Privacy Policy

This Privacy Policy sets out the principles for processing personal data in connection with the use of the website available at https://eurostar-group.eu/, hereinafter referred to as the “Website”.

We are committed to protecting the privacy of people using the Website and ensuring the security of the data entrusted to us. We process personal data in accordance with applicable laws, in particular:

• Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 (the “GDPR”),
• the Polish Act of 10 May 2018 on Personal Data Protection,
• the Polish Act of 26 June 1974 – the Labour Code – insofar as it applies to recruitment processes,
• other applicable provisions of Polish and European Union law concerning personal data protection.

This Policy applies both to individuals located in Poland and to individuals accessing the Website from other countries.

The controller of personal data processed in connection with the use of the Website is:

For matters relating to the processing of personal data, the exercise of rights under the GDPR or this Policy, you may contact the Controller using the e-mail address provided above or by writing to the Company’s registered office.

The scope of personal data processed depends on how the Website is used and the nature of your contact with EUROSTAR.

In particular, we may process:

• first and last name,
• company name,
• e-mail address,
• telephone number,
• information provided in messages or contact forms,
• information relating to transport enquiries or planned orders,
• information about loading and unloading locations, the type of transport and other details necessary to prepare a quotation or provide a service,
• data concerning individuals representing clients, contractors and business partners,
• data concerning job applicants,
• information contained in CVs, recruitment documents and employment-related correspondence,
• technical data related to the use of the Website, such as IP address, device information, operating system, web browser, time of visit and information relating to the security and proper functioning of the Website.

If a User contacts EUROSTAR through a contact form, e-mail, telephone or another available communication channel, the data provided may be processed for the purpose of:

• responding to the message,
• handling the enquiry,
• preparing a quotation,
• agreeing on the terms of a potential transport order,
• taking steps prior to entering into a contract,
• maintaining further correspondence relating to the matter.

The legal basis for processing may be:

• Article 6(1)(b) GDPR – where the communication concerns entering into a contract or taking steps at the request of the individual before entering into a contract.
• Article 6(1)(f) GDPR – the Controller’s legitimate interest in conducting communication, handling enquiries, maintaining business relationships and responding to correspondence.

Providing data is voluntary. However, failure to provide the information necessary for contact may prevent us from responding or preparing a quotation.

Where data is provided in connection with an enquiry about domestic or international transport, it may be processed for the purpose of:

• determining the scope of the planned service,
• preparing a quotation,
• assessing the feasibility of the transport,
• communicating about the order,
• preparing, entering into and performing a contract,
• fulfilling legal obligations associated with providing the service,
• establishing, pursuing or defending against potential claims.

The applicable legal basis for processing is:

• Article 6(1)(b) GDPR,
• Article 6(1)(c) GDPR – where processing is necessary to comply with a legal obligation,
• Article 6(1)(f) GDPR – where processing is necessary for the Controller’s legitimate interests, particularly establishing, pursuing or defending against claims.

In connection with EUROSTAR’s business activities, we may process the personal data of clients, contractors, suppliers, subcontractors, business partners and their employees and representatives.

For individuals who are parties to a contract, the primary legal basis for processing is Article 6(1)(b) GDPR.

For employees, representatives or contact persons acting on behalf of other entities, the legal basis may be Article 6(1)(f) GDPR, namely the Controller’s legitimate interest in conducting cooperation, communication and business relationships.

Data may also be processed under Article 6(1)(c) GDPR where necessary to comply with obligations arising from tax, accounting, transport or other applicable laws.

EUROSTAR conducts recruitment processes through the Website and available communication channels, particularly for driver positions.

In connection with recruitment, we may process applicant data, including in particular:

• first and last name,
• contact details,
• educational background,
• professional qualifications,
• employment history,
• professional experience,
• licences, authorisations and qualifications required for the position,
• information included in CVs or other application documents,
• other information voluntarily provided by the applicant during recruitment.

Data required under applicable employment law is processed for the purpose of conducting recruitment under Article 6(1)(c) GDPR in conjunction with the relevant provisions of the Polish Labour Code.

