Privacy Policy

In order to ensure the highest standard of protection for your personal data, we have prepared this Privacy Policy. In this document, you will find the principles on which the processing of personal data is based while using our website, as well as how cookies operate. Please familiarize yourself with this information if you use our website.

Table of Contents:

1. Definitions
2. Introduction
3. Personal Data and Purposes of Processing
4. Requirement to Provide Data and Legal Bases for Processing Personal Data
5. Period of Personal Data Processing
6. Data Recipients
7. Cookies – Types of Cookies, Their Storage Period, and How to Withdraw Consent for Their Installation
8. Social Media Plugins
9. Data Transfer to Third Countries
10. User Rights
11. Final Provisions

1. Definitions

1.1. Website – the website https://www.polfarmex.pl operated by Polfarmex S.A. with its registered office in Kutno, ul. Józefów 9, 99-300 Kutno.

1.2. GDPR – means the Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC.

1.3. Personal Data Controller – the entity that determines the purposes and means of the processing of personal data within the meaning of Article 4(7) of the GDPR. The personal data controller of the website users is Polfarmex S.A. with its registered office in Kutno, ul. Józefów 9, 99-300 Kutno.

1.4. Foundation – the Wośko Family Foundation with its registered office in Siemienice, Siemienice 18, 99-314 Krzyżanów.

1.5. User – any person visiting the Polfarmex S.A. website. In the case of correspondence with the Foundation, the personal data controller is the Foundation.

1.6. Personal Data – means any information relating to an identified or identifiable natural person (“data subject”); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person (in accordance with Article 4(1) of the GDPR).

1.7. Cookies – small text files saved on the user’s computer or mobile device while using the Website.

2. Introduction

2.1. Maintaining confidentiality, protecting data, and respecting the rights of individuals whose data are processed are extremely important to Polfarmex S.A., and we want every person whose data we process to know that we comply with the requirements of the GDPR. Consequently, Polfarmex S.A. applies appropriate data protection measures, continuously monitors data security, and actively responds to identified threats and any requests from individuals whose data are concerned.

2.2. Data security should be understood as ensuring their confidentiality, integrity, availability, and accountability through the implementation and operation of the necessary technical mechanisms and organizational procedures.

2.3. The purpose of presenting this information is to protect the interests of the data subjects by providing access to essential information and enabling the exercise of the rights available to every person whose personal data are processed by the Polfarmex S.A. website.

3. Personal Data and Purposes of Processing

3.1. Personal data, depending on individual needs, will be processed for the following purposes:

1. receiving and handling applications to Polfarmex S.A. and the Foundation,
2. conducting correspondence, responding to questions and requests addressed to Polfarmex S.A. and the Foundation,
3. receiving and registering reports of adverse effects of medicinal products and forwarding this information to the appropriate authority.

4. Requirement to Provide Data and Legal Bases for Processing Personal Data

4.1. The processing of personal data is necessary to achieve the above-mentioned purposes; however, the provision of data is voluntary.

4.2. The legal basis for processing personal data will be Article 6(1)(f) of the GDPR when the data are processed in the legitimate interest of Polfarmex S.A. The legitimate interest of Polfarmex S.A. is to handle correspondence conducted using dedicated contact forms on the Polfarmex S.A. website (point 3.1. sub-points 1-2).

4.3. Due to the nature of the Company’s activities, the legal basis for processing personal data will also be the fulfillment of the Company’s obligations arising from legal regulations (Article 6(1)(c) of the GDPR), such as receiving reports and registering adverse drug reactions. The legal basis for processing is provided by Article 9(2)(i) of the GDPR, i.e., processing is necessary for reasons of public interest in the area of public health, including ensuring high standards of quality and safety of medicinal products. The legal obligation arises from Articles 36d, 36e, and 36g of the Pharmaceutical Law Act of 6 September 2001. The provision of data is necessary to fulfill the above-mentioned legal obligations of the controller; without providing the required data, it is not possible to accept and register a report (point 3.1. sub-point 3).

5. Period of Personal Data Processing

5.1. Personal data processed for the purposes of correspondence and responding to inquiries will be deleted gradually after they cease to be useful (point 3.1. sub-points 1-2).

5.2. Personal data relating to individuals reporting adverse drug reactions (point 3.1. sub-point 3) will be processed for the duration of the marketing authorization for the medicinal product and for 10 years from the date of its expiration.

6. Data Recipients

6.1. Polfarmex S.A. transfers personal data to other entities entrusted with processing personal data on behalf of and for the Company, in particular to providers of IT systems and services. Personal data are entrusted for processing only to entities that ensure appropriate data protection standards in accordance with the requirements of Article 28 of the GDPR.

6.2. In addition, Polfarmex S.A. discloses personal data to entities providing postal and courier services. In the case of pursuing claims, data will be disclosed to law firms, courts, bailiffs, or debt collection agencies.

6.3. When dictated by a legal obligation, personal data will also be disclosed to the relevant Tax Office based on Article 6(1)(c) of the GDPR, but only to the extent specified in the relevant legal provisions. If such an obligation arises from legal regulations, personal data may be disclosed to courts, prosecutors, the Police, the National Tax Administration, the Border Guard, the Internal Security Agency (ABW), or the Central Anti-Corruption Bureau (CBA).

