Privacy Policy

Privacy Policy of Global Certification Body Sp. z o.o. based in Warsaw

Preamble

The team at Global Certification Body Sp. z o.o. (hereinafter referred to as the “Company” or the “Administrator”) ensures that your personal data is processed securely and only to the extent necessary for the services we provide, as well as for evaluation and control processes required by law. The Company has implemented a personal data protection system compliant with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation – GDPR), based on modern IT solutions.

§ 1. Principles of Personal Data Administration

1. The Administrator of your personal data is Global Certification Body Sp. z o.o., ul. Królewska 18, 00-103 Warsaw, KRS 0001054966, REGON 525665948, NIP 7011152119, represented by Adam Sobantka – President of the Management Board (hereinafter referred to as the “Administrator”). You may contact the Administrator via e-mail at: office@gcbcert.com or by post at the company’s registered address.

2. The purposes and legal bases for processing your personal data by the Administrator are as follows:

a) to conclude or perform a contract to which you are a party (legal basis: Article 6(1)(b) GDPR),

b) to comply with legal obligations applicable to the Administrator (legal basis: Article 6(1)(c) GDPR),

c) on the basis of your consent for specified purposes (legal basis: Article 6(1)(a) GDPR),

d) to pursue the legitimate interests of the Administrator, such as business operations and direct marketing (legal basis: Article 6(1)(f) GDPR),

e) to establish, exercise, or defend legal claims (legal basis: Article 6(1)(f) GDPR).

3. The Administrator may entrust the processing of your personal data to verified third-party subcontractors (pursuant to Article 28 GDPR), such as recruitment agencies or accounting service providers, ensuring they apply appropriate technical and organizational measures in accordance with GDPR. Data access may also be granted to institutions financing the Administrator’s activities or to public authorities acting under applicable laws.

4. If the Administrator becomes aware that data of a person under 16 years of age has been provided, the Administrator will seek parental or guardian consent. If consent is not obtained, such data will be immediately deleted. The Administrator does not knowingly process data of minors without legal consent.

5. Personal data will be processed for the period during which a legal basis exists, and thereafter for the period required by applicable laws. Data processed on the basis of consent will be retained until that consent is withdrawn.

6. You have the right to withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing based on consent prior to withdrawal.

7. Your data may be transferred to third countries or international organizations if necessary for the Administrator’s operations. In such cases, the Administrator ensures that the recipient outside the EEA complies with the EU Standard Contractual Clauses adopted by the European Commission.

8. Your personal data will not be subject to automated decision-making, including profiling.

9. You have the right to request access to, rectification, erasure, restriction of processing, data portability, and to object to processing as outlined in Articles 15–22 of the GDPR. Requests may be submitted by post, phone, or e-mail.

10. Providing your personal data is voluntary, but necessary for concluding a contract with the Administrator or fulfilling legal obligations.

11. If you enter into an employment or civil-law contract with the Administrator, or use services related to its business activities, your data will continue to be processed for HR or service purposes. After cooperation ends, data will be archived for the period required by law.

12. By contacting the Administrator via publicly available platforms, such as the company’s website (https://gcbcert.com/), LinkedIn, Facebook, or recruitment portals, you consent to the processing of personal data to the extent specified in the information you provide. Only publicly available data is accessed, and it is not stored in the Administrator’s internal systems unless explicitly provided in private messages. Irrelevant data will be deleted without notice.

13. If you contact the Administrator by post or e-mail, you are deemed to have consented to the processing of personal data within the scope of your correspondence. Data deemed irrelevant to the Administrator’s operations will be deleted without notice.

14. Applicants are asked not to send sensitive data such as identity document copies (except when required by law for non-EU nationals seeking employment in Poland).

15. The Data Protection Officer (DPO) can be contacted at: k.goralczyk@gcbcert.com for any matters regarding personal data processing and exercising related rights.

16. Detailed rules for personal data processing are described in the Company’s internal Data Protection Policy.

§ 2. Cookie Policy

1. The website https://gcbcert.com/ uses cookies.

2. Cookies are small text files stored on your computer or mobile device while browsing the website. They typically include the website’s name, storage duration, and a unique identifier.

3. The Administrator is the entity responsible for processing cookie data.

4. Cookies are used for the following purposes:

a) to tailor website content to user preferences and optimize usability, including recognizing the user’s device,

b) to create anonymous statistics that help improve the website’s structure and content.

5. The Administrator uses the following types of cookies:

a) session cookies – temporary cookies deleted after closing the browser,

b) persistent cookies – remain on the device for a defined period or until deleted,

c) performance cookies – collect information about how the website is used,

d) functional cookies – remember user settings such as language, font size, or layout.

6. By default, web browsers allow cookies to be stored on your device. You may change browser settings to block or delete cookies. Refer to your browser’s help section for instructions.

7. Cookies used on this website may be shared with analytics providers such as Google Analytics.

§ 3. Information Automatically Collected by the Server

1. Certain information about user behavior is processed at the server level to ensure smooth website operation and service management.

2. This data may include:

a) time of website access and browsing,

b) error details that occurred during website use,

c) referring URL (if redirected from another site),

d) browser type,

e) IP address (for identifying access location by country, region, city).

3. The data referred to above is not linked to specific individuals.

4. Such data is used solely for server administration purposes.

§ 4. Final and Legal Information

1. The Administrator reserves the right to amend this Privacy Policy by posting an updated version on the website https://gcbcert.com/ or related online services.

2. If you believe the Administrator has violated your rights or unlawfully processed your personal data, you may file a complaint with the President of the Personal Data Protection Office (UODO) at www.uodo.gov.pl.

3. For additional questions regarding privacy, please contact us at: k.goralczyk@gcbcert.com.

4. This Privacy Policy enters into force on 15 July 2024.