1. Personal Data Controller
2. Personal data processing
3. How and why we collect and process your data
4. The purpose of personal data processing
5. Data subject rights
6. Personal data profiling
7. Protection of processed personal data
8. Sharing personal data
1. Cookies
2. Types of cookies and the purposes for which they are used
3. Cookie files handling – how to disable cookies
The Data Controller is Atlas sp. z o.o. with its registered office in Łódź (91-421) at 2 Jana Kilińskiego Street, entered into the Register of Entrepreneurs of the National Court Register under the KRS number 0000264887, REGON 100253695, Tax ID 9471936467, share capital 966,454,700.00 zł, registration number in the BDO database 000011378, registry court District Court for Łódź – Śródmieście in Łódź, 20th Commercial Division of the National Court Register (hereinafter referred to as: “ATLAS” or “Data Controller”).
The Data Controller has not appointed a Data Protection Officer within the meaning of Article 37 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation) (hereinafter referred to as the “GDPR”). All matters related to personal data protection should be reported to the contact details provided below.
Contact details of the Data Controller:
This document sets out the general principles for the processing of personal data and the use of cookies by ATLAS. Detailed information regarding specific processing activities may be further defined in the relevant information clauses provided to Data Subjects.
This privacy policy applies to the processing of personal data of individuals who are the Data Subjects or target audience of:
Personal data means any information relating to an identified or identifiable natural person (‘data subject’) within the meaning of the GDPR.
All personal data are collected and processed by the Data Controller – ATLAS sp. z o.o., in accordance with the GDPR, the Act of 18 July 2002 on the Provision of Services by Electronic Means, and the Act of 12 July 2024 – Electronic Communications Law.
Providing personal data via ATLAS forms is voluntary.
While providing personal data is voluntary, it is a precondition for participating in competitions organized by ATLAS or for receiving a response to inquiries submitted via the contact form In these instances, providing data is a precondition for using the specific feature, and Data Subjects are encouraged to review the Terms and Conditions applicable to that activity.
Regarding marketing campaigns conducted on the Platforms, Data Subject’s personal data may be collected:
In each case, ATLAS collects only the personal data strictly necessary to achieve the specified purpose.
Certain forms provided by the Controller also offer the option to grant consent for the processing of personal data for marketing purposes, the electronic delivery of commercial information, and the use of telecommunications terminal equipment. The specific purposes and scope of these activities are detailed within the respective forms and correspond to the particular requirements of a given program, Platform, or activity.
Every form used by ATLAS to collect personal data includes a comprehensive information clause detailing the identity of the data controller(s), the purposes and methods of processing, the categories of data recipients, and the specific rights afforded to Data Subjects under the GDPR. The scope of this information is tailored to the specific form being used.
All provided data is protected against unauthorised access by third parties and is processed by ATLAS solely for the purposes specified in the respective forms.
Utilizing specific communication channels, such as email or SMS, requires prior consent for the processing of personal data for a defined purpose. Consent may be granted by selecting the appropriate checkbox on a form, providing verbal authorisation during telemarketing calls, or by completing a survey during training sessions organized by ATLAS.
ATLAS processes candidate personal data solely for recruitment and selection purposes, which include evaluating qualifications, verifying information, and communicating throughout the hiring process.
The legal basis for processing personal data is Article 6(1)(b) of the GDPR (steps taken at the request of the data subject prior to entering into a contract) and Article 6(1)(a) of the GDPR regarding any data provided voluntarily.
Personal data may be processed via third-party recruitment platforms in accordance with their respective privacy policies.
Candidate data is processed exclusively for recruitment purposes and is not repurposed for any other use.
We process the personal data necessary for our engagement with you, such as your name, contact information, mailing address, and, where applicable, account details or data related to your participation in competitions. The Website also processes technical and operational data, such as IP addresses and system logs, for the purposes of security monitoring, system administration, and statistical analysis. For marketing campaigns, personal data may also be processed by third-party platforms in accordance with their respective privacy policies.
