Privacy Policy

The Company Poznańskie Zakłady Zielarskie ,”Herbapol” S.A., with its registered office in Poznań at Towarowa No. 47/51, is aware of the importance of the information entrusted by you, and wishing to ensure due diligence in terms of the rights due to you, and in particular a right to protect your privacy, undertakes relevant steps to develop and adapt this Privacy Policy.

In consequence of the changed regulations concerning personal data protection, and with the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the General Data Protection Regulation, hereinafter referred as GDPR) coming into force on May 25, 2018, we would like to inform you about the purposes and rules applicable when we process your personal data.

Who collects and processes your personal data, i.e., who is a controller of your personal data?

The controller of your personal data is the Company Poznańskie Zakłady Zielarskie “HERBAPOL” S.A., with its registered office in Poznan, at Towarowa 47/51, 61-869 Poznań, registered in the register of entrepreneurs of the National Court Register (KRS) maintained by the District Court Poznań – Nowe Miasto i Wilda in Poznań, 8th Commercial Division of the National Court Register (KRS) with the number: 0000094109 (hereinafter referred to as the Company or PDC).

Contact

A Personal Data Protection Officer was appointed at our Company, who can be contacted by e-mail at: daneosobowe@herbapol.poznan.pl

When and which personal data are collected and processed by us?

We collect and process personal data for the following purposes:

• marketing, concerning the Company’s own products – the legal background for data processing is a legal interest of our Company – marketing of own products and services (Article 6.1.f GDPR),
• sending commercial information by e-mail – only when you give your consent – the legal background for data processing is a consent (Article 6.1.a of GDPR),
• providing a service of a User account management at the PZZ “HERBAPOL” S.A. website and making available the Online Medicine Ordering System to render a service of booking selected products in a pharmacy through a website www.herbapol.poznan.pl. – the legal background for data processing is a contract performance (Article 6.1.b of GDPR),
• sale of products offered by the Company – the legal background for data processing is a contract performance (Article 6.1.b of GDPR),
• handling of complaints, investigation and defence in the event of mutual claims – the legal background for data processing is a legal interest of our Company (Article 6.1.f GDPR),
• ensuring processing of transactions and solving of technical problems – the legal background for data processing is a contract performance (Article 6.1.b of GDPR),
• contacts with a User for purposes related to rendering a service of a User account management at the PZZ “HERBAPOL” S.A. and/or performance of a sales agreement – the legal background for data processing is a contract performance (Article 6.1.b of GDPR),
• for tax and accounting purposes – the legal background for data processing is a fulfilment of legal obligations of the Controller – the Company (Article 6.1.c of GDPR).

What can you do with your personal data?

You are entitled, to the extent specified in relevant legislation, to access your personal details, to rectify, delete or anonymise them or to limit their processing, or to object to their processing, as well as you have a right to move your data, or to withdraw the consent granted at any time. The withdrawal of consent shall not affect the lawfulness of the processing based on consent before its withdrawal.

In the event of any doubts related to the processing of personal data, you can contact the Company with a request for information. Regardless of the above, you have a right to lodge a complaint with the supervisory authority – the President of the Personal Data Protection Office.

If you wish to exercise any of your rights, you can contact PZZ “HERBAPOL” S.A. at daneosobowe@herbapol.poznan.pl

Will your personal data be transferred to any country outside The European Economic Area?

Poznańskie Zakłady Zielarskie “Herbapol” SA do not transfer your personal data to entities operating outside The European Economic Area.

Data profiling

Your personal data will not be processed in an automated way (including profiling) in such a way that this automated processing could result in automated decision-making.

Supplying of personal data is voluntary; however, it is necessary for the conclusion of the agreement with the Company.

Please select an appropriate tab from the list and read the information included in it.

1. PZZ “HERBAPOL” S.A. customers
2. Representatives of PZZ “HERBAPOL” S.A. customers, including, as a contact person, a person authorised to perform specific actions in the customer’s name.
3. Possible customers of PZZ “HERBAPOL” S.A.
4. Persons using contact forms available at websites managed by PDC.
5. Targets for marketing activities.
6. Persons participating in recruitment.
7. The Shareholders.
8. Former employees.
9. Cookies policy.

When you are a customer of PZZ “HERBAPOL” SA:

What purposes are your data processed for?

