Privacy Policy of the bsindustrial.com website

1. Controller of personal data

The controller of personal data processed in connection with the use of the website available at https://bsindustrial.com is:

entered in the register of entrepreneurs of the National Court Register kept by the Sąd Rejonowy dla Wrocławia-Fabrycznej we Wrocławiu, VI Wydział Gospodarczy Krajowego Rejestru Sądowego (District Court for Wrocław-Fabryczna in Wrocław, 6th Commercial Division of the National Court Register), under number KRS 0001257795. NIP: 8943291831 · REGON: 545377180 · VAT UE: PL8943291831. Share capital: 5 000,00 PLN, paid up in full.

In all matters concerning the protection of personal data and in order to exercise the rights described in section 11, please contact us: e-mail: [email protected] · telephone: +48 788 868 868 · postal address: as above.

2. What this policy covers

This policy describes the processing of personal data in connection with the public BS Industrial website — browsing it and the contact a visitor may establish with BS Industrial on the basis of the contact details provided on the website.

This policy does not cover the processing of data within:

• user accounts and registration in the BS Industrial system,
• the company panel and the contractor panel,
• the submission and verification of documents evidencing qualifications and authorisations,
• the handling of enquiries and orders and the agreement of cooperation terms within the system,
• analytics tools and visit statistics.

None of these functions is currently made available on the public website. Their launch will be preceded by an update of this policy.

3. Data processed in connection with visiting the website

Opening a website involves — as with any network connection — the transmission of technical data necessary to display it. This data comes automatically from HTTP requests and from the network layer; the visitor does not provide it themselves.

The website is made available through the network and security infrastructure of an external provider and is then served by the BS Industrial server. In this process, the following in particular may be processed:

• IP address,
• date and time of the request,
• host name and the address (path) of the requested resource together with the query parameters,
• HTTP method and response status as well as the response size,
• technical information about the connection and the protocol,
• browser and system identifier (the so-called user agent),
• the address of the referring page, if it was transmitted,
• security-related information, including the approximate location determined on the basis of the IP address — to the extent that such information is used by the network infrastructure provider.

IP address. The visitor’s IP address is transmitted to the BS Industrial server in the request headers and to that extent is processed while the connection is being handled. In the current technical configuration, the access log of the BS Industrial server does not record the public IP address of the visitor — the internal address of the intermediary component is recorded in the client address field. The website application does not keep its own log of individual requests.

Purposes of processing: the correct delivery of the website, network and application security, the prevention and detection of abuse, technical diagnostics and ensuring the availability and correct operation of the website.

Legal basis: Article 6(1)(f) GDPR — the legitimate interest of the controller consisting in making available, securing and diagnosing its own website.

4. Contact by e-mail

The website has no contact form. Contact takes place solely through the e-mail address or telephone number provided.

Links such as “write to us” open the mail program or service configured on the visitor’s device. Clicking the link alone does not transmit any data to BS Industrial. If a visitor sends a message to our e-mail address, the data contained in that message is then processed by BS Industrial and by the e-mail service provider in order to deliver and handle it.

The scope of the data depends solely on the content of the message. It may include, for example: first name and surname, e-mail address, telephone number, company name, position or function, the content of the correspondence, information about the project, as well as attachments and other information voluntarily provided by the sender. Not every one of these categories appears in every message — providing them is a matter for the sender to decide.

Source of the data: directly from the person sending the message and, to the relevant extent, from the entity that person represents.

Purposes of processing: providing a reply, conducting business correspondence, establishing the scope of the expected cooperation, preparing or negotiating cooperation or a contract in a B2B relationship, as well as retaining the correspondence to the extent necessary to establish, pursue or defend claims.

Legal bases. The basis depends on the capacity in which the person contacts BS Industrial:

• Article 6(1)(b) GDPR — where the data subject is personally a party or a potential party to a contract (for example a sole trader running a one-person business) and requests steps to be taken prior to entering into a contract, or where the processing is necessary for the performance of a contract concluded with that person;
• Article 6(1)(f) GDPR — where the person makes contact as an employee, representative, member of a governing body, proxy or contact person of another entity that is or is to be a party to a contract. The legitimate interest of the controller is then the conduct of business correspondence, the negotiation of cooperation with that entity and the documentation of the business relationship. The same basis covers the establishment, pursuit or defence of claims;
• Article 6(1)(c) GDPR — where retaining the documentation becomes necessary in order to comply with a legal obligation to which the controller is subject.