ATLAS collects, stores, and processes personal data upon the acceptance of Terms and Conditions for specific activities (such as competitions or promotions), through the granting of consent via our digital forms, or upon the submission of an inquiry through our website’s contact forms.
Personal data may also be collected through ATLAS marketing activities on social media and advertising networks, specifically during campaigns designed for lead generation. In these instances, Data Subjects provide personal data to ATLAS voluntarily by completing a form hosted either by ATLAS or by a third-party platform collaborating with ATLAS on a marketing campaign.
ATLAS processes personal data in strict compliance with applicable laws and internal procedures, ensuring a level of security appropriate to the risk. The specific legal basis for processing personal data is disclosed at the time of collection.
Depending on the context, personal data is processed based on the following:
a) Article 6(1)(b) GDPR: To enter into and perform a contract, or to provide specific website functionalities (e.g., user accounts, programs, or competitions).
b) Article 6(1)(a) GDPR: Based on your explicit consent for marketing and communication purposes.
c) Article 6(1)(f) GDPR: To pursue our legitimate interests, including ensuring website security, establishing or defending legal claims, and conducting analytics to improve our services.
d) Article 6(1)(c) GDPR: To fulfil the Controller’s legal obligations, such as accounting and tax requirements.
Comprehensive details for each processing operation are set out in the information clauses provided during data entry, pursuant to the transparency requirements of Articles 13 and 14 of the GDPR.
Personal data is processed solely for the purposes for which it was originally collected and it may only be further processed for statutory requirements or other legitimate interests pursued by the Controller. For instance, if you submit an inquiry via our contact form, the information provided will be used exclusively to address and resolve your request. ATLAS may also process this data to enhance our customer service standards and optimize our internal processes, which constitutes a legitimate interest of the Controller.
The Controller may process personal data for the direct marketing of its own products and services based on its legitimate interests (Article 6(1)(f) GDPR) and such processing will continue until the Data Subject exercises their right to object. In accordance with Electronic Communications Law, any marketing initiatives deployed via regulated electronic channels shall be contingent upon obtaining the Data Subject’s prior consent.
Data processing for lead generation campaigns primarily involves facilitating contact with the Data Subject, delivering commercial and marketing information, and presenting offers and it also includes subsequent marketing initiatives by the Controller, conducted in accordance with the scope of the Data Subject’s consent and applicable laws.
Personal data is retained for the duration necessary to fulfil the purposes for which it was collected. Following the fulfilment of these purposes, data may be stored for periods mandated by applicable law, or until the withdrawal of consent, a valid objection, or an effective request for erasure, depending on the specific legal basis.
Personal data is retained in accordance with the specific purpose of processing and all applicable statutory requirements:
|
Purpose |
Retention period |
|
Accounting and tax documentation |
5 years from the end of the financial year |
|
Recruitment |
Where consent is provided for future recruitment purposes, personal data is retained until such consent is withdrawn, but for no longer than three years from the date of granting. Where consent is granted for a specific recruitment process, personal data is processed only until that process has been formally concluded. |
|
Marketing / newsletter |
Until consent is withdrawn, or, in cases where the Data Controller has a prevailing legitimate interest, until such interest no longer exists. |
|
Loyalty programmes |
Until the conclusion of the programme or the withdrawal of consent, unless a prevailing legitimate interest of the Data Controller exists, in which case processing continues until such interest no longer persists. |
Every data subject has the right to contact ATLAS directly to exercise their rights to access, rectification, and erasure (‘the right to be forgotten’) and additionally, you may request the restriction of processing, obtain a copy of your data, object to processing, or exercise your right to data portability.
Detailed Summary of Data Subject Rights
Requests concerning the exercise of data subject rights should be directed to the Data Controller. Correspondence may be submitted via telephone +48 42 631 88 00 or +48 42 631 77 60, electronic mail odo@atlas.com.pl, or registered post to the following address – Atlas sp. z o.o., ul. Kilińskiego 2, 91-421 Łódź, marked for the attention of the GDPR Department.