The Company processes personal data for the following purposes:

• performing an agreement concluded with the Company – the legal background for data processing is a contract performance (Article 6.1.b of GDPR),
• maintaining of books and tax documentation; when your data were provided in the agreement or other documents related to performance by PDC, its obligations result from legal regulations, and in particular from tax and accountancy regulations (Article 6.1.c of GDPR in relation to Article 74.2 of the Accountancy Act of 29 September 1994, and other specific regulations),
• marketing, concerning the Company’s own products – the legal background for data processing is a legal interest of our Company – marketing of own products and services (Article 6.1.f GDPR),
• handling of complaints, investigation and defence in the event of mutual claims – the legal background for data processing is a legal interest of our Company (Article 6.1.f GDPR),
• sending commercial information by e-mail – only when you give your consent – the legal background for data processing is a consent (Article 6.1.a of GDPR),
• for tax and accounting purposes – the legal background for data processing is a fulfilment of the legal obligations of the Controller – the Company (Article 6.1.c of GDPR),
• ensuring the safety of people and property by using visual monitoring recording an image at PZZ “HERBAPOL” S.A., representing a legal interest for data processing by PDC (Article 6.1.f of GDPR),

Supplying of personal data is voluntary; however, it is necessary for the conclusion of the agreement with the Company and for the performance of that agreement.

Period of storage of your personal data

Your personal data will be stored for a period necessary to perform the agreement, and after that period for a statutory limitation period of all claims resulting from an agreement concluded between you and the Company. Additionally, data can be stored by the Company to prevent malpractices and frauds, for statistical and archiving purposes for a period of 6 years from the day of the termination of the above-mentioned agreement or an event resulting in a need of data processing. Your personal data collected on the basis of your consent will be stored until the possible withdrawal of your consent. Furthermore, for accounting purposes the Company will store the data for a period it is obliged to store the data or documents containing such data to document the meeting of legal requirements, including the verification by public authorities of the meeting of these requirements.

Recipients of your personal data

• authorised employees and partners of PZZ “HERBAPOL” S.A.,
• entities providing postal or courier services,
• governmental bodies or other authorised entities under legal regulations, to perform our obligations (Tax Office, Labour Inspectorate, Social Insurance),
• entities enabling us to perform remote payment transactions,
• entities supporting us in our operations under our order, and in particular suppliers of external systems supporting our operations, entities providing software supply services, or maintenance services for software or hardware used by us, accountants, auditors, expert auditors, legal counsellors, and tax counsellors.

When you act as a representative of a PZZ “HERBAPOL” S.A. customer, including, as a contact person, a person authorised to perform specific actions in the customer’s name:

What purposes are your data processed for

The Company processes personal data for the following purposes:

• performance of an agreement concluded by PZZ “HERBAPOL” SA with an entity you represent, and this is understood as a legal interest of PDC (Article 6.1.f of GDPR),
• maintaining of books and tax documentation, when your data were provided in the agreement or other documents related to performance by PDC, its obligations result from legal regulations, and in particular from tax and accountancy regulations (Article 6.1.c of GDPR in relation to Article 74.2 of the Accountancy Act of 29 September 1994, and other specific regulations),
• marketing, concerning the Company’s own products – the legal background for data processing is a legal interest of our Company – marketing of own products and services (Article 6.1.f GDPR),
• handling of complaints, investigation and defence in the event of mutual claims – the legal background for data processing is a legal interest of our Company (Article 6.1.f GDPR),
• sending commercial information by e-mail – only when you give your consent – the legal background for data processing is a consent (Article 6.1.a of GDPR),
• for tax and accounting purposes – the legal background for data processing is a fulfilment of the legal obligations of the Controller – the Company (Article 6.1.c of GDPR),
• ensuring the safety of people and property by using at PZZ “HERBAPOL” SA visual monitoring recording of an image, representing a legal interest for data processing by PDC (Article 6.1.f of GDPR),

Providing your personal details is voluntary, but they are necessary to perform an agreement on behalf of an entity you represent.

Period of storage of your personal data

Your personal data will be stored for a period necessary to perform the agreement, and after that period for a statutory limitation period of all claims resulting from an agreement concluded between the entity you represent and the Company. Additionally, data can be stored by the Company to prevent malpractices and frauds, for statistical and archiving purposes, for a period of 6 years from the day of termination of the above-mentioned agreement or an event resulting in a need of data processing. Your personal data collected on the basis of your consent will be stored until the possible withdrawal of your consent. Furthermore, for accounting purposes the Company will store your data for a period it is obliged to store data or documents containing such data to document the meeting of legal requirements, including enabling the verification by public authorities of the meeting of these requirements.

