Privacy policy

This Privacy Policy sets out the rules for processing and protection of personal data of the Users of the Website available at www.farmio.com.

Users' personal data is processed as per applicable legislation, in particular the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation), hereinafter: “GDPR”, and the Act on personal data protection of 10 May 2018.

If you do not agree with provisions of this Privacy Policy, please do not use the Website.

I. Joint control of data

1. In order to achieve the necessary business objectives, including administrative process improvement, as well as to ensure the highest security standards, the Zakłady Drobiarskie Farmio Sp. z o. o. company with its registered office in Golina (address: ul. Leśna 1, 63-200 Golina), entered in the Register of Entrepreneurs of the National Court Register kept by the District Court of Poznań Nowe Miasto and Wilda in Poznań, 9th Commercial Division of the National Court Register, under the KRS number 0000606642 (hereinafter referred to as the Company1 or Controller 1) and Farmio S.A. with its registered office in Warsaw (address: al. Rzeczypospolitej 1, 02-972 Warsaw), entered in the Register of Entrepreneurs of the National Court Register kept by the District Court for the Capital City of Warsaw in Warsaw, 13th Commercial Division of the National Court Register, under the KRS number 0000405809 (hereinafter referred to as: Company2 or Controller2), collectively referred to as: “Companies” or “Joint Data Controllers”, have jointly, as controllers of the personal data of the Website, determined the purposes and means regarding processing of the personal data used by the Website. For this reason, the Companies have adopted a model of asserting joint control over certain Website Users' personal data.
   
   
2. On the basis of an agreement between the aforementioned Companies, rules have been established for asserting joint control over the personal data of the Website by the Companies.
   
   
3. The Companies have agreed that they are jointly fully responsible for complying with information-related and other obligations under the GDPR in respect of personal data as set out in Section I, subsection 6 of the Privacy Policy.
   
   
4. The Companies have agreed that each is individually responsible for complying with the information-related and other obligations under the GDPR in respect of personal data as set out in Section II, subsections 2 and 4 of the Privacy Policy.
   
   
5. The Joint Data Controllers undertake to cooperate and support each other in order to fulfil the obligations set out in Section I, subsections 3 and 4 of the Privacy Policy.
   
   
6. The data jointly controlled by the Companies includes: information about the User's IP address, the time when a query is received and the response is sent, the address of the website from which the user was redirected to the Website and the type of software the user uses (operating system and browser type). Such information is used for Website administration purposes and to compile statistics and analyses.
   
   
7. The Joint Data Controllers can be contacted via email or by traditional means. Contact details are as indicated in Section II, subsections 3 and 5 of the Privacy Policy.

II. Data control

1. Some of the data collected through the Website is not jointly controlled by the Companies. This means that each Company is a separate controller of part of the personal data processed on the Website.
   
   
2. The Company1 is the controller of the personal data (hereinafter referred to as Controller1) collected through the Website via the contact form and recruitment form, which are dedicated on the Website to contact the Company1.
   
   
3. The Controller1 can be contacted on matters concerning data protection, including the exercise of data subjects' rights. Contact can be made by email at: biurozd@farmio.com or by post at: Zakłady Drobiarskie Farmio Sp. z o.o., ul. Leśna 1, 63-200 Golina.
   
   
4. The Company2 is the controller of the personal data (hereinafter referred to as Controller2) collected through the Website by means of the contact form and recruitment form, which are dedicated on the Website to contact the Company2.
   
   
5. The Controller2 can be contacted on matters concerning data protection, including the exercise of data subjects' rights. Contact can be made by email at: biuro@farmio.com, or by post at: Farmio S.A., al. Rzeczypospolitej 1, 02-972 Warsaw.

III. Basic information data collection and processing objectives

1. When using the Website, its users’ data can be collected and used (hereinafter: “Users”), which also applies to personal data.
   
   
2. Users' data may be collected as a result of: its voluntary provision by Users (e.g. when filling in a contact form, applying for a specific job position) and the use of social plug-ins and cookies - both own ones and from third parties and similar tools.
   
   
3. In addition, the following data can be collected: information about the User's IP address, the time when a query is received and the response is sent, the address of the website from which the user was redirected to the Website and the type of software the user uses (operating system and browser type). Such information is used for Website administration purposes and to compile statistics and analyses.
   
   
4. The Joint Data Controllers shall ensure that Users' data is correctly secured through the use of suitable organisational and technical measures.
   
   
5. The personal data security during transmission is ensured by the SSL transmission protocol used by the Joint Data Controllers. The protocol encrypts the data before it is sent from the User's browser and decrypts it after it arrives safely to the Website server.
   
