PRIVACY POLICY

This Privacy Policy describes how Brillance sp. z o.o. processes personal data when you use the website www.brillance.pl (the “Site”), contact us through the Site, use our services, participate in recruitment processes or otherwise provide us with your personal data through the Site.

Please read this Privacy Policy carefully. It explains in particular what personal data we process, for what purposes, on what legal bases, for how long, with whom we may share it and what rights you have as a data subject.

1. WHO WE ARE

BRILLANCE is an independent Contract Research Organization (CRO) based in Kraków, conducting research and development activities in medical sciences and pharmacy, in particular through clinical trial management and monitoring.

Controller identification and contact details:

BRILLANCE sp. z o.o.

ul. Zarzecze 136 A, 30-134 Kraków, Poland

KRS: 0000193560, NIP/Tax ID: 6772225251, REGON/Statistical ID: 356802784

share capital: PLN 50,000.00

tel.: +48 12 623 07 15

email: privacy@brillance.pl

Brillance sp. z o.o. is the controller of personal data within the meaning of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (General Data Protection Regulation, “GDPR”).

2. TO WHOM DOES THIS PRIVACY POLICY APPLY?

This Privacy Policy applies in particular to:

persons visiting the Site;
persons contacting us through the contact form or by email;
persons registering for training or using our services individually or on behalf of an organization;
persons participating in current or future recruitment processes;
representatives, employees or associates of our clients, contractors, suppliers and business partners.

Protection of children’s privacy. The Site and our services are not addressed to children under 16 years of age. We do not knowingly collect personal data from children under 16. If you have reason to believe that a child under 16 has provided us with personal data through the Site, please contact us at privacy@brillance.pl and we will take appropriate steps to delete such data, unless there is another legal basis for its continued processing.

3. WHAT PERSONAL DATA DO WE PROCESS?

The scope of personal data we process depends on how you use the Site or our services and on the nature of your contact with us. We may process data received directly from you, data received from the entity on whose behalf you act or which registers you for training or recruitment, and technical data collected automatically when you use the Site.

3.1. Contact form and correspondence

If you contact us through the contact form available on the Site or by email, we may process: your name and surname, email address, phone number — if provided — the content of your message and any other personal data voluntarily included in the correspondence.

Providing personal data is voluntary; however, providing the data required in the form is necessary to submit an enquiry and receive a response. Providing your phone number is voluntary and is not required to submit the form.

3.2. Google reCAPTCHA and form protection

To protect the contact form against spam, abuse and automated submissions, we use Google reCAPTCHA. In connection with the operation of this mechanism, technical data related to your use of the form may be processed, such as your IP address, browser and device information and information about your interaction with the form. reCAPTCHA may also use a necessary cookie, such as _GRECAPTCHA, to provide its risk analysis.

This mechanism is provided by Google; in connection with its operation, data, including your IP address, may be transferred to Google LLC in the United States on the terms described in Section 10, while the rules on the use of cookies are set out in Section 4.

3.3. Training, services and client relationships

If you register for training, use our services, enter into a contract with us or act as a representative, employee or associate of a client, contractor or business partner, we may process: your name and surname, position, name of the represented entity, correspondence address or registered office address, email address, phone number, Tax ID/NIP, data necessary to issue an invoice or other accounting document, data concerning participation in training, data related to contract performance and data necessary for settlements or payment handling, including a bank account number where necessary.

3.4. Recruitment

If you send us application documents or participate in a recruitment process, we may process personal data necessary to conduct the recruitment.

In the case of recruitment for employment under an employment contract, we may process data specified in Article 22(1) § 1 of the Polish Labour Code, in particular: name and surname, date of birth, contact details indicated by the candidate, education, professional qualifications and employment history, excluding information on remuneration in current and previous employment relationships. Data concerning education, professional qualifications and employment history are processed where necessary to perform work of a specific type or in a specific position.

In the case of recruitment for cooperation based on a civil law contract, services agreement or B2B cooperation, we may process data necessary to take steps prior to entering into a contract and to assess the candidate’s qualifications and experience.

If you voluntarily provide in your application documents data exceeding the scope required by law or necessary to conduct the recruitment, we will process it on the basis of your consent expressed by voluntarily providing such data or — in the case of future recruitment processes — on the basis of separate, optional consent.