Recipients of your personal data

• authorised employees and partners of PZZ “HERBAPOL” SA,
• entities providing postal or courier services,
• governmental bodies or other authorised entities under legal regulations, to perform our obligations (Tax Office, Labour Inspectorate, Social Insurance),
• entities enabling us to perform remote payment transactions,
• entities supporting us in our operations under our order, and in particular suppliers of external systems supporting our operations, entities providing software supply services, or maintenance services for software or hardware used by us, accountants, auditors, expert auditors, legal counsellors, and tax counsellors.

When you are a potential customer of PZZ “HERBAPOL” SA:

What purposes are your data processed for?

The Company processes personal data for the following purposes:

• actions undertaken before the conclusion of an agreement, on your request (Article 6.1.b of GDPR),
• marketing, concerning the Company’s own products – the legal background for data processing is a legal interest of our Company – marketing of own products and services (Article 6.1.f GDPR),
• handling of complaints, investigation and defence in the event of mutual claims – the legal background for data processing is a legal interest of our Company (Article 6.1.f GDPR),
• sending commercial information by e-mail – only when you give your consent – the legal background for data processing is a consent (Article 6.1.a of GDPR),
• ensuring the safety of people and property by using at PZZ “HERBAPOL” SA visual monitoring recording an image, representing the legal interest for data processing by PDC (Article 6.1.f of GDPR).

Supplying of personal data is voluntary; however, it is necessary to initiate negotiations that can lead to establishing a cooperation with the Company.

Period of storage of your personal data

Your personal data will be stored until a decision is made concerning the conclusion of the agreement, and after that period for a statutory limitation period of all mutual claims. Your personal data collected on the basis of your consent will be stored until the possible withdrawal of your consent.

Recipients of your personal data

• authorised employees and partners of PZZ “HERBAPOL” SA,
• entities providing postal or courier services,
• entities supporting us in our operations under our order, and in particular suppliers of external systems supporting our operations, entities providing software supply services, or maintenance services for software or hardware used by us, accountants, auditors, expert auditors, legal counsellors, and tax counsellors.

Persons notifying adverse effects

What purposes are your data processed for?

You provide your data to control adverse effects of our products – the legal background for data processing is a fulfilment of legal obligations of the Controller – the Company (Article 6.1.c of GDPR).

Your personal data are processed in accordance with the Pharmaceutical Law, and for statistical and evidence purposes.

Supplying of personal data is voluntary; however, it is necessary for the control of adverse effects of our products.

Period of storage of your personal data

Your personal data will be stored for a period until the expiry of the marketing authorisation for our products, and after that period for a statutory limitation period of all claims resulting from relevant legal regulations. Additionally, data can be stored by the Company to prevent malpractices and frauds, for statistical and archiving purposes or due to an event resulting in the need of data processing. Furthermore, for accounting purposes the Company will store your data for a period it is obliged to store data or documents containing them to document the meeting of legal requirements, including enabling the verification by public authorities of the meeting of these requirements.

Recipients of your personal data

• authorised employees and partners of PZZ “HERBAPOL” S
• entities providing postal or courier services,
• governmental bodies or other authorised entities under legal regulations, to perform our obligations,
• entities supporting us in our operations under our order, and in particular suppliers of external systems supporting our operations, entities providing software supply services, or maintenance services for software or hardware used by us, accountants, auditors, expert auditors, legal counsellors, and tax counsellors.

When PZZ “HERBAPOL” SA undertakes any marketing activities targeted at you:

What purposes are your data processed for?

The Company processes personal data for the following purposes:

• marketing, concerning the Company’s own products – the legal background for data processing is a legal interest of our Company – marketing of own products and services (Article 6.1.f GDPR),
• sending commercial information by e-mail – only when you give your consent – the legal background for data processing is a consent (Article 6.1.a of GDPR),

Supplying of personal data is voluntary; however, it is necessary to send to you marketing and commercial information.

