Privacy policy and cookies

In accordance with the requirements of REGULATION (EU) 2016/679 OF THE EUROPEAN PARLIAMENT AND OF THE COUNCIL of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) hereinafter referred to as the “Regulation”, we would like to inform you that:

1. Personal data administrator

The administrator of personal data hereinafter referred to as “Administrator” is company Yellows Sp. z o.o. with its registered office in Warsaw at ul. Waszkowskiego 7, 02-913 Warszawa, registered at the District Court for the capital city of Warsaw in Warsaw, 13th Commercial Department of the National Court Register under the number KRS 0000654561, NIP: 5213760803 REGON: 366147930, The personal data administrator is responsible for the use of personal data in a secure manner, consistent with the purposes for which they were collected and in accordance with applicable law.

2. Contact

Email: rodo@yellows.pl

Correspondence address: ul. Waszkowskiego 7, 02-913 Warszawa

Telephone number: 507 390 040

Data Protection Officer data

Email: rodo@yellows.pl

Michał Kuls

Correspondence address: ul. Waszkowskiego 7, 02-913 Warszawa

Telephone number: 507 390 040

General provisions

We use the collected personal data only for specific, legitimate purposes for which it was collected. The scope of personal data, the purpose of their processing, the legal basis for such processing, the processing period and categories of data recipients result from the legal requirements incumbent on the Administrator and from the nature and scope of activities undertaken by the data subject.

3. The purpose of data processing by the Administrator

• Purpose of data processing: Taking action at the request of the data subject, before concluding the contract (e.g. preparation of the offer), legal basis for processing: Article 6 (1)(b) Regulation (“performance of a contract”)
• Retention period: The data is stored for the period necessary for contract performance, termination or expiration and for the period after which any possible claims expire.
• Purpose of data processing: Conducting direct marketing, legal basis for processing: Article 6 (1)(f) Regulation (“legitimate interests of the Administrator”)
• Retention period: The data is stored for the duration of the legitimate interest pursued by the Administrator and for the period after which any possible claims expire. In the event of an effective objection regarding the use of his personal data by the data subject, the Administrator will no longer process this data for direct marketing.
• Purpose of processing: Electronic transmission of advertising content information regarding the offer of Yellows Sp. z o.o., legal basis for processing: Article 6 (1)(a) Regulation (“consent of the data subject”)
• Retention period: The data is stored until the data subject withdraws his consent for further processing of his data for marketing purposes. Consent can be withdrawn at any time using the opt-out link placed in every message.
• Purpose of processing: Electronic transmission of information about Yellows Sp. z o.o. events, legal basis for processing: Article 6 (1)(a) Regulation (“consent of the data subject”)
• Retention period: The data is stored until the data subject withdraws his consent for further processing of his data for marketing purposes. Consent can be withdrawn at any time using the opt-out link placed in every message.
• Purpose of processing: Electronic transmission of information about new expert publications of Yellows Sp. z o.o., legal basis for processing: Article 6 (1)(a) Regulation (“consent of the data subject”)
• Retention period: The data is stored until the data subject withdraws his consent for further processing of his data for marketing purposes. Consent can be withdrawn at any time using the opt-out link placed in every message.
• Purpose of data processing: Electronic transmission of expert publications of Yellows Sp. z o.o. based on the user’s request, legal basis for processing: Article 6 (1) (a) Regulation (“consent of the data subject”)
• Retention period: The data is stored until the data subject withdraws his consent for further processing of his data for marketing purposes. Consent can be withdrawn at any time using the opt-out link placed in every message.
• Purpose of data processing: Sending the Yellows Sp. z o.o. newsletter, legal basis for processing: Article 6 (1)(a) Regulation (“consent of the data subject”)
• Retention period: The data is stored until the data subject withdraws his consent for further processing of his data for marketing purposes. Consent can be withdrawn at any time using the opt-out link placed in every message.
• Purpose of data processing: Customer feedback, legal basis for processing: Article 6 (1)(a) Regulation (“consent of the data subject”)
• Retention period: The data is stored until the data subject withdraws his consent for further processing of his data for this purpose.

4. Data recipients

In order to perform the contract and to ensure the proper functioning of the Administrator’s websites, he uses the services of external entities cooperating with him (for example: post office, couriers, payment processing operators). Personal data is transferred to external entities only if and to the extent that it is necessary to achieve the purpose of processing. Personal data provided may be used by external entities only to perform the task ordered by the Administrator.

Personal data may be transferred to the following recipients cooperating with the Administrator:

• entities conducting postal, courier and similar activities (e.g. courier brokers) – to the extent necessary to complete the delivery and correspondence,
• entities providing technical support services to the Administrator and IT solution providers enabling the Administrator to operate (for example a software providers, e-mail and hosting services providers) – the Administrator provides personal data to a trusted supplier acting on his behalf only in the case and to the extent necessary to achieve a specific purpose of processing
• providers of solution for expressing / publishing customer opinions – to the extent necessary to express an opinion.

5. Transfer of data outside the European Economic Area

Personal data may be transferred outside the European Economic Area (including the European Union, Iceland, Liechtenstein and Norway) to Google LLC on the basis of an appropriate legal safeguards, which are standard contractual clauses for the protection of personal data approved by the European Commission. See also section 9 Web analysis.

6. Rights of the person whose data is processed by the Administrator

The processing of personal data does not require consent, if, among others: processing is necessary to perform the contract or take action before the conclusion of the contract, results from the legal obligation incumbent on the Administrator or is necessary for the pursuance of the legitimate interest of the Administrator. If consent is necessary to be able to process personal data for a specific purpose (e.g. consent to the use of cookies), the Administrator asks for such consent. The consent given may be withdrawn at any time.

