A. When you are browsing our website

What personal data do We process and from where do We have it?

We process the personal data you leave Us as part of your browsing of our website (the Website). These is mainly data concerning your activity in the Website, obtained by BR-AG in connection with the use of cookies and other similar technologies (more information can be found in the Cookie Policy), in particular the IP address of the device on which the Website is displayed, the URL of the displayed file or page, date and time of entry, data concerning the device and browser, which you use when visiting the Website, the name of the Internet access provider and any other similar data concerning use, as well as information that may be used in case of attacks on our IT systems.

Information about the rules of processing other data provided by you, e.g. in connection with filling in forms available on the Website, including purposes, recipients of data and the period of its processing – you will find below, in separate tabs relating to particular types of your activity on the Website.

Due to the fact that the services and products offered within the Website are dedicated to adults, BR-AG does not knowingly process personal data of children.

For what purpose do We process your data and on what legal basis?

When you visit the Website, We may process your data for the following purposes:

• pursuing legally justified interests of BR-AG or third parties, related to the management of the Website, including: making available to you the possibility of viewing, retrieving and reading information and materials made available within the Website, ensuring the safety and reliability of services provided within the Website, guaranteeing undisturbed creation of connection, guaranteeing comfortable use of the Website, analysis of security and stability of the system, based on cookies and other similar technologies (legal basis from Article 6 section 1 letter f of the GDPR);
• pursuing legally justified interests of BR-AG or third party consisting in establishment, exercise or defence of legal claims, e.g. providing information necessary for criminal proceedings in the event of a cyber attack (legal basis of Article 6, section 1, letter f of the GDPR);
• analytical, based on cookies and other similar technologies – based on your consent (legal basis of Article 6, section 1, letter a of the GDPR and Article 173, section 2 in conjunction with Article 174 of the Telecommunications Law). Giving consent is voluntary, and disagreement does not affect the ability to use the Website.

More information about cookies and other similar technologies used by BR-AG and how to block them can be found in our Cookie Policy.

The provision of personal data is voluntary, but may be necessary for the purposes stated above, which BR-AG will not be able to achieve if you do not provide personal data.

Who is the recipient of your data?

We share your personal data with others only if We have a legal basis for this. 

Your personal data may be disclosed to public authorities or other entities authorized to have such access under the law.

Depending on the purpose for which We process your data, the recipients of your personal data may also include entities providing analytical and IT services (in particular Google LLC) or providing BR-AG with ICT systems, telecommunications entrepreneurs, law firms and consulting companies with which We cooperate.

In particular when it is necessary for the performance of the services provided to you. If We transfer your personal data to recipients outside the European Union or the European Economic Area (EEA), this only takes place if the European Commission has confirmed an adequate level of data protection in relation to that third country, an adequate level of data protection has been agreed with the recipient (e.g. using so-called standard contractual clauses) or if We have obtained your consent. You have the possibility to obtain a copy of this data.

For how long do We keep your data?

We do not keep your personal data longer than necessary to achieve the purposes for which data was collected.

Your personal data contained in cookies will be processed by Us depending on the basis of processing – until the consent is withdrawn or an effective objection is raised. You may withdraw your consent at any time without affecting the lawfulness of any processing that was carried out on the basis of consent prior to its withdrawal. The principles of cookie management are contained in our Cookie Policy.

Personal data that will be processed for the purpose of establishing, exercising or defending legal claims will be processed until the statute of limitations for claims or dispute resolution.

B. When you give your consent to marketing

What personal data do We process and from where do We have it?

Depending on the scope of your marketing consent, We may process: your name, surname, e-mail address, telephone number, job title or the name of the entity at which you work.

We have collected your data from you when you consented to the processing of your data.

Providing personal data is voluntary, in particular it is not a condition for concluding a contract.

For what purpose do We process your data and on what legal basis?

We may process your data for direct marketing purposes, which is our legitimate interest. These purposes include, in particular, presenting you with offers and promotions that We believe may be of interest to you, as well as other information promoting the BR-AG brand and our products.

If We carry out direct marketing of BR-AG services and products by electronic means of communication (sending e-mails) and by telephone, We always do so on the basis of your consent (e-mail or telephone communication addressed to you takes place on the basis of your consent provided for by the Act on the provision of electronic services and the Telecommunications Law).