Data necessary for taking steps towards entering into a contract may also be processed under Article 6(1)(b) GDPR.

Where an applicant voluntarily provides additional data beyond the scope required by law, such data may be processed on an appropriate legal basis, including consent where required.

Consent may be withdrawn at any time. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.

Providing the data necessary to participate in recruitment is voluntary. However, without such data, participation in the recruitment process may not be possible.

We ask applicants not to include particularly sensitive information in CVs or messages unless it is necessary for the recruitment process.

EUROSTAR also offers communication via WhatsApp, including for recruitment-related matters.

Using WhatsApp is voluntary. Users may choose other available communication channels instead, particularly telephone or e-mail.

When communicating through WhatsApp, the Controller processes data provided during the conversation, particularly telephone numbers, profile names, message content and documents sent, only to the extent necessary to handle the matter.

Independently of processing carried out by EUROSTAR, data associated with using WhatsApp is also processed by the service provider in accordance with its own terms and privacy policy.

For Users located within the European Economic Area, WhatsApp services are provided by WhatsApp Ireland Limited.

Users of WhatsApp should also familiarise themselves with the service’s current privacy policy.

When using the Website, certain technical information may be automatically recorded in server logs.

This may include, in particular:

• IP address,
• date and time of the connection,
• address of the requested resource,
• web browser information,
• operating system information,
• referring website address,
• information concerning errors and connection security.

This data may be used to:

• ensure the Website functions properly,
• administer the Website,
• maintain security,
• detect attempted misuse, attacks and unauthorised access,
• diagnose technical problems,
• compile technical statistics.

The legal basis for processing is Article 6(1)(f) GDPR, namely the Controller’s legitimate interest in ensuring the security and proper functioning of the Website.

The Website may include elements or links provided by third-party suppliers, such as maps, multimedia content, links to social media platforms or other online features.

Using certain features provided by third parties may involve the processing of data by those service providers.

Third-party providers may process data in accordance with their own privacy policies and terms of service.

Users should familiarise themselves with the privacy practices of the relevant provider before using its services.

The Website may contain links to EUROSTAR profiles operated on external social media platforms.

Clicking such a link redirects the User to a website operated by a third party.

The processing of data by the operator of a social media platform is governed by its own privacy policy and terms of use.

Simply including a standard link to an external profile does not automatically result in data being transferred to its operator before the link is clicked, unless additional technologies from that provider have been implemented on the Website.

Personal data may be shared with entities supporting the Controller in operating its business and Website, solely to the extent necessary to perform the tasks entrusted to them.

Such entities may include, in particular:

• hosting and IT infrastructure providers,
• website administrators and technical support providers,
• e-mail and communication service providers,
• security and backup service providers,
• providers of tools used to handle forms,
• providers of systems and software used in EUROSTAR’s operations,
• accounting, legal, auditing and consulting firms,
• entities participating in the provision of transport services where data sharing is necessary to perform a specific service,
• public authorities or other entities legally authorised to receive data under applicable laws.

Where an entity processes data on behalf of the Controller, such processing takes place under an appropriate agreement and in accordance with the Controller’s instructions.

Due to the nature of certain online and communication services, data may in some circumstances be processed or transferred outside the European Economic Area (“EEA”).

Where such a transfer occurs, the Controller applies the mechanisms provided for in Chapter V of the GDPR.

Depending on the circumstances, these may include, in particular:

• an adequacy decision of the European Commission recognising an appropriate level of data protection in a given country,
• applicable Standard Contractual Clauses approved by the European Commission,
• other appropriate safeguards provided for under the GDPR.

Where data is transferred to an entity located in the United States and that entity participates in a valid mechanism recognised by the European Commission as ensuring an adequate level of protection, the transfer may also take place on that basis.

The Controller seeks to ensure in every case that the level of data protection required by the GDPR is maintained.

The period for which personal data is retained depends on the purpose and legal basis of its processing.

Correspondence and Forms

Data related to enquiries is retained for the period necessary to handle the matter and maintain correspondence. Thereafter, where justified, it may be retained for the period necessary to protect against or defend potential claims.

