PRIVACY POLICY FOR WWW.MAGOFFSHORE.PL

1. General information

This Privacy Policy applies to the website available at www.magoffshore.pl, hereinafter referred to as the “Website”.www.magoffshore.pl

The operator of the Website and the controller of personal data is MAG OFFSHORE Sp. z o.o.,
ul. Tadeusza Wendy 15, 81-341 Gdynia, Poland, Tax Identification Number (NIP): 5860102122, National Court Register (KRS): 0000016806, Statistical Number (REGON): 001316656, hereinafter referred to as the “Operator” or the “Controller”.

The Operator may be contacted by email at: office@magoffshore.

The Operator is the controller of personal data voluntarily provided by users through the Website.

The Website collects information about users and their activity through:

• data voluntarily entered into forms and submitted to the Operator’s systems;
• information provided in correspondence addressed to the Operator;
• cookies stored on users’ end devices;
• automatically recorded server logs.

2. Selected data protection measures applied by the Operator

Areas of the Website in which personal data are entered are protected during transmission by means of an SSL/TLS certificate. As a result, data entered on the Website are encrypted on the user’s device and may be read only by the destination server.

The Controller applies appropriate technical and organisational measures to protect the personal data processed against unauthorised disclosure, loss, destruction, alteration or access by unauthorised persons.

The Controller implements and periodically reviews technical and organisational measures designed to ensure the security of data processing and the resilience of the IT systems used, taking into account the nature of the Controller’s activities, the current state of technical knowledge and the applicable legal requirements.

Access to personal data is granted only to persons authorised by the Controller and to entities providing services to the Controller, to the extent necessary for the performance of those services.

3. Hosting and data processors

The Website is hosted, i.e. technically maintained, on servers operated by the hosting service provider cyber_Folks S.A., with its registered office in Poznań. In order to ensure the proper and secure operation of the Website, the hosting provider may maintain server logs.

In particular, the following information may be recorded:

• resources identified by a URL, including the addresses of requested pages and files;
• the time at which a request is received and the time at which a response is sent;
• information concerning the user’s device or client workstation;
• information about errors occurring while processing a request;
• the URL of the page previously visited by the user, where the Website was accessed via
  a link;
• information about the web browser, operating system and IP address;
• diagnostic information related to the operation of the Website;
• information related to the handling of email sent to and by the Operator.

Data may also be processed by providers of IT services, email services, technical support and other services supporting the Controller’s activities, solely to the extent necessary for the provision of those services.

4. Purposes, legal bases and data retention periods

The Controller processes users’ personal data in accordance with applicable law, in particular Regulation (EU) 2016/679 of the European Parliament and of the Council, hereinafter referred to as the “GDPR”.

4.1. Website analytics and traffic statistics

Data relating to the use of Google Analytics 4 are processed for the following purposes:

• analysing how the Website is used;
• preparing Website traffic statistics;
• assessing the popularity of individual subpages;
• improving the operation and usability of the Website.

The legal basis for processing is Article 6(1)(a) of the GDPR, i.e. the user’s voluntary consent expressed through the cookie consent management tool.

Data are collected until the user withdraws consent. Data collected before consent is withdrawn are retained for the retention period configured in Google Analytics 4.

4.2. Website administration and security

Data contained in server logs may be processed for the following purposes:

• administering the Website;
• ensuring the proper operation of the Website;
• identifying errors and irregularities;
• preventing misuse and security threats;
• ensuring the security of IT systems;
• establishing, pursuing or defending against claims.

The legal basis for processing is Article 6(1)(f) of the GDPR, i.e. the Controller’s legitimate interest in ensuring the security, stability and proper operation of the Website.

Data are retained for the period resulting from the technical configuration of the server and security requirements, and for as long as necessary to establish, pursue or defend against potential claims.

5. Information provided through forms

The Website collects information voluntarily provided by the user, including personal data, where such data are entered into a form or included in the content of a message.

The scope of data collected through a form depends on the fields included in that form and on the information provided by the user in the content of the enquiry.

The Website may record connection parameters, in particular the date and time of the connection and the IP address.

Data provided through a form are processed for the purpose corresponding to the function of that form, in particular to handle an enquiry, contact the user or take steps prior to entering into
a contract.

Users should not provide through the form any personal data that are not necessary for handling their matter.

6. Rights of data subjects

In order to fulfil obligations arising from personal data protection laws and to ensure an appropriate level of data protection, the Operator has appointed a Data Protection Officer. The Data Protection Officer is Marlena Luleńska.

The Data Protection Officer may be contacted by email at: iod@magoffshore.pl

The data subject has the right to request from the Controller:

• access to their personal data and receipt of a copy thereof;
• rectification of their personal data;
• erasure of their personal data, where the conditions provided for by law are met;
• restriction of processing;
• data portability, where processing is based on consent or a contract and is carried out by automated means;
• the right to object to the processing of personal data based on the Controller’s legitimate interest.