You never need to give consent (consent is voluntary). If you give a consent, you have the right to revoke your consent at any time (revoking your consent will not affect the lawfulness of the processing carried out before revocation of your consent) by sending your request to the BR-AG e-mail address indicated in the section How can you contact us?

Your personal data may also be processed to ensure and demonstrate compliance with the legal obligations imposed on BR-AG when processing is necessary to fulfill a legal obligation on BR-AG (legal basis from Article 6, section 1, letter c of the GDPR), as well as for archiving and evidentiary purposes fulfilling a legitimate interest in securing information in the event of a legitimate need or obligation to prove the facts (legal basis from Article 6, section 1, letter f of the GDPR).

Who is the recipient of your data?

We share your personal data with others only if We have a legal basis for doing so.

Your personal data may be disclosed to public authorities or other entities authorized to such access under the law.

Depending on the purpose for which We process your data, the recipients of your personal data may also include entities providing IT services or providing BR-AG with ICT systems, telecommunications entrepreneurs, law firms and consulting companies with which We cooperate, as well as trusted marketing partners of BR-AG (Google LLC and others).

The processing of your data contained in third party cookies may result in the transfer of your data to the United States. If We transfer your personal data to recipients outside the European Union or the European Economic Area (EEA), this only takes place if the European Commission has confirmed an adequate level of data protection in relation to that third country, an adequate level of data protection has been agreed with the recipient (e.g. using so-called standard contractual clauses) or if We have obtained your consent.

For how long do We keep your data?

We do not keep your personal data longer than necessary to achieve the purposes for which data was collected.

Your personal data will be processed by Us depending on the basis of processing – until the consent is withdrawn or an effective objection is raised. You may withdraw your consent at any time without affecting the lawfulness of any processing that was carried out on the basis of consent prior to its withdrawal.

Personal data which will be processed in order to demonstrate and fulfill our obligations are processed only to the extent and for the period necessary to fulfill these obligations and to demonstrate that our obligations have been fulfilled.

C. When you use our newsletter

D. When you are applying for participation in the recruitment process

What personal data do We process and from where do We have it?

We process your personal data, voluntarily provided by you within the framework of your application and participation in the recruitment process conducted by BR-AG through our website or in any other way.

The scope of personal data that We need for recruitment purposes is indicated in the advertisement. Providing personal data is always voluntary, but the failure to provide data necessary to conduct the recruitment process will prevent your participation in the recruitment process.

For what purpose do We process your data and on what legal basis?

When you apply for participation in our recruitment process, We may process your data in order to conduct the recruitment process:

• when it is necessary to take action at your request before entering with you into a mandate contract, contract of specific work, contract for the provision of services or any other contract of similar nature (legal basis under Article 6, section 1, letter b of the GDPR). Providing personal data is then a condition for acceptance of your application.
• based on the law (legal basis under Article 22¹, clause 1 of the Labor Code in conjunction with Article 6, section 1, letter c of the GDPR), if you apply for employment on the basis of an employment contract. Providing personal data in such a case results from legal regulations and is a condition of participation in the recruitment process.

The remaining data (e.g. image) provided by you in your recruitment application is processed on the basis of your voluntary consent, which you gave Us by sending/providing your recruitment application to Us and the submission thereof does not affect the possibility to participate in the recruitment process.

We process your personal data on the basis of your voluntary consent if you have consented to the processing of your data by Us for the purposes of a future recruitment. We would like to inform you that providing your data is voluntary in such cases, and if you do not give your consent, it will not unable you to participate in the recruitment process.

Your personal data may also be processed to ensure and demonstrate compliance with the legal obligations imposed on BR-AG when processing is necessary to fulfill a legal obligation on BR-AG (legal basis of Article 6, section 1, letter c of the GDPR).

We may also process your data on the basis of our legitimate interest consisting in establishment, exercise or defence of legal  claims if the claims relate to our recruitment process, as well as for archiving and evidentiary purposes fulfilling our legitimate interest in securing information in the event of a legitimate need or duty to establish facts (legal basis of Article 6, section 1, letter f of the GDPR).

Who is the recipient of your data?