Furthermore, participants in promotions or competitions, as well as recipients of marketing communications who have submitted their information via an online form, maintain the right to access and rectify the personal data provided to ATLAS. The aforementioned rights may be exercised by directing a formal request to the email address odo@atlas.com.pl, via alternative means of distance communication, or by written correspondence to the Data Controller’s registered office.
Please note that if a Data Subject requests the erasure of their data, it may preclude further participation in the promotion or competition, as ATLAS will no longer possess the information necessary to administer the entry. Where the Data Controller is subject to statutory retention obligations (e.g., under tax or accounting laws), the erasure of data will be deferred until the expiration of the mandatory retention period. Pursuant to Article 74(2)(4) of the Accounting Act, this period is typically five years, calculated from the start of the year following the financial year in which all related transactions or proceedings were concluded or settled.
You have the right to lodge a complaint with the President of the Personal Data Protection Office if you believe that the processing of your personal data infringes upon the provisions of the GDPR.
Personal data may be subject to standard profiling, which involves the automated analysis of selected information and this process allows ATLAS to better tailor our content, marketing communications, and offers to reflect the specific interests and needs of our Data Subjects.
Categories of Data Used for Profiling:
The underlying logic consists of the systematic assignment of Data Subjects to defined segments based on the processing of aforementioned data points and this methodology facilitates the delivery of bespoke commercial information, ensuring that the Controller’s outreach is optimised for the inferred preferences of the recipient.
The intended outcome of such profiling is the optimisation of commercial communications to the specific needs and professional interests of the Data Subjects.
The profiling activities conducted by ATLAS do not result in automated decision-making and no decisions regarding Data Subjects are made solely on the basis of automated processing which would produce legal effects or similarly significant impacts on their situation.
The Data Subject shall have the right to object to the processing of personal data by submitting a request to the Data Controller via the provided communication channels.
The collected personal data is maintained within a high-security database environment, hosted on servers protected by stringent cybersecurity protocols and physical access controls to prevent unauthorized remote or on-site entry. ATLAS has implemented appropriate technical and organisational measures to ensure a level of security commensurate with the risks associated with the processing of personal data, specifically regarding the protection of the rights and freedoms of Data Subjects. Furthermore, all personnel involved in the processing of personal data have been granted formal authorisations by the Data Controller in accordance with Article 29 of the GDPR.
Highly sensitive information, specifically user passwords, is transmitted exclusively via encrypted protocols (TLS/SSL) to ensure that all data in transit between the user’s device and our servers is protected against unauthorised interception.
ATLAS has established robust Incident Response Procedures designed to identify, mitigate, and resolve security events, including potential personal data breaches and we maintain comprehensive Business Continuity and Disaster Recovery plans to ensure the ongoing availability and resilience of the IT systems used for data processing. In the event of a personal data breach, ATLAS shall strictly adhere to all statutory obligations under applicable law, including the GDPR.
The selection of technical and organisational measures is based on a comprehensive risk assessment regarding the potential impact on the rights and freedoms of Data Subjects and these safeguards are specifically tailored to the nature, scope, context, and purposes of the processing activities to ensure a proportionate level of security.
ATLAS does not sell Data Subjects’ personal data. Personal data may be disclosed to authorised data processors acting on behalf of the Data Controller (pursuant to Article 28 of the GDPR) and such transfers are strictly limited to what is necessary to fulfil our service objectives, including hosting services, data analytics, and the execution of targeted marketing and advertising campaigns. Any data disclosed by ATLAS to its cooperating partners consists of aggregated statistical summaries and these datasets are strictly anonymised, ensuring they do not contain information that would allow for the re-identification of individual Data Subjects. For technical and operational reasons, ATLAS may delegate processing to third parties under Article 28 of the GDPR via a binding legal agreement, provided the original purposes of processing specified above remain strictly unchanged.
