Social Media Privacy Policy

In accordance with Articles 13 and 14 of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (the “GDPR”), in this Policy we inform you how we handle your personal data in connection with our operation of the social media profiles of the Amtra Group brands.

1. Data controller and joint controllership

The processing operations described in this Social Media Privacy Policy (the “Policy”) are carried out by Amtra sp. z o.o., with its registered office in Sosnowiec (41-200), ul. Schonów 3 (the “Controller”) and, to the extent indicated below, also by the operators of the social media platforms on which the Controller runs the Brand profiles (the “Operator”, the “Operators”). The Controller runs social media profiles for the following brands: Amtra, Moje Auto, MA Professional, Clinex, WD-40, Sejfboksy, Tecmaxx and Wunderbaum (jointly the “Brands”, individually a “Brand”).

You may contact the Controller:

• by post: Amtra sp. z o.o., ul. Schonów 3, 41-200 Sosnowiec, marked “Dane osobowe” (Personal data);
• using the contact form at www.amtra.pl;
• by e-mail: rodo@amtra.pl.

As regards the statistics concerning our profiles that the Operators make available to us in aggregated form (including data on reach, impressions, reactions and the demographic and geographic structure of the audience), the Controller and the Operator are joint controllers within the meaning of Article 26 GDPR. The Controller does not decide how the Operator collects the data used to generate the statistics and has no access to the source data; it does, however, define the criteria of the statistics it orders and the purpose for which it uses them.

The essence of the arrangement between the joint controllers, including the allocation of information duties and the manner in which data subject rights are handled, has been made available by the Operators:

1. Meta Platforms Ireland Limited (Facebook, Instagram) – Page Insights Controller Addendum: https://www.facebook.com/legal/terms/page_controller_addendum;
2. TikTok Technology Limited and Google Ireland Limited (YouTube) – as regards account statistics: the documents and information made available by those Operators and referred to in their privacy policies cited below.
3. LinkedIn Ireland Unlimited Company (LinkedIn) – Page Insights Joint Controller Addendum: https://legal.linkedin.com/pages-joint-controller-addendum.

Irrespective of the arrangement between the joint controllers, you may exercise your rights against each of them (Article 26(3) GDPR). Requests concerning data collected by an Operator within its own infrastructure should be addressed directly to that Operator – the Controller has no access to such data and cannot amend or erase it on your behalf.

In all other respects – in particular as regards the content published on the profiles, correspondence with users, job applications and competitions – the Controller acts as a sole controller.

Our websites may contain links to our social media profiles. These are not embedded social plug-ins – merely displaying the page does not transfer your data to the Operator. Only after you click the link are you redirected to the relevant platform, and the processing of your data is then governed by the rules laid down by its Operator.

The Controller runs profiles of the individual Brands on the following social media platforms (the “Portals” or the “Platforms”). The table below indicates on which Platforms each Brand is present, together with the addresses of the individual profiles:

You will find more information on the processing of your data by the individual Operators and on how to exercise your rights in their privacy policies:

1. Facebook (Meta Platforms Ireland Limited): https://www.facebook.com/privacy/policy
2. YouTube (Google Ireland Limited): https://policies.google.com/privacy?hl=pl
3. Instagram (Meta Platforms Ireland Limited): https://help.instagram.com/519522125107875
4. TikTok: https://www.tiktok.com/legal/page/eea/privacy-policy/pl
5. LinkedIn (LinkedIn Ireland Unlimited Company): https://www.linkedin.com/legal/privacy-policy

By using a Platform you provide your personal data to its Operator, which processes it as a separate controller, for the purposes and on the terms set out in its privacy policy. The Controller has no influence over those operations.

2. Scope of the personal data processed

The Controller processes the following categories of data:

1. identification data visible on your profile – your first name and surname or your pseudonym (username), to the extent you have made it available on that profile,
2. profile picture (avatar),
3. the content of your comments, reactions and other activity on our profiles, and the content of correspondence conducted with the Controller through the Platforms’ messaging services,
4. the data contained in a job application, if you send us one – including information on your education and professional experience,
5. the data necessary to award and settle a prize, if you take part in one of our competitions – to the extent resulting from the competition rules and tax legislation,
6. aggregated statistical data concerning the audience of our profiles, made available by the Operators through the Platforms’ analytics tools; this data does not allow the Controller to identify individual users.
7. Purposes of the processing of personal data

We process personal data for the following purposes:

1. providing information about our activity, promoting the brand, products, services and events, building and maintaining the community around our profiles and communicating with users by means of the functionalities made available by the Platforms (comments, reactions, private messages, Messenger), including answering the questions addressed to us – which constitutes our legitimate interest (Article 6(1)(f) GDPR),
2. analysing how our profiles function and how popular they are, and how they are used, including data on the number of followers, likes, comments and shares, on the basis of the aggregated statistics made available by the Operators – which constitutes our legitimate interest (Article 6(1)(f) GDPR),
3. conducting correspondence on matters raised by users and related to the subject matter of a given profile – which constitutes our legitimate interest in handling such enquiries (Article 6(1)(f) GDPR) and, where the correspondence concerns the conclusion or performance of a contract, on the basis of Article 6(1)(b) GDPR,
4. conducting recruitment, if you send us a job application – as regards the data specified in Article 22¹ § 1 of the Polish Labour Code, the processing is necessary for compliance with a legal obligation to which the Controller is subject (Article 6(1)(c) GDPR) and, in the case of cooperation under a civil-law contract, in order to take steps prior to entering into it at your request (Article 6(1)(b) GDPR); data going beyond that scope, including your image and information provided voluntarily, is processed on the basis of your consent (Article 6(1)(a) GDPR), given by sending us that data,
5. marketing and promotion of the Controller’s products, services and brand – on the basis of Article 6(1)(f) GDPR,
6. running competitions on the Controller’s profiles – in order to perform an obligation arising from a public promise of reward, on the terms set out in the competition rules (Article 6(1)(b) GDPR),
7. performing the obligations incumbent on the Controller in connection with awarding and settling a competition prize, in particular tax and documentation obligations – on the basis of Article 6(1)(c) GDPR,
8. establishing, pursuing or defending against claims – which constitutes our legitimate interest (Article 6(1)(f) GDPR),
9. moderating the content published on our profiles, including removing content that infringes the law or the rights of third parties – which constitutes our legitimate interest in maintaining order on the profile and protecting its image (Article 6(1)(f) GDPR),
10. handling requests concerning the protection of personal data and documenting how they have been dealt with – on the basis of Article 6(1)(c) GDPR in conjunction with Article 12 GDPR.