Contracts and Orders

Data related to concluded contracts and completed services is retained for the duration of the contract and subsequently for periods arising from legal obligations and the applicable limitation periods for claims.

Tax and Accounting Documentation

Data contained in documents that the Controller is required to retain under tax, accounting or other applicable laws is stored for the period required by those laws.

Recruitment

Applicant data is processed for the duration of a specific recruitment process and for the period necessary to complete related activities.

Where an applicant provides separate consent to participate in future recruitment processes, their data may be retained until consent is withdrawn or the purpose for which it was collected ceases to apply.

Data Processed on the Basis of Consent

Data processed on the basis of consent is processed until that consent is withdrawn, unless the cessation of the processing purpose requires earlier deletion of the data.

Security Data and Logs

Technical data and logs are retained for the period necessary to maintain security, diagnose technical problems and protect the Website, after which they are deleted or anonymised, unless continued retention is necessary in connection with a specific incident or claim.

Under the conditions set out in the GDPR, a data subject may have the right to:

• receive information about the processing of their personal data,
• access their personal data,
• obtain a copy of their data,
• rectify inaccurate data,
• complete incomplete data,
• have data erased (the “right to be forgotten”),
• restrict processing,
• data portability in cases provided for under the GDPR,
• object to processing based on Article 6(1)(f) GDPR,
• withdraw consent at any time where processing is based on consent.

Withdrawal of consent does not affect the lawfulness of processing carried out before its withdrawal.

The scope of each right depends on the legal basis and circumstances of the specific processing activity.

To exercise your rights, you may contact the Controller at: biuro@eurostar.net.pl .

Where necessary to prevent unauthorised disclosure of data, the Controller may request information to verify the identity of the person submitting the request.

Where personal data is processed under Article 6(1)(f) GDPR, the data subject has the right to object to such processing on grounds relating to their particular situation.

Upon receiving an objection, the Controller will cease processing the data for the relevant purpose unless it demonstrates compelling legitimate grounds for continued processing which override the interests, rights and freedoms of the data subject, or unless the data is needed for the establishment, exercise or defence of legal claims.

Any individual who believes that their personal data is being processed in violation of the GDPR has the right to lodge a complaint with the competent supervisory authority.

In Poland, the competent supervisory authority is:

President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych)

Exercising the right to lodge a complaint does not prevent an individual from first contacting EUROSTAR directly to clarify the matter.

Data submitted through contact forms, transport enquiries or recruitment processes is not used by EUROSTAR to make decisions concerning Users based solely on automated processing that would produce legal effects concerning them or similarly significantly affect them.

If the Controller introduces solutions involving such processing in the future, this Policy will be updated accordingly and the individuals concerned will receive the information required under the GDPR.

The Controller implements appropriate technical and organisational measures to protect personal data against:

• unauthorised access,
• unauthorised disclosure,
• loss,
• destruction,
• alteration,
• unlawful use.

The security measures applied are adapted to the nature of the data, the method of processing and the risks involved.

Access to data is granted only to individuals and entities that require it to perform their duties.

The Website may contain links to websites operated by other entities.

EUROSTAR is not responsible for the data processing practices applied by external websites.

After leaving the Website, Users should familiarise themselves with the privacy policy of the entity operating the relevant website.

As a general rule, providing personal data is voluntary.

In certain cases, however, providing specific data is necessary to:

• receive a response,
• obtain a quotation,
• take steps before entering into a contract,
• receive a service,
• participate in a recruitment process.

Where the provision of certain data is directly required under applicable law, providing that data may be mandatory.

The Controller may periodically update this Policy, particularly in the event of:

• changes in applicable laws,
• changes to the functionality of the Website,
• implementation of new tools or services,
• changes in the methods of processing data,
• the need to clarify information provided to Users.

The current version of the Policy is published on the Website.

In the event of significant changes, the last updated date will be amended accordingly.

If you have any questions about this Privacy Policy or the processing of personal data, please contact: