Privacy and cookie policy

I. General provisions

This Privacy Policy sets out the rules for processing and protecting the personal data of users of the website https://montochem.com.pl (the "Service").

The controller of personal data collected through the Service is Montochem – Oświęcim Sp. z o.o., with its registered office in Oświęcim at ul. Chemików 1, 32-600 Oświęcim, entered in the Register of Entrepreneurs of the National Court Register under KRS number: 0000163859, NIP (tax ID): 549-215-79-09, REGON (statistical number): 356704113 (the "Controller").

Personal data is processed in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the General Data Protection Regulation, "GDPR"), as well as applicable Polish data protection law.

The Controller exercises particular diligence to protect the interests of data subjects, and in particular ensures that the data it collects is processed lawfully, collected for specified, legitimate purposes, and not further processed in a manner incompatible with those purposes.

II. Purposes, legal bases and retention periods

The personal data of Service users is processed for the following purposes, on the legal bases below, and for the periods indicated:

1. Handling enquiries submitted through the contact form

• Purpose: Enabling electronic contact, responding to messages sent through the contact form, and presenting a commercial offer at the user's request.
• Legal basis: Article 6(1)(f) GDPR — the Controller's legitimate interest in building customer relationships and handling correspondence, or Article 6(1)(b) GDPR — taking steps at the request of the data subject prior to entering into a contract.
• Retention period: Data is retained for as long as necessary to handle the enquiry and provide a response, but no longer than until an objection is raised or any claims arising from the correspondence become time-barred (typically up to 3 years).

2. Recruitment of employees and associates

• Purpose: Conducting a recruitment process for a position advertised, or reviewing a spontaneous application.
• Legal basis:
  • Article 6(1)(c) GDPR (in conjunction with Article 22¹ § 1 of the Polish Labour Code) — for data required by law (first and last name, date of birth, contact details, education, employment history).
  • Article 6(1)(a) GDPR (user consent) — for additional data provided in the CV, cover letter or form (e.g. photograph, additional skills) and for future recruitment purposes (if the user consents to this).
• Retention period: Data is retained until the recruitment process for the given position is completed, and, where consent for future recruitment has been given, until that consent is withdrawn, but no longer than 2 years from submission.

3. Analytics and website traffic statistics

• Purpose: Analysing user activity on the Service, optimising the site's operation, and measuring the effectiveness of marketing campaigns.
• Legal basis: Article 6(1)(a) GDPR — the user's voluntary consent to the installation of analytical/statistical cookies (given via the cookie consent banner).
• Retention period: Statistical data is retained for the validity period of the cookies (typically up to 14 months for Google Analytics) or until the user withdraws consent (by clearing cookies in the browser).

III. Recipients of personal data

Recipients of users' personal data may only be entities entitled to obtain personal data under the law, as well as the Controller's trusted partners with whom data-processing agreements have been concluded for the purpose of providing services necessary for the Service to operate:

• the hosting provider (storage of Service data and email);
• providers of IT systems and tools supporting office/recruitment work;
• providers of accounting, HR/payroll or legal advisory services;
• Google LLC (in connection with the use of Google Analytics and reCAPTCHA anti-spam protection).

In connection with the use of Google's services, users' data (including IP address) may be transferred to Google's servers in the United States. Google LLC is a certified participant in the Data Privacy Framework (the EU-US data protection framework), which guarantees a level of data protection equivalent to GDPR requirements.

IV. Data subject rights

Every data subject has the right to:

• Access their data: the right to obtain information as to whether data is being processed, and to obtain a copy of it;
• Rectification of data: the right to have inaccurate data corrected or incomplete data completed;
• Erasure of data ("the right to be forgotten"): the right to request erasure of data where there is no legal basis for its further processing;
• Restriction of processing: the right to request that processing operations be suspended in certain situations (e.g. while the accuracy of the data is being verified);
• Data portability: the right to receive data in a structured format and to have it transmitted to another controller (applicable to processing based on a contract or consent, carried out by automated means);
• Objection: the right to object to processing based on the Controller's legitimate interest, for reasons connected with the user's particular situation;
• Withdrawal of consent: the right to withdraw consent at any time where processing is based on it (withdrawal does not affect the lawfulness of processing carried out before it was withdrawn).

To exercise these rights, users may contact the Controller in writing at its registered office address or electronically at: t.szafran@m4eg.com.

Users also have the right to lodge a complaint with the supervisory authority — the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warsaw, Poland) — if they consider that the processing of their personal data infringes GDPR.

V. Security and data protection (reCAPTCHA v3)

The Service uses SSL (Secure Socket Layer) encryption, which secures the transmission of data entered in forms by encrypting it before it is sent to the server.

The contact and recruitment forms on the Service are protected by Google reCAPTCHA v3 to guard against automated spam requests (bots). This system analyses user behaviour in the background (e.g. mouse movements, time taken to fill in the form) and assesses the risk of automated spam without requiring the user to solve visual puzzles. This is based on the Controller's legitimate interest in protecting the Service's IT infrastructure (Article 6(1)(f) GDPR). Use of this service is subject to Google's Privacy Policy and Terms of Service.

VI. Cookie policy

The Service uses cookies. These are small text files saved on the user's end device (e.g. computer, smartphone) while browsing websites.

Cookies are used to:

• ensure the correct functioning of the Service's basic features (e.g. remembering cookie consent);
• collect anonymous statistical data on how the Service is used, via the Google Analytics tool.

The Service uses two main types of cookies:

• Essential (technical): required for the site to function. These cannot be disabled via the on-site settings panel (the user may block them in their browser, though this may disrupt the site's operation).
• Analytical / statistical (Google Analytics): used to study traffic. These are only activated once the user has given explicit consent via the cookie consent banner.

Users may change their cookie settings in their web browser at any time (e.g. block cookies, set notifications when cookies are saved, or delete existing cookies). Detailed configuration information can be found in the given browser's help menu.