Accessibility features
HomePrivacy Policy

Privacy Policy

Privacy Policy

Urtica Sp. z o.o.

Privacy Policy

In order to fulfil the obligations imposed on personal data controllers by Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter the “GDPR”), we inform you that:

Where your personal data are processed, their controller is Urtica Sp. z o.o. with its registered office in Wrocław (54-613), ul. Krzemieniecka 120, registered with the District Court for Wrocław-Fabryczna, 6th Commercial Division of the National Court Register, under KRS no. 0000113253, NIP (tax identification number) 894-255-67-99, with a share capital of PLN 21,000,000.00 (hereinafter the “Controller”). You may also contact the Controller by email at: biuro.zarzadu@urtica.pl.

Data processing

We will process your personal data (including by recording telephone conversations) for one or more of the following purposes:

  1. to comply with a legal obligation to which the Controller is subject – e.g. issuing invoices or bills, settling accounts and keeping accounting and tax records, delivering medicines, retaining documentation relating to medicines, retaining documentation relating to services provided by the Controller (in particular marketing services), including for reporting and accounting purposes, and processing in connection with recruitment and employment, in particular with regard to data such as first name, surname and contact details (legal basis for processing – Article 6(1)(c) GDPR);
  2. to perform a contract to which you are a party (as a natural person) or to take steps at your request prior to entering into a contract – in particular a contract for marketing, analytical or consulting services, or for services relating to debt collection and receivables monitoring (legal basis for processing – Article 6(1)(b) GDPR);
  3. to contact you in connection with the performance of a contract concluded by the Controller with your employer, principal or the legal person you represent – in that case, the legal basis for processing is the Controller’s legitimate interest in ensuring the proper performance of the contract with its counterparty (Article 6(1)(f) GDPR);
  4. to respond to your enquiries, including those submitted via the contact form – the legal basis for processing is the Controller’s legitimate interest in informing you, at your request, about the Controller’s activities (Article 6(1)(f) GDPR);
  5. for purposes related to pursuing and defending against claims, including the sale of receivables, ensuring the security of persons, areas and facilities of the Company, and marketing the Company’s products and services, or for purposes related to pursuing and defending against claims, monitoring receivables and marketing the products and services of entities commissioning such services from the Company (in that case, the legal basis for processing is the Controller’s legitimate interest – Article 6(1)(f) GDPR in conjunction with the last sentence of Recital 47 of the GDPR). If you have not provided us with your personal data directly, the data have been collected from generally available and public sources, i.e. websites and public registers. The scope of the processed data includes in particular identification data (first name and surname, name of the business entity, NIP, REGON, email address, telephone number, fax number, registered office address of the business entity, correspondence address);
  6. for purposes related to verifying your credibility, ability to pay and financial situation – consisting of the necessary risk assessment before the conclusion of a contract, after its conclusion and during its performance. If you have not provided us with your personal data directly, the data have been collected from generally available and public sources, i.e. websites and public registers. For this purpose, we may additionally obtain your data from business information registers, business intelligence agencies and other publicly available sources of information. The personal data referred to in the preceding sentence will concern the settlement of your liabilities and the business activity you conduct (legal basis: Article 6(1)(f) GDPR – pursuing the legitimate interest of the controller) and will be processed for the period necessary to carry out such an assessment. The scope of the processed data includes in particular identification data (first name and surname, name of the business entity, NIP, REGON, email address, telephone number, fax number, registered office address of the business entity, correspondence address);
  7. to add you to the Controller’s newsletter mailing list – the legal basis for processing is the Controller’s legitimate interest in providing you, at your request, with information about the Controller, its affiliated entities and entities commissioning such services, and consequently in promoting their activities (Article 6(1)(f) GDPR);
  8. to pursue the Controller’s legitimate interests other than those indicated in points 3–7 above, in particular informing you about its services in other ways and promoting them (legal basis for processing – Article 6(1)(f) GDPR in conjunction with the last sentence of Recital 47 of the GDPR);
  9. notwithstanding the above, if you have given the Controller your voluntary consent to the processing of your data for one of the purposes listed in point 2, 3, 4, 5, 6 or 7 above, or to the processing of data other than those required by law in the course of recruitment, the legal basis for processing is Article 6(1)(a) GDPR.

Provision of data

We also inform you that where your data are collected for the purpose of:

  1. complying with a statutory obligation (e.g. an accounting obligation) – providing the data is a statutory requirement;
  2. performing a contract (e.g. on cooperation in the distribution or supply of products, or on analytical, consulting and marketing services) – providing the data is voluntary but necessary to perform the contract, e.g. to issue invoices and settle payments;
  3. performing a contract with your employer, principal or the legal person you represent – providing the data is voluntary but necessary to ensure proper contact between the Controller and its counterparty, so that the contract concluded with it is performed properly;
  4. responding to your enquiries – providing the data is voluntary but necessary for us to respond to you.

Recipients of data

The recipients of your personal data may include:

  1. the Controller and its representatives, employees, associates and advisers, as well as entities belonging to the Pelion capital group;
  2. entities commissioning services from the Controller, including analytical, consulting and marketing services, as well as services relating to debt collection and receivables monitoring;
  3. entities providing services to the Controller (including accounting and IT services);
  4. entities supporting the Controller with promotional, marketing and analytical services.

Your personal data are entrusted to other entities in accordance with the law and with due diligence, using appropriate technical and organisational measures.

Storage period

Your personal data will be stored until:

  1. the legal obligation has been fulfilled – where the legal basis for processing your data is Article 6(1)(c) GDPR;
  2. all claims of the parties arising from the concluded and performed contract have become time-barred – where the legal basis for processing your data is Article 6(1)(b) GDPR;
  3. you withdraw your consent – where the legal basis for processing is Article 6(1)(a) GDPR;
  4. you object – where the legal basis for processing is the Controller’s legitimate interest (Article 6(1)(f) GDPR).

Data Protection Officer

The Data Protection Officer appointed by the Controller is attorney-at-law Maciej Skory; contact details: attorney-at-law Maciej Skory, email: iod.urtica@iurico.pl, tel.: +48 71 344 56 59 or +48 516 486 502.

Your rights

We also inform you that you have the right to request from the Controller access to your personal data, their rectification, erasure or restriction of processing, as well as the right to data portability. In addition:

  1. where the legal basis for processing is your consent – you have the right to withdraw it at any time, without affecting the lawfulness of processing carried out before its withdrawal;
  2. where the legal basis for processing is the Controller’s legitimate interest – you have the right to object to the processing of your data.

You have the right to lodge a complaint with the supervisory authority, which in the Republic of Poland is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, Warsaw.

Data transfers and profiling

Furthermore, with the assistance of entities supporting its activities in the area of promotional, marketing and analytical services, the Controller may transfer selected personal data to third countries, i.e. countries outside the European Economic Area – however, only to third countries or entities in respect of which the European Commission has decided that they ensure an adequate level of data protection.

The Controller does not intend to carry out profiling or automated processing of your personal data, including your first name and surname, email address, telephone number or other contact details.

The Controller may, however, use cookies stored on your devices for analytical and statistical purposes – in accordance with the information provided in the Cookie Policy.

Data provided by your employer

The Company further informs you that where it has obtained your personal data from your employer (or an entity with which you cooperate under a civil-law contract) – for the purpose of contacting you in connection with the performance of a contract with that entity or cooperation prior to its conclusion – it processes your data in the following scope: first name and surname, workplace, position, telephone number and email address. In this case, the source of the data is your employer (or the entity with which you cooperate under a civil-law contract).