Information about data protection
Information about data protection
Processing of your personal data shall be compliant with the rules of law, reliable and transparent. Therefore we would like to inform about the rules and purpose of processing personal data and to explain rights you are entitled to and manners of their execution. It results from the application of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27th April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC, commonly known as the General Data Protection Regulation (“GDPR”).
As a principle it is possible to surf on our website without providing your personal data, however, there are some cases when your personal data is retrieved (see below).
Who is your personal data controller?
Your personal data controller is DB Cargo Polska S.A. with headquarters in Zabrze at ul. Wolności 337.
How to contact us to get more information about processing of your personal data?
DB Cargo Polska S.A. has appointed Representatives for Personal Data Protection:
DB Cargo Polska S.A.
Representatives for Personal Data Protection
ul. Wolności 337
How did we receive your personal data?
We receive your personal data:
- if you expressed your consent to processing of your personal data for marketing purposes or in order to receive commercial and marketing correspondence from DB Cargo Polska, including electronic means and with electronic devices such as phone, computer and other,
- if you contacted the company in order to conclude a contract or started cooperation with us by concluding a contract,
- if you provided your data to us with a contact form available on the website at https://pl.dbcargo.com/rail-polska-pl/Formularz-Kontaktowy-2303794
- if you provided your personal data for recruitment purposes,
- if you expressed your consent to personal data processing.
What are the purposes and bases for processing of personal data?
We collect and process your personal data in specific purposes only.
- If you contact us by sending correspondence by e-mail or by post not related to a concluded contract or provided services, we may process your personal data included in the e-mail/post correspondence only for communication purposes or proceeding with the issue the correspondence is related to. It is required to provide personal data only if it is necessary for proceeding with the case and failure to do so renders it impossible to proceed – the legal basis for processing is the legitimate interest of the Administrator (art. 6 clause 1 letter f of the General Data Protection Regulation (GDPR), which is about keeping correspondence received in connection with the conducted business activity.
- If you contact us by phone in matters not related to concluded contract or provided services, we may require personal data only if it is necessary for processing the case you contacted us about and failure to do so would render it impossible to proceed – the legal basis for processing is the legitimate interest of the Administrator (art. 6 clause 1 letter f of the EU General Data Protection Regulation (GDPR), which is about the need to process a case submitted by phone related to conducted business activity.
- If it is necessary for the purpose of concluding and executing a contract concluded with you, including the provision of service and for the purpose of conducting a case if you submit a complaint for the way your requests submitted to us (e.g. via the contact form) are processed or contacting you in purposes related to the provision of services – the legal basis then is art. 6 clause 1 letter b) of the EU General Data Protection Regulation (GDPR). Additionally if the rules of law require us to process your data for tax and accounting purposes – then the legal basis shall be art. 6 clause 1 letter c) of the EU General Data Protection Regulation (GDPR).
- If it is required for compliance with legal obligations to which the Data Controller is subject or carrying out tasks in the public interest (e.g. storing of tax documentation) – the legal basis shall be art. 6 clause 1 letter c) of the EU General Data Protection Regulation (GDPR).
- In order to ensure safety of people and property our facilities are equipped with video surveillance system. We also control the entrance to premises and to area under our management. Personal data collected this way may be used only for the purpose of protecting people and property which means it shall not allowed to used them in any other purpose – the basis for personal data processing is the legitimate interest of the Administrator (art. 6 clause 1 letter f) of the EU General Data Protection Regulation (GDPR). In such case the provision of such data is required by the Controller to allow a person to enter the premises and refusal to do so will render the entrance impossible.
- For the establishment, exercise or defence of legal claims which is our legitimate interest – the basis for the personal data processing is the legitimate interest of the Administrator (art. 6 clause 1 letter f) of the EU General Data Protection Regulation (GDPR).
