Privacy and cookie policy

The confidentiality of data and the protection of the privacy of our Customers is a priority for us. Therefore, out of concern for the security of your personal data, the co-organizers of the “Marketing Director of the Year / CMO of the Year” competition — HEX-NET Sp. z o.o., with its registered office in Warsaw (02-797), ul. Franciszka Klimczaka 1, and HEXAGON NETWORK INT LTD, with its registered office in London, Ealing Cross, 1st Floor, 85 Uxbridge Road, London W5 5TH, United Kingdom — have established a policy setting out the rules on how personal data is processed.

We process your personal data in accordance with Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter the GDPR).

The controllers of your personal data are jointly — as joint controllers within the meaning of Article 26 of the GDPR — the co-organizers of the “Marketing Director of the Year” competition:

1. HEX-NET Sp. z o.o., with its registered office in Warsaw (02-797), ul. Franciszka Klimczaka 1, entered in the register of entrepreneurs kept by the District Court for the Capital City of Warsaw in Warsaw, 13th Commercial Division of the National Court Register, under number 0001191786, REGON: 542599939, NIP (tax identification number): 9512628812;
2. HEXAGON NETWORK INT LTD, with its registered office in London, Ealing Cross, 1st Floor, 85 Uxbridge Road, London W5 5TH, United Kingdom, entered in the Companies House register of companies under number 16085570.

The joint controllers jointly determine the purposes and means of processing personal data in connection with the organization and promotion of the competition, the handling of entries, the gala, and contact with participants and visitors to the website. The information obligations towards you are fulfilled by this policy, and the common point of contact is the address given in the section “Contacting the controllers”. You may exercise your rights against each of the joint controllers. We make the essence of the arrangement between the joint controllers available on request.

In all matters relating to the processing of personal data, you can contact the controllers by post — at the registered office address of either company — or by email: [email protected] (for competition matters also [email protected]).

Personal data is obtained directly from you or from third parties / entities, e.g. the entity on whose behalf you are acting or our Partners, as well as from other publicly available registers. We also obtain information when you complete a contact form or through cookies.

When you contact the Controller through the website or the contact details provided on the website, the Controller processes the data you provide in order to establish contact, including your first name, surname, email address or telephone number, the content of the question you have asked or the issue you have raised, and any other data you have provided. In connection with the use of cookies for statistical purposes, the Controller may process the following data: IP address, the duration of a session, and the frequency of visits to the website.

Purpose of processing

Legal basis

Registration of an account in the Online Store, in order to create an individual account and manage that account

necessary for the performance of the contract for the provision of the Account service – Article 6(1)(b) GDPR

Placing an order in the Online Store, in order to perform the sales contract

necessary for the performance of the sales contract – Article 6(1)(b) GDPR

Replying to a person who has contacted the Controller through the contact form.

The Controller’s legitimate interest – Article 6(1)(f) GDPR.

Entering into and performing a contract – where you are a party to the contract.

Processing is necessary for entering into and performing the contract – Article 6(1)(b) GDPR.

Ensuring the contacts necessary to service and perform the contract concluded with the entity on whose behalf you act, and maintaining business contacts.

The Controller’s legitimate interest – Article 6(1)(f) GDPR.

Handling any complaints, as well as establishing, pursuing and defending against claims.

The Controller’s legitimate interest – Article 6(1)(f) GDPR.

Fulfilling legal obligations imposed on the Controller, relating among other things to keeping accounts and accounting records, as well as giving effect to the rights of data subjects.

Compliance with a legal obligation to which the Controller is subject – Article 6(1)(c) GDPR.

Sending marketing content in the form of a newsletter (containing in particular information about the company, new products and the current offer) by email.

Freely given consent – Article 6(1)(a) GDPR.

Carrying out direct marketing activities.

The Controller’s legitimate interest – Article 6(1)(f) GDPR.

Collecting website traffic statistics.

The Controller’s legitimate interest – Article 6(1)(f) GDPR

When registering an account for the Newsletter service in the Online Store, the Customer provides the following data:
– email address;
– first name.

When placing an order in the Online Store, the Customer provides the following data:
– email address,
– address details: postal code and town, country, street, house/apartment number;
– first name and surname;
– telephone number.

