Privacy Policy

§1

General provisions

1. This Privacy Policy sets out the principles for the processing and protection of personal data of Users using the Website available at the following internet address: gtvbus.pl, hereinafter referred to as the Website. The document also sets out the rules for the use of cookies.
2. The Website’s Privacy Policy is of purely informational character.
3. The Joint Controllers of the personal data of the Users of the Website, within the meaning of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data and repealing Directive 95/46/W (General Data Protection Regulation) of 27 April 2016. (Official Journal of the European Union L No. 119,
   p. 1), hereinafter referred to as the GDPR, are:
   1. GTV Office Sp. z o.o., ul. Hutnicza 5, 46-040 Ozimek, NIP: 9910514597, KRS 0000696080, info@gtvbus.pl
   2. International Transport Company Sp. z o.o. ul. Hutnicza 5, 46-040 Ozimek, NIP: 9910546249,  KRS: 0000992407, info@gtvbus.pl
   3. Green Bus Logistics Sp. z o.o. ul. Hutnicza 5, 46-040 Ozimek, NIP: 9910546255 KRS: 0000992870, info@gtvbus.pl

                 hereinafter referred to as Joint Controllers and who are also Service Providers of the Website.

1. Contact details of the Joint Controllers: contact is possible at: ul. Hutnicza 5, 46-040 Ozimek or by email at info@gtvbus.pl.
2. A data protection officer Barbara Sośnicka has been appointed, contact with her is possible at: ul. Hutnicza 5, 46-040 Ozimek or by email at: iod@gtvbus.pl.
3. The User’s personal data will be processed in accordance with data protection regulations and the Act of 18 July 2002 on the provision of electronic services (Journal of Laws No. 144, item 1204, as amended).
4. The Joint Controllers will co-manage personal data in accordance with the co-management agreement, the material provisions of which are set out further in this Privacy Policy.
5. The Joint Controllers will use their best endeavours to protect the interests of the data subjects whose data are collected and, in particular, ensure that the data are processed in accordance with the law. Personal data will be collected by the Joint Controllers for defined, legitimate purposes,and will not be subject to further processing incompatible with those purposes. The Joint Controllers declare that the data they collect will be kept in a form that allows the identification of the data subjects for no longer than is necessary to achieve the specific purpose of the processing.
6. The purpose of the Privacy Policy is to set out the actions taken by the Joint Controllers regarding the personal data collected through the Website and the related services and tools used by Users to perform activities such as booking a ride, contacting
   the Service Providers and to perform other activities on the Website.
7. The User who uses the services and tools made available on the Website confirms that he/she has read the provisions of the Website’s Privacy Policy as well as consents, if necessary, to the use of his/her personal data in accordance with the Privacy Policy (for this purpose, he/she will check the relevant boxes, following the messages on the Website).
8. All data collected by the Joint Controllers will be protected using reasonable technical and organisational measures and security procedures to prevent unauthorised access or use.
9. The Joint Controllers of the Website have exclusive access to the data, under the terms of the Privacy Policy. Access to the User’s personal data may also be entrusted to other entities, which collect, process and store personal data in accordance with their rules and regulations and privacy policies. Access to the User’s personal data will be granted to the entities in question only to the extent necessary to ensure the adequate provision of the services. External entities will process the entrusted data only on the basis of the relevant entrustment agreements.
10. The Joint Controllers, as part of the Website, enable the function of applying for job vacancies posted on the Website. Such application is possible by redirecting to the ES-Candidate Website, the administrator of which is ES sp. z o.o. with its registered office in Warsaw, ul. Złota 7/18, 00-019 Warsaw, KRS 0000575902. All rules related to the processing of personal data as well as the rules and regulations can be found on the Website, i.e. https://es-candidate.com/pl/terms/.