- For the archiving (evidential) purposes in order to secure information in case of a legal requirement to prove some facts – the legal basis for the processing is the legitimate interest of the Controller; a legitimate interest of the Controller is protection against any charges and statements of third parties and ensuring accountability (proving that we meet the requirements resulting from the rules of law) – the basis for personal data processing is the legitimate interest of the Controller (art. 6 clause 1 letter f) of the EU General Data Protection Regulation (GDPR).
- In order to be able to offer you products and services directly (direct marketing), in order to send you invitations to events organised by the company which is our legitimate interest – the basis for the personal data processing is the legitimate interest of the Controller (art. 6 clause 1 letter f) of the EU General Data Protection Regulation (GDPR).
- If it results from other legitimate interests of the Data Controller - the basis for the personal data processing is the legitimate interest of the Controller (art. 6 clause 1 letter f) of the EU General Data Protection Regulation (GDPR).
- If you participate in a recruitment process, the Controller shall process your personal data only in the scope covered by the rules of the Labour Law and in the scope exceeding the requirements of the rules of law, only if you voluntarily provide your consent. The personal data is processed:
- in order to fulfil duties resulting from the rules of law related to the employment process, including first and foremost the Labour Law – the legal basis of processing is the legal duty of the Controller (art. 6 clause 1 letter c of the EU General Data Protection Regulation (GDPR) in connection with the provisions of the Labour Law);
- in order to conduct a recruitment process related to data exceeding the requirements of law and for the purpose of any future recruitment processes – the legal basis for processing is a consent (art. 6 clause 1 letter c of the EU General Data Protection Regulation (GDPR);
- in order to establish, exercise or defend legal claims – the legal basis for data processing is the legitimate interest of the Controller (art. 6 clause 1 letter f) of the EU General Data Protection Regulation (GDPR);
- If we are entitled or obliged to process your personal data based on a consent, the basis for data processing is a consent provided voluntarily (art. 6 clause 1 letter a) of the EU General Data Protection Regulation (GDPR). You have the right to withdraw your consent to data processing at any time without influencing the lawfulness of processing that occurred based on the consent provided prior to its withdrawal. A declaration on withdrawing the consent shall be submitted in writing or in electronic form at: email@example.com.
- We store and analyse data of users obtained from internet sources in a pseudonymous manner so that we are able to continuously improve our offer. The legal basis is art. 6 clause 1 letter f of GDPR).
- Your personal data may also undergo processing if due to technical reasons they need to be collected and saved at each visit on the www.pl.dbcargo.com and www.dbcargo.com websites (it refers in particular to date and duration of a visit, opened pages, identification data of browser and operating system as well as the website from where you were redirected to DB Cargo Polska’s website).
Magazine for customers – ‘railways’
To order a digital version of “railways”, a magazine for customers, you need to fill in the following fields: profile of reader, title, surname, first name, e-mail address. To order a print version, you need to fill in the following fields: reader type, title, surname, first name, e-mail address, company, street/number, post code and city.
When you subscribe to our newsletter, we store the IP address of the computer system you were using at the time of subscribing. This is provided by the internet service provider (ISP). We also store the date and time at which you subscribed. We need to collect it in order to trace any misuse that may affect a person's e-mail address at a later point as a part of the legal protection we provide.
Subscription and cancelling the PDF issue and print version.
If you order the electronic issue of the magazine in the PDF version, your data shall be used only for the purpose of sending the ‘railways’ magazine. You may resign from the subscription at any time. In order to do so, you need to send an e-mail at L-Cargo-Railways@deutschebahn.com or click the following link: https://www.dbcargo.com/rail-deutschland-en/news-and-media/Customer_magazine_railways/Order_railways-1697236.
If you order print version, your data shall be used only for the purpose of sending the ‘railways’ magazine. You may resign from the subscription at any time. In order to do so you need to send an e-mail at L-Cargo-Railways@deutschebahn.com or click the following link: https://www.dbcargo.com/rail-deutschland-en/news-and-media/Customer_magazine_railways/Order_railways-1697236.
Who will receive your personal data?