6.4. Polfarmex S.A., in fulfilling the legal obligation related to receiving and registering adverse drug reactions, discloses personal data to the European Medicines Agency. Other personal data are not transferred to third countries or international organizations.

7. Cookies – Types of Cookies, Their Storage Period, and How to Withdraw Consent for Their Installation

7.1. Polfarmex S.A., in accordance with Articles 173 and 174 of the Telecommunications Law Act of July 16, 2004, informs that the Website uses “cookies” technology. Cookies are small text files saved on the user’s computer or mobile device while using the Website.

7.2. The Website uses the following types of cookies: a. “Technical” cookies – these are cookies that are absolutely essential for the proper functioning of the website and the correct provision of the services requested by you, as well as for storing your consent for other categories of cookies. You can disable them in your browser settings, but this may affect the functioning of the website. b. “Analytical” cookies – these are cookies installed by Google Analytics. They are used to improve our website by collecting and presenting information on how you use it. The cookies collect information in a way that does not allow direct identification of individuals. The installation of analytical cookies on the User’s end device requires their consent.

7.3. If the User does not want to save cookies, they can change their browser settings. However, it should be noted that disabling cookies essential for authentication, security, and maintaining user preferences may hinder or, in extreme cases, prevent the use of the Website. Instructions on how to configure cookie settings in different browsers can be found at the following addresses: a. Firefox – browser settings instructions b. Chrome – browser settings instructions c. Microsoft Edge – browser settings instructions d. Safari – browser settings instructions

7.4. The legal basis for processing the data referred to in point 7.2(a) is Article 6(1)(f) of the GDPR; the data are necessary for the proper operation and display of the Website, to establish communication with the user’s device, and to transmit data to it.

7.5. The legal basis for processing analytical cookies (point 7.2(b)) will be Article 6(1)(f) of the GDPR (point 3.2. sub-points b, c), after the User consents to their installation in accordance with Article 173(1)(2) of the Telecommunications Law Act of July 16, 2004. Moreover, the legal basis for the transfer of data related to the processing of Google Analytics cookies, which are transferred outside the European Economic Area (EEA), is the User’s consent, expressed by agreeing to these cookies in accordance with Article 49(1)(a) of the GDPR, by checking the consent checkbox on the banner displayed when entering the Website.

8. Social Media Plugins

8.1. On the Polfarmex S.A. website, plugins from the social networks Facebook (provided by Meta Platforms Ireland Limited, Serpentine Avenue, Dublin 4, Ireland) and LinkedIn (LinkedIn Ireland Unlimited Company, Wilton Place, Dublin 2, Ireland) have been integrated.

8.2. When the user clicks on the Facebook and LinkedIn plugin icons, they are redirected to these portals. The user then has the option to like, comment on, and share posts available on Polfarmex S.A.’s profile on these portals.

8.3. Polfarmex S.A. has no control over the data processed by Facebook and LinkedIn. From the moment the user clicks on the plugin button redirecting to Facebook and LinkedIn, personal data is processed by these portals, which become their administrators and decide on the purposes and scope of their processing. Cookies left by Facebook and LinkedIn plugins (or other third parties) may also be installed on the user’s device after entering the site and then associated with the data collected on Facebook and LinkedIn. Polfarmex S.A. has no control over data processing by third parties in this way.

8.4. If the user has an account on the social networks Facebook and LinkedIn and does not want them to collect information about them through the Polfarmex S.A. website or associate it with data already stored by Facebook and LinkedIn, they must close the Polfarmex S.A. website, log out of their user account on these portals, and then re-enter the Polfarmex S.A. website.

9. Transfer of Data to Third Countries

9.1. Since we use tools offered by Google (Google Analytics), maintained on servers located worldwide, your personal data may be transferred to third countries outside the European Economic Area based on the European Commission’s Implementing Decision of July 10, 2023, issued under Regulation (EU) 2016/679, stating the adequate level of protection of personal data provided by the EU-U.S. Data Privacy Framework. It is possible to obtain a copy of the data transferred to a third country from the Administrator.

10. User Rights

10.1. A person whose personal data is processed by Polfarmex S.A. has the right to:

1. Access their personal data and receive a copy of the personal data being processed based on Art. 15 GDPR;
2. Rectify their incorrect data in cases indicated in Art. 16 GDPR;
3. Request data erasure (right to be forgotten) in circumstances specified in Art. 17 GDPR;
4. Request restriction of data processing in cases indicated in Art. 18 GDPR;
5. Transfer the provided data processed automatically in cases specified in Art. 20 GDPR;
6. Object to data processing in cases indicated in Art. 21 GDPR.

10.2. Polfarmex S.A. informs that it may refuse to delete personal data in cases where Polfarmex S.A. is obliged to process these data by Polish or EU law or if processing is related to the assertion or defense of claims.

10.3. Any person who believes that their personal data is being processed unlawfully can lodge a complaint with the supervisory authority (UODO, ul. Stawki 2, 00-193 Warsaw).

11. Final Provisions

11.1. The privacy policy applies to data processing by Polfarmex S.A. for the website https://www.polfarmex.pl.

11.2. You can contact the Data Protection Officer by sending a letter to the above address or by sending an email to iod@polfarmex.pl.

11.3. The privacy policy is regularly reviewed and updated as necessary. The current version of the policy was adopted and is effective as of March 1, 2024.