Privacy policy

1. Privacy protection principle

The purpose of this Privacy Policy is to define activities in the field of processing and protection of personal data collected in connection with the provision of electronic services as part of the transaction platform available in the app.caret.pro domain and the website available in the caret.pro domain by the CARET EUROPE OÜ company based in Tallinn, Lõõtsa tn 2b, 11415 Tallinn, Estonia, entered into the register at the District Court of Harju Province, under the number 16624843, with a share capital of EUR 1,002,500.00, with tax identification number: EE102562446 (hereinafter referred to as the “Administrator” ” or “Company”).

We have appointed a Data Protection Officer who can be contacted at [email protected].

The Administrator carefully selects and applies appropriate technical and organizational measures to ensure the protection of processed personal data. Personal data regarding Users and other persons whose data was reported by the User are protected by the Administrator against disclosure to unauthorized persons, as well as other cases of disclosure or loss or unauthorized modification of the indicated data and information.

2. Purpose, scope and legal basis of personal data processing

Personal data are processed by the Administrator in accordance with the law and only for purposes related to its activities, including:

Area	Purpose of processing and legal basis
Activities to conclude and implement the contract and conduct business:	carrying out activities related to the conclusion and performance of a contract for the provision of electronic services in accordance with the principles set out in the Regulations for Buyers or the Regulations for Sellers (pursuant to Article 6(1)(b) of the GDPR), in particular:   taking actions related to the registration/setting up of an Account by the User, providing services electronically in the field of User Account management, providing services electronically in connection with the processing of sales contracts concluded by Users via the caret.pro platform, contacting Users in the scope related to the services provided, ensuring traffic safety on the caret.pro platform, preventing abuse and fraud, taking actions before concluding a contract, in particular providing an offer at the request of the data subject, establishing commercial relations, including answering questions asked in connection with Users’ contact (pursuant to Article 6(1)(f) of the GDPR in connection with the
Contact and correspondence, including electronically (by phone, e-mail and via the contact form on the website)	sending information, including marketing content, if you have consented to it (pursuant to Article 6(1)(a) of the GDPR), response to an inquiry regarding the offer or response to the offer sent to us and implementation of the activities you requested before creating a User Account (pursuant to Article 6(1)(b) of the GDPR), an answer to a question asked or a message sent unrelated to the User’s Account, based on consent, i.e. Art. 6 section 1 letter a GDPR, conducting correspondence in connection with the implementation of legal provisions, e.g. in the complaint procedure or fulfilling obligations arising from the GDPR, e.g. the right to access data (pursuant to Article 6(1)(c),), recording and storing telephone conversations with consultants and using the recorded conversations to assess the content of the conversation in the event of customer claims (pursuant to Article 6(1)(f) of the GDPR where the legitimate interest is the optimization of the services provided and the operation of the enterprise as well as defense against claims) and, if you have consented, for internal training purposes (Article 6(1)(a) of the GDPR). Providing data is voluntary, but necessary to respond, deliver the requested content or fulfill your requests. In some cases, providing data may be a legal requirement, e.g. when we are obliged to verify the applicant before providing data. You can withdraw your consent at any time by submitting a request via the same communication channel. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.
Other processing based on consent	For the purposes specified each time in the content of the consent (Article 6(1)(a) or Article 9(2)(a) of the GDPR). Providing data is voluntary, but necessary to achieve the purposes specified in the consent. Consent may be withdrawn at any time in the manner specified by the Administrator when obtaining consent. Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.
Website delivery	research on user preferences and behavior on the caret.pro website using cookie technology (Article 6(1)(a) of the GDPR), carrying out statistical and analytical activities, including activity analysis, traffic management on the caret.pro website (pursuant to 6 section 1 letter f of the GDPR in connection with the implementation of the Administrator’s legally justified interests regarding optimization within the caret.pro domain), creating a User profile and sending personalized advertising (Article 6(1)(a) of the GDPR), technical provision of content, maintenance and technical support of the service, ensuring the security of the service, preventing fraud and removing errors, adapting the service to the needs of users (Article 6(1)(f) of the GDPR), the Administrator’s communication with Users on matters related to the functioning of the website and data protection based on your consent (Article 6(1)(a) of the GDPR) or in order to take actions you requested before creating a User Account (Article 6(1)(a) of the GDPR) 1(b) GDPR) or if we are obliged to fulfill a legal obligation imposed on us, e.g. to exercise your rights related to the protection of personal data (Article 6(1)(c) of the GDPR), conducting online chat conversations using software installed on the website based on your consent (Article 6(1)(a) of the GDPR) or in order to take actions you requested before creating a User Account (Article 6(1)(a) of the GDPR) 1 letter b GDPR).
Servicing the User Account on the platform	taking actions related to the processing of registration made by the User and providing services electronically in the scope of servicing Platform User Accounts, based on the necessity to conclude and perform the contract (personal data necessary to set up and operate the Account), i.e. Art. 6 section 1 letter b GDPR. handling complaints, including solving technical problems, based on the Administrator’s legitimate interest in protecting the rights of the Company and the User, i.e. Art. 6 section 1 letter f GDPR.
Newsletter, reports	sending an information bulletin containing marketing content (newsletter) to your e-mail address, based on your consent (Article 6(1)(a) of the GDPR or if processing is necessary to implement the legitimate interest of the Administrator, in this case informing about new products and promotions (pursuant to Article 6(1)(f) of the GDPR). sending reports, which may also contain marketing content, to your e-mail address, based on your consent (Article 6(1)(a) of the GDPR).
Marketing	distribution of personalized or general marketing messages and information about offers within our services, website, third-party online platforms, including social networking sites, in accordance with applicable law based on your consent (Article 6(1)(a) of the GDPR).
Social media	administering and managing the Company’s company profile, including responding to your posts and comments, as well as supervising the content published by users, based on the legally justified interest of the Company consisting in the possibility of running and managing the company profile, i.e. Art. 6 section 1 letter f GDPR, providing answers to a question asked or a message sent, based on consent, i.e. Art. 6 section 1 letter a GDPR, sending information, including marketing content, if you have consented to it, pursuant to Art. 6 section 1 letter a GDPR, responding to an inquiry regarding the offer or response to the offer sent to us and implementing the actions you have requested, pursuant to Art. 6 section 1 letter b GDPR, creating a user profile and sending personalized advertising (Article 6(1)(a) of the GDPR). The provision of data is voluntary, but necessary to achieve the above-mentioned purposes. To some extent, so-called joint control takes place between us and the providers of social media platforms. This means that, together with the providers of these platforms, we are responsible for your personal data and you can exercise your rights under the GDPR against each of the administrators. Details on the principles of data processing in social media can be found in the privacy policies of individual websites: https://pl.linkedin.com/legal/privacy-policy?trk=homepage-basic_footer-privacy-policy https://policies.google.com/privacy?hl=pl

