Who collects and processes your personal data—in other words, who is the controller of your personal data?
The controller of your personal data is Poznańskie Zakłady Zielarskie “HERBAPOL” S.A., with its registered office in Poznań (hereinafter also referred to as the “Company”).
You can contact us via:
- contact form on the website https://www.herbapol.poznan.pl/pl/kontakt
- email: sekretariat@herbapol.poznan.pl
- Contact number: +48 61 886 18 00
- in writing to the Company’s registered office at the address listed above.
The Company has appointed a Data Protection Officer, who can be contacted at the following email address: daneosobowe@herbapol.poznan.pl
When and what personal data do we collect and process?
We collect and process personal data for the following purposes:
- to fulfill the Company’s legal obligations arising from applicable laws, in particular the provisions of the Act of September 15, 2000—the Commercial Companies Code—and the provisions of the Company’s Articles of Association,
- ensuring that the Company facilitates the exercise of the rights and fulfillment of the obligations of shareholders and their proxies,
- marketing of the Company’s own products—the legal basis for data processing is the Company’s legitimate interest—marketing its own products and services (Article 6(1)(f) of the GDPR),
- sending commercial information electronically—only if you have given your consent—the legal basis for data processing is consent (Article 6(1)(b) of the GDPR),
- providing the service of maintaining a User account on the PZZ website “HERBAPOL” S.A. website and to provide access to the Online Medication Ordering System for the purpose of reserving selected products at a pharmacy via the website www.herbapol.poznan.pl. – The legal basis for data processing is the performance of a contract (Article 6(1)(b) of the GDPR),
- the sale of products offered by the Company—the legal basis for data processing is the performance of a contract (Article 6(1)(b) of the GDPR),
- handling complaints, pursuing and defending against any mutual claims—the legal basis for data processing is the Company’s legitimate interest (Article 6(1)(f) of the GDPR),
- to process transactions and resolve technical issues—the legal basis for data processing is the performance of a contract (Article 6(1)(b) of the GDPR),
- to contact the User for purposes related to providing the service of maintaining the User’s account on the PZZ “HERBAPOL” S.A. website and/or the performance of a sales contract—the legal basis for data processing is the performance of the contract (Article 6(1)(b) of the GDPR),
- to protect property and ensure the safety of individuals in the Company’s buildings through internal and external video surveillance and by recording individuals entering and exiting the Company’s premises – the legal basis for data processing is the Company’s legitimate interest (Article 6(1)(f) of the GDPR),
- For tax and accounting purposes, the legal basis for data processing is compliance with a legal obligation to which the controller—the Company—is subject (Article 6(1)(c) of the GDPR).
What You Can Do with Your Personal Data
You have the right, to the extent provided by law, to access your data and to have it corrected, deleted, anonymized, or its processing restricted; the right to object to the processing; the right to data portability, as well as the right to withdraw your consent at any time. Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent prior to its withdrawal.
In case of any doubts regarding the processing of personal data, any person may contact the Company to request information. Notwithstanding the foregoing, you have the right to file a complaint with the supervisory authority—the President of the Personal Data Protection Office.
Will your data be transferred to countries outside the European Economic Area?
Poznań Herbal Products “Herbapol” S.A. does not transfer your personal data to entities operating in European Union member states.
Data Profiling
Your personal data will not be processed automatically (including through profiling) in such a way that any decisions could be made as a result of such automated processing.
Please select the tab that applies to you from the list and review the information it contains.
- Contractors of PZZ “HERBAPOL” S.A.
- A representative of the counterparty, PZZ “HERBAPOL S.A.,” including, as the designated contact person, a person authorized to perform specific actions on behalf of the counterparty.
- Potential counterparties of PZZ “HERBAPOL” S.A.
- Users of the contact forms available on the websites operated by ADO.
- The target audience for marketing activities.
- People participating in the recruitment process.
- Shareholders.
- Former employees.
- Cookie Policy.
If you are a contractor of PZZ “HERBAPOL” SA:
Where do we get your data from? | The data is collected directly from you before the contract is concluded or during its performance. |
Is it necessary for you to provide your information? | Providing the information necessary to submit an offer and subsequently sign and fulfill the contract is a condition for entering into the contract. Refusal to provide this information will result in the inability to submit an offer or enter into the contract. |
Why do we process your data?
