Privacy policy

PRIVACY POLICY

Grupa Progres

 

  1. Definitions
    1. Executive Controller – the company Grupa Progres Sp. z o.o. with its registered office at Al. Grunwaldzka 411, 80-309 Gdańsk, entered into the register of entrepreneurs kept by the District Court Gdańsk‑Północ in Gdańsk, VII Commercial Division of the National Court Register under KRS number 0000532455; NIP: 5842739004, REGON: 360182321.
    2. Joint Controllers – the Executive Controller together with the following companies which, together with the Executive Controller, process personal data under a Joint Controllership Agreement: Progres HR International Sp. z o.o. (registered office: Al. Grunwaldzka 411, 80-309 Gdańsk, KRS 0000513227, NIP 5842736371, REGON 222108725); Progres Sp. z o.o. (registered office: Al. Grunwaldzka 411, 80-309 Gdańsk, KRS 0000176128, NIP 5932406370, REGON 190031562); Progres Advanced Solutions Sp. z o.o. (registered office: Al. Grunwaldzka 411, 80-309 Gdańsk, KRS 0000694006, NIP: 5272820139, REGON: 368264981); Progres Services Sp. z o.o. (registered office: Al. Grunwaldzka 411, 80-309 Gdańsk, KRS: 0000863576, NIP 5842776543, REGON 387254981); Progres HR Poland Sp. z o.o. (registered office: Al. Grunwaldzka 411, 80-309 Gdańsk, KRS 0000761627, NIP 6040100389, REGON 220647576).
    3. Policy – this Privacy Policy.
    4. GDPR – Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation).
    5. Personal data – any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.
    6. Website – the websites operated by the Joint Controllers, available at: https://grupaprogres.pl/ and https://jestempro.pl/.
    7. User – a person or entity visiting this website, using the Website or making contact via e‑mail or telephone.
    8. Newsletter – a free service provided electronically by the Joint Controllers to the User, involving the sending of electronic messages by which the Joint Controllers inform about events, services, products and other matters relevant to their business activities, including for the purpose of direct marketing, with the User’s consent.
    9. Cookies – IT data, in particular text files, saved and stored on devices through which the User accesses the Website’s pages.
    10. Device – an electronic device together with its software, through which the User accesses the Website.

 

  1. General provisions
    1. The Controller of personal data within the meaning of Article 4(7) GDPR is Grupa Progres Sp. z o.o. with its registered office at Al. Grunwaldzka 411, 80-309 Gdańsk, KRS 0000532455, NIP 5842739004, REGON 360182321, acting as the Executive Controller.
    2. Some personal data are processed jointly by the Executive Controller and the other Grupa Progres companies under the joint controllership arrangement referred to in Article 26 GDPR. Detailed information on joint controllership is contained in Section 3 of this Policy.
    3. Any matters relating to the processing of personal data may be addressed to the Data Protection Officer (DPO), common to all Joint Controllers: Mateusz Pęczkowski, e‑mail address: iod@grupaprogres.pl, correspondence address: Al. Grunwaldzka 411, 80-309 Gdańsk.
    4. Use of the Website signifies acceptance of the provisions contained in this Privacy Policy.
    5. Provision of the personal data indicated in the forms and provision of data in the course of e‑mail correspondence is voluntary.

 

  1. Joint controllership of personal data
    1. Pursuant to Article 26 GDPR, the Executive Controller and the following companies have entered into a Joint Controllership Agreement:

No.

Company

Address

KRS

NIP

1.

Grupa Progres Sp. z o.o. (Executive Controller)

Al. Grunwaldzka 411, 80-309 Gdańsk

0000532455

5842739004

2.

Progres HR International Sp. z o.o.

Al. Grunwaldzka 411, 80-309 Gdańsk

0000513227

5842736371

3.

Progres Sp. z o.o.

Al. Grunwaldzka 411, 80-309 Gdańsk

0000176128

5932406370

4.

Progres Advanced Solutions Sp. z o.o.