Entrepreneurs provide the above data and, additionally:
– the Entrepreneur’s company name;
– the NIP (tax identification) number.

1. When the Online Store is used, additional information may also be collected, including: the IP address assigned to the Customer’s computer or the external IP address of the Internet provider, domain, browser type, access time, and type of operating system.

2. Navigation data may also be collected from Customers, including information about the links and references they choose to click or other actions performed in our Online Store. Legal basis – legitimate interest – Article 6(1)(f) GDPR, enabling better use of services provided by electronic means.

3. For the purpose of establishing, pursuing and enforcing claims, certain personal data provided by the Customer when using the functionalities may also be processed, including: first name, surname, data on the use of services, if the claims arise from the way in which the Customer uses the services, and other data necessary to prove the existence of the claim, including the extent of the damage suffered.

4. Legal basis – legitimate interest – Article 6(1)(f) GDPR, consisting in establishing, pursuing and enforcing claims and in defending against claims in proceedings before courts and other public authorities.

5. The personal data collected by the Controller is provided to it voluntarily, in connection with sales contracts concluded and services provided through the Online Store, subject to the proviso that failure to provide the data specified in the forms during Registration makes it impossible to Register and create a Customer Account, while, where an order is placed without Registration of a Customer Account, it will make it impossible to place and fulfill the order.

Your personal data will be used for automated decision-making, including profiling.

The recipients of your personal data will be:

1. The Controller’s personnel authorized to do so,

2. Entities processing personal data on behalf of the Controller to fulfill the purposes for which the data is collected (in particular entities providing IT solutions and IT and technical support services). These entities must have access to the data in order to perform their duties. They will have access to personal data only to the extent necessary to carry out the tasks assigned to them.

3. Public authorities and entities performing public tasks or acting on behalf of public authorities, to the extent and for the purposes arising from generally applicable law.

1. The list of recipients of the Personal Data processed by the Controller results primarily from the scope of services used by the Customer. The Customer’s personal data is passed to the service providers used by the Controller in running the Online Store. The Controller’s service providers to whom personal data is passed, depending on contractual arrangements and circumstances, either follow the Controller’s instructions as to the purposes and means of processing the data – processors – or determine the purposes and means of processing independently – controllers.

2. Processors – The Controller uses providers who process personal data solely on the Controller’s instructions; these include, among others, providers of hosting or ICT services, accounting services, providers of marketing systems, systems for analyzing traffic in the Online Store, systems for analyzing the effectiveness of marketing campaigns, companies running marketing campaigns, and companies servicing software.

3. Controllers – The Controller also uses providers who do not act solely on its instructions and themselves determine the purposes and means of using Customers’ personal data. They provide electronic payment services and banking services.

4. Location – The service providers are established in Poland and in other countries of the European Economic Area (EEA).

5. Customers’ personal data is stored:

– where the legal basis for processing personal data is consent given for that purpose, the Customer’s personal data is processed by the Controller until the consent is withdrawn. After withdrawal, the personal data is stored for a period corresponding to the limitation period for claims that the Controller may bring and that may be brought against it. Unless a specific provision states otherwise, the limitation period is 10 years, and 3 years for claims for periodic benefits and claims related to the conduct of business activity.

– where the legal basis for processing is the performance of a contract, the Customer’s personal data is processed by the Controller for as long as is necessary to perform the contract. After that time, the personal data is processed for a period corresponding to the limitation period for claims. Unless specific provisions state otherwise, the limitation period is 10 years, and 3 years for claims for periodic benefits and claims related to the conduct of business activity.

– where a purchase is made in the Online Store, personal data may be passed, depending on the Customer’s choice, to the following entities in order to deliver the products ordered in the Online Store: Poczta Polska, DPD, DHL, InPost

– where the Online Store Customer chooses to pay through the PayU payment system, their personal data is passed, to the extent necessary to process the payment, to PAYU S.A., with its registered office in Poznań (60-166), ul. Grunwaldzka 182, entered in the register of entrepreneurs kept by the District Court Poznań-Nowe Miasto and Wilda in Poznań, 8th Commercial Division of the National Court Register, under KRS number 0000274399.