We reserve the right to remove, in exceptional situations, content posted on our social media profiles, for example posts or attachments that infringe the law or the rights of third parties (such as copyright or personal rights), incite hatred, are abusive, contain words commonly regarded as offensive, or are otherwise unlawful.

4. Voluntary nature of providing data

You do not have to provide us with your data; however, given the rules applied by the operators, if you write to us or comment on our post, we will see your first name and surname or your pseudonym and your photograph or avatar.

Providing data in connection with the use of our profiles is voluntary. Failure to provide it may make it impossible to use certain functionalities of the Platforms (for example to post a comment or to make contact through the messaging service) and, in the case of a competition, to take part in it or to receive a prize.

5. Source of the data

We obtain data directly from you – from the content you publish on our profiles or send to us in correspondence – and from your public profile on the relevant Platform, to the extent you have made it available. We receive aggregated statistical data from the Operators through the Platforms’ analytics tools.

6. Data retention period

The retention period depends on the purposes of and the legal bases for the processing. Accordingly:

1. for questions or complaints – for the period necessary to answer the questions and, for evidentiary purposes, for 3 years from the date the answer is given,
2. for the marketing of products and services – until you object to the processing for that purpose; an objection to direct marketing requires no justification and is binding on the Controller,
3. for following our profiles – for as long as you follow them. You may at any time delete your comments under our posts, stop following us or delete your account on the relevant service; the content you have published on our profile nevertheless remains visible until it is deleted by you or by the Controller,
4. for the analysis of activity and statistics – for the period during which such data is made available to the Controller by the Operator through the Platform’s analytics tools and, if an objection is raised, until it has been examined and, if it proves justified, the processing has ceased,
5. for content moderation – for as long as the content is published on the profile and, if an objection is raised, until it has been examined,
6. for competitions – for the duration of the competition and for a period no longer than 3 years from the end of the competition, inter alia in order to pursue or defend against claims relating to that competition. The data of competition winners will be processed for 5 years counted from the end of the calendar year in which the deadline for payment of the tax related to the award of the prize expired, in accordance with tax legislation,
7. data processed on the basis of consent – until the consent is withdrawn; withdrawal does not affect the lawfulness of the processing carried out before it was withdrawn,
8. in the remaining cases based on the Controller’s legitimate interest – until an objection justified by your particular situation is raised and upheld, unless there are compelling legitimate grounds for further processing which override your interests, rights and freedoms.
9. Data recipients

The recipients of personal data may be:

1. public authorities and entities performing public tasks or acting on behalf of public authorities – to the extent and for the purposes resulting from generally applicable law,
2. the Operators of the individual Platforms – to the extent and on the terms described above and in their privacy policies,
3. entities processing data on behalf of the Controller under data processing agreements – in particular marketing agencies, providers of analytics and statistics tools, IT and hosting service providers, and law firms.
4. Transfers of data outside the European Economic Area

Within its own processing operations, the Controller does not transfer personal data to third countries. If the use of tools made available by the Operators, or of the services of processors, involves such a transfer, it takes place on the basis of the mechanisms provided for in Chapter V GDPR – in particular a European Commission adequacy decision (for entities participating in the EU-US Data Privacy Framework) or standard contractual clauses.

Your use of a Platform may result in your data being processed in third countries by its Operator, on the terms and under the mechanisms indicated in that Operator’s privacy policy. The Controller has no influence over those operations.

9. Data subject rights

You have the right to access your data, to rectify, erase and restrict the processing of it, the right to object to the processing and, as regards data processed by automated means on the basis of consent or a contract, the right to data portability. Where the processing is based on consent, you may withdraw it at any time; this does not affect the lawfulness of the processing carried out before the withdrawal. Requests should be sent to the contact details indicated at the beginning of the Policy. You also have the right to lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw.

The right to object applies in two situations:

• where we process personal data for the purposes of direct marketing; such an objection does not have to be justified and is binding on the Controller,
• where we process personal data on the basis of other legitimate interests of the Controller; such an objection must be justified by the data subject’s particular situation.

Where you exercise your rights, the answer given to your request is archived for 3 years in order to document our compliance with our statutory obligations. That period begins when we give our final answer.

10. Automated decision-making and profiling

The Controller does not take decisions in relation to you based solely on automated processing, including profiling, which would produce legal effects concerning you or similarly significantly affect you. The Operators of the Platforms may, however, profile users for their own purposes, including in order to display tailored content and advertising, on the terms set out in their privacy policies.