Webinar	sending an invitation or enabling the person who registered for it to participate in the webinar – based on your consent (Article 6(1)(a) of the GDPR).
Recruitment	conducting the recruitment process (pursuant to Article 6(1)(c) of the GDPR and pursuant to Article 6(1)(a) of the GDPR and Article 9(2)(a) of the GDPR for data not provided for in the above provisions) and on the basis of Your consent, also in subsequent recruitment of employees. providing information on the progress of the ongoing recruitment process – based on your consent (Article 6(1)(a) of the GDPR). Providing data is voluntary, but necessary to participate in recruitment to the extent specified by law.
Other processing based on the legitimate interests of the Administrator	Your personal data is or may be processed also on the basis of Art. 6 section 1 letter f) of the GDPR if processing is necessary for the following purposes arising from the legitimate interests pursued by the Administrator: internal administration and work organization, including internal supervision and reporting (legitimate interest is to ensure optimal functioning of the enterprise), ensuring the security of IT networks and processes (legitimate interest is the protection of persons and property), conducting an assessment of User satisfaction, the Administrator may measure loyalty and satisfaction with the services provided by the Administrator in connection with the optimization of the services provided and adapting them to the needs of Users).

3. Cookies and other tracking technologies

We use cookies and other tracking technologies (e.g. Google Tag Manager, Google Analytics, YouTube) to recognize the user and his/her characteristics. These activities allow us to conduct analytical activities, e.g. traffic research on our website and the caret.pro platform, as well as marketing activities, e.g. displaying advertisements to you.

4. Data recipients

Personal data is stored for the period of holding your User Account on the

We share your personal data only with entities thanks to which we can guarantee high quality of the service. These are primarily:

• entities acting for the Administrator, responsible for operating the caret.pro online platform and entities providing services in this respect to the Administrator (e.g. companies providing Internet delivery services, entities providing servers), providers of plug-ins and cookies for the website (such as DoubleClick , Criteo, RTB House, Index Exchange, OpenX);
• companies providing software, in particular: accounting, office (including Microsoft), sales and marketing;
• companies providing maintenance or ITSM services;
• courier and/or postal companies;
• companies providing HR, payroll and accounting services;
• banks and insurance companies;
• companies providing marketing services;
• companies providing support services in employee recruitment;
• if appropriate consent is given, these will also be: LinkedIn Ireland Unlimited Company, Google Ireland Ltd., Sendinblue SASU (Brevo supplier), ClickMeeting Sp. z o. o.

The data is processed on the basis of a contract with us and only on our instructions. We do not share your data with any external entities for their own use – only to perform the tasks specified above. All partners who process your personal data ensure data security and fulfill all personal data protection obligations. We also make your personal data available to authorized employees and collaborators of the Company who, on behalf of the Administrator, perform tasks related to the processing of your data. Recipients may also be entities authorized to receive data under applicable law, including competent judicial authorities.