6. The Controller also processes data for the purpose of promoting its own services and goods, including sending the User electronic information (email) about the available range. This data is processed by the Controller on the basis of Article 6(1)(f) GDPR (the legal basis for processing here is the Controller’s legitimate interest).

7. Personal navigation data may be used to provide Customers with better service, to analyze statistical data, to adapt the Online Store to Customers’ preferences and to administer the Online Store.

8. Where the Customer chooses to subscribe to the Newsletter, the Controller will send information to their email address or SMS messages to their mobile phone, containing commercial information about promotions, discounts and new products available in its Online Store.

9. If a request for disclosure of data is addressed to the Controller, the Controller will disclose personal data to authorized public authorities, in particular the organizational units of the Public Prosecutor’s Office, the Police, the President of the Personal Data Protection Office, the President of the Office of Competition and Consumer Protection or the President of the Office of Electronic Communications.

Yes, in two situations:

1. The joint controller HEXAGON NETWORK INT LTD is established in the United Kingdom. Data is transferred to the United Kingdom on the basis of a European Commission decision finding an adequate level of protection of personal data in that country (Article 45 GDPR).
2. We use Google Analytics (Google Ireland Limited) and the Meta pixel (Meta Platforms Ireland Ltd.), so data may be transferred to the United States. The basis is the European Commission decision on the EU-U.S. Data Privacy Framework, in which Google LLC and Meta Platforms, Inc. participate, and, additionally, standard contractual clauses approved by the European Commission.

The data processing period depends on the purposes and legal bases of processing, and therefore:

1. data processed on the basis of statutory requirements will be processed for as long as the law requires the data to be retained;

2. data processed in order to conclude and perform a contract will be processed for the period necessary to perform and settle it, which may, where appropriate, be extended by the limitation period for civil-law claims.

3. data processed on the basis of the Controller’s legitimate interest will be processed until an objection is effectively lodged or that interest ceases, e.g. data processed for the purpose of pursuing or defending against claims will be processed for a period equal to the limitation period for those claims.

4. data processed on the basis of consent will be processed until the consent is withdrawn.

5. personal data processed for recruitment purposes will be stored until the end of the recruitment process in which you are taking part. If you have additionally given your consent to the use of your data for future recruitment purposes, your data will be stored for a period of 9 months.

Providing your personal data is voluntary but necessary to achieve the purpose you wish to accomplish, including, for example, using the website, concluding a contract, or receiving a reply to your inquiry or the issue you have raised.

The Controller points out that the provision by a candidate of the personal data specified in Article 22(1) of the Labor Code is mandatory under applicable labor law. Failure to provide it will make it impossible to take part in the recruitment process. The provision by a candidate of personal data beyond the scope resulting from Article 22(1) of the Labor Code is voluntary. The Controller declares that failure to provide such data cannot be a basis for unfavorable treatment of a person applying for employment, nor may it cause any negative consequences for that person, in particular it cannot constitute a reason justifying a refusal of employment.

You have the right to:

1. request access to your personal data, rectification, erasure or restriction of processing, as well as the right to data portability,

2. where the legal basis for processing personal data is the Controller’s legitimate interest – the right to object at any time to the processing of personal data on grounds relating to your particular situation,

3. where the legitimate interest consists in carrying out direct marketing activities – the right to object at any time to the processing of personal data for marketing purposes, without having to justify your decision,

4. withdraw consent at any time, without affecting the lawfulness of processing carried out on the basis of consent before its withdrawal,

5. lodge a complaint with a supervisory authority, i.e. the President of the Personal Data Protection Office.

A request to exercise your rights can be submitted using the contact details given at the beginning.

The website uses cookies and similar technologies (browser storage):

1. necessary — for the website to work and to remember your choice in the cookie settings;
2. analytics — Google Analytics 4 (Google Ireland Limited) and our own visit statistics run by the organizers; an anonymous visitor identifier is created only after you consent to analytics cookies and disappears when you withdraw that consent;
3. marketing — the Meta pixel (Meta Platforms Ireland Ltd.), which measures the performance of our ads on Facebook and Instagram.

We store analytics and marketing cookies only with your consent, which you can change or withdraw at any time in the cookie settings (link in the footer of the page). More about Google cookies: https://policies.google.com/technologies/cookies