrator's initiatives, activities, and promoting events, services, and products.
8.1.3. Using data for statistical and analytical purposes.
8.1.4 Using data for asserting claims or defending against claims.
9. Contests
9.1 The Administrator processes personal data of contest participants necessary to participate in the contest and to award prizes. This data may include first name, last name, profile name on the social media platform, and other data required as part of the contest task.
9.2 The processing of personal data aims to conduct the contest, select winners, award prizes, and fulfill tax obligations related to prize awards. The legal basis for processing personal data is the legitimate interest of the Administrator, which involves conducting the contest, selecting winners, as well as asserting claims or defending against claims. Additionally, it is necessary to fulfill the legal obligation incumbent on the Administrator arising from tax law provisions regarding prize awards. It is worth noting that this processing of data relates solely to purposes related to specific contests and will not be used for other purposes without the consent of contest participants.
10. Recruitment
10.1 As part of the recruitment process, the Administrator expects candidates to provide personal data only to the extent required by the provisions of the Labor Code and other applicable regulations concerning recruitment. Additional information should not be provided. If submitted applications contain additional data that exceeds the scope defined by labor law provisions, the processing of such data will be based on the candidate's consent.
10.2 If the preferred form of employment is an employment contract, the data is processed to fulfill obligations arising from labor law provisions. The legal basis for processing is the necessity to fulfill a legal obligation incumbent on the Administrator.
10.3 If the preferred form of employment is a civil law contract, the data is processed to conduct the recruitment process. The legal basis for processing data is the necessity to take action before entering into a contract at the request of the data subject.
10.4 Data may also be processed to conduct the recruitment process regarding data not required by law or by the Administrator, as well as for future recruitment processes. The legal basis for processing is the candidate's consent.
10.5 Verification of the candidate's qualifications and skills, as well as determining the conditions of cooperation, is also the purpose of processing data. The legal basis is the legitimate interest of the Administrator.
10.6 Data may also be processed to establish or assert claims or defend against claims. The legal basis for processing data is the legitimate interest of the Administrator.
10.7 Consent can be withdrawn at any time without affecting the lawfulness of processing based on consent before its withdrawal. In the case of consent for future recruitment processes, personal data is deleted after two years, unless consent is withdrawn earlier.
10.8 Providing data required by the Labor Code is necessary for considering a candidacy in the recruitment process. Failure to provide this data makes it impossible to consider a particular candidacy. Providing other data is voluntary.
11. Services and Other Contracts
11.1 When collecting data to execute a specific contract, the Administrator is obligated to provide the Data Subject with detailed information regarding the processing of their personal data. This information is provided at the time of contract conclusion or in the event of personal data acquisition before contract conclusion, when processing is necessary to take action at the Data Subject's request.
11.2 Detailed information regarding the processing of personal data includes, among other things:
- The purpose of processing personal data in the context of the concluded contract;
- The legal basis for processing personal data, including consent or the necessity of processing for contract performance;
- The duration of personal data processing and the criteria for determining this period;
- The rights of the Data Subject regarding the processing of their personal data, such as the right to access, rectify, erase data, the right to object, and other rights pursuant to applicable law;
- Information on any potential disclosure of personal data to other recipients, if required as part of contract execution.
11.3 Providing this information is important to ensure transparency and protection of Data Subjects' personal data in the context of concluded contracts and the performance of actions at their request.
12. Personnel of Contractors or Customers
12.1 In connection with concluding and executing commercial contracts as part of business activity, the Administrator collects from contractors or customers data of individuals involved in contract execution. This data may include persons authorized for contact, placing orders, executing tasks, and other necessary data. The scope of transferred data is limited to the necessary extent for contract performance and usually includes the name, surname, and business contact details. Processing such personal data aims to fulfill the legitimate interests of the Administrator and its contractor.
12.2 Such data may be disclosed to third parties involved in contract execution and entities accessing data in accordance with regulations on public information transparency, as well as proceedings based on public procurement law, to the extent provided for by these regulations.
12.3 The data is processed for the period necessary to fulfill the specified interests and obligations arising from regulations, and then it is deleted or anonymized. Long-term data retention is minimized to what is necessary for potential claim assertion or defense.
13. Sanctions Lists
13.1 The Administrator is obligated to verify whether it indirectly or directly collaborates with entities listed on sanctions lists maintained by the Minister of the Interior and Administration of the Republic of Poland and in accordance with relevant regulations of the European Union. To fulfill this obligation, the Administrator processes personal data of representatives of the contractor, such as board members, proxies, or ultimate beneficial owners. This serves to fulfill a legal obligation incumbent on the Administrator.
13.2 The data is processed for the duration of the Administrator's legal obligation, taking into account the duration of cooperation with the contractor subject to verification. The Administrator informs that providing information to representatives of the contractor is exempt from Art. 14(5)(b) of the General Data Protection Regulation, therefore based on consent. At the same time, ensuring the protection of rights and freedoms and the legitimate interests of data subjects, the Administrator publicly provides the above information.
14. Other Cases
14.1 The Administrator also collects personal data in other cases, such as building and utilizing lasting business contacts during business meetings or industry events. Processing data in these situations is based on the legitimate interest of the Administrator, which involves creating a network of contacts related to conducted business activities. Personal data collected in such cases is processed solely for the purpose for which it was collected, and the Administrator ensures its appropriate protection.
14.2 In the course of business activities, the Administrator may disclose personal data to external entities, such as IT service providers, accounting firms, marketing or recruitment agencies. The Administrator also reserves the right to disclose selected information regarding the data subject to relevant authorities or third parties who may request such information, based on appropriate legal grounds and in accordance with applicable law.
14.3 In the event of transferring personal data outside the European Economic Area (EEA), the Administrator ensures an adequate level of data protection through the use of appropriate mechanisms, such as European Commission decisions, standard contractual clauses, or binding corporate rules.
14.4 The data processing period depends on the type of service provided and the purpose of processing. It may also be determined by legal regulations or the legitimate interests of the Administrator. Rights related to the processing of personal data, including the right to access, rectify, erase data, and object to processing, are respected in accordance with applicable law.
15. Data Subjects' Rights
15.1 Data subjects have the following rights related to the processing of their personal data:
- The right to information about the processing of personal data;
- The right to obtain a copy of data;
- The right to rectification;
- The right to erasure of data;
- The right to restriction of processing;
- The right to data portability;
- The right to object to processing for marketing purposes;
- The right to object to other purposes of data processing;
- The right to withdraw consent;
- The right to lodge a complaint.
15.2 If you wish to exercise your rights related to the processing of personal data by the Administrator, you may submit the appropriate request in any form.
15.3 The Administrator may request additional information to identify the person making the request. Providing additional data is not obligatory but may facilitate faster processing of the request.
15.4 If the request is made by a representative, the Administrator recommends that the authorization be certified by a notary or authorized legal advisor or lawyer, which will expedite the process of verifying the authenticity of the request.
15.5 The Administrator undertakes to respond to the request within one month of its receipt. If an extension of this period is necessary, the Administrator will inform the applicant of the reasons for the delay.
15.6 The response to the request will be provided in the same form in which it was submitted, unless the applicant requests a different form. Information regarding the submitted request and the person who submitted it will be stored in a manner ensuring the integrity and confidentiality of the data.
16. Policy Amendments
16.1 The policy is regularly reviewed and updated as needed. The latest version of the Policy was approved and applied on February 29, 2024.