   
6. Through the Website, Companies may process personal data to:
   
   - contact the User if s/he has written a message to the Controller1 or Controller2, filled in a contact form (based on Article 6, section 1, item f of the GDPR), as data processing is necessary for the purposes deriving from the legitimate interests pursued by the Controller, such interest being to contact the User on their request or provide a response;
   
   - contact people interested in being employed by the Company1 or Company2, their application or CV data is processed in paper or electronic form. The legal basis here is the fulfilment of the Controller's legal obligations under Art. 22¹ § 1 and § 3 of the Labour Code of 26 June 1974. (Journal of Laws of 2020, item 1320 as amended) and is conducted as per Art. 6, section 1, item c of the GDPR, and for the purpose of taking action on request, prior to concluding an employment contract - as per Art. 6, section 1, item b of the GDPR. Personal data other than this listed in Art. 22¹ § 1 and § 3 of the Labour Code may be processed as per Art. 6, section 1, item a of the GDPR, on the basis of the consent given, which may be withdrawn at any time. In this case, a job application will not be considered by the Companies and we will immediately delete all data provided;
   
   - conduct direct marketing of the products and services offered by the Controller1 or the Controller2 - as per Art. 6, section 1, item f of the GDPR, as processing is necessary for the purposes deriving from the legitimate interests pursued by the Joint Data Controllers; such interest being the promotion of the products and services offered by the Companies;
   
   - record statistics and perform analyses of the Users’ behaviour on the Website - as per Art. 6, section 1, item f of the GDPR, as processing is necessary for the purposes of the legitimate interests pursued by the Joint Data Controllers; such interest is to make findings regarding the use of the Website by Users in order to optimise it to such Users’ needs;
   
   - make the Website more attractive and user-friendly; we use “social plug-ins” for this purpose. They are used as per Art. 6, section 1, item f of the GDPR, in order to enhance recognisability of the Companies. The resulting promotional purpose is considered as a legitimate interest under the GDPR.

IV. Data recipients

The Controller1 or Controller2 or jointly the Joint Data Controllers can share the Users' personal data with their subcontractors belonging to the following categories of entities: hosting providers, marketing and advertising agencies, IT system operation and maintenance service providers and lawyers. The Joint Data Controllers share Users' personal data with these entities in accordance with applicable laws (for example, based on data processing entrustment agreements, if their conclusion is required under the GDPR).

V. Data transfers outside the European Economic Area

1. The Joint Data Controllers do not transfer personal data outside the European Economic Area, with the exception of using services provided by the following entities: Google LLC, Facebook Ireland Ltd.
   
   
2. In the case of Google LLC and LLC Facebook Ireland Ltd., data is transferred to the USA. The data transfer outside the European Economic Area takes place on the basis of standard contractual clauses (Art. 46, section 2 of the GDPR). The text of Google's standard contractual clauses is available at: https://privacy.google.com/businesses/processorterms/mccs/. Information on the data transfer to the USA by Facebook Ireland Ltd. together with information on standard contractual clauses is at: https://www.facebook.com/legal/EU_data_transfer_addendum.

VI. Personal data processing period

1. Personal data processed for the purpose of contacting the User is processed for a period of 3 years from the date its collection or User’s objection.
   
   
2. For the purposes of direct marketing of the Joint Data Controllers’ products and services - it will be stored until:
   
   - objection to its processing for that purpose is filed, unless the Joint Controllers or the Controller1 or Controller2 demonstrate the existence of compelling legitimate grounds for data processing which override the interests, rights and freedoms of the data subject, in which case the data will be stored until such compelling legitimate grounds for processing exist, or
   
   - the consent to receive commercial communications or to use telecommunications terminal equipment and automatic calling systems for direct marketing purposes is withdrawn.
   
   
3. For the purposes of recording statistics and creating analyses of Users’ behaviour on the Website - such data is processed for a period of 3 years from the date of their collection.
   
   
4. For the purposes of concluding and performing a agreement when you are a client, contractor or their representative or a contact person - we store data for the time necessary for the performance of the agreement and thereafter, until the statute of limitations for claims that may arise from such a agreement, or for the time required by the law.
   
   
5. Recruitment-related data will be processed for a period of 3 months counted from the end of the recruitment period, unless the data subject has agreed to participate in other recruitment processes, in which case this period is maximum 12 months counted from the submission of the documents.