Please do not include special categories of personal data referred to in Article 9 GDPR in your application documents unless it is necessary and lawful. If such data is provided without our request, we may delete it or disregard it in the recruitment process.

3.5. Technical information, cookies and Site usage data

When you use the Site, we may process technical information such as: IP address, cookie identifiers, browser type and version, device type, operating system, date and time of the visit, visited subpages, source of entry to the Site, events related to the use of the Site and general location information derived from technical data.

We use this data in particular to ensure the proper operation of the Site, maintain security, detect abuse, analyse traffic and — if you give the required consent — for analytical, functional or marketing purposes.

4. COOKIES AND SIMILAR TECHNOLOGIES

Cookies are small text files stored on your device or read from your device when you use the Site. Similar technologies may include, among others, local storage, session storage, pixels or other online identifiers.

The use of cookies and similar technologies is subject to the GDPR and Polish electronic communications law. As a rule, storing information on your device or accessing information already stored on your device requires your consent, unless it is necessary to provide an electronic service requested by you or to transmit a communication over a telecommunications network.

We may use the following categories of cookies:

essential cookies — necessary for the proper operation of the Site, security, remembering privacy settings, handling forms and protecting forms against spam; these cookies cannot be disabled through our settings, but you may block them in your browser settings, which may cause parts of the Site to malfunction;
functional cookies — enabling additional Site functions or remembering user preferences;
analytical or performance cookies — enabling us to measure and analyse how the Site is used, where such tools are used and the required consent has been given;
marketing or targeting cookies — used for marketing or advertising activities, where such tools are used and the required consent has been given.

Currently, the Site uses primarily cookies necessary for its operation, including cookies or similar mechanisms necessary to protect the contact form against spam and abuse. If additional cookies or analytical, functional or marketing tools are implemented on the Site, they will be used in accordance with applicable laws and — where required — after obtaining your consent.

You can manage cookie settings through the tool available on the Site, if provided, and through your web browser settings. Withdrawal of consent does not affect the lawfulness of the use of cookies before withdrawal.

5. FOR WHAT PURPOSES AND ON WHAT LEGAL BASES DO WE PROCESS DATA?

We process personal data only where we have an appropriate legal basis. Depending on the situation, the legal basis may be:

Article 6(1)(a) GDPR — your consent;
Article 6(1)(b) GDPR — the necessity to take steps prior to entering into a contract or to perform a contract;
Article 6(1)(c) GDPR — the necessity to comply with a legal obligation incumbent on the Controller;
Article 6(1)(f) GDPR — the legitimate interest pursued by the Controller or a third party.

We may process personal data in particular for the following purposes:

ensuring the operation of the Site, its functions, forms and security — Article 6(1)(f) GDPR;
handling enquiries submitted through the contact form, email or other communication channels — Article 6(1)(f) GDPR and, where the enquiry concerns entering into or performing a contract, also Article 6(1)(b) GDPR;
protecting forms against spam, abuse and automated submissions, including through Google reCAPTCHA — Article 6(1)(f) GDPR;
preparing, entering into and performing a contract, including a training agreement, services agreement, mandate contract or other contract — Article 6(1)(b) GDPR;
settlements, accounting, archiving accounting and tax documentation and complying with legal obligations — Article 6(1)(c) GDPR;
conducting a current recruitment process — depending on the type of recruitment: Article 6(1)(b), (c), (f) or (a) GDPR and applicable provisions of the Polish Labour Code;
participation in future recruitment processes — Article 6(1)(a) GDPR, if you have given separate, optional consent;
maintaining business relationships with clients, contractors and partners — Article 6(1)(f) GDPR;
establishing, pursuing or defending claims — Article 6(1)(f) GDPR;
conducting statistical analyses and improving the Site, where relevant tools are used — Article 6(1)(f) GDPR or Article 6(1)(a) GDPR where consent is required;
direct marketing of our own services, sending commercial information, newsletters, invitations to training or events — Article 6(1)(f) GDPR or Article 6(1)(a) GDPR, and, as regards the use of electronic communication or telecommunications terminal equipment, also on the basis of consents required under Polish electronic communications law, where such consents are required.

