PRIVACY POLICY

This Privacy Policy applies to personal data processed by us (hereinafter referred to as "BRILLANCE" or "we") during the use of our website (hereinafter referred to as the "Site") and/or our services (hereinafter referred to as the "Services"), as well as in all other instances where you provide us with your personal data via the Site. We kindly request that you carefully review the contents of this Privacy Policy to understand how your personal data will be processed by us. If you do not agree with any part of our Privacy Policy, please refrain from using our Site and Services, and do not provide us with your personal data in any other manner. In order to operate our Site and provide our Services, we process the personal data of individuals visiting our Site (hereinafter referred to as "Site Visitors") and/or our clients (hereinafter referred to as "Clients") in accordance with the principles set forth below.

1. WHO WE ARE?

BRILLANCE is an independent Contract Research Organization (CRO) based in Krakow, engaged in conducting research and development activities in the fields of medical sciences and pharmacy, particularly through the management and monitoring of clinical trials. Below you will find our identification and contact information:

BRILLANCE sp. z o.o.

ul. Królowej Jadwigi 167B, 30-212 Kraków

KRS: 0000193560, NIP: 6772225251, REGON: 356802784

Share capital: 50.000,00 zł

tel.: 12 623 07 15, fax: 12 637 05 40

e-mail: privacy@brillance.pl

We hereby inform you that BRILLANCE sp. z o.o. is the data controller within the meaning of Regulation (EU) 2016/679 of the European Parliament and of the Council of 27 April 2016 on the protection of natural persons with regard to the processing of personal data and on the free movement of such data, and repealing Directive 95/46/EC (General Data Protection Regulation, hereinafter referred to as the "GDPR").

2. TO WHOM DOES THIS PRIVACY POLICY APPLY?

This Privacy Policy applies to:

Site Visitors, i.e., individuals browsing the content of our Site, as well as those contacting us via the contact form, and individuals who have submitted their personal data to us in connection with ongoing or future recruitment processes;
Clients, i.e., individuals providing us with their personal data either individually or on behalf of an organization in order to utilize our Services, particularly for the purpose of entering into a training agreement.

Protection of Children's Privacy: We inform you that BRILLANCE does not collect information from children under the age of 16. If you are under 16 years old, under no circumstances should you provide us with your personal data. We encourage parents and legal guardians to monitor their children's internet usage and to help enforce our Privacy Policy by instructing their children never to provide personal data without parental or guardian consent. If you have reason to believe that a child under the age of 16 has provided personal data to BRILLANCE through the Site, please contact us at privacy@brillance.pl, and we will make every effort to promptly delete such personal data from our databases.

3. PERSONAL DATA WE PROCESS

The types of personal data we process depend on how and why you use our Site or Services. Generally, we process personal data that we receive: (a) directly from you when you provide us with your personal data, for example, in connection with our Services; (b) indirectly, i.e., through automated technologies such as cookies (for more information on cookies, please refer to section 4 below).

Please note that you can visit our Site without providing any personal data. This requires prior adjustment of the settings on your browser and/or the device you are using. However, if you wish to use the full functionality of our Site or our Services, or otherwise provide us directly with your personal data, we will process this information in the following manner:

Contact Form: If you contact us via the contact form available on our Site, we will ask you to provide the following personal data: name, email address, and phone number. Providing this personal data is entirely voluntary and is not required by any applicable law or contractual provisions. However, it is necessary to establish contact and to respond to the inquiries submitted through the contact form.
Recruitment Form: If you contact us via the recruitment form available on our Site to participate in a recruitment process currently conducted by us, we will ask you to provide the following personal data:

In the case where employment is to be based on an employment contract:
- - personal data specified in Article 221 § 1 of the Labour Code, such as: name, date of birth, contact information, education, professional qualifications, and employment history;
- - personal data other than those specified in Article 221 § 1 of the Labour Code, such as: additional data included in the CV, data contained in the portfolio, and image;
In the case where cooperation is to be based on a service or mandate contract:
- - personal data necessary to prepare the draft contract, such as: name, correspondence address, contact information, PESEL/NIP number;
- - regarding other personal data than those indicated above: education, professional qualifications, employment history, data included in the CV, data contained in the portfolio, and image;
If you additionally give optional consent to participate in future recruitment processes conducted by us, your personal data will be processed by us based on your consent as described above.

