Privacy policy

1. DEFINITIONS
   1. Administrator – GFL Sp. z o. o., with its registered office in Zdunowo, Zdunowo 48, 09-142 Załuski, entered in the Register of Entrepreneurs maintained by the District Court for Łódź Śródmieście in Łódź, 20th Commercial Division of the National Court Register, under KRS number: 0000903453, Tax Identification Number (NIP): 5671837621, National Business Registry Number (REGON): 141215990, with share capital of: PLN 400,000.00.
   2. Personal data – information relating to an identified or identifiable natural person, based on one or more factors specific to their physical, physiological, genetic, mental, economic, cultural or social identity, including the device’s IP address, location data, online identifier and information collected via cookies and other similar technologies.
   3. Policy – this Privacy Policy.
   4. GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.
   5. Website – the website operated by the Administrator at: www.gfl.com.pl.
   6. User – any individual who visits the Website or uses one or more of the services or features described in this Policy.
2. DATA PROCESSING IN CONNECTION WITH THE USE OF THE WEBSITE
   1. In connection with the User’s use of the Website, the Controller collects Personal Data to the extent necessary to provide the specific services offered, as well as information about the User’s activity on the Website. The detailed rules and purposes of processing the Personal Data collected whilst the User is using the Website are set out below.
3. PURPOSES AND LEGAL BASIS FOR DATA PROCESSING ON THE WEBSITE

USING THE WEBSITE

1. The personal data of all users of the Website (including IP addresses or other identifiers, and information collected via cookies or other similar technologies) is processed by the Controller:
   1. for the purpose of providing electronic services relating to the provision to Users of content collected on the Website – in which case the legal basis for processing is that processing is necessary for the performance of a contract (Article 6(1)(b) of the GDPR);
   2. for analytical and statistical purposes – in such cases, the legal basis for processing is the Controller’s legitimate interest (Article 6(1)(f) of the GDPR), which consists of analysing Users’ activity and preferences in order to improve the functionality of the website and the services provided;
   3. for the purpose of potentially establishing and pursuing claims or defending against claims – the legal basis for processing is the Controller’s legitimate interest (Article 6(1)(f) of the GDPR), which consists in protecting its rights.
2. The User’s activity on the Website, including their personal data, is recorded in system logs (a specialised computer program used to store a chronological record containing information about events and actions relating to the IT system used by the Controller to provide services).

The information collected in the logs is processed primarily for purposes related to the provision of services. The Controller also processes it for technical and administrative purposes, to ensure the security of the IT system and to manage that system, as well as for analytical and statistical purposes – in this regard, the legal basis for processing is the Controller’s legitimate interest (Article 6(1)(f) of the GDPR), consisting of carrying out IT and administrative work aimed at maintaining the security and proper functioning of the Website.

CONTACT FORM “Leave a Message”

1. The Data Controller provides a means of contacting them via an online contact form. To use the form, you must provide the personal data necessary to contact you and respond to your enquiry. Providing the data marked as mandatory is required in order to receive and process your enquiry; failure to provide this data will result in the enquiry not being processed. Providing any other data is voluntary.
2. Personal data is processed:
   1. in order to identify the sender and process enquiries submitted via the contact form – the legal basis for processing is that processing is necessary for the performance of a contract for the provision of services (Article 6(1)(b) of the GDPR);
   2. for analytical and statistical purposes – the legal basis for processing is the Controller’s legitimate interest (Article 6(1)(f) of the GDPR), which consists of compiling statistics and analysing enquiries submitted by Users via the Website for the purpose of improving the Website’s functionality;
   3. for the purpose of establishing or pursuing claims or defending against such claims by the Controller – the legal basis for processing is the Controller’s legitimate interest (Article 6(1)(f) of the GDPR), which consists in safeguarding its commercial interests.

REGISTRATION FORM FOR “JOB ALERT” NOTIFICATIONS ABOUT NEW JOB VACANCIES

1. The Controller offers the option to subscribe to “Job Alert” email notifications regarding new job vacancies at the Controller’s company. Personal data will be processed by the Controller for the purpose of sending email notifications containing information about the Controller’s new job vacancies. Providing this data is necessary for the sending of email notifications, and failure to provide it will result in the inability to receive them.
2. Personal data is processed:
   1. to enable the User to view the Controller’s current job vacancies contained in email notifications – the legal basis for processing is the Controller’s legitimate interest (Article 6(1)(f) of the GDPR), consisting in the Controller’s marketing activities in the form of sending email notifications to Users about interesting job vacancies, in connection with their subscription to the ‘Job Alert’ email notifications;
   2. analytical and statistical purposes – the legal basis for processing is the Controller’s legitimate interest (Article 6(1)(f) of the GDPR), which consists of compiling statistics and analyses of the frequency and number of Users subscribing to ‘Job Alert’ email notifications for the purpose of improving the functionality of the Website;
   3. the establishment or pursuit of claims, or the defence against claims by the Controller – the legal basis for processing is the Controller’s legitimate interest (Article 6(1)(f) of the GDPR), which consists in the protection of its commercial interests.