Al. Grunwaldzka 411, 80-309 Gdańsk

0000694006

5272820139

5.

Progres Services Sp. z o.o.

Al. Grunwaldzka 411, 80-309 Gdańsk

0000863576

5842776543

6.

Progres HR Poland Sp. z o.o.

Al. Grunwaldzka 411, 80-309 Gdańsk

0000761627

6040100389
    1. The Joint Controllers have jointly determined the purposes and means of processing personal data in the following areas: joint marketing of Grupa Progres services, handling of joint recruitment processes, receipt and handling of whistleblower reports, handling of enquiries submitted through the contact form available on the Website, conducting analytical and statistical activities related to the functioning of the Website, and managing cookies.
    2. The function of Executive Controller is performed by Grupa Progres Sp. z o.o. The Executive Controller is responsible for fulfilling information obligations and handling requests of data subjects on behalf of all Joint Controllers.
    3. Irrespective of the foregoing, the User may address his/her requests and enquiries to any of the Joint Controllers. In such a case, the Joint Controller to whom the request is addressed shall forward it without delay to the Executive Controller.
    4. The common contact point for data subjects is the Data Protection Officer, shared by all Joint Controllers: iod@grupaprogres.pl.
    5. Personal data processed within the framework of joint controllership are not transferred between Joint Controllers as a disclosure of data to an external recipient – the actions of the Joint Controllers constitute joint processing for the agreed purposes.
    6. The essential content of the arrangements between the Joint Controllers is as follows:
      1. The Joint Controllers declare that they process Users’ personal data in accordance with the principles set out in Article 5 GDPR, in particular the principles of lawfulness, fairness and transparency, purpose limitation, data minimisation, accuracy, storage limitation, and integrity and confidentiality.
      2. The Executive Controller retains all documentation relating to joint controllership for the purpose of fulfilling the accountability requirement referred to in Article 5(2) GDPR.
      3. The Joint Controllers do not transfer Users’ personal data outside the European Economic Area, subject to the proviso that such transfer may take place only in the cases and under the conditions specified in Chapter V of the GDPR, in particular on the basis of a European Commission adequacy decision or standard data protection clauses approved by the European Commission.
      4. The Joint Controllers undertake to restrict access to Users’ personal data solely to persons whose access is necessary for the performance of the agreed processing purposes. Only persons holding a personal authorisation granted by the relevant Joint Controller, who have undertaken to keep personal data confidential and have been trained in personal data protection rules, shall be permitted to process personal data.
      5. The Joint Controllers ensure an appropriate level of security of personal data, in particular by ensuring the ability to continuously ensure the confidentiality, integrity, availability and resilience of processing systems, the ability to quickly restore the availability of data in the event of a physical or technical incident, as well as regular testing and evaluating the effectiveness of the technical and organisational measures applied.
      6. The Joint Controllers may entrust the processing of personal data to processors, in compliance with the requirements of Article 28 GDPR.
      7. The User may contact the Executive Controller, each of the other Joint Controllers, as well as the Data Protection Officer at: iod@grupaprogres.pl, in matters relating to the protection of his/her personal data.

 

  1. Scope of collected data, purposes of processing and legal bases for processing
    1. The purpose of processing personal data, the scope of such data and the potential recipients of personal data provided by the User are determined on the basis of the consent given by the User, or pursuant to applicable legal provisions, or on the basis of the legitimate interests of the Controllers.
    2. The User provides personal data:
      1. in the contact form – handled by all Joint Controllers; b. in the contact form intended for business clients; c. when submitting an application for recruitment for positions offered by Grupa Progres and its companies – when completing the application form, the candidate is provided with a separate information clause concerning the processing of personal data in the recruitment process, in accordance with Article 13 GDPR; d. in the Newsletter subscription form.
    1. In some cases, data may be stored in the form of browser preferences, IP address, traffic and frequency of the User’s visits to the website, as well as location data and data on resources used.
    2. Personal data collected by the Joint Controllers are processed for the following purposes:

Purpose of processing

Legal basis for processing

For the purpose of return contact, correspondence and answering the question asked by the User by completing the contact form on the Website – carried out jointly by all Joint Controllers

Article 6(1)(f) GDPR – legitimate interests pursued by the Joint Controllers

For the purpose of taking steps related to the conclusion and performance of a contract with the User or the entity on whose behalf the User acts

Article 6(1)(b) or (f) GDPR – performance of a contract or steps prior to entering into a contract, including performance of a contract for the provision of electronic services

For marketing purposes, in particular: sending information about new products and services and offers, sending commercial information by electronic means, in particular distributing the newsletter; for the purpose of using personal data for marketing purposes by using the telephone number – carried out jointly by all Joint Controllers

Article 6(1)(a) GDPR – on the basis of consent given, which may be withdrawn at any time

For the purpose of administrative activities, in particular administering services provided by the Controllers, managing the organisation, in particular the website and IT systems

Article 6(1)(f) GDPR – legitimate interests pursued by the Joint Controllers

For the purpose of statistical and analytical activities related to the functioning of the Website

Article 6(1)(f) GDPR – legitimate interests pursued by the Joint Controllers

For the purpose of pursuing the legitimate interests of the Controllers, in particular the establishment, exercise and defence of legal claims

Article 6(1)(f) GDPR – legitimate interests pursued by the Joint Controllers

For the purpose of carrying out the recruitment process

Article 6(1)(c) GDPR in conjunction with Article 221 § 1 of the Polish Labour Code; Article 6(1)(a) GDPR in conjunction with Article 22² § 1 of the Polish Labour Code (in the case of data going beyond the statutory catalogue); Article 6(1)(a) GDPR (in the case of participation in future recruitment processes) Where data are processed on the basis of consent, the consent may be withdrawn at any time.

For the purpose of handling telephone contact – answering the question asked by the User or taking steps related to the conclusion of a contract at the User’s request

Article 6(1)(f) GDPR – legitimate interests pursued by the Joint Controllers, consisting in responding to the enquiry made and maintaining relationships with clients and candidates; Article 6(1)(b) GDPR – to the extent that the telephone contact relates to steps aimed at concluding a contract or its performance at the User’s request

 

  1. Automated data processing
    1. The Joint Controllers do not process data by automated means, including profiling that produces legal effects for the User.

 

  1. Recipients of personal data
    1. Recipients of personal data may be exclusively entities authorised under the provisions of law or entities to which the processing of personal data has been entrusted under a data processing agreement concluded in accordance with Article 28 GDPR.
    2. Processing of data within the framework of joint controllership does not constitute a disclosure of data to a recipient – the actions of the Joint Controllers constitute joint processing for agreed purposes.
    3. Data may be transferred to entities providing services to the Joint Controllers, in particular providers of IT services, entities providing advisory and accounting services, provided that such entities process data solely under an agreement with the Joint Controllers and in accordance with their instructions.
    4. Data may also be disclosed to clients of the Joint Controllers responsible for the recruitment process or offering employment that may be of interest to the User – clients and potential employers are obliged to maintain the confidentiality of the disclosed data.
    5. Data may be disclosed to public administration authorities and law enforcement authorities, if the Joint Controllers have been obliged to disclose them on the basis of legal provisions.

 

  1. Transfer of personal data to third countries
    1. As a rule, the Joint Controllers do not transfer or process the User’s personal data outside the European Union.
    2. Personal data may be transferred to a third country, i.e. a country that is not part of the European Economic Area (EEA), only in the cases and under the conditions specified in Chapter V of the GDPR, in particular on the basis of:
      1. Article 45(1) GDPR – a European Commission adequacy decision (in the case of countries for which such a decision has been adopted); b. Article 46(2)(c) GDPR – standard data protection clauses approved by the European Commission (in the case of other countries).