The company processes personal data for the following purposes:
- necessary for the performance of a contract concluded with the Company—the legal basis for data processing is the performance of the contract (Article 6(1)(b) of the GDPR),
- maintaining accounting records and tax documentation, if your data was provided in a contract or other documents related to the ADO’s fulfillment of its legal obligations, in particular tax and accounting regulations (Article 6(1)(c) of the GDPR in conjunction with Article 74(2) of the Accounting Act and other specific provisions),
- marketing of the Company’s own products—the legal basis for data processing is the Company’s legitimate interest—marketing its own products and services (Article 6(1)(f) of the GDPR),
- handling complaints, pursuing and defending against mutual claims—the legal basis for data processing is the Company’s legitimate interest (Article 6(1)(f) of the GDPR),
- sending commercial information electronically—only if you have given your consent—the legal basis for data processing is consent (Article 6(1)(b) of the GDPR),
- For tax and accounting purposes—the legal basis for data processing is compliance with a legal obligation to which the controller—the Company—is subject (Article 6(1)(c) of the GDPR),
- to protect property and ensure the safety of individuals in the Company’s buildings through internal and external video surveillance and by recording individuals entering and exiting the Company’s premises – The legal basis for data processing is the Company’s legitimate interest (Article 6(1)(f) of the GDPR).
Providing personal data is voluntary, but necessary for entering into a contract with the Company and for the performance of that contract.
The Period During Which We Retain Your Personal Data
Providing personal data is voluntary but necessary for entering into a contract with the Company and for the performance of that contract. Your personal data is processed for no longer than is necessary to achieve the purposes for which it was collected and to comply with legal requirements. In addition, for accountability purposes, the Company will retain the data for the period during which it is required to retain the data or the documents containing it to document compliance with legal requirements, including to enable public authorities to verify such compliance.
Recipients of Your Personal Data
- authorized employees and associates of PZZ “HERBAPOL” SA,
- entities engaged in postal or courier services,
- to government agencies or other entities authorized by law, for the purpose of fulfilling our legal obligations (Tax Office, National Labor Inspectorate, Social Insurance Institution),
- entities that enable us to process remote payment transactions,
- entities that support us in our operations at our request, in particular providers of external systems that support our operations.
If you are acting as a representative of a PZZ “HERBAPOL” S.A., including as a designated contact person, a person authorized to perform specific actions on behalf of the counterparty:
Where do we get your data from? | Data is collected from the entity on whose behalf you are acting or directly from you. If personal data is provided by the entity on whose behalf you are acting, the Data Controller collects the following information about you: first name, last name, phone number, email address, and job title. |
Is it necessary for you to provide your information? | If you provide personal data directly to the Data Controller, such provision is voluntary but necessary for the Data Controller to perform the contract on behalf of the entity you represent. Failure to provide this data may hinder the performance of the contract. |
Why do we process your data?
The company processes personal data for the following purposes:
- the performance of the contract concluded between PZZ “HERBAPOL” SA and the entity on whose behalf you are acting, which constitutes a legitimate interest of the data controller (Article 6(1)(b) and (f) of the GDPR),
- maintaining accounting records and tax documentation, if your data was provided in a contract or other documents related to the ADO’s fulfillment of its legal obligations, in particular tax and accounting regulations (Article 6(1)(c) of the GDPR in conjunction with Article 74(2) of the Accounting Act and other specific provisions),
- marketing of the Company’s own products—the legal basis for data processing is the Company’s legitimate interest—marketing its own products and services (Article 6(1)(f) of the GDPR),
- handling complaints, pursuing and defending against mutual claims—the legal basis for data processing is the Company’s legitimate interest (Article 6(1)(f) of the GDPR),
- sending commercial information electronically—only if you have given your consent—the legal basis for data processing is consent (Article 6(1)(b) of the GDPR),
- For tax and accounting purposes—the legal basis for data processing is compliance with a legal obligation to which the controller—the Company—is subject (Article 6(1)(c) of the GDPR),
- to protect property and ensure the safety of individuals in the Company’s buildings through internal and external video surveillance and by recording individuals entering and exiting the Company’s premises – The legal basis for data processing is the Company’s legitimate interest (Article 6(1)(f) of the GDPR).
Providing personal data is voluntary, but necessary for entering into a contract with the Company and for the performance of that contract.
The Period During Which We Retain Your Personal Data
Your personal data is processed for no longer than is necessary to fulfill the purposes for which it was collected and the purposes required by law. In addition, for accountability purposes, the Company will retain the data for the period during which it is required to retain the data or the documents containing it to demonstrate compliance with legal requirements, including to enable public authorities to verify such compliance.
Recipients of Your Personal Data
- authorized employees and associates of PZZ “HERBAPOL” SA,
- entities engaged in postal or courier services,
- to government agencies or other entities authorized by law, for the purpose of fulfilling our legal obligations (Tax Office, National Labor Inspectorate, Social Insurance Institution),
- entities that enable us to process remote payment transactions,
- entities that support us in our operations at our request, in particular providers of external systems that support our operations.
People Reporting Adverse Events
Where do we get your data from? | We collect data directly from you or from doctors |
Is it necessary for you to provide your information? | Providing the information necessary to process and respond to your request or question is a prerequisite for receiving a response. Failure to provide this information will result in our inability to respond to your request or question. |
Why do we process your data?
You provide us with your personal data for the purpose of monitoring adverse reactions to our products.
Your personal data is processed in accordance with pharmaceutical law and for statistical and evidentiary purposes.
Providing personal data is voluntary but necessary for the monitoring of adverse reactions to our products.
The Period During Which We Retain Your Personal Data
Personal data will be retained for the period necessary until the expiration of the manufacturing license for our products and, after that period, until the statute of limitations expires for all claims arising under applicable law. In addition, the Company may retain the data for the purposes of preventing abuse and fraud, for statistical and archival purposes, or in the event of a situation requiring data processing. Furthermore, for accountability purposes, the Company will retain data for the period during which it is required to retain the data or documents containing it to demonstrate compliance with legal requirements, including to enable public authorities to verify such compliance.
Recipients of Your Personal Data
- authorized employees and associates of PZZ “HERBAPOL” SA,
- entities engaged in postal or courier services,
- to government agencies or other entities authorized by law, for the purpose of fulfilling our obligations,
- entities that support us in our operations at our request, in particular providers of external systems that support our operations.
If PZZ “HERBAPOL” SA is conducting marketing activities directed at you:
Where do we get your data from? | Data may be collected:
1. directly from you;
2. from the entity on whose behalf you are acting (first name, last name, phone number, email address, job title);
3. from publicly available sources (first name, last name, company name, phone number, email address, job title) |
Is it necessary for you to provide your information? | Providing your information is voluntary. |
Why do we process your data?
The company processes personal data for the following purposes:
- marketing of the Company’s own products—the legal basis for data processing is the Company’s legitimate interest—marketing its own products and services (Article 6(1)(f) of the GDPR),
- sending commercial information electronically—only if you have given your consent—the legal basis for data processing is consent (Article 6(1)(b) of the GDPR),
Providing your personal information is voluntary, but necessary for us to send you marketing and sales information.
The Period During Which We Retain Your Personal Data
Your personal data will be retained until you revoke your consent, if applicable. In addition, for accountability purposes, the Company will retain the data for the period during which it is required to retain the data or the documents containing it to demonstrate compliance with legal requirements, including to enable public authorities to verify such compliance.
Recipients of Your Personal Data
The recipients of personal data will be:
- authorized employees and associates of PZZ “HERBAPOL” SA,
- entities engaged in postal or courier services,
- to government agencies or other entities authorized by law, for the purpose of fulfilling our obligations,
- entities that enable us to process remote payment transactions,
- entities that support us in our operations at our request, in particular providers of external systems that support our operations.
People participating in the recruitment process
Where do we get your data from? | We collect data directly from you and from companies that conduct the recruitment process on our behalf. |
Is it necessary for you to provide your information? | Providing your personal information is necessary to enter into an agreement regarding your participation in the recruitment process. |
Why do we process your data?
