Definitions

1. Personal data controller / Website Administrator / Administrator – Meest Polska sp. z o.o., with its registered office in Dębica, ul. Drogowców 7, 39-200 Dębica, Poland, entered in the National Court Register by the District Court in Rzeszów, 12th Business Department of the National Court Register, with the reference number KRS 0000259760, Tax Identification Number (NIP): 8722267231, Statistical Business Identification Number (REGON): 180145090, share capital: PLN 990 000.00.

2. Personal data – any information concerning an identified or identifiable natural person.

3. Website – the website placed in the Internet domain www.meestpost.com.

4. User – a natural person with full legal capacity, a natural person running a business, a legal entity or an organizational unit not having legal personality, which uses the Services provided on the Website;

5. Services – services provided by the Website Administrator to Website Users electronically within the meaning of the provisions of the Act of 18 July 2002 on the Provision of Services by Electronic Means (Journal of Laws No. 144, item 1204, as amended);

6. Act on the Provision of Services by Electronic Means – the Act of 18 July 2002 on the Provision of Services by Electronic Means (Journal of Laws No. 144, item 1204, as amended);

7. Carrier – an entity professionally engaged in transporting and delivering goods, providing services in its own name and on its own behalf, in accordance with the Carrier Service Regulations it uses.

General information

This document sets out the principles of the Privacy Policy on www.meestpost.com. The Website Administrator is Meest Polska sp. z o.o., with its registered office in Dębica, ul. Drogowców 7, 39-200 Dębica, Polska, entered in the National Court Register by the District Court in Rzeszów, 12th Business Department of the National Court Register, with the reference number KRS 0000259760, NIP: 8722267231, REGON: 180145090, share capital: PLN 990 000.00. The Website Administrator is also the Personal Data Controller.

The personal data collected by the Website Administrator is processed in accordance with the provisions of Regulation (EU) 2016/679 of the European Parliament and of the Council (EU) of 27/04/2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (OJ EU L 119, p. 1), hereinafter called the GDPR.

The Personal Data Controller makes every effort to protect privacy and the information provided to it, concerning the users of the Website. The Controller selects and uses appropriate technical measures with due care, including programming and organizational ones, to ensure the protection of the data processed, in particular it safeguards the data against being made available to unauthorized persons, disclosed, lost and destroyed, unauthorized modification, as well as being processed in violation of the applicable laws.

Children under 16 years of age do not have the possibility of using the services available on the Website. The Personal Data Controller does not envisage collecting any data concerning children under 16 years of age on purpose.

Personal data

Purposes of and legal grounds for the processing of personal data

The Personal Data Controller processes your personal data for the following purposes and to the following extent:

• to provide the services available on the Website, i.e. browsing the Website pages, a content search engine, a form for running a simulation of the costs of transporting and delivering a parcel, a parcel postage order form, we process the information and data which you voluntarily enter into the Website’s forms and the personal data concerning your activity on the Website, i.e. data concerning the content or services which you browse, data concerning your device session, operating system, browser, location and unique ID, the IP address;

• for the purposes of statistics on the use of the individual functionalities available on the Website, the data provided in the enquiry form, to facilitate the use of the Website and to ensure the information security of the Website, we process the personal data concerning your activity on the Website and the amount of time spent on each subpage of the Website, your browsing history, location, IP address, device ID, data concerning your web browser and operating system. The provision of certain data is a condition for using individual Services and functionalities (obligatory data). Our system marks the obligatory data automatically. If this data is not provided, we are unable to provide specific Services and functionalities. Except for the data marked as obligatory, the provision of other personal data is optional;

• to establish, exercise and enforce legal claims and to defend against legal claims in proceedings before courts and other enforcement authorities, we may process the personal data you provided when ordering services and other data necessary to prove the existence of a claim or data which arises from a legal requirement, court order or other legal procedure;

• to deal with complaints and requests and to answer the Users’ questions, we process the personal data you provide in complaints and requests or to answer questions asked in a different form and certain personal data which you provide, as well as data concerning our Services being the reason for a complaint or request and data contained in the documents enclosed with complaints and requests;

• to send a promotional newsletter about novelties, promotions and offers of the Website and other websites of Meest and the Website Administrator’s business partners by electronic means, we use the personal data you provided in your consent to receiving the newsletter, given on the Website;

• to market our Services and our partners’ services, including remarketing, we process the data concerning your activity on the Website, including the activities which are recorded and stored via cookies, in particular the history of activities, services ordered, browsing history, clicks on the Website, the history and your activity related to our communications with you. In the case of remarketing, we use the data about your activity to reach you with our marketing messages outside the Website and we use the services of external providers for this purpose. These services consist of displaying our messages on websites other than the Website. Detailed information about this topic can be found in the Cookie Information;

• to organize competitions and loyalty programmes, i.e. notifications about the points scored, to notify the winners and to advertise our offer, we use the personal data you provided when registering for a competition or loyalty programme. Detailed information about this topic is provided each time in the terms of participation in a given competition or loyalty programme;

• for the purposes of market research and opinion polls carried out by us or our partners, i.e. information about services, the data you provided when using the services, e-mail address. We do not use data collected as part of market research and opinion polls for advertising purposes. Detailed instructions are given in the information about a given questionnaire or in the place in which you enter your data.