Device and Usage Information: When you use the Site or interact with it, we or authorized third parties may automatically collect information regarding your usage of the Site via your device. This information is collected through cookies and/or similar technologies (hereinafter referred to as "Device and Usage Information") and consists of:
- Device Information: This includes information about the devices and software you use to access the Site, such as the web browser or mobile device you use, the website or source that linked or directed you to the Site, your IP address or device identifier, the operating system of your computer or mobile device, and other similar technical information.
- Usage Information: This includes information about your interactions with the Site, including dates and times of access, information about specific events, log data, and cookie data. This information allows us to understand which subpages you view, how you use the Site and/or our Services, and what other activities you undertake on our Site. We or authorized third parties automatically collect log data when you access and use the Site. We use this information to administer and improve our Site and Services, analyze trends, and track users' usage of the Site.
- Location Information: Based on the Device and Usage Information, we are also able to determine general location information; however, we do not store IP addresses.

4. COOKIES

A cookie is a small piece of data (a text file) that a website stores on your device when visited by a user, in order to remember information about you. This information typically does not directly identify you. Because we respect your right to privacy, you may choose not to consent to the use of certain types of cookies, which may, however, affect your experience of the Site or our Services. You can manage cookies during your first visit to our website by clicking the "Settings" button (at the bottom of the page). You can also change these settings later. Additionally, you can change your browser settings to manage cookies.

We may use cookies and other tracking technologies for the following purposes:

Essential Cookies: These cookies are essential for the operation of the Site and cannot be disabled in our settings. They are typically set in response to actions taken by the Site Visitor, such as requests for our Services, setting privacy preferences, or filling out and submitting a contact form. You can set your browser to block or alert you about these cookies, but some parts of our Site may not function properly. Essential cookies do not store any data that directly identifies you.
Targeting Cookies: These cookies may be set through our Site by our advertising partners. They may be used by these companies to build a profile of the Site Visitor's interests and display relevant ads on other sites. They do not store directly identifying data but are based on uniquely identifying your browser and internet device. If you do not allow these cookies, you will experience less targeted advertising.
Functional Cookies: These cookies enable the Site to provide enhanced functionality and personalization. They may be set by us or by authorized third-party providers whose services we have added to our Site. If you do not allow these cookies, some or all of these services may not function properly.
Performance Cookies: These cookies allow us to count visits and traffic sources so we can measure and improve the performance of our Site. They help us know which subpages are the most and least popular and see how Site Visitors move around the Site. If you do not allow these cookies, we will not know when you visited our Site and will not be able to monitor its performance.

Cookies we currently use:

Cookies essential for the operation of the Site.

5. HOW DO WE USE YOUR PERSONAL DATA?

We use your personal data for several purposes. To process your personal data for a specific purpose in accordance with GDPR, we must have a valid legal basis for doing so. These legal bases are as follows:

Contract Performance: when your personal data is necessary to enter into or perform a contract for conducting training, or when you are interested in employment with us (preparation and conclusion of an employment contract or a service contract);
Your Explicit Consent: when you have given consent for us to use your personal data through the appropriate form provided on our Site, particularly when you have consented to the processing of your personal data for current or future recruitment purposes;
Legitimate Interest: when we use your personal data to achieve a legitimate interest of ours, such as when you contact us via the contact form on our Site;
Legal Obligation: when we must use your personal data to fulfill our legal obligations in accordance with applicable law, such as to meet accounting requirements;
Protection of Claims: when your personal data is necessary to defend against or pursue potential legal claims.