 

  1. Social media plug‑ins
    1. The Website may use social media plug‑ins from the following networks: Facebook, Instagram, X (formerly Twitter), LinkedIn, YouTube, TikTok, pursuant to Article 6(1)(f) GDPR, in order to allow the User to access channels run by the Joint Controllers.
    2. Each social media platform has its own separate privacy policy, which the User should read when visiting the respective site.
    3. The plug‑in content is transmitted from the browser to the social network and is integrated with the page. The information is then sent directly from the User’s browser to the server of the particular social network and stored there.
    4. The User may log out of the respective social network account prior to visiting the website if he/she does not wish the collected information about the visit to be attributed to the social network.

 

  1. Period of processing of personal data
    1. Personal data will be processed for as long as the basis for processing exists, i.e.:
      1. in the case of consent having been given – until its withdrawal, but no longer than 5 years; b. in the case of data being necessary for the performance of a contract – for the duration of its performance and until the expiry of the limitation period for claims under that contract; c. where the legal basis for processing is the legitimate interests of the Controllers – until the User lodges an effective objection, but no longer than until the expiry of the limitation period for claims arising from the given processing purpose; d. in the case of sending the Newsletter – until the User resigns from receiving the Newsletter or until the Joint Controllers cease providing the Newsletter service, but no longer than 5 years.

 

  1. User’s rights
  1. Every User has the right to:
    1. access personal data, including obtaining a copy of the data; b. request rectification of personal data; c. request erasure of personal data (‘the right to be forgotten’); d. request restriction of processing of personal data; e. data portability; f. object to the processing of personal data, including objecting to direct marketing; g. withdraw consent – withdrawal of consent does not affect the lawfulness of processing based on consent before its withdrawal; h. lodge a complaint with a supervisory authority, i.e. the President of the Personal Data Protection Office (PUODO).
    2. Requests and questions relating to the exercise of the rights indicated above should be addressed to the Executive Controller or to the Data Protection Officer: iod@grupaprogres.pl. The User may also contact any Joint Controller directly – in such a case the Joint Controller shall forward the request to the Executive Controller.
  1.  

 

  1. Cookies
    1. The Joint Controllers’ Website uses cookies, to which the User consents by means of the appropriate acceptance of the notification in the form of a pop‑up window upon entering the website.
    2. The entity placing cookies on the User’s terminal device and obtaining access to them is the Joint Controllers.
    3. Cookies are used for the following purposes:
      1. adapting the content of the website to the User’s preferences, in particular by remembering passwords and filling in the Website User’s preferences; b. remembering information and using it to improve the structure and content of the website; c. maintaining the Website User’s session after logging in; d. recording the User’s visits for marketing and statistical purposes; e. ensuring the security of the services; f. using social features.
    1. The Website uses the following types of cookies:
      1. Strictly necessary cookies – essential for the functioning of the website and cannot be disabled in the Joint Controllers’ systems. b. Analytical cookies – enable analysis of the number of visits and collection of data on traffic sources. c. Advertising cookies – used to promote the Joint Controllers’ services. d. Functional cookies – help to perform certain functions, such as sharing website content on social media platforms. e. Session cookies – temporary information stored until leaving the Website. f. Persistent cookies – stored on the User’s terminal device until deleted by the User or for the period resulting from their settings.
    1. The User may at any time change the settings of his/her browser regarding the saving, deletion and access to stored cookies.
    2. The Website uses, among others, the following analytical and advertising tools: Google Analytics and Google Ads. More information about the privacy policies of these services is available on the websites of their providers.
    3. The Joint Controllers reserve that disabling or limiting the handling of cookies may restrict access to certain functions of the Website.

 

  1. Final provisions
    1. In matters not regulated by this Privacy Policy, the relevant provisions of Polish and European law shall apply.
    2. The Joint Controllers reserve the right to introduce updates to this Policy, publishing its new version on the Website. Information about any modifications to the Policy may also be communicated to Users by e‑mail or through other available forms of communication.

 

Date of last update: 16.06.2026