Your personal data may be provided to entities from our capital group (Infra SILESIA S.A., DB Cargo Spedkol Sp. z o.o., DB Port Szczecin Sp. z o.o.) and subcontractors, i.e. entities that provide their data processing services to us, i.e. accounting, legal, IT, insurance companies (claims adjusters), consulting companies, couriers, marketing and recruitment agencies as well as authorised organisations when required by law.
External service providers we cooperate with are carefully selected and subject to strict contractual obligations. The service providers proceed in accordance with our instructions and guidelines, are equipped with technical and organisational measures and are subject to our controls and audits which ensure data safety.
Do we provide personal data to countries outside European Economic Area?
Personal data is not provided to third countries outside EU / EEA or international organisations, unless relevant guarantees are provided. They cover standard EU contractual clauses and decision of the European Commission on ensuring a relevant level of security.
For how long do we keep personal data?
Data processing period depends on the type of provided service and the purpose of processing.
- If the personal data is collected in order to conclude a contract, we keep them from the moment of collecting the data prior to the contract conclusion, through the entire period of contract negotiations and until the elapse of the calendar year following the year in which you last time contacted us. If the processing is based on your consent, the data is processed until the moment of its withdrawal.
- If the personal data is collected in relation to complete an order or conclude and executing a contract – we process them from the moment of collecting the data until the end of the period of limitation of any possible claims resulting from the contract. If the processing is based on your consent, data shall be processed until you withdraw it.
- If the personal data is collected in order to fulfil duties resulting from the rules of law or in connection with the fulfilment of tasks in the public interest – we shall process it for the period of fulfilment of duties and tasks resulting from the individual rules of law,
- If the data is processed pursuant to a legitimate interest of the Controller – e.g. for safety reasons – the data shall be processed for the period which allows for its fulfilment or for submitting an effective objection to data processing. If the processing occurs pursuant to a consent, the data shall be processed until it is withdrawn, however, no longer than for the period referred to in the information about data processing.
- It the data is processed in order to ensure safety in a form of recordings from surveillance system, they shall be stored for the period of 3 months.
Basic contact details are stored for the purposes of direct marketing of our products and services until:
you file an objection to its processing for this purpose,
- you withdraw your consent,
- processing pursuant to so-called marketing consent gets outdated,
- we find that the data is outdated ourselves.
The data processing period may be prolonged if the processing of such personal data was necessary for the establishment, exercise or defence of legal claims, and after the elapse of this period only in case and scope required by the rules of law. After the elapse of the processing period, data shall be irretrievably deleted or rendered anonymous.
What rights are you entitled to?
If we process your personal data in a specific purpose, we shall ensure:
- the right of access to personal data (information about data we process, including the right to obtain their copy),
- the right to require rectification (correction) of personal details if the data is wrong or incomplete,
- the right to require erasure of personal data (so-called “right to be forgotten”); if in your opinion there are no bases to process the data, you shall submit a request to erase them,
- the right to restrict data processing; you may submit a request to restrict the processing of your personal data to storing only or performing jointly agreed activities if in your opinion data which we have is incorrect or we process it groundlessly; or if you do not wish the data to be deleted because it is necessary for the establishment, exercise or defence of legal claims,
- • you shall have the right to file an objection to data processing: “marketing objection”. You have the right to object to processing of your personal data for the purposes of direct marketing. If you exercise this right – we will cease to process your data for this purpose.
- objection due to specific situation; you shall have the right to object to processing of your data based on legitimate interest for purposes other than direct marketing and when the processing is necessary for us in order to carry out tasks in public interest. It is necessary to describe the special situation which in your opinion justifies discontinuation of our processing of data covered by the objection. We shall cease to process data for those purposes unless we demonstrate that the bases for processing your data override your rights or that this data is necessary for the establishment, exercise or defence of legal claims,
- the right to data portability: you shall have the right to receive personal data concerning you which you have provided to us based on a contract or your consent in a structured, commonly used, machine-readable and interoperable format (e.g. “csv”). You are also entitled to order us to transmit it to another controller.