Below are the purposes and corresponding legal bases for which we may process your personal data:

To provide access to the Site and Services, access to content, features, and functionality (depending on the context – performance of the contract, your consent, or our legitimate interest);
To perform our obligations and enforce rights arising from contract entered into between you and us, including billing and defending claims (depending on the context – performance of the contract or protection of our claims);
To process and finalize transactions, including verifying payments and sending related information, including invoices and notifications (depending on the context – performance of the contract or our legitimate interest);
To develop and improve our Site and Services, conduct scientific research, surveys (depending on the context – our legitimate interest or your explicit consent);
To respond to your inquiries and requests or to communicate with you in other ways, for example, to respond to your questions, manage our mutual relations, and ensure proper customer service (depending on the context – performance of the contract, our legitimate interest or your explicit consent);
To manage and update the Site, add new functionalities, enhance user experience (UX) (our legitimate interest);
To detect fraud, illegal activities, or security breaches (our legitimate interest);
To ensure compliance with applicable legal regulations (fulfillment of legal obligations incumbent upon us as the data controller);
To conduct statistical analyses by monitoring and analyzing trends, usage, and activity on the Site (depending on the context – your explicit consent if required, or our legitimate interest);
To increase the number of people using our Site and Services through marketing and advertising (your explicit consent);
To send commercial information, according to your preferences, about products and services, newsletters, offers, training, and events (your explicit consent);
Ongoing or future recruitment: When you apply for a job with us or want to provide services, we may process your personal data to improve communication related to recruitment and streamline the recruitment process. By submitting your CV or directing us to your portfolio, you consent to us disclosing your personal data in this regard. Your personal data may be disclosed by us to our clients. In such cases, we will show our clients your personal data, CV, and portfolio to highlight the skills and experience of our current or future team members. We will do this only when we receive an explicit request from our clients in this regard (depending on the context – performance of the contract or your explicit consent);
Disclosing information to regulatory authorities: When required by law and only to the extent described below in Section 6 (depending on the context – performance of a legal obligation, protection of our claims);

6. DISCLOSURE OF YOUR PERSONAL DATA

We may disclose your personal data only in the manner described below:

External service providers: We may disclose your personal data to our external subcontractors or service providers who are engaged to perform services on our behalf and for our benefit. These entities undertake specific actions to assist us in operating the Site and providing our Services, and in some cases, they also collect information on our behalf. Below is a list of services for which we may use external providers:
- Web hosting and content delivery services;
- Analytical services;
- Marketing partners and social media platforms;
- Communication and recruitment platforms;
- Debugging functionalities and services;
- Professional service providers: auditors, lawyers, consultants, accountants.
Legal obligations, security, business cooperation with our clients: We may additionally disclose your personal data in limited circumstances (other than those specified above), including: (i) with your explicit consent; or (ii) when we believe in good faith that it is required by law, for example, in response to a court summons or administrative order; or (iii) to protect your safety and/or the security of our Site or Services, or to prevent spam, abuse, or other malicious activities concerning our Site and/or Services; or (iv) as required by our clients to fulfill our business cooperation under a separate agreement; or (v) to protect our rights, as well as the rights of users of our Site or Services. If we are required to disclose your personal data under the law, such as in response to a court summons or administrative order, our policy is to respond only to the requests that are properly issued in accordance with applicable law and to the extent required by law.

7. PERSONAL DATA SECURITY

We respect and protect your privacy, which is why we have implemented necessary security measures aimed at protecting your personal data. Furthermore, we continuously monitor the processing of your personal data to ensure its compliance with GDPR.

8. HOW LONG DO WE PROCESS YOUR PERSONAL DATA?

We apply the following criteria to determine the retention periods for your personal data: (a) the type and nature of the personal data; (b) the purposes for which we collect and process personal data; (c) the period during which we maintain an ongoing relationship with you and provide you with access to our Site and/or Services; (d) applicable legal requirements.

If your personal data is processed in connection with a contract we have entered into, we will retain your personal data as long as necessary to provide our Services under the contract. If your personal data is processed based on applicable legal provisions, your information will be processed for the period specified in these regulations. If you have consented to the processing of your personal data for current or future recruitment purposes, we will process your personal data for no longer than 10 years unless you withdraw your consent to the processing of your personal data before the end of this period. In other cases, your personal data will be processed until you withdraw your consent or until we no longer need your personal data. If your personal data is processed in connection with the protection of our claims, such data will be retained until the expiration of all claims, which is no longer than 6 years.