VI. Users' rights

1. In order to exercise their rights, Users may contact the Joint Data Controllers, Controller1 or Controller2, in the manner set out in Section I.1 or Sections II.3 and II.5 of the Privacy Policy.
   
   
2. The User may also contact the Joint Data Controllers to obtain information on why the Controller has deemed it appropriate to process the User's personal data, which also includes the necessity resulting from their legitimate interests.
   
   
3. The personal data provision when using the Website is voluntary. However, if the user does not provide the necessary data, e.g. in a contact form, it will not be possible to contact them.
   
   
4. The Controller will not make any decisions towards the Users which are based solely on automated data processing, including profiling, and which produce legal effects or similarly significantly affect the Users.
   
   
5. The User has the right to access the content of the data, and to request rectification, erasure, restriction of processing, the right to data portability and the right to object to data processing, as well as the right to lodge a complaint with a supervisory authority dealing with Personal Data protection. The User has the right to withdraw their consent to their personal data processing, in case such processing is based on the User's previously granted consent.

VIII. Tools used on the Website

1. Within the Website, the Joint Data Controllers use IT tools provided by third parties. The use of these tools may involve using cookies cookies obtained from these entities.
   
   
2. The Joint Data Controllers use the following tools provided by Google on the Website: Google Analytics, Google Ads, Google Tag Manager and Google Maps.
   
   
3. Through the use of cookies, Google Analytics analyses the site traffic and how Users navigate the Website. The Joint Data Controllers use the data collected by Google Analytics for remarketing/retargeting purposes, to report on page hits in the Google's advertising network and to analyse Users’ demographic data and interests. The Joint Data Controllers can determine keywords, adverts, advert groups and campaigns that most effectively attract customers. The Joint Data Controllers can also observe the activity on the Website,i.e. scrolling through pages, copying their elements, given user’s time of activity and other events. All this data is collected anonymously. This is made possible by a mechanism designed to anonymise the user's IP number. Users can prevent their data from being used in Google Analytics. For more information on how this can be done, visit: https://tools.google.com/dlpage/gaoptout.
   
   
4. Google Ads is used to display relevant advertisements to Users. Cookies are placed on the User's device in order to remember which pages s/he visits. Based on the information collected, personalised advertisements are displayed on the pages s/he views. The Controller may commission advertisements to selected recipients, e.g. all Users persons who have visited the Website within 7 days. The Controller commissions advertising on the basis of aggregate criteria, e.g. targeted at specific target groups, never at a specific user. You can change your advertising personalisation settings for Google services at https://adssettings.google.com/. Within Google Ads, the Controller makes use of the enhanced conversion option. This feature collects encrypted information on the conversion page (e.g. email addresses from contact forms) and then matches it with information concerning logged-in Google users. The augmented conversion feature complements the existing conversion tags by sending encrypted conversion data from the Website to Google in a privacy-preserving manner. The augmented conversions feature ensures information confidentiality and security, using the highest industry standards - the data is encrypted before being sent to Google (a one-way encryption algorithm called SHA256).
   
   
5. Google Tag Manager is a system for managing the tags and codes placed on the Website. With Google Tag Manager, Google may collect information on, for example, the use of a service/tags and the tags used. This data is used in accordance with Google's privacy policy.
   
   
6. Google Maps aims to attractively present our offers online and to easily locate the places we indicate on the Website. This constitutes a legitimate interest within the meaning of Art. 6, section 1, item f of the GDPR. We use the Google Maps mapping services via an API. If you are resident in the European Economic Area or Switzerland, this service is provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. If you are a permanent resident outside the European Economic Area and Switzerland, this service is provided by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA. For Google's privacy policy, visit: policies.google.com/privacy. In order to use the Google Maps feature, it is necessary to store your IP address. This information is generally sent to a Google server in the USA and stored there. We have no control over this data transmission.
   
   
7. For the Google's privacy policy, visit: https://policies.google.com/privacy.
   
   
8. Google can transfer data to third parties. For more information on Google”s use of cookies, visit: https://policies.google.com/technologies/cookies?hl=pl&gl=pl.
   
   
9. Controller1 and Controller2 use business tools provided by Facebook, including Facebook Pixel, which are used for marketing activities.
   
   
10. Facebook Pixel “tracks” the visits and behaviour of Users navigating the Website. This makes it possible to target them with tailored advertising (remarketing/retargeting).
    
    
11. Controller1 and Controller2 only receive statistical data from Facebook, without reference to specific Users. In this way, the Controller checks the effectiveness of Facebook and Instagram ads, researches the market and keeps their own statistics.
    