§2

Collection, acquisition, scope and purpose of personal data collection

1. The Joint Controllers obtain information about Users by, among other things, collecting server logs through the hosting operator.
2. The data recorded in the server logs are not associated with specific individuals using the Website and are not used to identify individuals using the Website.
3. The server logs are only ancillary material for the administration of the Website, and their contents are not disclosed to anyone other than those authorised to administer the server.
4. The Joint Controllers within the Website may collect personal data of Users and potential Users who contact the Joint Controllers as part of customer service, and which (personal data) are necessary to fulfil a given User request and to contact the User in order to respond. The basis for data processing is Article 6(1)(a) of the GDPR — consent to processing. The legal basis for processing after the possible end of contact will be a legitimate purpose in the form of archiving correspondence for the purpose of demonstrating its course in the future (in accordance with Article 6(1)(f) of the GDPR). If a contract is concluded after contact, the data will be processed on the basis of Article 6(1)(b) of the GDPR.
5. The data provided in connection with the Newsletter subscription will only be used for sending the Newsletter on the basis of the consent given (pursuant to Article 6(1)(a) of the GDPR).
6. The Joint Controllers process the Users’ personal data necessary for the proper implementation of the services available on the Website and are entitled to use the data collected and stored within the Website for the following purposes:
   1. direct marketing of own services (on the basis of Article 6(1)(f) of the GDPR),
   2. provision of comprehensive User support, including booking a ride, resolving technical issues and providing access to relevant features (based on Article 6(1)(b) and (f) of the GDPR),
   3. fulfilment of legal obligations incumbent on Joint Controllers under generally applicable law, i.e. the issuance of VAT invoices and for accounting purposes (pursuant to Article 6(1)(c) of the GDPR),
   4. customisation of the offer and the User’s experience on the Website (based on Article 6(1)(b) and (f) of the GDPR),
   5. contacting the Users, in particular for purposes related to the provision of services, User support, permitted marketing and advertising activities (based on Article 6(1)(a), (b) and (f) of the GDPR),
   6. conducting research and analysis to improve the performance of available services (based on Article 6(1)(b) and (f) of the GDPR),
   7. monitoring the activity of all and specific Users (on the basis of Article 6(1)(f) of the GDPR),
   8. sending the Newsletter (on the basis of Article 6(1)(a) and (f) of the GDPR),
   9. enforcement of the compliance with the Terms and Conditions of the Website (on the basis of Article 6(1)(b) and (f) of the GDPR),
   10. assessment of certain personal factors of the User (based on Article 6(1)(f) of the GDPR).
7. The Joint Controllers may store the data collected and tracked on the Website only for the purposes specified above.\
8. The Joint Controllers reserve the right to filter and block messages sent via the internal messaging system, in particular if they are spam, contain prohibited content or otherwise threaten the security of the Website’s Users.
9. The Joint Controllers are authorised to automatically obtain and record data transmitted to the server by the Users’ web browsers or devices, e.g. IP address, software and hardware parameters, pages viewed, mobile device ID number and other device and system usage data. The collection of the above mentioned data will ensue while using the Website.
10. The Joint Controllers collect, process and store the following User data:
11. e-mail address,
12. full name,
13. telephone number,
14. the address of the journey and the address to be used for the VAT invoice, i.e. country, street, postal code and town/city,
15. other personal data provided by the User in the course of contacting the Service Provider,
16. The Service Providers declare that the provision of data by the User, to the extent indicated above, is voluntary. However, providing them may be necessary to conclude and perform the Agreement for the provision of Services offered by the Website. The scope of the data required to conclude the contract is indicated in advance on the Website and in the Terms and Conditions of the Website.
17. The Joint Controllers may share anonymised data with other entities, including the Website’s partners, in order to identify the attractiveness of advertisements and services to Users, to improve the quality and efficiency of the services provided by the Website or the aforementioned entities, or to participate in research.
18. The Joint Controllers will inform the Users that they entrust the processing of personal data to the following entities:
19. DigitalOcean, LLC 101 6th Ave, New York, NY 10013, United States – for the purpose of storing personal data on the server on which the Website is installed,
20. Freshmail – to use the system for sending the Newsletter,
21. PayU S. A. with its registered office in Poznań, ul. Grunwaldzka 186, 60-166 Poznań, KRS: 0000274399, NIP: 7792308495, REGON: 30052344400000 – to enable electronic and credit card payments for the Service ordered,
22. Stripe, Inc. 510 Townsend Street San Francisco, CA 94103, USA – to enable electronic payment for the booked Service via Apple Pay, Google Pay, Microsoft Wallet.
23. The Joint Controllers hereby inform that they use technology that tracks the User’s actions on the Website:
24. Google Analytics tracking code – in order to analyse the statistics of the Website; information related to Google Analytics can be found at: https://support.google.com/analytics/answer/6004245,
25. Facebook conversion pixel – in order to monitor events on the Website and to manage Facebook ads; information related to Facebook’s use of data collected via the pixel can be found at: https://www.facebook.com/privacy/explanation,
26. Hotjar tracking code – to analyse the behaviour and use of the Website by Users; information related to Hotjar can be found at: https://www.hotjar.com/legal/policies/privacy/.