SOCIAL MEDIA PLATFORMS

1. The Controller processes the personal data of Users visiting the Controller’s social media profiles (Facebook, LinkedIn). This data is processed solely in connection with the maintenance of the profile, including for the purpose of informing Users about the Administrator’s activities and promoting various events, services and products. The legal basis for the processing of Personal Data by the Administrator for this purpose is its legitimate interest (Article 6(1)(f) of the GDPR), consisting in the promotion of its own brand.
2. The above information does not apply to data processing by social media platform operators (Facebook). Detailed information on the purpose and scope of data collection by the social media platforms mentioned can be found via the links below:
   1. Facebook: https://www.facebook.com/policy.php
   2. Linkedin: https://pl.linkedin.com/legal/privacy-policy
3. COOKIES AND SIMILAR TECHNOLOGIES
   1. Cookies are small text files stored on the device of a User accessing the Website. Cookies collect information that makes it easier to use the website – for example, by remembering the User’s visits to the Website and the actions they have taken. The controller of the data processed in connection with the use of cookies is GFL Sp. z o.o., with its registered office in Zdunowo. On the Website, the Controller uses its own cookies, which are installed directly by the Website. Third-party cookies – which are cookies from a domain other than that of the visited website – are also used, primarily for the Controller’s analytical purposes.
   2. The website uses cookies primarily to ensure the website functions correctly, to remember the User’s preferences on the site – and, where the User has given their consent – also to analyse and track traffic on the website.
   3. The website operator uses the following categories of cookies: essential, functional and analytical cookies.

ESSENTIAL COOKIES

1. The use of essential cookies by the Administrator is necessary for the website to function properly. These cookies are used, in particular, to remember login sessions or form submissions, as well as for purposes related to privacy settings.
2. The legal basis for data processing in connection with the use of essential cookies is that such processing is necessary for the performance of a contract (Article 6(1)(b) of the GDPR).
3. If you wish to obtain further information about specific files in this category – i.e. the names of individual cookies, a description of how they work, their expiry dates and their origin – please click the “Manage cookies” button, which can be found in section 6 of the Policy, or the cookie icon available on every subpage of the Website. When the cookie banner appears, select the “Customise” button and then expand the “Essential” list.

FUNCTIONAL AND ANALYTICAL COOKIES

1. Functional cookies are used to remember and adapt the Website to the User’s choices, including language preferences. Functional cookies may be set by the Controller and its partners via the Website.
2. Analytical cookies enable us to gather information such as the number of visits and the sources of traffic to the Website. They are used to determine which pages are more popular and which are less so, and to understand how Users navigate the site, by compiling statistics on traffic to the Website. Data processing is carried out to improve the performance of the Website. The information collected by these cookies is aggregated and is therefore not intended to identify the User. Analytical cookies may be installed by the Administrator and its partners via the Website.
3. The legal basis for the processing of data in connection with the use of functional and analytical cookies by the Controller is the Controller’s legitimate interest (Article 6(1)(f) of the GDPR), which consists in ensuring the highest quality of services provided on the Website, in connection with the User’s consent to their storage (separate consent for analytical cookies and separate consent for functional cookies).
4. The processing of data in connection with the use of functional and analytical cookies is subject to the User’s consent to the use (separately) of functional and analytical cookies via the cookie consent management platform. This consent may be withdrawn at any time via this platform.
5. If you wish to obtain further information about specific files in these categories – i.e. the names of individual cookies, a description of how they work, their expiry dates and their origin – please click the “Manage cookies” button, which can be found in section 6 of the Policy, or the cookie icon available on every subpage of the Website. When the cookie banner appears, select the “Customise” button and then expand the list to “Functional”, “Analytics” or “Performance” as appropriate.
6. ANALYTICAL AND MARKETING TOOLS USED BY THE CONTROLLER’S PARTNERS
   1. The Administrator and its Partners use various solutions and tools for analytical and marketing purposes. Below is some basic information about these tools. Further details can be found in the privacy policy of the relevant partner.