    
12. The data from Facebook Pixel is only collected by the Controller1 or Controller2 for statistical analyses, and advertisements are only commissioned on the basis of the aggregate criteria, never to target a specific user.
    
    
13. For more information on Facebook's data processing rules, visit: https://www.facebook.com/privacy/explanation.

IX. Social plug-ins / social media

In order to make the Website more attractive and user-friendly, the Controller1 and Controller2 use “social plug-ins”. Pursuant to Art. 6, section 1, item f of the GDPR, in order to enhance recognisability of the Website and Companies. The resulting promotional purpose is considered as a legitimate interest under the GDPR. The responsibility to act in compliance with data protection legislation must be guaranteed by the relevant provider.

Social bookmarks are web bookmarks allowing us to access our profile via various providers, currently:

- Facebook (Facebook Inc., 1 Hacker Way, Menlo Park, CA 94025, USA).

This means that social plug-ins (buttons) are provided on our website as links. By clicking the social medium icons (plug-ins), the User is directed to our Website by the respective providers, i.e. user information is only transmitted after the first click and is directed to the respective provider.
The information on personal data processing when using
services offered by the respective provider can be found in their privacy policy.
We process your personal data in connection with your visit to our social media page . We have a profile on the following social media site:

- Facebook:
https://www.facebook.com/zakladydrobiarskiefarmio

https://www.facebook.com/FarmioWolneOdGMO/

In addition to our company (i.e. independently of us), the relevant social media platform operator is also responsible for your personal data processing. To the extent that we can influence this and parameterise the processing, we will endeavour, within the limits of the possibilities available to us, to ensure that the social media platform operator processes your data in a manner that complies with applicable data protection regulations. In this context, we also ask you to pay attention to the data protection declarations made by the social media platform concerned.

X. Information on personal data processing in social media by Zakłady Drobiarskie Farmio sp. z o.o. with its registered office in Golina and by Farmio S.A. with its registered office in Warsaw

1. When you click the “Like” or “Follow” icon on a fanpage belonging to Zakłady Drobiarskie Farmio sp. z o.o. with its registered office in Golina (hereinafter ZD Farmio sp. z o.o.) or Farmio S.A. with its registered office in Warsaw (hereinafter Farmio S.A.) and collectively referred to as the “Companies”, publish comments under our posts or send us direct messages via social networks, ZD Farmio sp. z o.o. and Farmio S.A. process your personal data.
   
   
2. Each Company processes your data on its own exclusively for the purposes of replying to your queries, commenting on your posts and communicating with you in the course of the Companies' business and within the framework of the content provided by us. Personal data collected through communication will only be processed for the purpose of providing a response, if necessary. Your activity related to the use of our fanpages will not be archived by us outside the respective social network.
   
   
3. Your personal data that we process in connection with our fanpage operation includes: your identifier on the relevant social network (usually including your first name and surname); basic identification and other data that you have published on your social network on the relevant; your profile picture (if you have published one); other pictures (which may also be an image) that you have voluntarily published under our fanpage posts; the content of your comments and the content of conversations you have had with us, e.g. via Messenger; anonymous statistical data about fanpage visitors (as for Facebook, this is available via the “Facebook Insights” function provided by Facebook in accordance with the non-modifiable terms and conditions of using the Facebook site, collected by spyware files [”cookies”], each of which contains a unique user code that can be linked to the connection data of users registered on Facebook and which is downloaded and processed when the fanpage is opened).
   
   
4. We process your personal data in order to inform you, through our fanpages on social networks, about our activities, to promote various events we organise, to promote our brand and products, to build and maintain a community associated with us and to communicate through the available functionalities offered by a given respective social network. The activities indicated constitute our legitimate interest pursuant to Art. 6, section 1, item f of the GDPR. Your personal data processing also serves the legitimate interest of conducting analyses regarding our fanpage functioning, popularity and use. Personal data processing also takes place pursuant to Art. 6, section 1, item b of the GDPR in connection with taking action on your request before entering into an agreement, if submit queries regarding about our products.
   
   
5. As for social network profiles, your data recipients are the owners of the respective social networks under the non-modifiable data-related rules of the respective social network. In addition, we entrust personal data to entities that support management of our social network profiles, as well as to other entities that support our activities, and to entities authorised to receive personal data by law.
   
   
6. Your data will be processed for the period necessary to fulfil the processing purposes indicated above, i.e.:
   
   - the information we hold in private messages will be retained for the duration of the response to your query or until the end of the agreement period;
   
   - the case of information we retain within the comments you have provided will be available until the author deletes it.
   