We share your personal data with others only if We have a legal basis for doing so.

Your personal data may be disclosed to public authorities or other entities authorized to have such access under the law.

Depending on the purpose for which we process your data, the recipients of your personal data may also include entities providing IT services (in particular Google LLC), such as hosting or providing BR-AG with ICT systems, telecommunication entrepreneurs, providers of job advertisement publication services, providers of recruitment management systems (in particular ENNOVA Spółka Jawna), law firms, companies providing HR and payroll services and consulting companies with which we cooperate.

The processing of your data may result in its transfer to the servers of software and IT service providers in connection with the use of the service/software they provide by BR-AG. Some of these servers are located in the USA. If We transfer your personal data to recipients outside the European Union or the European Economic Area (EEA), this only takes place if the European Commission has confirmed an adequate level of data protection in relation to that third country, an adequate level of data protection has been agreed with the recipient (e.g. using so-called standard contractual clauses) or if We have obtained your consent. You have the possibility to obtain a copy of this data.

For how long do We keep your data?

We do not keep your personal data longer than necessary to achieve the purposes for which it was collected.

If BR-AG concludes a contract with you after the completion of the recruitment process, your personal data will be stored during the term of the employment relationship or any other type of relationship, in accordance with legal requirements.

Personal data processed in order to demonstrate and fulfill our obligations are processed only to the extent and for the period necessary to fulfill those obligations and to demonstrate that our obligations have been fulfilled.

If after the recruitment process BR-AG does not conclude a contract with you, BR-AG removes recruitment documents after the completion of the recruitment process, if no other basis justifies further processing, and in case you have agreed to participate in future recruitment – after 36 months from the end of the first recruitment, unless within this period, after another recruitment process, BR-AG concludes a contract with you.

If the processing of your data is necessary for the establishment, exercise or defence of legal claims, We process your personal data until the statute of limitations for claims or dispute resolution.

E. When you sign up for a webinar

What personal data do We process and from where do We have it?

We process your personal data voluntarily provided by you in the context of your application for participation in the webinar (name, surname, e-mail address, position, name of the entity at which you work and, if necessary, telephone number).

The provision of your data is voluntary, but the provision of an e-mail address is necessary to access the webinar.

For what purpose do We process your data and on what legal basis?

We process your personal data in order to conclude and perform a contract for the provision of electronic services (legal basis of Article 6, section 1, letter b of the GDPR), which you conclude with Us by signing up for our webinar.

We may also process your personal data for archiving and evidentiary purposes that fulfill a legitimate interest in securing information in the event of a legitimate need or obligation to prove facts, as well as for the purpose of fulfilling other legitimate interests of the Controller or a third party such as: marketing of BR-AG products and services, establishing, exercising and defending claims, ensuring resource protection, safety and quality of the service provided (legal basis from Article 6, section 1, letter f of the GDPR).

E-mail and telephone communication addressed to you, containing marketing content, is also based on your consent (more information in the section When you give your consent to marketing).

Your personal data may also be processed to ensure and demonstrate compliance with the legal obligations imposed on BR-AG when processing is necessary to fulfill a legal obligation of BR-AG (legal basis of Article 6, section 1, letter c of the GDPR). Processing of your data is necessary in this respect and failure to process your data would prevent Us from fulfilling and demonstrating fulfilment of our obligations.

Who is the recipient of your data?

We share your personal data with others only if We have a legal basis for doing so.

Your personal data may be disclosed to public authorities or other entities authorized to such access under the law.

Depending on the purpose for which We process your data, the recipients of your personal data may also be entities providing IT services (in particular Google LLC) or providing BR-AG with ICT systems, telecommunications entrepreneurs, law firms, and consulting firms with which We cooperate, including marketing and advertising agencies.

The processing of your data may result in its transfer to the servers of software and IT services providers in connection with the use by BR-AG of the services/software they provide. Some of these servers are located in the USA. If We transfer your personal data to recipients outside the European Union or the European Economic Area (EEA), this only takes place if the European Commission has confirmed an adequate level of data protection in relation to that third country, an adequate level of data protection has been agreed with the recipient (e.g. using so-called standard contractual clauses) or if We have obtained your consent. You have the possibility to obtain a copy of this data.