GOOGLE ANALYTICS

1. Google Analytics cookies are files used by Google to analyse how Users use the Website and to compile statistics and reports on the Website’s performance. Google does not use the collected data to identify the User, nor does it combine this information to enable identification. Detailed information on the scope and principles of data collection in connection with this service can be found at the following link: https://www.google.com/intl/pl/policies/privacy/partners.
2. MANAGING COOKIE SETTINGS
   1. The use of cookies to collect data, including accessing data stored on the User’s device, requires the User’s consent. On the Website, the Controller obtains the User’s consent via a cookie consent management platform. This consent may be withdrawn at any time in accordance with the rules set out in section 6.3 below.
   2. Consent is not required only in the case of cookies whose use is essential for the provision of a telecommunications service (data transmission for the purpose of displaying content). Users cannot opt out of these cookies if they wish to use the Website.
   3. You can withdraw your consent to the use of cookies on the Website via the cookie consent management platform. You can return to the cookie banner by clicking the ‘Manage cookies’ button below or the cookie icon available on every page of the Website.
   4. Once the banner has appeared, you can withdraw your consent by clicking the ‘CUSTOMISE’ button. Then, move the slider for the relevant cookie category and click the ‘SAVE MY PREFERENCES’ button.
   5. You can also withdraw your consent by changing your browser settings. Further information on this can be found via the links below:
      1. Internet Explorer: https://support.microsoft.com/pl-pl/help/17442/windows-internet-explorer-delete-manage-cookies;
      2. Mozilla Firefox: http://support.mozilla.org/pl/kb/ciasteczka;
      3. Google Chrome: http://support.google.com/chrome/bin/answer.py?hl=pl&answer=95647;
      4. Opera: http://help.opera.com/Windows/12.10/pl/cookie.html/;
      5. Safari: https://support.apple.com/kb/PH5042?locale=en-GB.
   6. You can check the status of your current privacy settings for your browser at any time using the tools available via the links below:
      1. http://www.youronlinechoices.com/pl/twojewybory;
      2. http://optout.aboutads.info/?c=2&lang=EN.
3. PERIOD OF PROCESSING OF PERSONAL DATA
   1. The period for which the Controller processes data depends on the type of service provided and the purpose of the processing. As a general rule, data is processed for the duration of the service, until consent is withdrawn or a valid objection is raised against the processing of data in cases where the legal basis for the processing is the Controller’s legitimate interest.
   2. The data processing period may be extended where processing is necessary for the Controller to establish and pursue potential claims or to defend against claims; after this period, data may only be retained where and to the extent required by law. Once the processing period has expired, the data is permanently deleted or anonymised.
4. USER RIGHTS
   1. You have the right to access your personal data and to request that it be corrected, erased or that its processing be restricted; you also have the right to data portability and the right to object to the processing of your personal data, as well as the right to lodge a complaint with the supervisory authority responsible for personal data protection.
   2. Where your personal data is processed on the basis of your consent, you may withdraw that consent at any time by contacting the Data Controller.
   3. The User has the right to object to the processing of data for marketing purposes if such processing is carried out on the basis of the Controller’s legitimate interest, as well as for reasons relating to the User’s particular situation – in other cases where the legal basis for data processing is the Controller’s legitimate interest (e.g. in connection with analytical and statistical purposes).
5. DATA RECIPIENTS
   1. In certain cases, where necessary to achieve the purposes described above, Personal data will be disclosed to external entities providing services to the Controller (e.g. IT service providers, customer relationship management service providers, providers of cookie consent management services and tools, analytics companies) and to entities affiliated with the Controller, including companies within its group.
   2. If the User’s consent is obtained, their data may also be shared with other entities for their own purposes, including marketing purposes.
   3. The Administrator reserves the right to disclose selected information concerning the User to the relevant authorities or third parties who request such information, on an appropriate legal basis and in accordance with the provisions of applicable law.
6. TRANSFER OF DATA OUTSIDE THE EEA
   1. The level of protection afforded to personal data outside the European Economic Area (EEA) differs from that provided by European law. For this reason, the Controller transfers personal data outside the EEA only where necessary, and provided that an adequate level of protection is ensured, primarily through:
      1. cooperation with entities processing personal data in countries in respect of which the European Commission has issued a decision confirming that an adequate level of protection of personal data is ensured;
      2. the use of standard contractual clauses issued by the European Commission;
      3. the application of binding corporate rules approved by the competent supervisory authority.
   2. The controller always informs data subjects of its intention to transfer personal data outside the EEA at the time of collection.
7. PERSONAL DATA SECURITY
   1. The Data Controller conducts ongoing risk assessments to ensure that Personal Data is processed securely – ensuring, above all, that access to the data is restricted to authorised persons and only to the extent necessary for the performance of their duties. The Controller ensures that all operations involving Personal Data are recorded and carried out only by authorised staff and associates.
   2. The Controller shall take all necessary measures to ensure that its subcontractors and other cooperating entities also guarantee the implementation of appropriate security measures whenever they process Personal Data on the Controller’s behalf.
8. CONTACT DETAILS
   1. You can contact the Data Controller by sending an email to: info@gfl.com.pl, or by post to the Data Controller’s registered address: GFL sp. z o. o., with its registered office in Zdunowo, Zdunowo 48, 09-142 Załuski.
   2. The Controller has appointed a Data Protection Officer, who can be contacted by email at iod@green-factory.com or in writing at the Controller’s registered office address regarding any matter relating to the processing of personal data.
9. CHANGES TO THE PRIVACY POLICY
   1. The policy is reviewed on an ongoing basis and updated as necessary.
   2. The current version of the Policy was adopted and came into force on 1 April 2026.