Due to the use of third-party tools, personal data may be transferred to third countries outside the EU and the EEA, specifically Sri Lanka. For such transfers, ATLAS ensures an adequate level of protection by implementing Standard Data Protection Clauses approved by the European Commission, pursuant to Article 46 of the GDPR. The recipient of data in the aforementioned third country is IFS SRI LANKA LTD (501 Galle Road, Colombo 06, Sri Lanka) and this entity acts as a sub-processor for our primary provider, Industrial and Financial Systems Central and Eastern Europe Sp. z o.o., and is engaged specifically to provide technical maintenance and support for the IT systems used in sales registration. The Data Subject maintains the right of access to their personal data and may, at any time, request a copy of the information transferred to a third country. Data is transferred in strict accordance with applicable legal frameworks. Such transfers are conducted either on the basis of Adequacy Decisions or through the implementation of appropriate safeguards as mandated by the GDPR.
In connection with marketing campaigns on Platforms, personal data may be processed by service providers acting as independent data controllers or, in specific instances, as joint controllers pursuant to Article 26 of the GDPR. This typically occurs when utilizing tools such as Facebook Lead Ads, where both ATLAS and the platform provider determine the purposes and means of processing.
These providers handle your data according to their own privacy standards and we encourage you to review their individual policies for more information:
The Data Controller utilises cookies and similar technologies (such as advertising pixels and tags) to optimise website performance and provide an enhanced user experience. These tools allow us to deliver personalised content, analyse traffic patterns, and execute targeted marketing and lead generation campaigns across various Platforms.
Cookies and similar technologies are utilised to measure the effectiveness of marketing campaigns, generate statistical insights, and optimise website content. Based on the consents granted, these tools also enable the delivery of personalised advertisements tailored to your interests, both on our website and on third-party Platforms.
To ensure full transparency regarding our data practices, we have adopted this Cookie Policy, which outlines the governing principles and detailed rules for the use of cookies and similar technologies on the ATLAS Website.
Cookies are data packets, specifically text files, stored on the end device of the ATLAS Website Data Subject or the recipient of a marketing campaign conducted via the Platforms. These files are intended to facilitate the use of the ATLAS Website and to measure the effectiveness of marketing campaigns. Cookies typically contain the name of the website from which they originate, their designated storage duration on the end device, and a unique identification number. The entity responsible for placing cookies on the Data Subject’s end device and gaining access to them is ATLAS Sp. z o.o., with its registered office at ul. Jana Kilińskiego 2, 91-421 Łódź, Tax ID PL9471936467, REGON: 100253695, KRS: 264887 (hereinafter referred to as ‘ATLAS‘), as well as the agencies providing technical and operational support for the ATLAS Website.
The term ‘Data Subject’ refers to any individual utilizing the ATLAS Website and its associated sites, communications, and services (hereinafter referred to as the ‘Data Subject‘).
ATLAS utilises cookies and similar technologies to recognise the Data Subject during their visits to the ATLAS Website, retain their preferences, and deliver relevant, personalised content. Through the use of cookies, interactions between the Data Subject and ATLAS are optimised for speed and efficiency. Furthermore, cookies facilitate the delivery of personalised content based on the Data Subject’s observed behaviour, removing the need for repetitive surveys or manual data entry.
Cookies employed by the ATLAS Website are classified into two fundamental types:
and
Session cookies are temporary files stored on the Data Subject’s end device until the user logs out, exits the website, or closes the web browser software.
Persistent cookies are stored on the Data Subject’s end device for the specific retention period defined within the cookie’s settings, or until such time as the Data Subject chooses to remove them.
The ATLAS Website also employs alternative technologies that facilitate the storage of data within the browser’s internal storage mechanisms (Session Storage and Local Storage) and, additionally, the site incorporates analytical scripts from external providers, which allow for the deployment of cookies under the domains of these third-party services. To the extent that these technologies are not strictly necessary for the operation of the website, their use is subject to the Data Subject’s prior consent.
Session cookies are retained on the Data Subject’s end device only until the browser session ends. Persistent cookies remain on the Data Subject’s end device for the specific retention period defined in their parameters or until they are manually deleted by the Data Subject. The retention period for cookies deployed for analytical and marketing purposes varies from several days to several months, depending on the specific cookie type and the configurations set by external tool providers.
Pursuant to Article 399 of the Act of 12 July 2024 – Electronic Communications Law, ATLAS applies a strict classification of cookies, distinguishing between strictly necessary technical cookies and those requiring the Data Subject’s explicit consent.
