Privacy Policy – GDPR
Privacy policy of Beryl Med Limited
I. Data of the Personal Data Controller
Please be informed that the Controller of your personal data is Beryl Med Limited, with registered office at 2nd Floor 19 Margaret Street, London W1W 8RR, hereinafter referred to as the “Company”. The contact with the Company regarding the protection of personal data is available at the following e-mail address: dp@beryl-med.com.
II. Goals and basics of personal data processing
In order to provide services to you and to be able to contact you in order to answer your questions or send you information which you may request in accordance with the scope of our business operations, the Company processes your personal data for a variety of purposes, always in accordance with the law. Below you will find specific purposes for the processing of personal data, including the legal basis.
- In order to to revert to you, if you ask us a question via the contact form posted on our website or call us on the phone numbers provided on the website, we process personal data such as:
- Your name and surname,
- Your e-mail address,
- The name of the company on behalf of which you have contacted us,
- Your telephone number.
- The legal basis for such data processing is art. 6.1.a of the GDPR which allows us to process your personal data if you have given your consent to it.
- In order to send you a commercial offer in response to your inquiry or telephone call,we process such personal data as:
- Your name and surname,
- Your e-mail address,
- The name of the company on behalf of which you have contacted us,
- Your telephone number.
- The legal basis for such data processing is art. 6.1.a of the GDPR which allows us to process your personal data if you have given your consent to it.
- In order to provide a quotation for a service and the performance of the service, we process such personal data as:
- Your name and surname,
- Your e-mail address,
- The name of the company on behalf of which you have contacted us,
- Your telephone number.
- The legal basis for such data processing is art. 6.1.b of the GDPR which allows us to process your personal data if it is necessary to perform the contract or take steps to conclude the contract; if you decide to give us also your surname, we consider that you have given your consent to the processing of your surname as well and then the legal basis for such processing is art. 6.1.a of the GDPR which allows us to process personal data on the basis of a voluntary consent;
- In order to issue an invoice and fulfill other obligations resulting from the tax law, such as storing the accounting records for 6 years, we process personal data such as:
- Your name and surname,
- The company name,
- The address of residence or of the registered office
- Tax Id No (NIP),
- The number of your order.
- The legal basis for such data processing is art. 6.1.c of the GDPR , which allows us to process your personal data if it is necessary for the Controller of Personal Data to fulfill its legal obligations;
- In order to accept your recruitment documentation (such as your CV), we process personal data such as:
- Your name and surname,
- Names an surnames of your parents,
- Your date of birth,
- Your address,
- Your address for correspondence,
- Your education and the history of your previous employment.
- The legal basis for such data processing is art. 22¹ of the Labor Code of April 13, 2018 (Journal of Law of 2018, item 917, as amended), which allows us to process exactly such scope of personal data (hereinafter referred to as the “Labor Code”).
- In order to store unpaid queries, we process personal data such as:
- Your name and surname,
- Your e-mail address,
- The number of your order.
- – because you may decide to use our services after some time from receiving our quotation. The legal basis for such data processing is art. 6.1.f of the GDPR , which allows us to process personal data for the purposes of the legitimate interests pursued by the Personal Data Controller (in this case, the interest of the Company is to conclude a contract within a certain period of time without the need to repeat the valuation);
- In order to accept the recruitment documentation in which you send us data that goes beyond the scope of the list mentioned in point 5 above, , we process personal data which you choose to send to us, for example:
- Your image (if you send it yourself),
- Any other personal data going beyond the list mentioned in art. 221 of the Labor Code.
- The legal basis for such data processing is art. 6.1.a of the GDPR which allows us to process your personal data if you have given your prior, voluntary consent to it.
- In order to establish claims, assert them or defend ourselves against them we process personal data such as:
- Your name and surname (if provided) or possibly the name of the company,
- Your address of residence (if provided),
- Personal Id (PESEL) number or tax identification number (NIP) (if provided),
- E-mail address
- The IP address,
- The number of the order.
- The legal basis for such data processing is art. 6.1.f of the GDPR which allows us to process personal data for the purposes of the legitimate interests pursued by the Personal Data Controller (in this case, the interest of the Company is to possess personal data that can identify claims, assert them or defend against them, including those of/by customers and third parties);
- For archival and evidential purposes, we process personal data such as:
- Your name and surname (if provided),
- E-mail address,
- The number of the order.
- – so that we could store information which may serve to prove facts of legal significance. The legal basis for such data processing is art. 6.1.f of the GDPR which allows us to process personal data for the purposes of the legitimate interests pursued by the Personal Data Controller (in this case, the interest of the Company is to possess personal data which may prove certain facts related to the provision of services, e.g. when a state authority requests it);
- For analytical purposes such as the research and analysis of the activity on the website belonging to the Company, we process personal data such as::
- The date and time of visiting the website,
- The type of your operating system,
- Your approximate location,
- The type of web browser used to browse the site,
- The time spent on the site,
- The subpages you visited,
- The subpage where the contact form has been completed.
