Privacy Policy

(1) The administrator of personal data of a person using the website https://oexcursor.pl/en/homepage/ or contacting OEX Cursor S.A. via e-mail or the contact form (hereinafter: "User") is OEX Cursor S.A., based in Warsaw, 4a Równoległa Street, 02-235 Warsaw.

(2) In matters related to the personal data provided by the User, the User may contact the Data Protection Officer (DPO) appointed by OEX Cursor S.A.: Advocate Maciej Mackiewicz, 4a Równoległa Street, 02-235 Warsaw, e-mail: iodo@cursor.pl.

(3) The User’s personal data are processed on the following legal grounds, for the following purposes:

1. To respond to the User's inquiry, handle the related matter, and, if necessary, assert or defend claims – based on Article 6(1)(f) GDPR, i.e., the Administrator’s legitimate interest in maintaining proper relations with customers, potential customers, or other contacts, in particular to manage correspondence sent via e-mail or the contact form,
2. To present an offer or project valuation (upon request) – based on Article 6(1)(b) GDPR, i.e., processing necessary to take action at the request of the data subject prior to entering into a contract (e.g., placing an order or commissioning services from OEX Cursor S.A.),
3. For marketing purposes, including informing about the latest offers, products, or promotions via telephone – based on Article 6(1)(a) GDPR, i.e., separate, voluntary consent given by the User via the appropriate checkbox in the contact form,
4. To send commercial information via e-mail – based on Article 6(1)(a) GDPR, i.e., separate, voluntary consent given by the User via the appropriate checkbox in the contact form.
5. To include the User’s application in future recruitment processes, in connection with the submission of a spontaneous application – based on Article 6(1)(a) GDPR, i.e., separate, voluntary consent given by the User via the appropriate checkbox in the application form.
   

(4) Providing personal data is voluntary.

(5) The User’s personal data will be stored no longer than 3 years from the date of sending the last message or until withdrawal of consent where required, whichever occurs first. In case of pending disputes or proceedings, including court proceedings, the storage period will be calculated from the date of their conclusion.iring consent - whichever comes first. In the event that a dispute is pending or a proceeding is in progress, in particular a court proceeding, the storage period will be calculated from the date of termination of the dispute or the final conclusion of the proceeding.

(6) Users’ personal data may be transferred to entities authorized to process data under applicable law. Additionally, IT system and service providers, postal operators, couriers, and entities providing legal or consulting services may have access to the data. For Users who are customers, suppliers, contractors, members of the Administrator’s bodies, or employees, personal data may also be processed by entities providing auditing, accounting, or payroll services.

(7) Where processing is based on the Administrator’s legitimate interest, the User has the right to object. Exercising this right will result in the Administrator ceasing to process the User’s personal data, unless there are overriding legitimate grounds, or the data is necessary for establishing, investigating, or defending claims.

(8) Where personal data are processed on the basis of consent, the User may withdraw consent at any time by sending a statement to iodo@cursor.pl or by mail to OEX Cursor S.A., Data Protection Officer, 4a Równoległa Street, 02-235 Warsaw. Withdrawal of consent does not affect the lawfulness of processing prior to withdrawal.

(9) The User has the right to request:

1) to provide information about the processing of personal data and to receive a copy of this data (the so-called right of access). The issuance of the first copy of the data is free, for subsequent copies we may charge a fee,

2) rectification of data - in case the data is outdated, incomplete or otherwise incorrect,

3) limit data processing (e.g., only to storage) for a specified period of time, in case:

• questioning by the User of the correctness of the personal data - for a period that allows the Administrator to verify its correctness,
• Consideration of the User's objection,
• when the User considers that the processing is unlawful and exercise the right to restrict the processing, instead of requesting the deletion of personal data,
• when further processing of data by the Administrator to a limited extent will be needed by the User to establish or defend possible claims;

4) portability of personal data (i.e. receipt of your data in a structured, commonly used, readable format for the purpose of sending it to another controller), such request may be made by the User in the case of data processed on the basis of the granted consent to processing or in order to perform the concluded contract.

5) deletion of personal data ("right to be forgotten") - in case:

• personal data are no longer necessary for the purposes for which they were collected,
• consent to their processing is effectively withdrawn (unless we have the right to process the data on another legal basis),
• an objection to the processing of the User's data is successfully filed,
• unlawful data processing would occur,
• if the necessity of deleting the data results from a legal obligation of the Administrator.

(10) For questions about personal data processing or to exercise rights, contact the DPO at iodo@cursor.pl, 4a Równoległa Street, 02-235 Warsaw. If rights are exhausted and the User believes GDPR has been violated, a complaint may be lodged with the supervisory authority – the President of the Office for Personal Data Protection.

(11) No automated decisions, including profiling, will be made with respect to the User.

(12) The Administrator uses tools such as Google Analytics, Google Ads, LinkedIn Ads, Facebook Ads, and Google Tag Manager. Information such as the User’s unique advertising identifier, IP address, location, and internet activity may be transferred to the United States in accordance with Commission Implementing Decision (EU) 2023/1795 of 10 July 2023, confirming an adequate level of data protection under the EU-US Data Privacy Framework. Apart from these transfers, the Administrator does not intend to transfer personal data to other third countries or international organizations.