Privacy and cookie policy

1. Data controller and contact

The controller of your personal data is RSHolding Sp. z o.o. Sp. K., ul. Dąbrówki 8, 35-036 Rzeszów, Poland, entered in the register of entrepreneurs of the National Court Register (KRS) under number 0000780671. Tax identification number (NIP) 8133809791, statistical number (REGON) 383029426.

For all matters concerning personal data, including the requests described in section 12, please contact us at rs@rsholding.com.pl or by phone at +48 793 738 360.

We have not appointed a data protection officer. Data protection matters are handled directly by the management board of the company, at the contact details given above.

2. What this website collects, and what it does not

This website is a company profile. It has no user accounts, no newsletter, no shop and no booking system. The only field where you can enter data is the application form in the “Jobs” section: we describe it separately in section 14.

The website sets no cookies of its own. It also loads no typeface from an external server: the font is hosted together with the site, so opening a page creates no connection to Google Fonts or to any other content delivery network. This matters in practice, because such a connection transmits the visitor’s IP address to the service provider, which has been the subject of litigation (judgment of the Regional Court of Munich I, case 3 O 17493/20).

Personal data therefore arise in five situations: when the server records your request in its log, when your browser downloads the Google Tag Manager script, when the map in the footer is displayed, when you decide to write or call us, and when you submit an application through the form in the “Jobs” section. Each is described separately below, together with its legal basis.

3. Information stored in your browser

The website stores no cookies. It does use the browser’s local storage, and keeps two values there:

• rsh-consent: your consent decision, that is, a record of whether the analytics and marketing categories were switched on, together with the date on which you made it. Without it the banner would ask for consent every time you open a page. The date lets us demonstrate when consent was given and measure the year after which we ask again.
• rsh-lang: a note that you chose the language version manually. Its only purpose is to stop the bar suggesting the other language version from appearing again.

Both values stay in your browser. They are never transmitted anywhere, we do not read them server side, and they contain no identifier that would let us recognise you on a later visit or on another website.

The distinction between “cookies” and “local storage” is technical and does not change your rights. The provision that applies here (Article 398 of the Polish Electronic Communications Law, previously Article 173 of the Telecommunications Law) speaks of storing information on terminal equipment and of gaining access to information already stored there, whatever the technique used. We therefore treat both values exactly as cookies would be treated: as strictly necessary to provide the service you asked for, and for that reason not requiring consent. You can delete them at any time by clearing this site’s data in your browser settings.

4. Consent: categories, default state and withdrawal

On your first visit we display a banner with three categories:

• Necessary: remembering your consent decision, remembering the language version you chose, and the security of the site. Always on and not requiring consent.
• Analytics: measuring traffic, that is, the number of visits and how the site is used.
• Marketing: tailoring advertising messages and measuring their effectiveness.

We use Google Consent Mode v2. Before you give consent, the signals are set as follows: security_storage and functionality_storage to “granted”, because they concern the security and basic operation of the site, and analytics_storage, ad_storage, ad_user_data, ad_personalization and personalization_storage to “denied”. In practice this means that until you give consent, no tag will write a Google cookie to your device or read an advertising identifier from it.

The legal basis for processing in the analytics and marketing categories is your consent (Article 6(1)(a) GDPR). Consent is voluntary, and refusing it restricts access to no content on this site. The reject button in the banner is equally visible and takes the same number of clicks as the accept button.

How long it lasts. Your decision is honoured for one year from the moment you make it. After that the banner appears again and the consent state returns to the default denial before any tag can run. We ask again because consent given indefinitely stops reflecting what you are actually agreeing to.

How to withdraw consent. In the footer of every page, next to the link to this policy, there is a “Cookie settings” button. It reopens the same banner with your previous choice restored. You can clear the categories there and save the choice, or use the “Reject optional” button directly.

What happens then. The new state is saved in local storage and immediately passed to Google Tag Manager as a consent update, which stops any further firing of consent dependent tags and any further cookie writing. Cookies written earlier do not disappear from your device by themselves: you remove them by clearing the site data in your browser. Withdrawal does not affect the lawfulness of processing carried out on the basis of consent before it was withdrawn.

5. Google Tag Manager

The website uses Google Tag Manager (container GTM-TFV3Q6SG), a tool provided to users in the European Economic Area by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. The tag manager does not measure traffic itself: it governs the firing of other tags and checks whether the consent state allows it.

The tag manager script is downloaded on every page view, including when you reject consent. Downloading the file from googletagmanager.com writes nothing to your device, but it does mean that the provider learns your IP address and the standard information your browser sends: its type and version, your operating system and your language settings. The legal basis for this single operation is our legitimate interest in having the consent layer and future traffic measurement handled by one controlled mechanism (Article 6(1)(f) GDPR). You may object to it on the terms described in section 12.

The only service active in the container is Google Analytics 4 (measurement ID G-0NBRXE0L7K). We measure page views, the display of individual sections of the home page, and clicks on the phone number and email address shown here. This serves one purpose: checking whether the site answers the questions suppliers arrive with. No advertising tag is active, we do not use Google Signals and we do not pass data to advertising systems. The marketing category remains available in the banner but currently triggers nothing.

After you reject consent, Google Analytics still sends a single page-view request. It then writes no cookie and no identifier that would let us recognise you on a later visit, but the request itself carries your IP address, the address of the page viewed, information about your browser and a flag stating that consent was not given. Google uses such requests to estimate statistics. This is the default behaviour of Consent Mode v2 rather than a separate decision of ours, but we consider it right to say so plainly, because it departs from what one may expect after clicking a refusal button. The legal basis is our legitimate interest in knowing the scale of traffic on the site (Article 6(1)(f) GDPR), and you may object to it on the terms described in section 12.

6. Location map

The footer embeds a map showing the location of our registered office. The map frame is loaded lazily, that is, only once you scroll down to the footer. If you never reach the footer, no connection to the map servers is made. We embed no Google maps.

Displaying the map means that its provider, the OpenStreetMap Foundation (St John’s Innovation Centre, Cowley Road, Cambridge, CB4 0WS, United Kingdom), receives your IP address and the technical information sent by your browser. This is unavoidable when map tiles are fetched. The frame carries an attribute that suppresses the referring address, so the provider does not learn which page the map was opened from. Beyond what your browser sends by itself when fetching content, we pass the provider no information about you.

The legal basis is our legitimate interest in showing where our registered office is, which is material information for visitors verifying a business partner (Article 6(1)(f) GDPR). The provider’s own processing is described in its privacy policy: osmfoundation.org. We have no influence over its content, nor over how long the provider keeps its own logs.

7. Server logs and hosting

The website runs on shared hosting at home.pl. The hosting operator processes data on our instructions, as a processor within the meaning of Article 28 GDPR.

The server records standard request information in its log: IP address, date and time, the resource requested, the response code and size, and browser information. Logs are created regardless of consent, because without them the server could neither answer requests nor detect abuse. We do not combine them with any other data set and do not use them to analyse visitor behaviour.

The legal basis is our legitimate interest in maintaining the security and correct operation of the website (Article 6(1)(f) GDPR).

To be confirmed: the exact log retention period and the exact set of fields recorded follow from the service configuration on the hosting operator’s side and from the data processing agreement concluded with it. We state no figure here that we have not verified in that agreement. If you would like to know the period, please contact us at the address in section 1.

8. Contact by phone and email

The website gives the company’s phone number and email addresses. If you write or call us, we process the data contained in your message or given during the call: name, email address, phone number, the name of the company you represent and the content of the matter. The scope depends solely on what you provide.

The legal basis is taking steps at your request prior to entering into a contract, where the matter concerns an offer or cooperation (Article 6(1)(b) GDPR), and in other cases our legitimate interest in conducting ongoing correspondence and defending against claims (Article 6(1)(f) GDPR). If the contact results in an order or a contract, we additionally process the related data to meet our tax and accounting obligations (Article 6(1)(c) GDPR).

We send no unsolicited commercial messages and add nobody to any mailing list on the basis of a contact concerning an offer.

9. Categories of recipients

We do not sell data and disclose it to nobody for marketing purposes. The recipients are:

• the hosting and email operator, home.pl, as a processor acting on our instructions: server logs and email correspondence;
• Google Ireland Limited, and to the extent described in section 10 also Google LLC: the data described in section 5;
• the OpenStreetMap Foundation: the data described in section 6;
• our accountants and legal advisers, if correspondence leads to a contract or a dispute;
• public authorities, where they address us with a demand founded on a legal provision.

Google’s role in relation to data collected by tags, that is, whether it acts as a processor or as a joint controller, depends on which tool is switched on in the container. We will state it once the configuration has been carried out.

10. Transfers outside the European Economic Area

Google Tag Manager is provided to users in the European Economic Area by the Irish company, but we cannot rule out that data from the connection to googletagmanager.com, and data collected by tags in the future, reach Google LLC in the United States.

Such a transfer relies on the European Commission implementing decision of 10 July 2023 finding an adequate level of protection of personal data under the EU-US Data Privacy Framework (Article 45 GDPR). That decision applies on condition that the recipient remains on the list of programme participants maintained by the United States Department of Commerce. To be confirmed before publication: whether Google LLC is currently on that list, and whether the Commission decision remains in force.

The map provider is established in the United Kingdom, which since leaving the European Union is a third country within the meaning of the GDPR and in respect of which the European Commission has issued an adequacy decision. To be confirmed before publication: the identifier and the current validity of that decision as at the date of publication, since its period of application has been extended.

Apart from the situations described above, we transfer no data to third countries or to international organisations.

11. Retention periods

• rsh-consent: the record stops being honoured one year after the choice was made. The banner then appears again and the consent state returns to the default denial before any tag can run. The entry itself stays in your browser until you clear this site's data, but it no longer has any effect.
• rsh-lang: kept indefinitely, until you clear this site's data in your browser. It does not expire by itself, because it concerns only the choice of language version and is unrelated to consent.
• Server logs: the period follows from the hosting service configuration. To be confirmed with the operator, as stated in section 7. We deliberately state no figure we have not verified.
• Data in Google Analytics: event data are retained for 2 months and user-related data for 14 months. For user data, the counter is set to reset on each subsequent visit, so for a returning visitor the period runs from the last activity rather than the first. These are settings we chose in the Google Analytics panel; 2 months is the shortest value the service permits for event data.
• Correspondence: for as long as the matter is being handled, and afterwards until the limitation period for any related claims expires.
• Accounting records: 5 years counted from the end of the calendar year in which the tax payment deadline fell, in line with Polish accounting legislation and the Tax Ordinance Act.
• Job applications: 12 months from receipt. Details in section 14.

12. Your rights

To the extent that we process your data, you have, as a data subject:

• the right of access to your data and to receive a copy of it (Article 15 GDPR);
• the right to rectification of inaccurate data and completion of incomplete data (Article 16 GDPR);
• the right to erasure (Article 17 GDPR), to the extent that we are not obliged to retain the data, for example as accounting records;
• the right to restriction of processing (Article 18 GDPR);
• the right to object to processing based on our legitimate interest (Article 21 GDPR), that is, to server logs, to the downloading of the Google Tag Manager script, to the display of the map and to the handling of correspondence;
• the right to data portability (Article 20 GDPR). It covers data processed by automated means on the basis of consent or a contract, which on this site means data collected by tags after consent is given. It does not cover server logs, which we process under legitimate interest;
• the right to withdraw consent at any time (Article 7(3) GDPR), by the method described in section 4;
• the right to lodge a complaint with the supervisory authority.

The supervisory authority is the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl.

Please address requests to the contact details in section 1. We reply without undue delay and at the latest within one month of receiving a request. If we cannot identify you within our records, for example where the only trace of you is an IP address in a server log, we will ask for additional information enabling identification or inform you that the request cannot be met (Article 11 GDPR).

13. Voluntariness, automated decisions and profiling

Using this website requires no data from you. Giving consent is voluntary and does not condition access to any content; refusing it causes no restrictions. Providing data in correspondence is voluntary, but without it we cannot answer your enquiry.

We take no decisions about you based solely on automated processing, including profiling, that would produce legal effects concerning you or similarly significantly affect you (Article 22 GDPR).

We carry out no profiling. The analytics in use measure traffic and do not build profiles of individual people for advertising: Google Signals, which would link the data to the accounts of signed-in Google users, is switched off, as is the passing of data to advertising systems. Should advertising tags be switched on in the future, they could involve profiling for advertising purposes. We would enable them only within the marketing category, that is, after obtaining consent, and would describe this in this policy beforehand.

14. Recruitment

The form in the “Jobs” section is used solely for job applications relating to our investment. It collects your first name, surname, phone number and the position indicated, and your e-mail address if you choose to provide it.

We process the data in order to run the recruitment for the position indicated: on the basis of your consent (Article 6(1)(a) GDPR) and to the extent necessary to take steps before entering into a contract (Article 6(1)(b) GDPR).

Applications are delivered to sekretariat@rsholding.com.pl, a mailbox hosted on the same server as this website. We use no external form service and pass applications to no party outside the company.

We keep the data for the duration of the recruitment and no longer than 12 months from receiving the application, after which we delete it. You may withdraw your consent at any time by writing to the same address. Withdrawal does not affect the lawfulness of processing carried out before it.

Providing the data is voluntary, but without a phone number we have no way of responding to the application.

15. Changes to this policy and status of the document

We update this policy whenever the facts described above change, in particular once tags are switched on in the Google Tag Manager container. The version date is stated at the top of the document.

This document describes the state of the website as established from its source code and configuration, rather than a set of general clauses. The passages marked “to be confirmed” await information that cannot be read from the code and will be completed. The whole is subject to review by legal counsel.