- The legal basis for such data processing is art.6.1.f of the GDPR which allows us to process personal data for the purposes of the legitimate interests pursued by the Personal Data Controller (in this case, the interest of the Company is to know the clients’ activity on the website);
- In order to use cookies on the website, we process appropriate text information (cookies are discussed in a separate section below). The legal basis for such processing is art. 6.1.a of the GDPR which allows us to process your personal data if you have given your voluntary consent to it. (the first time you enter the website, you will be asked for your permission to use cookies);
- In order to administer our website, we process personal data such as:
- Your IP address,
- The date and time of the server,
- The information about the web browser,
- The information about the operating system
- – these data are automatically saved in the so-called server logs each time a website belonging to the Company is used. It would not be possible to administer the website without using the server and without this automatic saving function. The legal basis for such data processing is art. 6.1.f of the GDPR which allows us to process personal data for the purposes of the legitimate interests pursued by the Personal Data Controller (in this case, the interest of the Company is to administer the website);
III. Cookies
- The website of this company, similarly to other business units, uses the so-called cookies, i.e. short text information saved on a computer, phone, tablet or any other user device. They can be read by our system, as well as by systems belonging to other business units whose services we use (such as Facebook, Google etc.).
- Cookies perform a lot of functions on the website; most of them are useful and we will try to describe them below (if the information is insufficient, please contact us):
- ensuring security – cookies are used to authenticate users and prevent unauthorized use of the client’s panel. They are therefore used to protect the user’s personal data against unauthorized access;
- impact on the processes and efficiency of using the website – cookies are used to ensure that the website works efficiently and that you can use the features available on it, which is done, among other things, by remembering the settings of your subsequent visits on the website. In the result, you can efficiently navigate the website and individual subpages;
- state of the session – cookies often record information about how visitors use the website, for example which subpages are displayed most often. They also allow to identify errors displayed on some subpages. Cookies used to record the so-called “session state” help to improve the quality of the services and increase the comfort of browsing;
- maintaining session status – if a client logs in to his panel, the cookies sustain the session. This means that after switching to another subpage, you do not have to re-enter your login and password; this contributes to the comfort of using the website;
- creating statistics – cookies are used to analyze how the visitors use the website (how many of them enter the website, how long they stay there, which content arouses the most interest, etc.). In the result, we can constantly improve the website and adapt its operation to the preferences of the users. In order to track the activity and create statistics, we use Google tools such as Google Analytics; in addition to reporting the website usage statistics, the pixel Google Analytics can also contribute, along with some of the cookies described above, to displaying more relevant content to the user in Google services (such as the Google search engine) and across the entire web;
- using social functions – our website has a so-called Facebook pixel, which allows you to like our fanpage on FB while using our website. However, to make this possible, we need to use cookies provided by Facebook.
- Please note that many cookies are anonymized for us: we are unable to identify you only with such cookies, without any additional information.
- Your Internet browser allows for the use of cookies in your device by default and therefore at your first visit we ask for your permission to use cookies. However, if you do not wish to use cookies while browsing the website, you can change the settings in the web browser – you can fully block the automatic support for cookies or request notification each time when any cookies are placed on the device. The settings can be changed at any time.
- While respecting the independence of all persons using our website, we have to inform you that disabling or limiting the use of cookies may cause quite serious difficulties in using the website, such as the need to log in to each subpage, slower loading of the website, restrictions on the use of its functionalities, limitations in liking the fanpage on Facebook, etc.
IV. The right to withdraw consent
- If the processing of personal data is subject to your consent, you can withdraw it at any time – at your sole discretion.
- If you would like to withdraw your consent to the processing of personal data, you can easily do it by:
- sending an email directly to the Company at the address dp@beryl-med.com or
- completing the contact form on the deletion or change of personal data. The form is on the contact or GDPR subpages.
- If the processing of your personal data was based on your consent, its withdrawal does not mean that the processing of personal data up to that point was illegal. In other words, we have the right to process your personal data until the withdrawal of your consent, and the withdrawal of such consent does not affect the legality of the current processing.
V. The requirement to provide personal data
- Providing any personal data is voluntary and depends on your decision. However, in some cases, providing certain personal data is necessary to meet your expectations regarding the use of the contact form and the recruitment form on our website.
- To answer your questions asked via the contact form or by phone, we need you to provide your email address and / or telephone number or else we will not be able to send you information or an answer your questions.
- In order to send you an invoice for our services, we need you to provide all data required by the tax law such as your name or the company name, address or registered address of the company, and the tax identification number. Without this, we will not be able to properly issue invoices.
- In order send you our quotation we need you to provide your e-mail address or telephone number – without this we will not be able to send you a quotation which you requested.
VI. Automated decision making and profiling
We kindly inform you that we do not make automated decision-making, including any decisions based on profiling.
VII. Recipients of personal data
- Like most business people, we use the help of other entities in our operations, which often involves the need to provide personal data to them. Therefore, if necessary, we may provide your personal data to the following recipients: lawyers who provide services to us, quick payment companies, our accounting company and hosting company, a company responsible for sending text messages, and an insurance company ( if it is necessary to repair any damages).