The company processes personal data for the following purposes:
- to conduct the recruitment process and, upon its successful completion, to enter into an employment contract; and, if you consent, also for the purpose of conducting future recruitment processes – the legal basis for data processing is taking steps at your request prior to entering into an employment contract and, in the event of a successful recruitment process, the performance of the employment contract (Article 6(1)(b) of the GDPR);
- to fulfill the Company’s legal obligations as an employer in connection with the recruitment process, arising, among other things, from the provisions of the Labor Code, including for the purpose of preventing discrimination in employment – the legal basis for data processing is compliance with a legal obligation to which the Company is subject (Article 6(1)(c) of the GDPR);
- to protect property and ensure the safety of individuals in the Company’s buildings through internal and external video surveillance and by recording individuals entering and exiting the Company’s premises – The legal basis for data processing is the Company’s legitimate interest (Article 6(1)(f) of the GDPR).
- to conduct any litigation, as well as proceedings before public authorities and other proceedings, including for the purpose of defending against claims – the legal basis for data processing is the Company’s legitimate interest (Article 6(1)(f) of the GDPR),
Providing personal data is voluntary, but necessary in order to participate in the recruitment process and, potentially, to subsequently enter into an employment contract with the Company and to fulfill the terms of that contract.
Your obligation to provide personal data in order to participate in the recruitment process stems, in particular, from Article 221 of the Labor Code and applies to personal data such as: first name(s) and last name, parents’ first names, date of birth, place of residence (mailing address), education, and employment history.
However, if in your application for the recruitment process you provide additional personal data beyond what is required by law (e.g., email address, phone number, interests, or a photo), the Company will process such additional personal data based on your consent (Article 6(1)(a) of the GDPR).
By submitting your application documents for the recruitment process that contain additional personal data, you are expressly confirming your consent to the Company’s processing of that data.
The Period During Which We Retain Your Personal Data
Personal data will be retained for the period necessary to conduct the recruitment process, and thereafter until all claims arising from the recruitment process have become time-barred. In addition, for accountability purposes, the Company will retain the data for the period during which it is required to retain the data or the documents containing it to demonstrate compliance with legal requirements, including to enable public authorities to verify such compliance.
Recipients of Your Personal Data
The recipients of personal data will be:
- Employees and associates of PZZ “HERBAPOL” SA
Shareholders
Where do we get your data from? | We collect data directly from you. |
Is it necessary for you to provide your information? | Providing your personal information is necessary to establish and exercise your rights as shareholders of the Company. |
Why do we process your data?
The company processes personal data for the following purposes:
- to fulfill the Company’s legal obligations arising from applicable laws, in particular the provisions of the Act of September 15, 2000—the Commercial Companies Code—and the provisions of the Company’s Articles of Incorporation,
- ensuring that the Company facilitates the exercise of the rights and fulfillment of the obligations of shareholders and their proxies,
- dividend payments,
- to protect property and ensure the safety of individuals in the Company’s buildings through internal and external video surveillance and by recording individuals entering and exiting the Company’s premises – The legal basis for data processing is the Company’s legitimate interest (Article 6(1)(f) of the GDPR).
- in order to maintain the accounting and tax records required by law,
- to conduct any litigation, as well as proceedings before public authorities and other proceedings, including for the purpose of defending against claims – the legal basis for data processing is the Company’s legitimate interest (Article 6(1)(f) of the GDPR),
- arising from the Controller’s legitimate interests,
- and for the following secondary purposes: data archiving, conducting internal audits within the Company, statistical research, or business, economic, or legal consulting services provided to the Company.
Scope of Personal Data Processed
Providing your personal data is necessary to establish and exercise your rights as shareholders of the Company. Failure to provide such data will result in our inability to take the necessary steps to enable the establishment and exercise of your rights and obligations as shareholders of the Company.
The following information is required:
- last name and first name,
- residential address or address for service,
- PESEL number,
- par value, series and number, type of Company shares held, and other information regarding the Company’s shares or the establishment of rights attached to the Company’s shares;
- email address, if you consent to communication via email.
Retention Period for Your Personal Data
Your personal data is processed for no longer than is necessary to fulfill the purposes for which it was collected and the purposes required by law. In addition, for accountability purposes, the Company will retain the data for the period during which it is required to retain the data or the documents containing it to demonstrate compliance with legal requirements, including to enable public authorities to verify such compliance.
Recipients of Your Personal Data
The following individuals may have access to your personal data:
- ADO employees and contractors authorized to process your personal data at the direction of ADO;
- entities engaged in postal or courier services,
- to government agencies or other entities authorized by law, for the purpose of fulfilling our legal obligations (Tax Office, National Labor Inspectorate, Social Insurance Institution),
- entities that enable us to process remote payment transactions,
- entities that support us in our operations at our request, in particular providers of external systems that support our operations
Former employees
Where do we get your data from? | We collect the data directly from you. |
Is it necessary for you to provide your information? | Your submission of this information was necessary for employment purposes |
Why do we process your data?