Where data are processed on the basis of consent, the user has the right to withdraw that consent at any time.

Withdrawal of consent does not affect the lawfulness of processing carried out on the basis of consent before its withdrawal.

Consent to analytical cookies may be withdrawn using the cookie settings tool available on the Website.

The data subject also has the right to lodge a complaint with a supervisory authority.

Contact details of the supervisory authority:

President of the Personal Data Protection Office

ul. Stanisława Moniuszki 1A

00-014 Warsaw

Poland

Providing personal data is voluntary; however, it may be necessary in order to respond to an enquiry or handle a matter submitted through the Website.

The Controller does not subject Website users to automated decision-making,
including profiling, within the meaning of Article 22 of the GDPR.

7. Google Analytics 4

The Operator uses Google Analytics 4, a service provided by Google Ireland Limited,
with its registered office in Ireland, solely for analytical and statistical purposes.

Google Analytics 4 may enable the collection of information including:

• the number of visits to the Website;
• subpages visited and time spent using the Website;
• traffic sources;
• the type of device, operating system and web browser;
• the user’s approximate location;
• the user’s interactions with specific elements of the Website.

Google Analytics 4 is activated only after the user has given prior voluntary consent to analytical cookies.

Refusal to consent to analytical cookies does not prevent the user from using the basic functions of the Website.

The Operator does not use Google Analytics 4 for:

• marketing activities;
• remarketing;
• displaying personalised advertisements;
• profiling users for marketing purposes;
• operating a newsletter.

The user may withdraw consent to the use of analytical cookies at any time through the cookie settings available on the Website.

In connection with the use of Google Analytics 4, data may be transferred to third countries, in particular to the United States. Such transfers are carried out in accordance with the GDPR, in particular on the basis of a European Commission adequacy decision (EU-U.S. Data Privacy Framework) or other appropriate safeguards provided for by law.

8. Company profile on LinkedIn

The Operator maintains a company profile on LinkedIn.

The profile is used to present the Operator’s activities, publish information about the company and communicate with LinkedIn users.

The Operator does not use its LinkedIn profile to track the activity of users on the Website at www.magoffshore.pl or to conduct remarketing activities.www.magoffshore.pl

The Website does not use the LinkedIn Insight Tag or any other LinkedIn tools designed to monitor the behaviour of users visiting the Website.

9. Cookies

The Website uses cookies.

Cookies are IT data, in particular small text files, stored on the user’s end device and used while the user is using the Website.

Cookies usually contain the name of the website from which they originate, the period for which they are stored on the end device and a unique identifier.

9.1. Necessary cookies

Necessary cookies are required for the proper, secure and stable operation of the Website and for the use of its basic functions.

Necessary cookies are used without the user’s prior consent where they are required to provide a service requested by the user or to ensure the security of the Website.

9.2. Analytical cookies

Analytical cookies are used by Google Analytics 4 to collect statistical information about how the Website is used.

Analytical cookies are not activated before the user has given prior consent.

The Operator does not use cookies for remarketing, behavioural advertising or displaying personalised advertisements.

The Website may use:

• session cookies, which are stored until the web browser is closed or the session ends;
• persistent cookies, which are stored for the period specified in their settings or until they are deleted or the user withdraws consent.

10. Managing consent to cookies

When the user first visits the Website, a banner is displayed enabling the user to manage consent to optional cookies.

The banner allows the user to:

• accept analytical cookies;
• reject analytical cookies;
• review detailed information about the cookies used.

Failure to make a choice or closing the banner is not treated as consent to analytical cookies.

Google Analytics 4 and the related analytical cookies are not activated until consent has been given.

The user may change their preferences or withdraw consent at any time using the “Cookie settings” link available in the Website footer.

Withdrawing consent is as easy as giving it.

The user may also delete or block cookies using their web browser settings. Restricting the use of necessary cookies may affect the proper operation of some Website functions.

11. Controller’s logs

Information about users’ activity on the Website may be recorded in server logs.

Data contained in the logs are used to administer the Website, ensure its security, identify errors and prevent misuse.

Server logs are not used by the Operator for marketing or remarketing purposes.

12. Recipients of data

Personal data may be disclosed to entities providing services to the Controller, in particular to providers of:

• hosting, IT and email services;
• Google Ireland Limited, which provides Google Analytics 4 – only after consent to analytical cookies has been obtained;

and to entities:

• providing technical support for the Website;
• authorised to receive data under applicable law.

The Controller does not sell personal data or disclose them to third parties for their own marketing purposes.

13. Amendments to the Privacy Policy

The Controller may amend this Privacy Policy, in particular in the event of changes to applicable law, the manner in which the Website operates or its functionality, or the scope of personal data processed.

The current version of the Privacy Policy is always published on the Website.