The data collected by the Google Analytics tracking code, the Facebook pixel and the Hotjar tracking code is anonymous – it does not allow the Joint Administrators to identify any specific individual.

§3

Cookie policy and operational data

1. The Joint Controllers collect the information contained in cookies by automatic means in order to collect data related to the User’s use of the Website. Cookies are small pieces of text that a website sends to the User’s browser and which the browser sends back when the User visits the website again. They are mainly used to maintain a session, e.g. by generating and sending back a temporary ID after login.
2. The Joint Controllers use “session” cookies stored on the User’s terminal equipment until the website is switched off or the User switches off the web browser, and “permanent” cookies stored on the User’s terminal equipment for the time specified in the parameters of the cookies or until they are deleted by the User.
3. The Joint Controllers on the Website use the following types of cookies:
4. “essential” cookies – these are necessary for the proper functioning of the website, enabling the use of the Services available on the Website,
5. security cookies,
6. “performance” / “analytical” cookies – used to obtain information on how Users use the Website,
7. “functional cookies” – these make it possible to “remember” the settings selected by the User
   and adapt the Website to the User,
8. “advertising” cookies – these allow for more personalised advertising to be delivered to Users based on their interests.
9. The Joint Controllers use external cookies for the following purposes:
10. the collection of general and anonymous statistical data via analytical tools: Google Analytics (the controller of the cookies is Google LLC with its registered office in the USA or Google Ireland Limited with its registered office in Ireland),
11. popularisation of the Service by means of the social networking site Facebook.com (external cookie administrator: Facebook Inc. with its registered office in the USA or Facebook Ireland with its registered office in Ireland),
12. collection of general and anonymous statistical data via analytical tools: Hotjar (the controller of cookies is Hotjar Ltd, based in Malta).
13. Google LLC and Facebook Inc are third country entities – the United States – and use appropriate compliance mechanisms such as standard contractual clauses to ensure an adequate level of protection of personal data as required by the GDPR.
14. The Joint Controllers provide the possibility of using the social networking feature, i.e. subscribing to a social profile. In addition, the Joint Controllers allow you to contact them via the chat room displayed on the Website. The use of these functions may involve the use of cookies from web service administrators such as Facebook, Instagram, Skype, YouTube, Messenger, Google Play or the Apple Store.
15. The Joint Controllers provide the possibility of using the function to apply for job vacancies selected by the User. The use of this function may involve the use of cookies by the administrator of the ES-Candidate website, i.e. ES sp. z o.o., based in Warsaw.
16. Cookies adapt and optimise the Website and its offer to the needs of Users through such actions as creating statistics on Website visits and ensuring the safety of its Users.
17. The User can change the cookie settings at any time via his/her internet browser, including the ability to block the collection of cookies.
18. Blocking the collection of cookies or making other changes to the settings concerning cookies on the User’s device may make it difficult or impossible to use the services and tools of the Website.
19. Users who do not wish to use cookies for the purposes described above may delete them manually at any time. For detailed instructions, please visit the website of the manufacturer of the web browser the User is currently using. More information on cookies is available in the help menu of each browser. Examples of web browsers that support these cookies are Internet Explorer, Mozilla Firefox, Google Chrome, and Opera.
20. The Joint Controllers may allow third parties, e.g. advertising providers or analytics providers, to collect information using the above technologies directly on the Website. The data collected in this way is subject to the provisions of the privacy policies developed by these entities.
21. Some third-party entities operating on the Website allow Users to withdraw their consent to their collection and use of data for the purpose of advertising based on the User’s activity. For more information and to make your choice, see for example: youronlinechoices.com.