5. Retention periods

Technical data processed by the network infrastructure provider is subject to the retention rules applied by that provider.

6. Recipients of the data

Data may be processed by entities whose services BS Industrial uses in operating the website and e-mail:

Technical data may be processed by Cloudflare in connection with providing network infrastructure, security and the delivery of the website. Correspondence sent to [email protected] is stored and delivered using the e-mail service provided by Migadu-Mail GmbH.

Data may also be disclosed to entities authorised under legal provisions and, where necessary in a particular matter, to professional advisers, for example legal or accounting advisers.

7. Transfers of data outside the European Economic Area

The use of the services indicated in section 6 may involve the processing of data outside the European Economic Area.

Cloudflare, Inc. is an entity established in the United States, and the processing of technical data in its global infrastructure may take place outside the EEA. That provider makes publicly available data processing terms covering the safeguards provided for in Chapter V GDPR, including standard contractual clauses.

Migadu-Mail GmbH is established in Switzerland. In relation to Switzerland, the European Commission has found an adequate level of protection of personal data, which constitutes an independent basis for the transfer of data within the meaning of Article 45 GDPR.

The data subject may obtain information from the controller about the safeguards applied by making contact at the address indicated in section 1.

8. Cookies and similar technologies

In the current version of the website, BS Industrial does not use cookies or similar technologies for analytics, marketing, profiling, user identification or remembering user preferences.

In particular, the website:

• does not store cookies and does not send headers setting cookies,
• does not use analytics tools or visit statistics,
• does not use advertising pixels or tracking tools,
• does not store data in the browser’s local storage (localStorage, sessionStorage, IndexedDB, Cache Storage),
• does not register mechanisms operating in the background (Service Worker),
• does not embed content, fonts, maps, scripts or images originating from third parties.

In the current configuration of the website we do not use technologies for which it would be necessary to obtain the user’s consent by means of a cookie banner, which is why no such banner is currently displayed.

If the website is extended in the future with analytics tools, optional cookies, tracking technologies or other solutions requiring consent, the relevant information and a consent mechanism will be made available before they are launched, and this policy will be updated.

9. Profiling and automated decision-making

Within the public website, BS Industrial does not carry out profiling of visitors and does not take decisions based solely on automated processing that would produce legal effects concerning the visitor or similarly significantly affect them.

10. Voluntary nature of providing data

Merely browsing the website does not require providing any contact details — the technical data described in section 3 is generated automatically as a result of the network connection.

Sending a message to BS Industrial is entirely voluntary. Providing contact details and information about the matter may, however, be necessary if the visitor expects a reply, the preparation of an offer or steps to be taken towards entering into a contract. Without this information it may be impossible to provide a reply.

11. Rights of data subjects

The data subject has — to the extent and on the terms arising from the GDPR — the following rights:

• access to the data and to a copy of it (Article 15 GDPR),
• rectification of inaccurate data or completion of incomplete data (Article 16 GDPR),
• erasure of the data (Article 17 GDPR),
• restriction of processing (Article 18 GDPR),
• objection to processing — in particular to processing based on the legitimate interest of the controller referred to in sections 3 and 4 (Article 21 GDPR),
• data portability — to the extent that the processing is carried out on the basis of a contract and by automated means (Article 20 GDPR).

The scope and effectiveness of individual rights depend on the legal basis and the purpose of the particular processing; some of them may be subject to limitations arising from legal provisions, in particular where further retention of the data is necessary in order to comply with a legal obligation or to establish, pursue or defend claims.

Because the processing described in this policy is not based on consent, the situation of withdrawing consent does not arise. Should any processing in the future be based on consent, it will be possible to withdraw that consent at any time, without affecting the lawfulness of processing carried out before its withdrawal.

In order to exercise the above rights, please contact us at [email protected].

The data subject also has the right to lodge a complaint with the supervisory authority:

12. Changes to the policy

This policy may be updated in the event of a change in the functionality of the website, a change of the service providers involved in the processing of data or a change in the requirements arising from legal provisions. The version currently in force, together with its date, is always published at this address.