Categories of relevant personal data

The Personal Data Controller processes the following categories of relevant personal data:

• contact details;

• data concerning activity on the Website;

• data concerning orders on the Website;

• data concerning complaints and requests;

• data concerning marketing services.

Freedom to provide personal data

The provision of the required personal data by you is voluntary and is a condition for the provision of services by the Personal Data Controller via the Website.

Duration of data processing

Personal data will be processed for the period necessary to process orders, provide services, carry out marketing activities and render other services to a User. Personal data will be deleted in the following cases:

• when the data subject requests that it be deleted or withdraws their consent;

• when the data subject is not active for more than 10 years (an inactive contact);

• on being informed that the data stored is out of date or inaccurate.

Certain data with regard to: e-mail address, name and surname, may be stored for another 3 years for evidence-related purposes, dealing with complaints and legal claims related to the services provided by the Website – this data will not be used for marketing purposes.

Data concerning orders for paid services, competitions and loyalty programmes will be stored for a period of 5 years from the order delivery date.

Data concerning the Users is stored for a period of time corresponding to the life cycle of the cookies saved on devices or until they are deleted from a User’s device by the User.

Your personal data concerning your preferences, behaviour and selection of marketing content may be used as a basis for making automated decisions to determine the sales opportunities of the Website.

Recipients of personal data

We provide your personal data to the following categories of recipients:

• Carriers – these entities determine the purposes and methods of processing this data on their own, without being subject to our instructions in this regard. Having obtained the Users’ personal data from the Administrator, a Carrier is obliged to fulfil all of its obligations to them under the GDPR;

• State authorities, e.g. the prosecutor’s office, Police, GIODO (General Inspectorate for Personal Data Protection), President of UOKiK (Office of Competition and Consumer Protection), if they ask us to do so;

• providers of the services we use to run the Website, e.g. to process orders.

Data subject’s rights

Under the GDPR you have the right to:

• request access to their personal data;

• request the rectification of their personal data;

• request the erasure of their personal data;

• request restriction of processing of personal data;

• object to the processing of personal data;

• request the portability of personal data.

The Personal Data Controller, without undue delay – and, in any event, within a month of receiving a request – will provide you with information about the measures taken in connection with your request. If need be, the one-month time limit may be extended by another two months due to the complex nature of the request or the number of requests.

In any event, the Personal Data Controller will inform you of such extension within a month of receiving your request, giving the reasons for the delay.

Right of access to personal data (Article 15 of the GDPR)

You have the right to obtain information from the Personal Data Controller whether or not your personal data is being processed.

If the Controller is processing your personal data, you have the right to:

• access the personal data;

• obtain information about the purposes of the processing, the categories of personal data being processed, about the recipients or the categories of recipients of that data, the planned period of storage of your personal data or about the criteria used to determine that period, about your rights under the GDPR and about the right to lodge a complaint with a supervisory authority, about the source of that data, about automated decision-making, including profiling and about the safeguards applied in connection with the transfer of that data outside the European Union;

• obtain copies of your personal data.

If you want to request access to your personal data, please send your request to the following address: info.poland@meest.com.

Right to rectification of personal data (Article 16 of the GDPR)

If your personal data is incorrect, you have the right to request that the Controller rectify your personal data immediately.

You also have the right to request that the Controller complete your personal data.

If you want to have your personal data rectified or completed, please send your request to the following address: info.poland@meest.com.

Right to the erasure of personal data, the so-called “right to be forgotten” (Article 17 of the GDPR)

You have the right to request that the Personal Data Controller should erase your personal data, when:

• your personal data is no longer necessary in relation to the purposes for which it was collected or otherwise processed;

• you have withdrawn the relevant consent, to the extent to which the personal data was processed on the basis of your consent;

• your personal data has been unlawfully processed;

• you have objected to the processing of your personal data for direct marketing purposes, including profiling, to the extent that the processing of personal data is related to direct marketing;

• you have objected to the processing of your personal data with regard to the processing necessary for the performance of a task carried out in the public interest or the processing necessary for the purposes of the legitimate interests pursued by the Personal Data Controller or by a third party.