ATLAS employs the following classifications of cookies across its website:
1. Essential Cookies – these files enable the core functionality of the ATLAS Website. They constitute a mandatory requirement and cannot be deactivated. In the absence of these essential cookies, the ATLAS Website or its individual components may fail to operate correctly.
We utilise the data stored within the aforementioned cookies for the following specific purposes:
To the extent that these cookies constitute personal data, their processing is based on the Controller’s legitimate interests pursuant to Article 6(1)(f) of the GDPR, or on the necessity to perform actions at the request of the Data Subject pursuant to Article 6(1)(b) of the GDPR.
2. Analytical Cookies – these allow us to identify and quantify the number of unique visitors to the ATLAS Website and track traffic sources. This data enables us to monitor performance metrics in real-time and continuously optimise the platform’s functionality. By analysing these metrics, ATLAS continuously improves its service delivery, ensuring that the most relevant information remains readily accessible to all Data Subjects. Analytical cookies are deployed exclusively upon receiving the Data Subject’s prior consent and these tools are utilised to analyse traffic patterns, evaluate marketing initiatives, and continuously optimise the operational performance of the ATLAS Website.
We utilise the data stored within the aforementioned cookies for the following specific purposes:
If the aforementioned files contain personal data, base the legal processing of such data on the Data Subject’s consent pursuant to Article 6(1)(a) of the GDPR.
Disable analytical cookies at any time via the cookie panel, as these files are not technically necessary for the operation of the ATLAS Website. Analytical cookies are used only after the Data Subject grants explicit consent via the cookie panel.
3. Marketing cookies are used to deliver personalised offers for ATLAS products to the Data Subject, appearing on both the ATLAS Website and the platforms of our external business partners.
We utilise the data stored within the aforementioned cookies for the following specific purposes:
Marketing cookies and tracking tools (e.g. Meta pixel, Google Ads, LinkedIn Insight Tag) may be used to:
Data collected through these tools is not used for direct identification, except in cases where a Data Subject voluntarily submits personal information through an online form.
If the aforementioned files contain personal data, base the legal processing of such data on the Data Subject’s consent pursuant to Article 6(1)(a) of the GDPR.
Third-party providers of advertising and analytical systems may deploy cookies and similar technologies on the ATLAS Website to provide the Data Controller with statistical, analytical, or marketing services. These entities may process the personal data of Data Subjects as independent data controllers, in accordance with their own privacy policies.
When visiting the ATLAS website, users can opt out of analytical and marketing cookies via the cookie consent banner. In this instance, the Data Controller will refrain from performing detailed analytics or personalising ads based on cookie data; however, non-targeted general advertisements may still be displayed. Cookie settings can be adjusted at any time via the consent panel.
The Data Subject is entitled to change or withdraw their cookie consent at any time and such withdrawal shall not affect the legality of processing based on consent before its removal.
In most instances, web browsers are configured by default to allow the storage of cookies on the Data Subject’s end device. Users of the ATLAS website may adjust their cookie preferences at any time. Users of the ATLAS website may configure their browser settings to prevent the automatic handling of cookies or to receive a notification whenever a cookie is being stored on their terminal equipment. Detailed information regarding cookie management and available options can be found within your web browser settings. ATLAS advises that restricting the use of cookies may impact the functionality and features available on the ATLAS website. For further information regarding cookies, please refer to the ‘Help’ section of your web browser’s menu.
If you prefer not to have cookies stored on your device, you can adjust your browser settings accordingly. Please refer to the following links for detailed instructions on managing cookie preferences in the most popular browsers:
Mozilla Firefox: HELPDESK
Microsoft Edge: HELPDESK
Google Chrome: HELPDESK
Opera: HELPDESK
Apple Safari: HELPDESK
For further information regarding cookies, please refer to the ‘Help’ section of your web browser’s menu.
Should you have any questions regarding cookies or require information about this Privacy Policy, please contact the Data Controller’s appointed data protection officer via email at: odo@atlas.com.pl.