1. INTRODUCTION
This Privacy Policy for Customer, Supplier, Business Partner, and Website User Data (further: the “Policy” or the “Privacy Policy”) regulates processing of all personal data of which HMR One, registered under the business name of “Hubert Ryszkowski HMR”, with its registered office in Warsaw, ul. Ordona 5B/81, 01-237 Warsaw, entered in the business register under the statistical number REGON 522002667 and tax identification number NIP 5273001981.

Processing of personal data is required for the Company to achieve its objectives. When processing such data, the Company undertakes to comply with the relevant provisions, in particular those of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/EC (General Data Protection Regulation), further the “GDPR”. To the extent that the data processed is the personal data of a (potential) customer, (potential) supplier and (potential) business partner, these persons will be referred to as the “Partners” in the Policy. To the extent that the data processed is the personal data of the Partner’s employees, co-workers, representatives and other persons involved in the performance of the contract concluded by the Company with the Partner, these persons will be referred to as the “Partner’s Employees”. To the extent that the data processed is the personal data of the website https://www.hmrone.com (further: the “Website”) users, these persons will be called the “Users”.

The Privacy Policy contains information about the personal data collected by the Company and describes how the Company uses this data and to whom it is entrusted or disclosed.

The Policy took effect on 10 January 2023 and was last updated on 26 January 2023. This Policy is subject to modifications and its latest version is published on our website. You will be immediately notified of any material modifications.

2. PROCESSING OF PERSONAL DATA OF PARTNERS AND PARTNERS’ EMPLOYEES
Your personal data can be processed for the following purposes:

I. To conclude and perform a contract (article 6(1)(b) of the GDPR)

a) to verify the Partner in order to conclude a contract – in order to conclude a contract, the Company may verify the Partner, e.g. in registers open to public inspection;

b) to manage relationships – personal data may be processed in performance of a contract in order to provide, receive or handle products or services. The Company will process your personal data to further perform a contract, including the provision of services to the customer;

II. For contact purposes (article 6(1)(f) of the GDPR)

a) to ensure the possibility of direct communication with the Partner’s employees/representatives – various possible methods of contact can be used (e.g. by e-mail, phone or via the website). In such case, your personal data will be used to respond to your question or request. You can also be contacted in connection with important contractual issues. The processing is based on our legitimate interest;

III. For marketing purposes (article 6(1)(a) of the GDPR or article 6(1)(f) of the GDPR).

a) to send marketing materials – with your consent or where we have a legitimate interest, we can send you marketing information to keep you informed about events, special offers, opportunities and the Company’s current and future products and services. When we contact you about marketing communications, we will contact you by e-mail or through newsletters, brochures or magazines (mailings). If you no longer wish to receive surveys or marketing information from us, please contact us as specified in clause 12 below.

IV. To pursue the Company’s business purposes (article 6(1)(f) of the GDPR)

a) to ensure the management reporting – to the extent necessary to pursue the Company’s legitimate interests, we will process personal data for various business purposes, such as data analysis, auditing, developing new products, improving, enhancing or modifying our services, identifying usage trends, determining the effectiveness of our promotional campaigns as well as conducting and expanding our business;

b) to protect the Company’s assets and interests – to the extent necessary to pursue our legitimate interests, we will process your personal data as appropriate or necessary (a) to enforce our obligations; (b) to protect our interests; (c) to protect our rights, privacy, security or property or the rights, privacy, security or property of you or others; (d) to enable us to enforce the legal remedies available to us or limit the damage we may incur; and (e) to determine, pursue or defend against any claims that may arise;

c) to ensure access to the Company’s registered office – to the extent necessary to pursue the Company’s legitimate interests, we will process personal data for verification purposes and to ensure the safety of persons and property.

V. To comply with legal obligations (article 6(1)(c) of the GDPR)

a) If the processing is necessary to fulfill a legal obligation incumbent on the Company, we will process personal data in order to meet such legal obligations arising, in particular, from tax and accounting law, as well as from anti-money laundering and terrorist financing regulations.