5. Storage period

In the case of processing personal data on the basis of your consent, we process your data until you withdraw your consent to data processing. However, withdrawal of consent does not affect the lawfulness of processing carried out before the withdrawal of consent.

If data processing is necessary to implement the legitimate interests of the Administrator, we process your personal data until you object to the processing of personal data.

With regard to:

• direct marketing of our own products and services: we process your personal data until you object or, if your consent has been expressed, until you withdraw it;
• running fan pages on social media: we process your personal data for the period necessary to achieve the above-mentioned processing purposes, in particular for the period in which you are an active user of the Company’s company profile on a given website or until you object to the processing of data. Data contained in posts or comments may be processed until they are deleted. You can always unfollow the Company’s business profile. Regardless of the data storage by the Company, the administrator of the LinkedIn portal may apply its own data storage periods;
• newsletter: we process your personal data until you withdraw your consent;
• pursuing claims and protection against claims: we process your personal data for the period of limitation/expiration of claims appropriate to the given legal relationship (min. 6 years from the date of termination of cooperation).);
• recruitment: we process your personal data for a maximum of 6 months from the date of receipt of the application, and in the event of consent to participate in future recruitment, for the period indicated in the consent to future recruitment, but no longer than for a period of 12 months from the end of the recruitment process;
• cookies: cookie data is deleted in accordance with the cookies policy;
• you have a User Account on the app.caret.pro platform: your personal data will be processed for the period of your account (until the end of the service), until the complaint is completed or the reported problem is resolved or until the last day of the calendar year following 3 years have passed since the end of the service provision (in the case of data processing based on the legitimate interest of the Company, consisting in the protection of the Company’s rights).

After the above-mentioned periods of time, data may be processed based on the Administrator’s legal obligations (e.g. in terms of storing accounting documents) or legally justified interest (defense against claims that may be made against the Administrator).

6. Control of personal data processing

The administrator ensures that persons whose personal data are processed exercise the rights arising from legal provisions, including: the right to access the content of their own personal data and to receive a copy thereof, rectify it, change it, delete it in a situation where the processing does not take place in order to fulfill the obligation. resulting from legal provisions, data transfer, and the right to request restriction of the processing of personal data.

You also have the right to object at any time to the processing of personal data based on Art. 6 section 1 letter f) GDPR. If you object to the processing of personal data for purposes arising from the legitimate interests pursued by the Administrator, your personal data will not be processed by us for this purpose. The reason for this objection must be your particular situation, therefore, when submitting the application, please indicate this particular situation. After receiving your objection, we will stop processing your data for the purpose or purposes to which you have expressed your objection, unless we demonstrate compelling legitimate grounds for processing that override your interests, rights and freedoms, or if we demonstrate grounds for establishing, pursuing or defending against claims.

In the case of voluntary consent to data processing, each person whose data is processed has the right to withdraw consent to data processing. Withdrawal of consent does not affect the processing carried out by the Administrator before its withdrawal.

In all matters relating to the processing of personal data, you can contact us at: [email protected]. Each person whose data is processed has the right to lodge a complaint with the Estonian Data Protection Inspectorate, 39 Tatari St., 10134 Tallinn.

7. Rules for transferring your personal data outside the EEA

Except where appropriate consent is given, your personal data is not transferred to recipients in third countries, i.e. outside the European Economic Area (EEA) or to international organizations.

If appropriate consent is given, personal data may or will be made available to LinkedIn Ireland Unlimited Company and Google Ireland Limited (Services). In accordance with the transnational nature of data flow within these Websites, your data is transferred outside the EEA, including to countries for which the European Commission has not determined an adequate level of protection.

Data protection in the case of Google Ireland Limited is ensured by an appropriate certificate, based on which the European Commission, in accordance with Art. 45 GDPR stated that they provide an adequate level of protection. In other cases, protection is primarily provided by the use of Standard Contractual Clauses with appropriate safeguards (including data encryption). More information on data processing on these Websites can be found in the Websites’ privacy policies.

https://www.linkedin.com/legal/privacy-policy?trk=homepage-basic_footer-privacy-policy

https://policies.google.com/privacy?hl=pl

Your personal data is processed in this way for marketing purposes (we use marketing tools, social platforms and cookies and social plug-ins on our website) and to maintain communication with the customer (social media – LinkedIn). Data is transferred only on the basis of your express consent.

8. Making automated decisions, including profiling

Your personal data will be processed in an automated manner, but decision-making, including profiling, will not take place in an automated manner.

LEGAL INFORMATION

Trademarks and logos presented on the caret.pro website are protected by law and international agreements, their use without appropriate consent is prohibited.

All works (in particular: photos, texts, catalogues, graphics) presented on the caret.pro website are legally protected, and their use without the prior written consent of CARET EUROPE OÜ is strictly prohibited.