- In addition to this, we may for instance be obliged to transfer your personal data to other entities, whether public or private, if we are bound to do so by provisions of law or decisions of the competent authority. That is why it is extremely difficult for us to predict who may apply for the disclosure of personal data. Nevertheless, we assure you that every request to disclose your personal data is analyzed very carefully and thoroughly, to avoid passing any information inadvertently to unauthorized persons.
VIII. Transfer of personal data to third countries
- Like most business people, we use various popular services and technologies offered by such entities as Facebook, Microsoft or Google. These companies are based outside the European Union and are therefore treated as third countries in the light of the provisions of the GDPR.
- The GDPR imposes certain restrictions on the transfer of personal data to third countries, because the European rules do not apply there, and therefore the protection of personal data of European Union citizens may unfortunately be insufficient. Therefore, each controller of the personal data is required to establish the legal basis for such transfer.
- For our part, we assure you that when using services and technologies, we only transfer personal data to entities from the United States and only to those which joined the Privacy Shield program based on the European Commission’s decision of July 12, 2016. More information on this subject is available on the European Commission website https://ec.europa.eu/info/law/law-topic/data-protection/data-transfers-outside-eu/eu-us-privacy-shield_pl. Entities that have joined the Privacy Shield guarantee that they will comply with the high standards of personal data protection that are in force in the European Union and therefore it is legal to use their services and technologies in the course of personal data processing.
- We will provide you with additional explanations regarding the transfer of personal data at any time, in particular when this issue raises your concern.
- You have the right to obtain a copy of your personal data transferred to a third country at any time.
IX. Personal data processing period
- In accordance with the applicable law, we do not process your personal information “infinitely”, but only for the time that is needed to achieve the goal. After that period your personal data will be irretrievably deleted or destroyed.
- Regarding individual periods of personal data processing, we kindly inform you that we process personal data for the period of:
- the duration of the contract – in relation to personal data processed in order to conclude and perform a contract;
- 3 years or 10 years + 1 year – in relation to personal data processed in order to establish, assert or defend claims (the length of the period depends on whether both parties are business persons or not);
- 6 months – in relation to personal data that were collected when valuing the service, if the contract was not concluded immediately;
- 6 years – in relation to personal data related to the fulfillment of obligations under tax law;
- no longer than until the end date of the recruitment for a given position – in the process of recruitment; also for a period not longer than 12 months if you agreed to participate in future recruitment processes;
- until the consent is withdrawn or the purpose of processing is achieved but no longer than 5 years – in relation to personal data processed on the basis of consent;
- until an effective objection is filed or the the purpose of the processing is achieved, but no longer than 5 years – in relation to personal data processed on the basis of the legitimate interests of the Personal Data Controller or for marketing purposes;
- until the time of obsolescence or loss of usefulness, but no longer than for 3 years – in relation to personal data processed mainly for analytical purposes, the use of cookies and the administration of the website.
- In order to facilitate the process of removing or destroying personal data, the years are counted from the end of the year in which we started to process personal data. Separate timing for each event would entail significant organizational and technical difficulties, as well as significant financial outlay; for this reason we set a single date for removing or destroying personal data. This allows us to manage the whole process more efficiently. Of course, if you use the right to be forgotten, we will consider your case individually.
- The additional year for the processing of personal data collected for the performance of a contract is to account for instances when someone may assert a claim a moment before the claim limitation date, a request is delivered with a significant delay or someone incorrectly calculates the limitation date for a claim.
X. Rights of data subjects
- We kindly inform you that you have the right to:
- the access to your personal data;
- correct your personal data;
- request deletion of your personal data;
- restrict the processing of your personal data;
- refuse the processing of your personal data;
- transfer your personal data.
- We respect your rights under the provisions of the act on the protection of personal data and we strive to facilitate their implementation to the highest extent possible.
- Please note that these rights are not absolute, and therefore we may legally refuse to comply with your requests in some cases. However, even if we refuse your request, we always do it after careful consideration and only when such refusal is necessary.
- Regarding your right to object, we explain that you have the right to object at any time to the processing of your personal data based on the legitimate interest of the Data Controller (they are listed in point III) due to your particular situation. However, you must remember that in accordance with the law, we may refuse to take your objection into account, if we demonstrate that:
- there are legitimate grounds for processing that override your interests, rights and freedoms or
- there are grounds for establishing, pursuing or defending any claims.
- Furthermore, at any time, you may object to the processing of your personal data for marketing purposes. In this situation, after receiving the objection, we will stop processing them for such purpose.
- You can exercise your rights by:
- sending an email directly to the Company at the address dp@beryl-med.com or
- completing the contact form for the deletion or change of personal data. Such form is available on the contact or GDPR subpages.
XI. The right to submit a complaint
If you believe that your personal data are being processed contrary to the law in force, you can complain to the President of the Office of Personal Data Protection.
XII. Final Provisions
- Cases not covered by this Privacy Policy are governed by provisions regarding the personal data protection.
- You will be notified of any changes made to this Privacy Policy by publishing them on the Company’s website (www.beryl-med.com).
- This Privacy Policy applies from May 25.2018.