- the right to file an objection: you shall have the right to file an objection to the processing of your data at any time,
- the right to lodge a complaint: you shall have the right to lodge a complaint on our processing of your data to a supervisory authority, i.e. the President of the Personal Data Protection Authority (address: President of the Personal Data Protection Authority, ul. Stawki 2, 00-193 Warsaw) or to the President of the Personal Data Protection Authority if you consider that the data processing violates the provisions of GDPR,
- the right to withdraw the consent to the processing of personal data: at any moment you shall have the right to withdraw the consent to process those personal data which we process pursuant to your consent. Withdrawal of the consent shall not affect the lawfulness of the processing which occurred prior to the withdrawal.
How to execute your rights?
In order to execute your rights you should send a request:
- in a written form to DB Cargo Polska SA, ul. Wolności 337, 41-800 Zabrze, comment: Representative for the personal data protection
- by e-mail at: firstname.lastname@example.org
The Controller contact the petitioner for additional information in case of failure to identify him/her based on the request itself.
The answer shall be provided within a month from the date of receipt of a request. If it is required to extend this term, the Controller shall provide the reasons to the petitioner.
The reply shall be given in a written form, unless the request was sent by e-mail or the petitioner demanded a reply by e-mail.
The procedure resulting from a submitted request is free of charge. Some fees may be charged only in case of requesting second and each next copy of data (first copy of data is free of charge); in such case the Controller may charge a fee in the amount of PLN 12.00. The abovementioned fee covers administration costs related to the fulfilment of the request.
If the fee was charged illegitimately, it is possible to file a complaint to the President of the Personal Data Protection Authority.
What happens in case of links to external websites?
When you click a link to an external website, you are forwarded to a page outside of the DB Cargo Group website. As a result, DB Cargo Polska S.A. shall not responsible for the content, services or products available offered on external websites. Similarly, DB Cargo Polska S.A. shall not be held liable for your data privacy or technical safety when you are on external websites.
When are cookies used?
Cookies are small text files used to store personal data. Cookies can be sent to the website when it is visited, allowing the user to be identified. Cookies help users to use websites more easily. We differentiate between cookies that are mandatory for the technical functions of the website and those that are not mandatory.
We want to allow you to make an informed decision for or against using cookies that are not essential for the technical functions of the website. Please note that rejecting cookies designed for commercial purposes means that any advertising you receive will not be as closely tailored to your interests as would otherwise be the case. The use of this website as such will not be affected by this. Please find below some information on how and in what manner cookies are used on our web pages.
It is generally possible to use www.pl.dbcargo.com and www.dbcargo.com without cookies that serve non-technical purposes. This means that you can prevent browser tracking from cookies (“do not track”, “tracking protection list”) or prevent third-party cookies from being saved. In addition, we recommend checking saved cookies regularly if they are not expressly desired.
Please note that when you delete all cookies, you are also deleting any opt-out cookies, meaning that you must opt out again.
Use of Matomo (formely Piwik)
We use the Matomo analysis service (formerly known as Piwik) on our website in order to analyse how our website is used and make improvements on a regular basis. The statistics gathered allow us to improve our offering and design it in a way that is more attractive to you as a user. With the help of small text files (cookies), we collect data on how you use our website, which includes your IP address. This data is anonymised and stored on our servers.
The legal basis for the use of Matomo is subparagraph 1 in point (f) of Article 6(1) of the GDPR.
Your deactivation options: If you do not consent to the analysis of the manner you use our website, you can configure your browser at any time in such a way that it does not install any analysis cookies. Additionally, you can decide whether to allow your browser to store a cookie that is clearly identified as being for web analysis purposes so that the website operator can collect and analyse various types of statistical data. If you decide not to allow this, click the following link to store the Matomo deactivation cookie in your browser.
Data from your visit to this website is currently being collected by the Matomo web analysis service. Click here to disable saving data from your visit.
Please note that if you delete all cookies, you will also delete the deactivation cookie. This means that you will need to opt out of the analysis of your usage behaviour again.