Period of storage of your personal data

Your personal data will be stored until the possible withdrawal of your consent. Furthermore, for accounting purposes the Company will store your data for a period it is obliged to store data or documents containing such data to document the meeting of legal requirements, including enabling the verification by public authorities of the meeting of these requirements.

Recipients of your personal data

• authorised employees and partners of PZZ “HERBAPOL” S.A.,
• entities providing postal or courier services,
• governmental bodies or other authorised entities under legal regulations, to perform our obligations,
• entities enabling us to perform remote payment transactions,
• entities supporting us in our operations under our order, and in particular suppliers of external systems supporting our operations, entities providing software supply services, or maintenance services for software or hardware used by us, accountants, auditors, expert auditors, legal counsellors, and tax counsellors.

Persons participating in recruitment

What purposes are your data processed for?

The Company processes personal data for the following purposes:

• the recruitment process and, following its successful outcome, to conclude an employment agreement, and when you give your consent also for purposes of future recruitment – the legal background for data processing is an initiation of operations on your request before an employment agreement is concluded and, following a successful outcome of the recruitment, the performance of the employment agreement (Article 6.1.b of GDPR), and when you give your consent to participation in future recruitment processes – your consent (Article 6.1.a of GDPR);
• performance of the Company’s legal obligations as an employer in relation to the conducted recruitment process, resulting, amongst others, from the Labour Code regulations, including the prevention of discrimination in employment – the legal background for data processing is the performance of the Company’s legal obligations (Article 6.1.c of GDPR);
• ensuring physical security in the Company’s buildings, including internal and external visual monitoring and registration of people entering and leaving the Company’s premises – thelegal background for data processing is a legal interest of our Company (Article 6.1.f of GDPR),
• management of possible disputes, as well as proceedings involving public authority bodies and other proceedings, including a defence against claims – the legal background for data processing is a legal interest of our Company (Article 6.1.f of GDPR).

Supplying of personal data is voluntary; however, it is necessary for participation in the recruitment process and possible later conclusion of an employment agreement with the Company and the performance of this agreement.

An obligation to provide your personal data, to participate in the recruitment process, results, in particular, from Article 221 of the Labour Code and concerns personal data such as: forename (forenames) and name, parents names, date of birth, address of residence (address for correspondence), education, previous employment.

However, when you provide additional personal details other than those provided for in the relevant legal regulations (e.g., e-mail address, telephone number, hobbies, image) in your application for the recruitment process, then the Company will process these details on the basis of your consent (Article 6.1.a of GDPR).

Sending documents of your application for the recruitment process containing additional personal data is a clear action confirming your consent to the processing of these data by the Company.

Period of storage of your personal data

Your personal data will be stored for a period necessary to conduct the recruitment process, and after that period for a statutory limitation period of all claims resulting from the recruitment process. Furthermore, when the consent to participation in the future recruitment processes is given, your personal details will be stored until you withdraw your consent. Furthermore, for accounting purposes the Company will store your data for a period it is obliged to store data or documents containing them to document the meeting of legal requirements, including enabling the verification by public authorities of the meeting of these requirements.

Recipients of your personal data

• authorised employees and partners of PZZ “HERBAPOL” S.A.,
• entities providing postal or courier services,
• governmental bodies or other authorised entities under legal regulations, to perform our obligations,
• entities supporting us in our operations under our order, and in particular suppliers of external systems supporting our operations, entities providing software supply services, or maintenance services for software or hardware used by us, accountants, auditors, expert auditors, legal counsellors, and tax counsellors.

The Shareholders

What purposes are your data processed for?

The Company processes personal data for the following purposes:

• maintaining a share register, control of shares, payment of your dividends, and meeting other legal obligations of the Company, resulting, amongst others, from the Commercial Companies Code – the legal background for data processing is the performance of the Company’s legal obligations (Article 6.1.c of GDPR);
• ensuring physical security in the Company buildings, including internal and external visual monitoring and registration of people entering and leaving the Company’s premises – the legal background for data processing is a legal interest of our Company (Article 6.1.f of GDPR).
• management of possible disputes, as well as proceedings involving public authority bodies and other proceedings, including a defence against claims – the legal background for data processing is a legal interest of our Company (Article 6.1.f of GDPR).

Supplying of your personal data is voluntary; however, it is necessary to conclude a share sales or purchase agreement and for the correct performance of the Company’s legal obligations.