For how long do We keep your data?

We do not keep your personal data longer than necessary to achieve the purposes for which it was collected.

Your personal data will be processed by Us depending on the basis of processing – until the completion of the service, withdrawal of consent or effective objection. You may withdraw your consent at any time without affecting the lawfulness of any processing that was carried out on the basis of that consent prior to its withdrawal.

Personal data processed in order to demonstrate and fulfill our obligations are processed only to the extent and for the period necessary to fulfill those obligations and to demonstrate that our obligations have been fulfilled.

Personal data that We process in order to establish, exercise or defend claims, are processed by Us until the statute of limitations for claims or dispute resolution.

F. When you are our customer/ supplier/ business partner or contact person/ attorney/ person representing our customer/ supplier/ contractor

What personal data do We process and from where do We have it?

If you are our customer, supplier or another business partner, being a natural person (including a person conducting business activity), We process your personal data that you have provided to Us for the purpose of concluding and performing the contract and data obtained from publicly available sources (e.g. CEIDG). Providing data is voluntary, however, it is necessary to conclude a contract with Us.

If you have been indicated as a contact person of the organization with which We cooperate (our customer/supplier/business partner), We may process your personal data provided to Us by your organization in order to cooperate with your organization, i.e. name and surname, position, telephone number, e-mail address and other personal data that you provide to Us in direct contact with Us.

If you have been indicated as an attorney or a person representing the organization with which We cooperate (our client/supplier/business partner), We may process your data you provided to Us, i.e. name and surname, position, telephone number, e-mail address, data contained in the National Court Register, and if you are an attorney – personal data contained in the power of attorney, including, but not limited to, the series and number of an identity document. Providing data is a condition of concluding a contract with your organization, and failure to provide data will prevent Us from concluding and executing a contract with your organization.

For what purpose do We process your data and on what legal basis?

If you are our customer, supplier or other business partner, being a natural person (including a self-employed person), We process your personal data:

• in order to conclude and perform a contract with you (legal basis from Article 6, section 1, letter b of the GDPR). Providing personal data by you is a condition for concluding a contract.
• for archiving and evidentiary purposes fulfilling a legitimate interest in securing information in the event of a legitimate need or duty to establish facts, and for purposes arising from other legitimate interests pursued by the BR-AG (legal basis of Article 6, section 1, letter f of the GDPR), such as the identification, recovery or defense of claims, satisfaction surveys of services provided and products supplied, direct marketing of BR-AG products and services, selection of appropriate business partners, prevention of criminal offenses.
• on the basis of a separate consent expressed by you, within the scope and purpose specified therein (e.g. e-mail and telephone communication addressed at you, containing marketing content, takes place on the basis of your consent – more information in the section When you give your consent to marketing).
• to ensure and demonstrate compliance with legal obligations imposed on BR-AG where processing is necessary to fulfill a legal obligation on BR-AG (legal basis from Article 6, section 1, letter c of the GDPR).

If you have been indicated as a contact person, attorney or representative of the organization with which We cooperate (our customer/supplier/business partner), We process your data:

• for archiving and evidentiary purposes fulfilling a legitimate interest in securing information in the event of a legitimate need or duty to prove the facts, as well as for purposes resulting from other legitimate interests pursued by BR-AG (legal basis from Article 6, section 1, letter f of the GDPR) i.e.: conclusion and implementation of a contract with your organization, establishment, execution or defense of legal claims, satisfaction surveys of services and products provided, direct marketing of BR-AG products and services, prevention of criminal acts.
• to ensure and demonstrate compliance with legal obligations imposed on BR-AG where processing is necessary to fulfill a legal obligation on BR-AG, in particular tax law obligations (legal basis of Article 6, section 1, letter c of the GDPR).

Who is the recipient of your data?

We share your personal data with others only if We have a legal basis for doing so.

Your personal data may be disclosed to public authorities or other entities authorized to have such access under the law.

Depending on the purpose for which We process your data, the recipients of your personal data may also be entities providing IT services or providing BR-AG with ICT systems, law firms and tax offices, entities providing courier or postal services, banks – if it is necessary to make settlements, insurance companies and consulting companies with which We cooperate, including marketing and advertising agencies.