If you do not wish to receive marketing information from us, please remember that you can withdraw your consent to direct marketing at any time directly from the unsubscribe link included in every marketing email we send. If you do this, we will immediately update our databases and take all reasonable steps to promptly fulfill your request. If you have any questions about the storage of your data, please contact us at: privacy@brillance.pl.

In some cases, we may opt to fully anonymize your personal data instead of permanently deleting it, for example for science or statistical purposes. When we decide to take this step, we guarantee that there will be no possibility to directly link this information back to you.

9. WHAT RIGHTS DO YOU HAVE REGARDING THE PROCESSING OF PERSONAL DATA?

In relation to the processing of your personal data, you have certain rights:

a) Right to information: This means our obligation to inform you that your personal data is being processed, including information about the scope, purpose, and legal basis of the processing).

b) Right of access: Your right to request a copy of the personal data that we process;

c) Right to rectification: Your right to request the correction of your personal data if it is incomplete or inaccurate;

d) Right to erasure (also known as the "right to be forgotten"): In certain circumstances, you can ask us to delete your personal data (unless the processing of personal data is necessary based on another legal basis, such as for the legitimate interest of the data controller or to fulfill a legal obligation; in such cases, we will inform you);

e) Right to restriction of processing: In specific cases, you have the right to ask us to suspend the processing of your personal data;

f) Right to data portability: You have the right to request a copy of your personal data in a commonly used format that enables the transfer of your personal data;

g) Right to object to processing: In certain cases, you have the right to object to our processing of your personal data.

You also have the right to lodge a complaint with the data protection authority in your country of residence at any time. However, we would appreciate the opportunity to address your concerns/complaints before you approach the supervisory authority, so if possible, please contact us first at: privacy@brillance.pl.

If we are unable to reasonably verify your identity, we will not be able to fulfill your request. Therefore, we may ask you for specific information to help confirm your identity. This is a security measure to ensure that personal data is not disclosed to any person who is not entitled to receive it. Please be informed that we will respond to all legitimate requests within one month. Sometimes it may take longer than a month if your request is particularly complex or you have made several requests. In such cases, we will notify you and keep you updated as required by law. If you wish to exercise any of the rights outlined above, you can contact us at: privacy@brillance.pl. You will not be charged any fees for accessing your personal data or exercising other rights, unless your request is clearly unfounded or excessive, in which case you will be informed.

10. TRANSFER OF PERSONAL DATA TO THIRD COUNTRIES

To conduct our global operations, including operating our Site and providing Services, we may in certain circumstances transfer your personal data to third countries or organizations outside of the European Economic Area (EEA) or the United Kingdom, where personal data protection standards may not be equivalent. By accessing our Site and/or using our Services or otherwise providing us with your personal data, you acknowledge that your personal data may be transferred to these third countries. Since different third countries may have personal data protection regulations that differ from those in the EEA and the United Kingdom, we take necessary steps to ensure appropriate safeguards to protect your personal data. These include entering into data processing agreements with our clients and, where necessary, using Standard Contractual Clauses in accordance with GDPR.

11. CHANGES TO THE PRIVACY POLICY

This Privacy Policy was last modified on the date indicated above. However, we suggest reviewing it from time to time, as our Site and the scope of Services we provide may change in the future. BRILLANCE reserves the right to modify this Privacy Policy at any time without prior notice or termination. However, if we make changes to this Privacy Policy that we believe will significantly affect your rights, we will promptly inform you of this via email. Continued use of the Site and/or our Services following the implementation of changes to this Privacy Policy indicates your acceptance of the revised terms of the Privacy Policy.

12. CONTACT US

If you have any questions or suggestions regarding our Privacy Policy, please contact us at:

tel.: 12 623 07 15

fax: 12 637 05 40

e-mail: privacy@brillance.pl