3. PROCESSING OF USERS’ PERSONAL DATA; COOKIE POLICY
Personal data of the Users may be processed to the extent necessary for the purposes of our legitimate interests, in particular, to ensure the possibility of the operation and proper functioning of the Website, collect general statistical information, examine the functional aspects of the Website and ensure the possibility of its operation and proper functioning under article 6(1)(f) of the GDPR. The Website uses cookies (i.e. small text files sent to the user’s device that identify it to the extent necessary to simplify or cancel a given operation) in order to collect information related to the use of the Website by the User.

Cookies help, in particular, to maintain the User’s session, adjust the operation of the Website to the User’s preferences, adjust the Website to the User’s needs and create the Website viewing statistics. The following types of cookies are used on the Website:

a) necessary cookies that help to improve services and the user experience on the Website and are used in
particular to configure the Website;

b) analytical cookies that collect information on how Users use the Website. This type of cookie does not collect personally identifiable information but may collect the IP address of the User’s device. The information collected through cookies is used to improve the Website, adjust the Website operations to the User preferences and create the Website usage statistics.

The following types of cookies can be distinguished in terms of how long they are stored in the browser:

a) session cookies that are stored in the User’s device and remain there until the end of a given browser session.
The stored information is then permanently deleted from the device memory. The mechanism of session cookies does not allow to download any personal data or any confidential information from the User’s device;

b) persistent cookies that are stored in the User’s device for the time specified in the parameters of cookie files or until deleted by the User. Ending the session of a given browser or switching off the device does not cause the cookies to be removed from the User’s device. The mechanism of persistent cookies does not allow to download any personal data or any confidential information from the User’s device.

The following types of cookie files can be distinguished according to their origin:

a) first-party cookies that are placed by the Website’s web servers. The Website only uses the first-party cookies;

b) third-party cookies that are placed by web servers of websites other than the Website.

Third party cookies are not controlled by the Company, which receives only limited information from their main provider. Therefore, when agreeing to them, please refer to the cookie policy of the respective supplier for further information.

If you use the Website without the cookie settings that block the automatic handling of cookies being changed, this means that you accept the use of cookies on the terms described in this Policy as the default settings of your browser are treated as your informed consent to the cookies being installed.

If the Website does not include a dedicated tool for managing cookies in order to express or withdraw consent, the User may at any time change the cookie settings, specifically, to the extent that the automatic handling of cookies be blocked in the settings of the Internet browser or that information be provided whenever a cookie is placed in the User’s device;
blocking of cookies can, however, impair the functioning of the Website. Detailed information about whether and how the cookie settings can be changed in the most popular Internet browsers can be obtained at the addresses:

a) Google Chrome https://support.google.com/chrome/answer/95647?hl=pl;

b) Firefox https://support.mozilla.org/pl/kb/ciasteczka?esab=a&s=ciasteczka&r=0&as=s;

c) Internet Explorer https://support.microsoft.com/pl-pl/help/17442/windows-internet-explorer-delete-manage-cookies;

d) Opera http://help.opera.com/Windows/12.10/pl/cookies.html;

e) Safari https://support.apple.com/pl-pl/guide/safari/sfri11471/mac.

Please be informed that when the User connects to the Website, information about the number (including the IP), type of the user’s end device from which the User connects to the Website, how long the User has been connected to the Website and other information about the User’s activity on the Website appears in the Website system logs.

4. HOW LONG DOES THE COMPANY STORE PERSONAL DATA?
Personal data of the Partners and the Partners’ Employees:

a) personal data of the Partners and the Partners’ Employees will be processed during the term of the contract concluded by the Company with the Partner, and subsequently, for the period of limitation of possible claims set under the generally applicable law;

b) if the processing is necessary to meet the Company’s legal obligation, the personal data of the Partners and the Partners’ Employees will be processed for the period of time stipulated under the generally applicable law, specifically, the tax law and accounting regulations;

c) if the processing is necessary for the purposes of the legitimate interests pursued by the Company or a third party, the personal data of the Partners and the Partners’ Employees will be processed for a period no longer than it is necessary for the purposes for which the data is processed or until an objection to the processing of personal data is made;

d) if personal data is processed on the basis of the consent, the personal data will be processed until the consent to the processing of personal data has been withdrawn.