Period of storage of your personal data

Your personal data will be stored for a statutory limitation period of all claims resulting from legal regulations. Furthermore, for accounting purposes the Company will store your data for a period it is obliged to store data or documents containing such data to document the meeting of legal requirements, including enabling the verification by public authorities of the meeting of these requirements.

Recipients of your personal data

The following persons can have access to your personal data:

• authorised employees and partners of PZZ “HERBAPOL” S.A.,
• entities providing postal or courier services,
• governmental bodies or other authorised entities under legal regulations, to perform our obligations (Tax Office, Labour Inspectorate, Social Insurance),
• entities enabling us to perform remote payment transactions,
• entities supporting us in our operations under our order, and in particular suppliers of external systems supporting our operations, entities providing software supply services, or maintenance services for software or hardware used by us, accountants, auditors, expert auditors, legal counsellors, and tax counsellors.

Former employees

What purposes are your data processed for?

The Company processes personal data for the following purposes:

• meeting the legal obligations of the Company, resulting, amongst others, from the Labour Code – the legal background for data processing is a performance of the Company’s legal obligations (Article 6.1.c of GDPR);
• ensuring physical security in the Company buildings, including internal and external visual monitoring and registration of people entering and leaving the Company premises – the legal background for data processing is the legal interest of our Company (Article 6.1.f of GDPR).
• management of possible disputes, as well as proceedings involving public authority bodies and other proceedings, including a defence against claims – the legal background for data processing is a legal interest of our Company (Article 6.1.f of GDPR).

Period of storage of your personal data

Your personal data will be stored for a statutory limitation period of all claims resulting from legal regulations. Furthermore, for accounting purposes the Company will store your data for a period it is obliged to store data or documents containing them to document the meeting of legal requirements, including enabling the verification by public authorities of the meeting of these requirements.

Recipients of your personal data

The following persons can have access to your personal data:

• authorised employees and partners of the Company,
• entities providing postal or courier services,
• governmental bodies or other authorised entities under legal regulations, to perform our obligations (Tax Office, Labour Inspectorate, Social Insurance),
• entities enabling us to perform remote payment transactions,
• entities supporting us in our operations under our order, and in particular suppliers of external systems supporting our operations, entities providing software supply services, or maintenance services for software or hardware used by us, accountants, auditors, expert auditors, legal counsellors, and tax counsellors.

Cookies policy

We are using cookie files to facilitate for you the use of our website. If you do not disable these files, it means that you agree to them being used and saved in the memory of your device. We would like to remind you that you can manage the cookie files yourself, by changing your browser settings.

Important: our website uses cookie files.

By using our Website, you give your consent to the use of cookie files, some of which may already be saved in the browser folder.

What are cookie files?

Cookie files should be understood as IT data, and in particular text files, stored in the terminal devices of users, intended for the use of internet websites. These files help to recognise the user’s device and display the website in a way adapted to their individual preferences. Usually, cookies contain the name of the website from which they were sent, duration of their storage on the terminal device, and a unique number.

What do we use cookies for?

Cookies are used to adapt website contents to the user’s preferences and to optimise the use of websites. They are also used to create anonymous aggregated statistical data helping to understand how the user uses websites, so that their structure and contents can be improved, excluding personal identification of the user.

Do cookies contain personal data?

Personal data collected with cookies can be collected solely to perform specific functions for the user. Such data are encrypted in a way preventing unauthorised access.

Deleting cookies

Typically, applications used to view websites allow the placing of cookies on the terminal device by default. These settings can be changed in the browser settings, to disable the automatic processing of cookies or inform each time that they are sent to the user’s device. Detailed information about possibilities for and methods of cookies processing are available in the application (browser) settings, usually from the level of the menu “Settings”.

Limiting the use of the cookies may affect some functionalities available on the website.

Which cookies do we use?

Persistent cookies – stored on the user's device for the time specified in the cookie file parameters or until they are manually deleted by the user.

Session cookies – these remain on the user’s device until the user logs out of the website or closes the application (internet browser). We do not use cookies of this type as standard cookies.

Analytical cookies – used by integrated websites, usually, e.g., Google Analytics, and in particular by website users, covered by their own privacy policy.

Can websites be used with cookies disabled?

Normally, disabling cookies in the browser settings does not prevent the use of our services, but may hinder such use. In particular, access to some contents may be difficult, and signing-in is impossible when cookies are disabled.