The company processes personal data for the following purposes:
- to fulfill the Company’s legal obligations arising, among other things, from the Labor Code,
- to protect property and ensure the safety of individuals in the Company’s buildings through internal and external video surveillance and by recording individuals entering and exiting the Company’s premises – the legal basis for data processing is the Company’s legitimate interest (Article 6(1)(f) of the GDPR),
- to conduct any litigation, as well as proceedings before public authorities and other proceedings, including for the purpose of defending against claims – the legal basis for data processing is the Company’s legitimate interest (Article 6(1)(f) of the GDPR),
The Period During Which We Retain Your Personal Data
Personal data will be retained until all claims arising from legal provisions have become time-barred. In addition, for accountability purposes, the Company will retain the data for the period during which it is required to retain the data or the documents containing it to demonstrate compliance with legal requirements, including to enable public authorities to verify such compliance.
Recipients of Your Personal Data
The following individuals may have access to your personal data:
- ADO employees and contractors authorized to process your personal data at the direction of ADO;
- authorized employees and associates of PZZ “HERBAPOL” SA,
- entities engaged in postal or courier services,
- to government agencies or other entities authorized by law, for the purpose of fulfilling our legal obligations (Tax Office, National Labor Inspectorate, Social Insurance Institution),
- entities that enable us to process remote payment transactions,
- entities that support us in our operations at our request, in particular providers of external systems that support our operations
To whom may PZZ “HERBAPOL” SA disclose your personal data?
The following parties may have access to your personal data:
- ADO employees and contractors authorized to process your personal data at the direction of ADO;
- authorized employees and associates of PZZ “HERBAPOL” SA,
- entities engaged in postal or courier services,
- to government agencies or other entities authorized by law, for the purpose of fulfilling our legal obligations (Tax Office, National Labor Inspectorate, Social Insurance Institution),
- entities that enable us to process remote payment transactions,
- entities that support us in our operations at our request, in particular providers of external systems that support our operations.
Cookie Policy
To make it easier for you to use our website, we use cookies. If you do not block these cookies, it means that you consent to their use and storage on your device. Please note that you can manage cookies yourself by changing your browser settings. For more information on this topic, please see our privacy policy. Cookie Policy
Important: Our website uses cookies.
By using this Website, you consent to the use of cookies, some of which may already be stored in your browser’s cache.
What are cookies?
Cookies are defined as IT data—specifically, text files—stored on users’ end devices for the purpose of using websites. These files allow the user’s device to be recognized so that the website can be displayed in a manner tailored to the user’s individual preferences. Cookies typically contain the name of the website from which they originate, the duration for which they are stored on the end device, and a unique number.
What do we use cookies for?
Cookies are used to tailor website content to user preferences and to optimize the user experience. They are also used to generate anonymous, aggregated statistics that help us understand how users interact with our websites, which allows us to improve their structure and content, without personally identifying users.
Do cookies contain personal data?
Personal data collected through cookies may be collected solely for the purpose of performing specific functions for the user. Such data is encrypted in a way that prevents unauthorized persons from accessing it.
Deleting Cookies
By default, web browsers allow cookies to be stored on the user’s device. These settings can be changed to block the automatic use of cookies in your web browser settings or to notify you each time a cookie is sent to your device. Detailed information about the options and methods for managing cookies is available in your browser settings; this is usually accessible through the “Settings” menu.
Restricting the use of cookies may affect some of the features available on the website.
What kinds of cookies do we use?
Persistent cookies – these remain on the user’s device for the duration specified in the cookie settings or until the user manually deletes them.
Session cookies – remain on the user’s device until the user logs out of the website or closes the software (web browser). We do not use this type of cookie as part of our standard cookie settings.
Analytical cookies—used by integrated services, most commonly Google Analytics, for example—and specifically those related to website users, are subject to their own privacy policies.
Is it possible to use the services with cookies disabled?
Disabling cookies in your browser generally does not prevent you from using our services, but it may cause some difficulties. In particular, access to certain content may be restricted, and disabling cookies will prevent you from logging in.