The processing of your data may result in its transfer to the servers of software and IT service providers in connection with the use of the service/software they provide by BR-AG. Some of these servers are located in the USA. If We transfer your personal data to recipients outside the European Union or the European Economic Area (EEA), this only takes place if the European Commission has confirmed an adequate level of data protection in relation to that third country, an adequate level of data protection has been agreed with the recipient (e.g. using so-called standard contractual clauses) or if We have obtained your consent. You have the possibility to obtain a copy of this data.

For how long do We keep your data?

We do not keep your personal data longer than necessary to achieve the purposes for which it was collected.

Your personal data, obtained in connection with the conclusion and implementation of the contract with you as a customer/supplier/business partner or your organization, which indicated you as a contact person or representative, are processed until the end of the period of limitation of claims that may potentially arise from the contract concluded with Us, and in the case of data required to meet the legal obligation to which BR-AG is subject (in particular obligations under tax law) – for the period resulting from the applicable legal regulations.

G. When you contact us about other matters

What personal data do We process and from where do We have it?

We process your personal data, voluntarily provided by you during contact with Us (personal contact, telephone contact, e-mail contact, contact by means of forms available at the Website, postal contact) i.e. your name, surname, address (correspondence, e-mail), telephone number, as well as other personal data voluntarily provided by you in a message addressed at Us or transmitted by telephone.

Providing personal data is voluntary, but may be necessary for the processing of your request.

The personal information you provide to Us is, of course, treated confidentially.

For what purpose do We process your data and on what legal basis?

• Your personal data is used by BR-AG to contact you and to provide you with information and advice, based on the legitimate interest of BR-AG to respond to your inquiries, to solve possible problems and thus to maintain and increase your satisfaction (legal basis from Article 6, section 1, letter f of the GDPR).
• If you use or wish to use our products or services, your data may be necessary to perform the contract to which you are a party or to take action at your request before the conclusion of the contract (legal basis of Article 6, section 1, letter b of the GDPR).
• Depending on the nature and course of the case you are addressing Us with, your data may also be processed for the purpose of pursuing legitimate interests of BR-AG, which may include, inter alia, the establishment, investigation and defense of claims, prevention and investigation of criminal offenses, management and further development of business activities, including risk management (legal basis from Article 6, section 1, letter f of the GDPR).
• Your personal data may also be processed for archiving and evidentiary purposes fulfilling a legitimate interest in securing information in the event of a legitimate need or obligation to prove the facts (legal basis of Article 6, section 1, letter f of the GDPR).
• Your personal data may also be processed to ensure and demonstrate compliance with the legal obligations imposed on BR-AG when processing is necessary to fulfill a legal obligation on BR-AG (legal basis of Article 6, section 1, letter c of the GDPR).

Who is the recipient of your data?

We share your personal data with others only if We have a legal basis for doing so.

Your personal data may be disclosed to public authorities or other entities authorized to such access under the law.

Depending on the purpose for which We process your data, the recipients of your personal data may also be entities providing IT services (in particular Google LLC) or providing BR-AG with ICT systems, telecommunications entrepreneurs, as well as law firms, tax and accounting advisors and other trusted entities with whom We cooperate.

The processing of your data may result in its transfer to the servers of software and IT service providers in connection with the use of the service/software they provide by BR-AG. Some of these servers are located in the USA. If We transfer your personal data to recipients outside the European Union or the European Economic Area (EEA), this only takes place if the European Commission has confirmed an adequate level of data protection in relation to that third country, an adequate level of data protection has been agreed with the recipient (e.g. using so-called standard contractual clauses) or if We have obtained your consent. You have the possibility to obtain a copy of this data.

For how long do We keep your data?

We do not keep your personal data longer than necessary to achieve the purposes for which it was collected.

Personal data that We have obtained from you in the course of inquiries addressed at Us via the Website, by e-mail, letter or telephone, will be processed by Us until the completion of your request.

Personal data that We process in order to establish, enforce or defend a claim will be processed by Us until the statute of limitations for claims or the dispute resolution.

Personal data processed in order to demonstrate and fulfill our obligations are processed only to the extent and for the period necessary to fulfill those obligations and to demonstrate that our obligations have been fulfilled.