§4

Rights and obligations of Joint Controllers and Users

1. The Joint Controllers have the right, as well as a statutory obligation, to provide selected or all information concerning the Website’s Users to public authorities or third parties who make such a request for information under applicable Polish law.
2. The Joint Controllers do not entrust the processing of data and do not share the collected personal data with non-affiliated entities without the consent of those concerned, unless the following circumstances apply:
3. The Joint Controllers may use the support of external entities to provide the services they offer, but these entities are not authorised to independently use the personal data processed on behalf of the Joint Controllers, and all their activities are subject to the provisions of the Website Privacy Policy.
4. The Joint Controllers retain the right to share data with public authorities in investigating possible infringements of the law or in combating possible infringements.
5. The User has the right to access his/her personal data at any time and collected by the Joint Controllers. This right includes the possibility of verifying, modifying, supplementing, deleting, restricting the processing of the data, objecting to the processing, transferring the data, stopping the processing of the User’s personal data, as well as the right to withdraw consent to the processing of the data for a specific purpose if the User has previously given such consent, as well as the right to lodge a complaint with a supervisory authority. These rights are available without the necessity to state a reason for exercising them.
6. By accepting the declarations proposed by the Joint Controllers contained in the interactive forms available on the website, the User consents to the processing of personal data for the purposes of providing the services.
7. The User, by accepting the optional statements proposed in the forms, may consent to additional purposes for the processing of his/her personal data.
8. Voluntarily granted consents to receive commercial information and to be sent the Newsletter may be revoked at any time upon the User’s request via the link appearing in each Newsletter. The deletion of the e-mail address takes place automatically by clicking the link. Immediately, and no later than 48 hours after receipt of the declaration of withdrawal of consent, the Joint Controllers remove the User’s data from the contact database used to transmit commercial information by electronic means. At any time, the User can rectify the data provided in connection with his/her Newsletter subscription, request its deletion by unsubscribing from the Newsletter, and request data portability.
9. In order to exercise their rights, the User may at any time send a declaration of intent to the address indicated by the Joint Controllers or by e-mail.
10. The deletion of personal data or the discontinuation of its processing by the Joint Controllers may result in the impossibility of providing the services provided through the Website, or in the restriction of the possibility of using the functionality of the Website.
11. Personal data collected for the purposes specified in the Privacy Policy will be stored for the duration of the services (including electronic services) provided by the Joint Controllers and for the period resulting from the limitation periods for claims, consumer rights, tax law or other rights in this regard (e.g. until the withdrawal of consent to receive the Newsletter or commercial information).

§5

Changes to the Privacy Policy

1. The Website’s offer will be expanded in the future. This means that the Joint Controllers will be obligated or entitled to make changes to the Privacy Policy.
2. New versions of the Privacy Policy will appear on the Website with a corresponding announcement.
3. Any change to the Privacy Policy will be effective from the date of notification of the change by posting it on the Website. Any changes will be appropriately highlighted for a period of one month from the date of the changes to the Privacy Policy.

If you have any further questions about the Website’s Privacy Policy, please contact us at the email address provided by the Joint Controllers.