In the event of withdrawal of consent, the data will no longer be processed to the extent that the consent concerned, but withdrawal of consent will not affect the lawfulness of the processing that was carried out on the basis of consent before its withdrawal.

On the terms set out in the Regulation, the data subject also has the right to request from Administrator an access to personal data concerning him, right to rectify his data, delete it (“be forgotten”) or limit its processing, the right to object to processing, as well as the right to transfer data.

If personal data is processed for the purposes of direct marketing, it is possible to object at any time to the processing of this data for the purposes of marketing, including profiling, to the extent that the processing is related to direct marketing.

In order to exercise the above stated rights, an application shall be submitted to the Administrator by e-mail, letter or by submitting an application in person at the Administrator’s registered office. The Administrator’s contact details are provided at the beginning. To ensure that the person submitting the application is entitled to submit it, the Administrator may ask for additional information confirming the applicant’s identity.

The provisions of the Regulation show to what extent each of these rights can be exercised. This will depend in particular on the legal basis and the purpose of processing personal data by the Administrator. The above stated rights can be exercised free of charge no more than once every 6 months. According to Article 12 of the Regulation, if the requests of the data subject are manifestly unjustified or excessive, in particular due to its continuous nature, the Administrator may charge a fee.

The data subject has the right to lodge a complaint with the supervisory body, i.e. to the President of the Office for Personal Data Protection.

7. Use of data for advertising purposes

             a.  Newsletter

Newsletter and other marketing messages are sent only to those Users who have given their consent and provided their e-mail address. At any time, consent to receive the newsletter may be withdrawn by clicking on the unsubscribe link provided in each newsletter or by contacting the Administrator at the address given above.

             b.  Cookies

The Administrator’s websites use cookies i.e. text files saved on the User’s device. These files enable the analysis of the way the website is used and identify the User’s web browser. By entering the appropriate browser settings the installation of cookies can be blocked – this may limit the functionality of the website

The Administrator may process the data contained in cookies for anonymous analysis of the activities of visitors, study of their behaviour (e.g. opening specific pages) in order to provide them with advertisements tailored to their anticipated interests, also when they visit other websites that are partners in the advertising network Google Inc. and Facebook Ireland Ltd. and to improve the administration of the Administrator’s websites.

             c. Onsite Targeting 

The administrator uses cookies to analyse the activities of visitors (e.g. opening specific subpages) and may present the User with advertisements and /or special offers.

             d.  Retargeting, third-party cookies and data collection by third parties for advertising purposes

The Administrator’s websites use retargeting technology (remarketing).

The Administrator uses the services of third parties that use cookies on the Administrator’s website, they are:

Google Analytics, Universal Analytics and Google Remarketing provided by Google Inc. (1600 Amphitheater Parkway, Mountain View, CA 94043, USA). Detailed information on the operation of the above services is available at www.google.com/intl/pl/policies/privacy/partners see also https://policies.google.com/privacy/update?hl=pl&gl=pl

and Facebook Pixel service provided by Facebook Ireland Limited (4 Grand Canal Square, Grand Canal Harbor, Dublin 2, Ireland). Detailed information available at https://www.facebook.com/about/privacy

             e. How can you block the saving of cookies?

To block the saving of cookies, the User should turn on the settings in the web browser that allow the acceptance of saving cookies only if he agrees.

To accept the use of Administrator cookies, while blocking the use of third-party cookies, select “Block cookies from third party websites” in your browser settings.

8. Server files

The web browser provides data on user activities on the Administrator’s websites, which are saved in server log files. Data records saved in this way contain the following data: date and time of download, name of the page opened, amount of data downloaded, as well as information about the product version of the web browser used, IP address, URL of the reference page (address of the page from which the user was redirected), .

The server log file data records are analysed to remove errors, manage server performance, protect against DDoS attacks and customize the offer.

9. Internet analysis

The Administrator uses the Google Analytics website analytics service provided by Google. Google Analytics analyses user’s behaviour on the website through the use of cookies. The information generated by cookies regarding the use of the website by the user (including his IP address) is transmitted to Google and may be stored by it on servers in the United States. Google will use this information to analyse use of the website by the user, create reports for websites using Google Analytics, and provide other services. Google may also transfer this information to third parties, as required by law or where third parties process this information on behalf of Google.

By using the website, the User consents to the processing of data concerning him by Google in the manner and for the purposes set out above.

The website is analysed by Google Analytics with the extension “_anonymizeIp ()” and therefore IP addresses are processed only in abbreviated form, which makes it impossible to directly associate the address with a given User.

The user may opt out of cookies by entering the appropriate browser settings. This may limit the functionality of the website and it may make it impossible to use all of its functions.

Consent to the collection and storage of personal data can be withdrawn at any time with effect for the future, for example using the Google Analytics Opt-Out tool:

https://tools.google.com/dlpage/gaoptout

In order to prevent the transmission of data generated by the cookie regarding the User’s use of the website (including the IP address) to Google and the processing of this data by Google, simply download and install the blocking plugins available at the following address: https://tools.google.com/dlpage/gaoptout?hl=en

10. Automated decision making and profiling

Personal data will not be used to make automated decisions that trigger legal effects on the data subject, including profiling.

11. Final Provisions

The Administrator’s websites may contain links to other websites. Such websites operate independently of the Administrator and are not supervised by the Administrator in any way. The Administrator recommends that after navigating to other pages,  their own privacy policies should be read. The Administrator is not responsible for the rules of handling data on these pages.