   - Your personal data collected by the respective social network, i.e. post history, activity history in Messenger, activity history in Instagram, is subject to the retention rules set out in the terms and conditions of these social networks;
   
   - data processed on the basis of the Controller's legitimate interest will be processed until an objection is successfully lodged or the interest ceases.
   
   - The statistical data on fanpage visitors available via the "Facebook Insights" function will be processed for the duration of the availability of this data on Facebook, which is 2 years.
   
   
7. The provision of your personal data is voluntary, but necessary in order to view fanpages, post comments or send messages via the aforementioned portals and applications. We also occasionally use the social media platforms described to display targeted advertising. For this purpose, we use the definitions of target groups that are provided to us by the social media provider. We only use anonymous target group definitions, i.e. we define characteristics based on, for example, general demographic data, behaviour, interests and connections. The social media platform operator uses it to display advertisements to its users accordingly. The legal basis is the consent that the social media platform operator has obtained from its users. If you wish to revoke this consent, please use the opt-out options provided by the social media platform provider, as they are responsible for this processing. Sometimes we or the social media platform provider may also use publicly available data to identify target groups. Art. 6, section 1, item f of GDPR constitutes the legal basis for this kind of data processing. It is a legitimate interest on our part to define a target group as appropriately as possible. We never use the special categories of personal data listed in Art. 9 and 10 of the GDPR to identify target groups.
   
   
8. We do not use location-based target group definitions. We do not share personal data with the social media platform of the as part of the definition of the target group. We also sometimes use information about visits or interactions with other sites (i.e. remarketing) to define target groups. For this purpose, we also use cookies. In such cases, however, we obtain users' prior consent on the individual pages via the consent banner and provide information on data processing. This consent can be withdrawn at any time by calling up the consent banner again on the respective site. If you wish to object to specific data processing that we have influence over, contact us at: biurozd@farmio.com or biuro@farmio.com.
   
   
9. We will delete your personal data if it is no longer needed for the above-mentioned processing purposes and no legal retention obligation prevents its deletion. At any time, you have the right to access, transfer, rectify and, where applicable, erase your personal data free of charge, as well as the right to object to your data processing or to withdraw your consent to your personal data processing, effective as of a future date.

XI. Data processing by social media platform operator

1. A social media platform operator uses online tracking methods. Online tracking can also be performed regardless of whether you are logged in or registered on a social media platform.
   
   
2. We would therefore like to stress the fact that it cannot be ruled out that the social media platform provider will use your profile and behavioural data in order to assess your habits, personal relationships, preferences, etc. Therefore, we have no influence on your data processing by social media platform providers. For more information on personal data processing by a social media platform provider, further options for objections and, where applicable, an agreement in accordance with Art 26 of the GDPR, refer to the provider's data protection statement:
   
   - Facebook:
   https://www.facebook.com/privacy/policy/?entry_point=data_policy_redirect&entry=0
   oraz
   https://www.facebook.com/notes/optegra-zobacz-wi%C4%99cej/polityka-prywatno%C5%9Bci-dotycz%C4%85ca-danych-osobowych-przetwarzanych-za-pomoc%C4%85-faceboo/665497036926113/

XII. Sharing function

1. In addition, we use the sharing function related to the Facebook network. “Sharing functions” are technologies that allow you, as a user, to share certain content with members of social networks via a direct connection. In order to integrate the sharing function, we use a technical solution that prevents data (e.g. IP address) from being transmitted to social networks such as Facebook, as soon as you open our website. This means that these buttons are disabled by default. They are only activated after they are clicked for the first time.
   
   
2. The Companies have no control over the extent of data that Facebook collects through plug-ins. However, we would still like to provide as much information as we can.
   
   
3. By activating the sharing function, providers receive information that the user has called up the relevant offer page. If the user is logged in, the visit can be assigned to the user account. When a user interacts with the buttons, for example by pressing the “Like” button or adding a comment, the relevant information is transmitted directly from the browser to Facebook, and stored there. If the user is not a member of the Facebook community, there is still a possibility that the provider will find their IP address and store it.
   
   
4. For further information on data processing by the social media platform operator, visit the operator's privacy policy at: https://www.facebook.com/privacy/policy/
   
   
5. If you have an account with the provider and do not want Facebook to collect data your via this offer and link it to your membership data, you must log out before visiting the site and before activating the sharing function.
   
   
6. Art. 6, section 1, item f of GDPR constitutes the legal basis for this kind of data processing. The underlying marketing purpose must be regarded as a legitimate interest within the meaning of the GDPR.