The Users’ personal data is stored until the cookie expires on your computer.

5. RIGHTS OF DATA SUBJECTS
All persons whose data is processed by the Company are vested with the rights set out in the GDPR.

Consequently, you have the following rights:

a) the right to access data and obtain a copy;

b) the right to rectification;

c) the right to erasure;

d) the right to restriction of processing;

e) the right to object – with regard to processing of personal data for the purposes of the Company’s legitimate interests and for direct marketing purposes;

f) the right to data portability – with regard to processing of personal data on the basis of the consent or contract and in an automated manner;

g) the right to lodge a complaint with the supervisory authority.

6. RIGHT TO WITHDRAW CONSENT
In certain cases, we may ask for your consent to process your data (e.g. for marketing purposes). If you have given us your consent to the processing of your personal data, you have the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of the data processing that had been carried out based on your consent before it was withdrawn. You can withdraw your consent by contacting us at [email protected].

7. IS IT MANDATORY TO PROVIDE PERSONAL DATA?
In the case of the Partners and the Partners’ Employees, the personal data is provided to us voluntarily, but it is also a condition for the contract to be performed. When we collect your data on the basis of your consent, providing personal data is voluntary.

8. AUTOMATED DECISION MAKING
The personal data you provide will not be used to make automated decisions about you.

9. TRANSFER OF PERSONAL DATA TO THIRD COUNTRIES
If it is necessary in a given situation, personal data may be transferred outside the European Economic Area in one of the situations:

a) in relations to personal data of the Partners and the Partners’ Employees:

• personal data may be transferred to one of the third countries for which the European Commission has issued a decision confirming an adequate level of protection of personal data in that country pursuant to art. 45(3) GDPR, if it is necessary to achieve the purposes of data processing. The basis for the transfer of personal data is art. 45(1) GDPR. Personal data may be transferred in this way to Argentina, Canada, Japan, New Zealand, Switzerland or the United States of America;

• personal data may also be transferred to a third country for which the European Commission has not issued a decision confirming an adequate level of personal data protection pursuant to art. 45(3) GDPR, if it is necessary to perform the contract. The basis for the transfer of personal data is art. 49(1)(d) GDPR.

b) in relation to personal data of the Users:

• personal data may be transferred to one of the third countries for which the European Commission has issued a decision confirming an adequate level of protection of personal data in that country pursuant to art. 45(3) GDPR, if it is necessary to achieve the purposes of data processing. The basis for the transfer of personal data is art. 45(1) GDPR. Personal data may be transferred in this way to Argentina, Canada, Japan, New Zealand, Switzerland or the United States of America;

• personal data may also be transferred to a third country for which the European Commission has not issued a decision confirming an adequate level of personal data protection pursuant to art. 45(3) GDPR, if the User agrees to it explicitly, after informing him about a possible risk, which – due to the lack of a decision confirming the appropriate level of protection and the lack of appropriate safeguards – may be associated with the proposed transfer. The basis for the transfer of personal data is art. 49(1)(a) GDPR.

Whenever personal data is transferred to a third country, it is ensured that data subjects are informed of the intended transfer.

10. HOW IS YOUR PERSONAL DATA SECURED?
In our opinion, and based on our risk assessment, we have taken appropriate steps to ensure the security of your personal data. We have considered the risk of the data being accidentally or unlawfully destroyed or accidentally lost, damaged, altered, being made available or accessed without authorisation or otherwise unlawfully processed (including, but not limited to, unnecessary collection of data) or further processed.

11. HOW TO CONTACT US
We have appointed the Data Protection Officer whom you can contact in case of questions about the protection of your personal data:

a) via e-mail at: [email protected];

b) in writing, at the Company’s registered office address: Hubert Ryszkowski HMR, ul. Ordona 5B/81, 01-237 Warsaw.

12. SOURCE OF PERSONAL DATA
Personal data of the Partners’ Employees was obtained by the Company after the personal data has been provided as a result of (a) the Partner’s Employee having been indicated as a person authorised to represent the Partner or a contact person in the contract concluded between the Company and the Partner; (b) the personal data of the Partner’s Employee having been otherwise forwarded during the term of the contract concluded between the Company and the Partner.