Despite requesting that personal data should be erased, the Personal Data Controller may continue processing your data for the establishment, exercise or defence of legal claims, of which you will be informed.

If you want to have your personal data erased, please send your request to the following address: info.poland@meest.com.

Right to request that the processing of personal data be restricted (Article 18 of the GDPR)

You have the right to have the processing of your personal data restricted, when:

• you are contesting the accuracy of your personal data – the Personal Data Controller will restrict the processing of your personal data for a period enabling the accuracy of that data to be verified;

• the processing of your data is unlawful, and instead of the erasure of your personal data you will request the restriction of the processing of your personal data;

• your personal data is no longer necessary for the purposes of the processing, but it is required for the establishment, exercise or defence of your legal claims;

• you have objected to the processing of your personal data – pending the verification of whether the legitimate interests of the Personal Data Controller override the grounds set out in your objection.

If you want to have the processing of your personal data restricted, please send your request to the following address: info.poland@meest.com.

Right to object to the processing of personal data (Article 21 of the GDPR)

You have the right, at any time, to object to the processing of your personal data, including profiling, with regard to:

• processing necessary for the performance of a task carried out in the public interest or processing necessary for the purposes of the legitimate interests pursued by the Personal Data Controller or by a third party;

• processing for direct marketing purposes.

If you want to object to the processing of your personal data, please send your request to the following address: info.poland@meest.com.

Right to request the portability of personal data (Article 20 of the GDPR)

You have the right to receive your personal data from the Personal Data Controller in a structured, commonly used and machine-readable format and to transmit it to another personal data controller.

You may also request that the Personal Data Controller should transmit your personal data directly to another controller (where technically feasible).

If you want to have your personal data moved, please send your request to the following address: info.poland@meest.com.

Right to withdraw consent

You may withdraw your consent to the processing of your personal data at any time.

The withdrawal of consent to the processing of personal data does not affect the lawfulness of processing based on your consent before its withdrawal.

If you want to withdraw your consent to the processing of your personal data, please send your request to the following address: info.poland@meest.com.

Lodging a complaint with a supervisory authority

If you consider that the processing of your personal data is in breach of the GDPR, you have the right to lodge a complaint with a supervisory authority, in particular in the Member State of your habitual residence, your place of work or place where the alleged breach occurred.

In Poland, the supervisory authority within the meaning of the GDPR is the Inspector General for the Protection of Personal Data (GIODO).

Cookies

General information

When browsing the Website’s web pages, cookies are used, hereinafter called Cookies which are small text files that are stored on your terminal equipment in connection with the use of the Website. They are used to improve the functioning of the Website’s web pages.

These files allow you to identify the software you use and to adapt the Website individually to your needs.

Cookies usually contain the name of the domain from which they come, the period of their storage on the device and the value assigned to them.

Safety

The cookies we use are safe for your devices. In particular, viruses or other unwanted software or malware cannot enter your devices via Cookies.

Types of cookies

We use two types of cookies:

• session cookies: these are stored on your device and they remain there until a given browser’s session ends. The information saved is then deleted permanently from the memory of your device. The session cookies mechanism does not allow any personal data or any confidential information to be collected from your device;

• persistent cookies: these are stored on your device and they remain there until they are cancelled. They are not deleted from your device, when a given browser’s session ends or your device is switched off. The persistent cookies mechanism does not allow any personal data or any confidential information to be collected from your device.

Purposes

We also use third parties’ cookies for the following purposes:

• presentation of a Certificate of Compliance – via solidnyregulamin.pl – by GP Kancelaria Poniatowska-Maj Strzelec-Gwóźdź sp. p., with its registered office in Kraków;

• preparation of statistics – which help us to understand the way in which Users use the Website, which makes it possible to improve its structure and contents via the analytical tools Google Analytics – by Google Inc., with its registered office in the USA.

To learn about the rules of using cookies, we suggest that you read the privacy policies of the aforementioned companies.

Cookies may be used by advertising networks, in particular the Google network, to display advertisements tailored to your preferences. For this purpose, information about the way you get about the network or the time of use of a website may be stored.

To browse and edit the information about your preferences, collected by the Google advertising network, you may use the tool provided at the following link https://www.google.com/ads/preferences/.

By using your web browser settings or by means of service configuration, you can change your cookie settings on your own and at any time, determining the terms of their storage and of cookies gaining access to your device. You can change these settings so as to block the automatic handling of cookies in your web browser settings or to inform about each time they are placed on your device. Detailed information about the possibility and methods of handling cookies is available in your software (web browser) settings.