6. WITH WHOM DO WE SHARE PERSONAL DATA?

We may share personal data only where justified by the purpose of processing and in accordance with the law. Recipients of data may include in particular:

persons authorised by the Controller, including employees and associates;
providers of IT services, hosting, website maintenance, email services, form tools, tools protecting forms against spam and abuse, analytical, communication, training or recruitment tools;
providers of accounting, legal, advisory, audit, administrative and archiving services;
payment operators, banks, postal and courier service providers — where necessary for contract performance or settlements;
our clients, sponsors, business partners or other entities cooperating with us, where necessary to perform a contract, present a project team, handle business cooperation, or where you have given consent or another appropriate legal basis exists;
public authorities, courts, offices, regulatory authorities or other entities authorised to receive data under applicable law.

Entities processing data on our behalf process data under appropriate data processing agreements or other relevant legal instruments.

7. PERSONAL DATA SECURITY

We apply appropriate technical and organisational measures to protect personal data against unauthorised access, loss, destruction, alteration, disclosure or other unlawful processing. The scope of measures depends on the nature of the data, the purpose of processing and the risk to the rights and freedoms of data subjects.

8. HOW LONG DO WE PROCESS PERSONAL DATA?

We process personal data for the period necessary to achieve the purpose for which it was collected, and subsequently for the period required by law or necessary to establish, pursue or defend claims.

In particular:

data related to the use of the Site and its security are processed for the period necessary to ensure proper Site operation, security and handling of potential incidents;
data submitted through the contact form or by email are processed for the period necessary to respond and close the correspondence, and subsequently until the expiry of limitation periods for potential claims or for the period necessary to demonstrate the course of communication, if justified by the nature of the matter;
data related to a contract or services are processed for the duration of the contract and its settlement, and subsequently until the expiry of limitation periods for claims;
data contained in accounting and tax documents are processed for the period required by accounting and tax regulations;
candidate data processed for the current recruitment are processed until the end of the recruitment process and subsequently for the period necessary to defend against potential claims;
candidate data processed for future recruitment processes on the basis of separate consent are processed until consent is withdrawn, but no longer than 24 months;
data processed for direct marketing purposes are processed until consent is withdrawn, an effective objection is raised or the purpose of processing ceases to exist;
data processed on the basis of consent are processed until consent is withdrawn, unless there is another legal basis for continued processing.

In some cases, we may anonymise personal data so that the data subject can no longer be identified and use anonymous data for statistical, analytical or scientific purposes.

9. WHAT RIGHTS DO YOU HAVE?

In connection with the processing of personal data, you have the following rights, in the cases and on the terms set out in the GDPR:

the right of access to personal data, including the right to obtain a copy of the data;
the right to rectify or supplement inaccurate or incomplete data;
the right to erase data;
the right to restrict processing;
the right to object to processing where the processing is based on legitimate interest;
the right to data portability, where processing is based on consent or contract and is carried out by automated means;
the right to withdraw consent at any time, without affecting the lawfulness of processing carried out before withdrawal;
the right to lodge a complaint with a supervisory authority.

If you wish to exercise any of the above rights, please contact us at privacy@brillance.pl. We may ask you for additional information necessary to confirm your identity in order to prevent disclosure of data to an unauthorised person.

The supervisory authority competent in Poland is the President of the Personal Data Protection Office. A complaint may be submitted in particular to the following address: President of the Personal Data Protection Office, ul. Stanisława Moniuszki 1A, 00-014 Warszawa, Poland. More information is available at uodo.gov.pl.

10. TRANSFERS OF DATA OUTSIDE THE EUROPEAN ECONOMIC AREA

In connection with our use of certain service providers, in particular providers of IT services, hosting, email services, communication, training, recruitment, analytical and security tools or tools protecting forms against spam and abuse, personal data may be transferred outside the European Economic Area.

Transfers of data outside the European Economic Area take place only where compliant with the GDPR and subject to appropriate legal mechanisms, such as an adequacy decision, standard contractual clauses, binding corporate rules or other appropriate safeguards provided for by law. You may obtain a copy of the safeguards applied or information on where they have been made available by contacting us at privacy@brillance.pl. We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.

11. CHANGES TO THIS PRIVACY POLICY

We may update this Privacy Policy from time to time, in particular where there are changes to the Site, tools used, services provided or applicable laws. The current version of the Privacy Policy is available on the Site.

12. CONTACT US

If you have any questions about this Privacy Policy or how we process personal data, you can contact us at:

tel.: +48 12 623 07 15

email: privacy@brillance.pl